@nextera.one/axis-server-sdk 0.1.0 → 0.2.0

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/index.ts","../../src/core/constants.ts","../../src/core/varint.ts","../../src/core/tlv.ts","../../src/core/axis-bin.ts","../../src/core/signature.ts"],"sourcesContent":["export * from './constants';\nexport * from './varint';\nexport * from './tlv';\nexport * from './axis-bin';\nexport * from './signature';\n","/**\n * AXIS Protocol Magic Bytes (e.g., 'AXIS1')\n */\nexport const AXIS_MAGIC = new Uint8Array([0x41, 0x58, 0x49, 0x53, 0x31]);\n\n/**\n * AXIS Protocol Version\n */\nexport const AXIS_VERSION = 0x01;\n\n/**\n * Maximum allowed size for the Header section in bytes.\n */\nexport const MAX_HDR_LEN = 2048;\n\n/**\n * Maximum allowed size for the Body section in bytes.\n */\nexport const MAX_BODY_LEN = 65536;\n\n/**\n * Maximum allowed size for the Signature section in bytes.\n */\nexport const MAX_SIG_LEN = 128;\n\n/**\n * Total maximum allowed size for a single AXIS frame.\n */\nexport const MAX_FRAME_LEN = 70 * 1024; // 70 KB\n\n/**\n * Frame Control Flags\n */\nexport const FLAG_BODY_TLV = 0x01;\nexport const FLAG_CHAIN_REQ = 0x02;\nexport const FLAG_HAS_WITNESS = 0x04;\n\n/**\n * TLV Tags for Header Section\n */\nexport const TLV_PID = 1;\nexport const TLV_TS = 2;\nexport const TLV_INTENT = 3;\nexport const TLV_ACTOR_ID = 4;\nexport const TLV_PROOF_TYPE = 5;\nexport const TLV_PROOF_REF = 6;\nexport const TLV_NONCE = 7;\nexport const TLV_AUD = 8;\nexport const TLV_NODE = 9;\nexport const TLV_TRACE_ID = 10;\n/** Key ID for key rotation support */\nexport const TLV_KID = 11;\n\n/**\n * TLV Tags for Receipt Section\n */\nexport const TLV_RID = 15;\nexport const TLV_OK = 16;\nexport const TLV_EFFECT = 17;\nexport const TLV_ERROR_CODE = 18;\nexport const TLV_ERROR_MSG = 19;\nexport const TLV_PREV_HASH = 20;\nexport const TLV_RECEIPT_HASH = 21;\nexport const TLV_NODE_KID = 30;\nexport const TLV_NODE_CERT_HASH = 34;\n\n/**\n * TLV Tags for Loom Runtime (Lawful Execution)\n */\n/** Presence ID - liveness proof (UTF-8 string, e.g., \"pr_abc123\") */\nexport const TLV_LOOM_PRESENCE_ID = 91;\n/** Writ - executable intent (canonical JSON, UTF-8 encoded) */\nexport const TLV_LOOM_WRIT = 92;\n/** Thread Hash - causal continuity (32 bytes, raw binary) */\nexport const TLV_LOOM_THREAD_HASH = 93;\n\n/**\n * Supported Authentication Proof Types\n */\nexport const PROOF_CAPSULE = 1;\nexport const PROOF_JWT = 2;\nexport const PROOF_MTLS = 3;\n/** Loom Presence + Writ proof */\nexport const PROOF_LOOM = 4;\n\n/**\n * Standard Protocol Error Codes\n */\nexport const ERR_INVALID_PACKET = 'INVALID_PACKET';\nexport const ERR_BAD_SIGNATURE = 'BAD_SIGNATURE';\nexport const ERR_REPLAY_DETECTED = 'REPLAY_DETECTED';\nexport const ERR_CONTRACT_VIOLATION = 'CONTRACT_VIOLATION';\n","/**\n * Encodes a number (up to 53 bits safe integer) into a Varint buffer.\n * Varints are a way of encoding integers using one or more bytes.\n * Smaller numbers take fewer bytes.\n *\n * @param {number} value - The unsigned integer to encode\n * @returns {Uint8Array} The encoded binary buffer\n * @throws {Error} If the value is negative\n */\nexport function encodeVarint(value: number): Uint8Array {\n  if (value < 0) throw new Error('Varint must be unsigned');\n  const bytes: number[] = [];\n  while (true) {\n    const byte = value & 0x7f;\n    value >>>= 7;\n    if (value === 0) {\n      bytes.push(byte);\n      break;\n    }\n    bytes.push(byte | 0x80);\n  }\n  return new Uint8Array(bytes);\n}\n\n/**\n * Decodes a Varint from a buffer starting at a specific offset.\n *\n * @param {Uint8Array} buf - The buffer containing the encoded varint\n * @param {number} [offset=0] - The starting position in the buffer\n * @returns {Object} The decoded numeric value and the number of bytes consumed (length)\n * @throws {Error} If the buffer is too small or the varint exceeds 8 bytes (max 53-bit safe int)\n */\nexport function decodeVarint(\n  buf: Uint8Array,\n  offset = 0,\n): { value: number; length: number } {\n  let value = 0;\n  let shift = 0;\n  let length = 0;\n\n  while (true) {\n    if (offset + length >= buf.length) {\n      throw new Error('Varint decode out of bounds');\n    }\n    const byte = buf[offset + length];\n    value += (byte & 0x7f) * Math.pow(2, shift);\n    length++;\n    shift += 7;\n    if ((byte & 0x80) === 0) {\n      break;\n    }\n    if (length > 8) throw new Error('Varint too large');\n  }\n\n  return { value, length };\n}\n\n/**\n * Calculates the number of bytes required to encode a value as a varint.\n * Useful for pre-allocating buffers.\n *\n * @param {number} value - The unsigned integer to check\n * @returns {number} The byte length\n * @throws {Error} If the value is negative\n */\nexport function varintLength(value: number): number {\n  if (value < 0) throw new Error('Varint must be unsigned');\n  let len = 0;\n  do {\n    value >>>= 7;\n    len++;\n  } while (value !== 0);\n  return len;\n}\n","import { encodeVarint, decodeVarint, varintLength } from './varint';\n\n/**\n * Represents a basic Type-Length-Value structure.\n *\n * @interface TLV\n */\nexport interface TLV {\n  /** The tag or type identifier */\n  type: number;\n  /** The raw binary value */\n  value: Uint8Array;\n}\n\n/**\n * Encodes an array of TLVs into a canonical binary buffer.\n *\n * **Canonical Rules:**\n * 1. TLVs MUST be sorted by `type` in ascending order.\n * 2. Duplicate `type` entries are NOT allowed.\n * 3. Format: `[type_varint][len_varint][value_bytes]`\n *\n * @param {TLV[]} tlvs - The list of TLV entries to encode\n * @returns {Uint8Array} The sorted and encoded binary buffer\n * @throws {Error} If duplicate types are detected\n */\nexport function encodeTLVs(tlvs: TLV[]): Uint8Array {\n  // 1. Sort by TYPE ascending\n  // Create a copy to avoid mutating input\n  const sorted = [...tlvs].sort((a, b) => a.type - b.type);\n\n  // 2. Check for duplicates\n  for (let i = 0; i < sorted.length - 1; i++) {\n    if (sorted[i].type === sorted[i + 1].type) {\n      throw new Error(`Duplicate TLV type: ${sorted[i].type}`);\n    }\n  }\n\n  // 3. Calculate total size\n  let totalSize = 0;\n  for (const t of sorted) {\n    totalSize += varintLength(t.type);\n    totalSize += varintLength(t.value.length);\n    totalSize += t.value.length;\n  }\n\n  // 4. Encode\n  const buf = new Uint8Array(totalSize);\n  let offset = 0;\n  for (const t of sorted) {\n    const typeBytes = encodeVarint(t.type);\n    buf.set(typeBytes, offset);\n    offset += typeBytes.length;\n\n    const lenBytes = encodeVarint(t.value.length);\n    buf.set(lenBytes, offset);\n    offset += lenBytes.length;\n\n    buf.set(t.value, offset);\n    offset += t.value.length;\n  }\n\n  return buf;\n}\n\n/**\n * Decodes a binary buffer of TLVs into a flat list.\n * Preserves the original wire order and allows duplicate types.\n *\n * @param {Uint8Array} buf - The buffer containing TLV-encoded data\n * @param {number} [maxItems=1024] - Security limit for the number of parsed items\n * @returns {TLV[]} A list of decoded TLV entries\n * @throws {Error} If the buffer is truncated or malformed\n */\nexport function decodeTLVsList(buf: Uint8Array, maxItems = 1024): TLV[] {\n  const list: TLV[] = [];\n  let offset = 0;\n\n  while (offset < buf.length) {\n    if (list.length >= maxItems) throw new Error('TLV_LIMIT');\n\n    // Decode TYPE\n    const { value: type, length: typeLen } = decodeVarint(buf, offset);\n    offset += typeLen;\n\n    // Decode LEN\n    const { value: len, length: lenLen } = decodeVarint(buf, offset);\n    offset += lenLen;\n\n    // Check bounds\n    if (offset + len > buf.length) {\n      throw new Error(`TLV violation: Length ${len} exceeds buffer`);\n    }\n\n    // Extract VALUE\n    const value = buf.slice(offset, offset + len);\n    list.push({ type, value });\n    offset += len;\n  }\n\n  return list;\n}\n\n/**\n * Decodes a binary buffer of TLVs into a Map for efficient access.\n * Enforces strict canonical order (sorted tiles) and forbids duplicate types.\n *\n * @param {Uint8Array} buf - The buffer containing canonical TLV data\n * @returns {Map<number, Uint8Array>} Map of Tag -> Value\n * @throws {Error} If canonical order is violated or duplicates are found\n */\nexport function decodeTLVs(buf: Uint8Array): Map<number, Uint8Array> {\n  const map = new Map<number, Uint8Array>();\n  let offset = 0;\n  let lastType = -1;\n\n  while (offset < buf.length) {\n    // Decode TYPE\n    const { value: type, length: typeLen } = decodeVarint(buf, offset);\n    offset += typeLen;\n\n    // Check canonical order\n    if (type <= lastType) {\n      throw new Error(\n        `TLV violation: Unsorted or duplicate type ${type} after ${lastType}`,\n      );\n    }\n    lastType = type;\n\n    // Decode LEN\n    const { value: len, length: lenLen } = decodeVarint(buf, offset);\n    offset += lenLen;\n\n    // Check bounds\n    if (offset + len > buf.length) {\n      throw new Error(`TLV violation: Length ${len} exceeds buffer`);\n    }\n\n    // Extract VALUE\n    const value = buf.slice(offset, offset + len);\n    map.set(type, value);\n    offset += len;\n  }\n\n  return map;\n}\n\n/**\n * Recursive Object Decoder (safe nesting).\n * This follows the AXIS Option A: Nested TLV objects.\n */\nexport function decodeObject(\n  bytes: Uint8Array,\n  depth = 0,\n  limits = { maxDepth: 8, maxItems: 128 },\n): Map<number, any> {\n  if (depth > limits.maxDepth) {\n    throw new Error('OBJECT_DEPTH_EXCEEDED');\n  }\n\n  const map = decodeTLVs(bytes);\n  // In v1, we leave values as Uint8Array unless schema-driven.\n  // The IntentSchemaValidator will handle deeper recursion.\n  return map;\n}\n\n/**\n * Array Decoder (explicit container).\n * VALUE = repeated TLVs of one ITEM type.\n */\nexport function decodeArray(\n  bytes: Uint8Array,\n  itemType: number,\n  maxItems = 256,\n): Uint8Array[] {\n  const list = decodeTLVsList(bytes, maxItems);\n  const items: Uint8Array[] = [];\n\n  for (const tlv of list) {\n    if (tlv.type !== itemType) {\n      throw new Error(`INVALID_ARRAY_ITEM:${tlv.type}`);\n    }\n    items.push(tlv.value);\n  }\n\n  return items;\n}\n","import * as z from 'zod';\n\n/**\n * AxisFrame Schema\n *\n * Defines the logical structure of an AXIS frame using Zod for runtime validation.\n * This is used for internal processing after the low-level binary parsing is complete.\n */\nexport const AxisFrameZ = z.object({\n  /** Flag bits for protocol control (e.g., encryption, compression) */\n  flags: z.number().int().nonnegative(),\n  /** A map of TLV headers where key=Tag and value=BinaryData */\n  headers: z.map(\n    z.number(),\n    z.custom<Uint8Array>((v) => v instanceof Uint8Array),\n  ),\n  /** The main payload of the frame */\n  body: z.custom<Uint8Array>((v) => v instanceof Uint8Array),\n  /** The cryptographic signature covering the frame (except the signature itself) */\n  sig: z.custom<Uint8Array>((v) => v instanceof Uint8Array),\n});\n\n/**\n * Represents a structured AXIS frame.\n * @typedef {Object} AxisFrame\n */\nexport type AxisFrame = z.infer<typeof AxisFrameZ>;\nimport {\n  AXIS_MAGIC,\n  AXIS_VERSION,\n  MAX_BODY_LEN,\n  MAX_FRAME_LEN,\n  MAX_HDR_LEN,\n  MAX_SIG_LEN,\n} from './constants';\nimport { decodeTLVs, encodeTLVs } from './tlv';\nimport { decodeVarint, encodeVarint } from './varint';\n\n/**\n * Encodes a structured AxisFrame into its binary wire representation.\n *\n * **Encoding Steps:**\n * 1. Encodes header TLV map into a single buffer.\n * 2. Validates lengths against MAX_* constants.\n * 3. Encodes lengths (HDR, BODY, SIG) as varints.\n * 4. Assembles the final byte array with magic, version, and flags.\n *\n * @param {AxisFrame} frame - The structured frame to encode\n * @returns {Uint8Array} The full binary frame\n * @throws {Error} If any section exceeds protocol limits\n */\nexport function encodeFrame(frame: AxisFrame): Uint8Array {\n  const hdrBytes = encodeTLVs(\n    Array.from(frame.headers.entries()).map(([t, v]) => ({\n      type: t,\n      value: v,\n    })),\n  );\n\n  if (hdrBytes.length > MAX_HDR_LEN) throw new Error('Header too large');\n  if (frame.body.length > MAX_BODY_LEN) throw new Error('Body too large');\n  if (frame.sig.length > MAX_SIG_LEN) throw new Error('Signature too large');\n\n  // Header Len, Body Len, Sig Len\n  const hdrLenBytes = encodeVarint(hdrBytes.length);\n  const bodyLenBytes = encodeVarint(frame.body.length);\n  const sigLenBytes = encodeVarint(frame.sig.length);\n\n  const totalLen =\n    5 + // Magic (AXIS1)\n    1 + // Version\n    1 + // Flags\n    hdrLenBytes.length +\n    bodyLenBytes.length +\n    sigLenBytes.length +\n    hdrBytes.length +\n    frame.body.length +\n    frame.sig.length;\n\n  if (totalLen > MAX_FRAME_LEN) throw new Error('Total frame too large');\n\n  const buf = new Uint8Array(totalLen);\n  let offset = 0;\n\n  // Magic (AXIS1 - 5 bytes)\n  buf.set(AXIS_MAGIC, offset);\n  offset += 5;\n\n  // Version\n  buf[offset++] = AXIS_VERSION;\n\n  // Flags\n  buf[offset++] = frame.flags;\n\n  // Lengths\n  buf.set(hdrLenBytes, offset);\n  offset += hdrLenBytes.length;\n\n  buf.set(bodyLenBytes, offset);\n  offset += bodyLenBytes.length;\n\n  buf.set(sigLenBytes, offset);\n  offset += sigLenBytes.length;\n\n  // Payloads\n  buf.set(hdrBytes, offset);\n  offset += hdrBytes.length;\n\n  buf.set(frame.body, offset);\n  offset += frame.body.length;\n\n  buf.set(frame.sig, offset);\n  offset += frame.sig.length;\n\n  return buf;\n}\n\n/**\n * Decodes a binary buffer into a structured AxisFrame with strict validation.\n *\n * @param {Uint8Array} buf - Raw bytes from the wire\n * @returns {AxisFrame} The parsed and validated frame\n * @throws {Error} If magic, version, or lengths are invalid\n */\nexport function decodeFrame(buf: Uint8Array): AxisFrame {\n  let offset = 0;\n\n  // 1. Magic (AXIS1 - 5 bytes)\n  if (offset + 5 > buf.length) throw new Error('Packet too short');\n  for (let i = 0; i < 5; i++) {\n    if (buf[offset + i] !== AXIS_MAGIC[i]) throw new Error('Invalid Magic');\n  }\n  offset += 5;\n\n  // 2. Version\n  const ver = buf[offset++];\n  if (ver !== AXIS_VERSION) throw new Error(`Unsupported version: ${ver}`);\n\n  // 3. Flags\n  const flags = buf[offset++];\n\n  // 4. Lengths\n  const { value: hdrLen, length: hlLen } = decodeVarint(buf, offset);\n  offset += hlLen;\n  if (hdrLen > MAX_HDR_LEN) throw new Error('Header limit exceeded');\n\n  const { value: bodyLen, length: blLen } = decodeVarint(buf, offset);\n  offset += blLen;\n  if (bodyLen > MAX_BODY_LEN) throw new Error('Body limit exceeded');\n\n  const { value: sigLen, length: slLen } = decodeVarint(buf, offset);\n  offset += slLen;\n  if (sigLen > MAX_SIG_LEN) throw new Error('Signature limit exceeded');\n\n  // 5. Extract Bytes\n  if (offset + hdrLen + bodyLen + sigLen > buf.length) {\n    throw new Error('Frame truncated');\n  }\n\n  const hdrBytes = buf.slice(offset, offset + hdrLen);\n  offset += hdrLen;\n\n  const bodyBytes = buf.slice(offset, offset + bodyLen);\n  offset += bodyLen;\n\n  const sigBytes = buf.slice(offset, offset + sigLen);\n  offset += sigLen;\n\n  // 6. Decode Header TLVs\n  const headers = decodeTLVs(hdrBytes);\n\n  return {\n    flags,\n    headers,\n    body: bodyBytes,\n    sig: sigBytes,\n  };\n}\n\n/**\n * Helper to get canonical bytes for signing.\n * SigTarget = All bytes up to SigLen, with SigLen=0, and no SigBytes.\n */\nexport function getSignTarget(frame: AxisFrame): Uint8Array {\n  // Re-encode frame but with empty signature\n  // Note: This is efficient enough for v1 (tens of KB).\n  return encodeFrame({\n    ...frame,\n    sig: new Uint8Array(0),\n  });\n}\n","import * as crypto from 'crypto';\n\nimport { AxisFrame, encodeFrame } from './axis-bin';\n\n/**\n * Signature utilities for AXIS binary frames\n * Supports Ed25519 signature generation and verification\n */\n\n/**\n * Computes the canonical payload for signing an AXIS frame.\n * The signature covers all bytes of the encoded frame EXCEPT the signature field itself.\n *\n * @param {AxisFrame} frame - The frame to prepare for signing\n * @returns {Buffer} The serialized canonical bytes for the signature algorithm\n */\nexport function computeSignaturePayload(frame: AxisFrame): Buffer {\n  // Re-encode frame with empty signature\n  const frameWithoutSig: AxisFrame = {\n    ...frame,\n    sig: new Uint8Array(0),\n  };\n\n  const encoded = encodeFrame(frameWithoutSig);\n  return Buffer.from(encoded);\n}\n\n/**\n * Signs an AXIS frame using the Ed25519 algorithm.\n * Automatically handles both raw 32-byte seeds and pkcs8 DER-encoded private keys.\n *\n * @param {AxisFrame} frame - The frame to sign\n * @param {Buffer} privateKey - Ed25519 private key (32-byte raw OR pkcs8 DER)\n * @returns {Buffer} The 64-byte Ed25519 signature\n * @throws {Error} If key format is invalid or signing fail\n */\nexport function signFrame(frame: AxisFrame, privateKey: Buffer): Buffer {\n  const payload = computeSignaturePayload(frame);\n\n  let keyObject: crypto.KeyObject;\n\n  // Check if key is raw 32-byte seed or DER-encoded\n  if (privateKey.length === 32) {\n    // Raw seed - wrap in pkcs8 DER format\n    // pkcs8 prefix for Ed25519: 0x302e020100300506032b657004220420\n    const pkcs8Prefix = Buffer.from([\n      0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70,\n      0x04, 0x22, 0x04, 0x20,\n    ]);\n    const pkcs8Key = Buffer.concat([pkcs8Prefix, privateKey]);\n\n    keyObject = crypto.createPrivateKey({\n      key: pkcs8Key,\n      format: 'der',\n      type: 'pkcs8',\n    });\n  } else {\n    // Assume already DER-encoded pkcs8\n    keyObject = crypto.createPrivateKey({\n      key: privateKey,\n      format: 'der',\n      type: 'pkcs8',\n    });\n  }\n\n  const signature = crypto.sign(null, payload, keyObject);\n\n  if (signature.length !== 64) {\n    throw new Error('Ed25519 signature must be 64 bytes');\n  }\n\n  return signature;\n}\n\n/**\n * Verifies an Ed25519 signature on an AXIS frame.\n * Automatically handles both raw 32-byte public keys and spki DER-encoded public keys.\n *\n * @param {AxisFrame} frame - The frame containing the signature to verify\n * @param {Buffer} publicKey - Ed25519 public key (32-byte raw OR spki DER)\n * @returns {boolean} True if the signature is cryptographically valid\n * @throws {Error} If signature length is invalid\n */\nexport function verifyFrameSignature(\n  frame: AxisFrame,\n  publicKey: Buffer,\n): boolean {\n  if (frame.sig.length === 0) {\n    return false; // No signature\n  }\n\n  if (frame.sig.length !== 64) {\n    throw new Error('Ed25519 signature must be 64 bytes');\n  }\n\n  const payload = computeSignaturePayload(frame);\n\n  try {\n    let keyObject: crypto.KeyObject;\n\n    // Check if key is raw 32-byte or DER-encoded\n    if (publicKey.length === 32) {\n      // Raw key - wrap in spki DER format\n      // spki prefix for Ed25519: 0x302a300506032b6570032100\n      const spkiPrefix = Buffer.from([\n        0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,\n      ]);\n      const spkiKey = Buffer.concat([spkiPrefix, publicKey]);\n\n      keyObject = crypto.createPublicKey({\n        key: spkiKey,\n        format: 'der',\n        type: 'spki',\n      });\n    } else {\n      // Assume already DER-encoded spki\n      keyObject = crypto.createPublicKey({\n        key: publicKey,\n        format: 'der',\n        type: 'spki',\n      });\n    }\n\n    const valid = crypto.verify(\n      null,\n      payload,\n      keyObject,\n      Buffer.from(frame.sig),\n    );\n    return valid;\n  } catch (error) {\n    return false;\n  }\n}\n\n/**\n * Generates a new Ed25519 key pair for use with the AXIS protocol.\n * Returns keys in canonical DER format (pkcs8 for private, spki for public).\n *\n * @returns {Object} An object containing the privateKey and publicKey as Buffers\n */\nexport function generateEd25519KeyPair(): {\n  privateKey: Buffer;\n  publicKey: Buffer;\n} {\n  const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519');\n\n  return {\n    privateKey: privateKey.export({ type: 'pkcs8', format: 'der' }) as Buffer,\n    publicKey: publicKey.export({ type: 'spki', format: 'der' }) as Buffer,\n  };\n}\n\n/**\n * Computes a standard SHA-256 hash of the provided data.\n *\n * @param {Buffer | Uint8Array} data - The input data to hash\n * @returns {Buffer} The 32-byte SHA-256 digest\n */\nexport function sha256(data: Buffer | Uint8Array): Buffer {\n  return crypto.createHash('sha256').update(data).digest();\n}\n\n/**\n * Computes a hash for an AXIS receipt, optionally chaining it to a previous hash.\n * This is used for generating an immutable transaction chain.\n *\n * @param {Buffer | Uint8Array} receiptBytes - The canonical binary representation of the receipt\n * @param {Buffer | Uint8Array} [prevHash] - The hash of the previous receipt in the chain\n * @returns {Buffer} The 32-byte SHA-256 hash of the receipt (and link)\n */\nexport function computeReceiptHash(\n  receiptBytes: Buffer | Uint8Array,\n  prevHash?: Buffer | Uint8Array,\n): Buffer {\n  const hasher = crypto.createHash('sha256');\n  hasher.update(receiptBytes);\n\n  if (prevHash && prevHash.length > 0) {\n    hasher.update(prevHash);\n  }\n\n  return hasher.digest();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGO,IAAM,aAAa,IAAI,WAAW,CAAC,IAAM,IAAM,IAAM,IAAM,EAAI,CAAC;AAKhE,IAAM,eAAe;AAKrB,IAAM,cAAc;AAKpB,IAAM,eAAe;AAKrB,IAAM,cAAc;AAKpB,IAAM,gBAAgB,KAAK;AAK3B,IAAM,gBAAgB;AACtB,IAAM,iBAAiB;AACvB,IAAM,mBAAmB;AAKzB,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,eAAe;AACrB,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,YAAY;AAClB,IAAM,UAAU;AAChB,IAAM,WAAW;AACjB,IAAM,eAAe;AAErB,IAAM,UAAU;AAKhB,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AACzB,IAAM,eAAe;AACrB,IAAM,qBAAqB;AAM3B,IAAM,uBAAuB;AAE7B,IAAM,gBAAgB;AAEtB,IAAM,uBAAuB;AAK7B,IAAM,gBAAgB;AACtB,IAAM,YAAY;AAClB,IAAM,aAAa;AAEnB,IAAM,aAAa;AAKnB,IAAM,qBAAqB;AAC3B,IAAM,oBAAoB;AAC1B,IAAM,sBAAsB;AAC5B,IAAM,yBAAyB;;;AClF/B,SAAS,aAAa,OAA2B;AACtD,MAAI,QAAQ,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACxD,QAAM,QAAkB,CAAC;AACzB,SAAO,MAAM;AACX,UAAM,OAAO,QAAQ;AACrB,eAAW;AACX,QAAI,UAAU,GAAG;AACf,YAAM,KAAK,IAAI;AACf;AAAA,IACF;AACA,UAAM,KAAK,OAAO,GAAI;AAAA,EACxB;AACA,SAAO,IAAI,WAAW,KAAK;AAC7B;AAUO,SAAS,aACd,KACA,SAAS,GAC0B;AACnC,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,SAAS;AAEb,SAAO,MAAM;AACX,QAAI,SAAS,UAAU,IAAI,QAAQ;AACjC,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AACA,UAAM,OAAO,IAAI,SAAS,MAAM;AAChC,cAAU,OAAO,OAAQ,KAAK,IAAI,GAAG,KAAK;AAC1C;AACA,aAAS;AACT,SAAK,OAAO,SAAU,GAAG;AACvB;AAAA,IACF;AACA,QAAI,SAAS,EAAG,OAAM,IAAI,MAAM,kBAAkB;AAAA,EACpD;AAEA,SAAO,EAAE,OAAO,OAAO;AACzB;AAUO,SAAS,aAAa,OAAuB;AAClD,MAAI,QAAQ,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACxD,MAAI,MAAM;AACV,KAAG;AACD,eAAW;AACX;AAAA,EACF,SAAS,UAAU;AACnB,SAAO;AACT;;;AC/CO,SAAS,WAAW,MAAyB;AAGlD,QAAM,SAAS,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI;AAGvD,WAAS,IAAI,GAAG,IAAI,OAAO,SAAS,GAAG,KAAK;AAC1C,QAAI,OAAO,CAAC,EAAE,SAAS,OAAO,IAAI,CAAC,EAAE,MAAM;AACzC,YAAM,IAAI,MAAM,uBAAuB,OAAO,CAAC,EAAE,IAAI,EAAE;AAAA,IACzD;AAAA,EACF;AAGA,MAAI,YAAY;AAChB,aAAW,KAAK,QAAQ;AACtB,iBAAa,aAAa,EAAE,IAAI;AAChC,iBAAa,aAAa,EAAE,MAAM,MAAM;AACxC,iBAAa,EAAE,MAAM;AAAA,EACvB;AAGA,QAAM,MAAM,IAAI,WAAW,SAAS;AACpC,MAAI,SAAS;AACb,aAAW,KAAK,QAAQ;AACtB,UAAM,YAAY,aAAa,EAAE,IAAI;AACrC,QAAI,IAAI,WAAW,MAAM;AACzB,cAAU,UAAU;AAEpB,UAAM,WAAW,aAAa,EAAE,MAAM,MAAM;AAC5C,QAAI,IAAI,UAAU,MAAM;AACxB,cAAU,SAAS;AAEnB,QAAI,IAAI,EAAE,OAAO,MAAM;AACvB,cAAU,EAAE,MAAM;AAAA,EACpB;AAEA,SAAO;AACT;AAWO,SAAS,eAAe,KAAiB,WAAW,MAAa;AACtE,QAAM,OAAc,CAAC;AACrB,MAAI,SAAS;AAEb,SAAO,SAAS,IAAI,QAAQ;AAC1B,QAAI,KAAK,UAAU,SAAU,OAAM,IAAI,MAAM,WAAW;AAGxD,UAAM,EAAE,OAAO,MAAM,QAAQ,QAAQ,IAAI,aAAa,KAAK,MAAM;AACjE,cAAU;AAGV,UAAM,EAAE,OAAO,KAAK,QAAQ,OAAO,IAAI,aAAa,KAAK,MAAM;AAC/D,cAAU;AAGV,QAAI,SAAS,MAAM,IAAI,QAAQ;AAC7B,YAAM,IAAI,MAAM,yBAAyB,GAAG,iBAAiB;AAAA,IAC/D;AAGA,UAAM,QAAQ,IAAI,MAAM,QAAQ,SAAS,GAAG;AAC5C,SAAK,KAAK,EAAE,MAAM,MAAM,CAAC;AACzB,cAAU;AAAA,EACZ;AAEA,SAAO;AACT;AAUO,SAAS,WAAW,KAA0C;AACnE,QAAMA,OAAM,oBAAI,IAAwB;AACxC,MAAI,SAAS;AACb,MAAI,WAAW;AAEf,SAAO,SAAS,IAAI,QAAQ;AAE1B,UAAM,EAAE,OAAO,MAAM,QAAQ,QAAQ,IAAI,aAAa,KAAK,MAAM;AACjE,cAAU;AAGV,QAAI,QAAQ,UAAU;AACpB,YAAM,IAAI;AAAA,QACR,6CAA6C,IAAI,UAAU,QAAQ;AAAA,MACrE;AAAA,IACF;AACA,eAAW;AAGX,UAAM,EAAE,OAAO,KAAK,QAAQ,OAAO,IAAI,aAAa,KAAK,MAAM;AAC/D,cAAU;AAGV,QAAI,SAAS,MAAM,IAAI,QAAQ;AAC7B,YAAM,IAAI,MAAM,yBAAyB,GAAG,iBAAiB;AAAA,IAC/D;AAGA,UAAM,QAAQ,IAAI,MAAM,QAAQ,SAAS,GAAG;AAC5C,IAAAA,KAAI,IAAI,MAAM,KAAK;AACnB,cAAU;AAAA,EACZ;AAEA,SAAOA;AACT;AAMO,SAAS,aACd,OACA,QAAQ,GACR,SAAS,EAAE,UAAU,GAAG,UAAU,IAAI,GACpB;AAClB,MAAI,QAAQ,OAAO,UAAU;AAC3B,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AAEA,QAAMA,OAAM,WAAW,KAAK;AAG5B,SAAOA;AACT;AAMO,SAAS,YACd,OACA,UACA,WAAW,KACG;AACd,QAAM,OAAO,eAAe,OAAO,QAAQ;AAC3C,QAAM,QAAsB,CAAC;AAE7B,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,SAAS,UAAU;AACzB,YAAM,IAAI,MAAM,sBAAsB,IAAI,IAAI,EAAE;AAAA,IAClD;AACA,UAAM,KAAK,IAAI,KAAK;AAAA,EACtB;AAEA,SAAO;AACT;;;AC1LA,QAAmB;AAQZ,IAAM,aAAe,SAAO;AAAA;AAAA,EAEjC,OAAS,SAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAEpC,SAAW;AAAA,IACP,SAAO;AAAA,IACP,SAAmB,CAAC,MAAM,aAAa,UAAU;AAAA,EACrD;AAAA;AAAA,EAEA,MAAQ,SAAmB,CAAC,MAAM,aAAa,UAAU;AAAA;AAAA,EAEzD,KAAO,SAAmB,CAAC,MAAM,aAAa,UAAU;AAC1D,CAAC;AA+BM,SAAS,YAAY,OAA8B;AACxD,QAAM,WAAW;AAAA,IACf,MAAM,KAAK,MAAM,QAAQ,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO;AAAA,MACnD,MAAM;AAAA,MACN,OAAO;AAAA,IACT,EAAE;AAAA,EACJ;AAEA,MAAI,SAAS,SAAS,YAAa,OAAM,IAAI,MAAM,kBAAkB;AACrE,MAAI,MAAM,KAAK,SAAS,aAAc,OAAM,IAAI,MAAM,gBAAgB;AACtE,MAAI,MAAM,IAAI,SAAS,YAAa,OAAM,IAAI,MAAM,qBAAqB;AAGzE,QAAM,cAAc,aAAa,SAAS,MAAM;AAChD,QAAM,eAAe,aAAa,MAAM,KAAK,MAAM;AACnD,QAAM,cAAc,aAAa,MAAM,IAAI,MAAM;AAEjD,QAAM,WACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY,SACZ,aAAa,SACb,YAAY,SACZ,SAAS,SACT,MAAM,KAAK,SACX,MAAM,IAAI;AAEZ,MAAI,WAAW,cAAe,OAAM,IAAI,MAAM,uBAAuB;AAErE,QAAM,MAAM,IAAI,WAAW,QAAQ;AACnC,MAAI,SAAS;AAGb,MAAI,IAAI,YAAY,MAAM;AAC1B,YAAU;AAGV,MAAI,QAAQ,IAAI;AAGhB,MAAI,QAAQ,IAAI,MAAM;AAGtB,MAAI,IAAI,aAAa,MAAM;AAC3B,YAAU,YAAY;AAEtB,MAAI,IAAI,cAAc,MAAM;AAC5B,YAAU,aAAa;AAEvB,MAAI,IAAI,aAAa,MAAM;AAC3B,YAAU,YAAY;AAGtB,MAAI,IAAI,UAAU,MAAM;AACxB,YAAU,SAAS;AAEnB,MAAI,IAAI,MAAM,MAAM,MAAM;AAC1B,YAAU,MAAM,KAAK;AAErB,MAAI,IAAI,MAAM,KAAK,MAAM;AACzB,YAAU,MAAM,IAAI;AAEpB,SAAO;AACT;AASO,SAAS,YAAY,KAA4B;AACtD,MAAI,SAAS;AAGb,MAAI,SAAS,IAAI,IAAI,OAAQ,OAAM,IAAI,MAAM,kBAAkB;AAC/D,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,QAAI,IAAI,SAAS,CAAC,MAAM,WAAW,CAAC,EAAG,OAAM,IAAI,MAAM,eAAe;AAAA,EACxE;AACA,YAAU;AAGV,QAAM,MAAM,IAAI,QAAQ;AACxB,MAAI,QAAQ,aAAc,OAAM,IAAI,MAAM,wBAAwB,GAAG,EAAE;AAGvE,QAAM,QAAQ,IAAI,QAAQ;AAG1B,QAAM,EAAE,OAAO,QAAQ,QAAQ,MAAM,IAAI,aAAa,KAAK,MAAM;AACjE,YAAU;AACV,MAAI,SAAS,YAAa,OAAM,IAAI,MAAM,uBAAuB;AAEjE,QAAM,EAAE,OAAO,SAAS,QAAQ,MAAM,IAAI,aAAa,KAAK,MAAM;AAClE,YAAU;AACV,MAAI,UAAU,aAAc,OAAM,IAAI,MAAM,qBAAqB;AAEjE,QAAM,EAAE,OAAO,QAAQ,QAAQ,MAAM,IAAI,aAAa,KAAK,MAAM;AACjE,YAAU;AACV,MAAI,SAAS,YAAa,OAAM,IAAI,MAAM,0BAA0B;AAGpE,MAAI,SAAS,SAAS,UAAU,SAAS,IAAI,QAAQ;AACnD,UAAM,IAAI,MAAM,iBAAiB;AAAA,EACnC;AAEA,QAAM,WAAW,IAAI,MAAM,QAAQ,SAAS,MAAM;AAClD,YAAU;AAEV,QAAM,YAAY,IAAI,MAAM,QAAQ,SAAS,OAAO;AACpD,YAAU;AAEV,QAAM,WAAW,IAAI,MAAM,QAAQ,SAAS,MAAM;AAClD,YAAU;AAGV,QAAM,UAAU,WAAW,QAAQ;AAEnC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,KAAK;AAAA,EACP;AACF;AAMO,SAAS,cAAc,OAA8B;AAG1D,SAAO,YAAY;AAAA,IACjB,GAAG;AAAA,IACH,KAAK,IAAI,WAAW,CAAC;AAAA,EACvB,CAAC;AACH;;;AC9LA,aAAwB;AAgBjB,SAAS,wBAAwB,OAA0B;AAEhE,QAAM,kBAA6B;AAAA,IACjC,GAAG;AAAA,IACH,KAAK,IAAI,WAAW,CAAC;AAAA,EACvB;AAEA,QAAM,UAAU,YAAY,eAAe;AAC3C,SAAO,OAAO,KAAK,OAAO;AAC5B;AAWO,SAAS,UAAU,OAAkB,YAA4B;AACtE,QAAM,UAAU,wBAAwB,KAAK;AAE7C,MAAI;AAGJ,MAAI,WAAW,WAAW,IAAI;AAG5B,UAAM,cAAc,OAAO,KAAK;AAAA,MAC9B;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAClE;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,IACpB,CAAC;AACD,UAAM,WAAW,OAAO,OAAO,CAAC,aAAa,UAAU,CAAC;AAExD,gBAAmB,wBAAiB;AAAA,MAClC,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH,OAAO;AAEL,gBAAmB,wBAAiB;AAAA,MAClC,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,QAAM,YAAmB,YAAK,MAAM,SAAS,SAAS;AAEtD,MAAI,UAAU,WAAW,IAAI;AAC3B,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AAEA,SAAO;AACT;AAWO,SAAS,qBACd,OACA,WACS;AACT,MAAI,MAAM,IAAI,WAAW,GAAG;AAC1B,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,IAAI,WAAW,IAAI;AAC3B,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AAEA,QAAM,UAAU,wBAAwB,KAAK;AAE7C,MAAI;AACF,QAAI;AAGJ,QAAI,UAAU,WAAW,IAAI;AAG3B,YAAM,aAAa,OAAO,KAAK;AAAA,QAC7B;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,MACpE,CAAC;AACD,YAAM,UAAU,OAAO,OAAO,CAAC,YAAY,SAAS,CAAC;AAErD,kBAAmB,uBAAgB;AAAA,QACjC,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AAAA,IACH,OAAO;AAEL,kBAAmB,uBAAgB;AAAA,QACjC,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,QAAe;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,KAAK,MAAM,GAAG;AAAA,IACvB;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO;AAAA,EACT;AACF;AAQO,SAAS,yBAGd;AACA,QAAM,EAAE,YAAY,UAAU,IAAW,2BAAoB,SAAS;AAEtE,SAAO;AAAA,IACL,YAAY,WAAW,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,CAAC;AAAA,IAC9D,WAAW,UAAU,OAAO,EAAE,MAAM,QAAQ,QAAQ,MAAM,CAAC;AAAA,EAC7D;AACF;AAQO,SAAS,OAAO,MAAmC;AACxD,SAAc,kBAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO;AACzD;AAUO,SAAS,mBACd,cACA,UACQ;AACR,QAAM,SAAgB,kBAAW,QAAQ;AACzC,SAAO,OAAO,YAAY;AAE1B,MAAI,YAAY,SAAS,SAAS,GAAG;AACnC,WAAO,OAAO,QAAQ;AAAA,EACxB;AAEA,SAAO,OAAO,OAAO;AACvB;","names":["map"]}

package/dist/core/index.mjs

@@ -0,0 +1,450 @@
+// src/core/constants.ts
+var AXIS_MAGIC = new Uint8Array([65, 88, 73, 83, 49]);
+var AXIS_VERSION = 1;
+var MAX_HDR_LEN = 2048;
+var MAX_BODY_LEN = 65536;
+var MAX_SIG_LEN = 128;
+var MAX_FRAME_LEN = 70 * 1024;
+var FLAG_BODY_TLV = 1;
+var FLAG_CHAIN_REQ = 2;
+var FLAG_HAS_WITNESS = 4;
+var TLV_PID = 1;
+var TLV_TS = 2;
+var TLV_INTENT = 3;
+var TLV_ACTOR_ID = 4;
+var TLV_PROOF_TYPE = 5;
+var TLV_PROOF_REF = 6;
+var TLV_NONCE = 7;
+var TLV_AUD = 8;
+var TLV_NODE = 9;
+var TLV_TRACE_ID = 10;
+var TLV_KID = 11;
+var TLV_RID = 15;
+var TLV_OK = 16;
+var TLV_EFFECT = 17;
+var TLV_ERROR_CODE = 18;
+var TLV_ERROR_MSG = 19;
+var TLV_PREV_HASH = 20;
+var TLV_RECEIPT_HASH = 21;
+var TLV_NODE_KID = 30;
+var TLV_NODE_CERT_HASH = 34;
+var TLV_LOOM_PRESENCE_ID = 91;
+var TLV_LOOM_WRIT = 92;
+var TLV_LOOM_THREAD_HASH = 93;
+var PROOF_CAPSULE = 1;
+var PROOF_JWT = 2;
+var PROOF_MTLS = 3;
+var PROOF_LOOM = 4;
+var ERR_INVALID_PACKET = "INVALID_PACKET";
+var ERR_BAD_SIGNATURE = "BAD_SIGNATURE";
+var ERR_REPLAY_DETECTED = "REPLAY_DETECTED";
+var ERR_CONTRACT_VIOLATION = "CONTRACT_VIOLATION";
+
+// src/core/varint.ts
+function encodeVarint(value) {
+  if (value < 0) throw new Error("Varint must be unsigned");
+  const bytes = [];
+  while (true) {
+    const byte = value & 127;
+    value >>>= 7;
+    if (value === 0) {
+      bytes.push(byte);
+      break;
+    }
+    bytes.push(byte | 128);
+  }
+  return new Uint8Array(bytes);
+}
+function decodeVarint(buf, offset = 0) {
+  let value = 0;
+  let shift = 0;
+  let length = 0;
+  while (true) {
+    if (offset + length >= buf.length) {
+      throw new Error("Varint decode out of bounds");
+    }
+    const byte = buf[offset + length];
+    value += (byte & 127) * Math.pow(2, shift);
+    length++;
+    shift += 7;
+    if ((byte & 128) === 0) {
+      break;
+    }
+    if (length > 8) throw new Error("Varint too large");
+  }
+  return { value, length };
+}
+function varintLength(value) {
+  if (value < 0) throw new Error("Varint must be unsigned");
+  let len = 0;
+  do {
+    value >>>= 7;
+    len++;
+  } while (value !== 0);
+  return len;
+}
+
+// src/core/tlv.ts
+function encodeTLVs(tlvs) {
+  const sorted = [...tlvs].sort((a, b) => a.type - b.type);
+  for (let i = 0; i < sorted.length - 1; i++) {
+    if (sorted[i].type === sorted[i + 1].type) {
+      throw new Error(`Duplicate TLV type: ${sorted[i].type}`);
+    }
+  }
+  let totalSize = 0;
+  for (const t of sorted) {
+    totalSize += varintLength(t.type);
+    totalSize += varintLength(t.value.length);
+    totalSize += t.value.length;
+  }
+  const buf = new Uint8Array(totalSize);
+  let offset = 0;
+  for (const t of sorted) {
+    const typeBytes = encodeVarint(t.type);
+    buf.set(typeBytes, offset);
+    offset += typeBytes.length;
+    const lenBytes = encodeVarint(t.value.length);
+    buf.set(lenBytes, offset);
+    offset += lenBytes.length;
+    buf.set(t.value, offset);
+    offset += t.value.length;
+  }
+  return buf;
+}
+function decodeTLVsList(buf, maxItems = 1024) {
+  const list = [];
+  let offset = 0;
+  while (offset < buf.length) {
+    if (list.length >= maxItems) throw new Error("TLV_LIMIT");
+    const { value: type, length: typeLen } = decodeVarint(buf, offset);
+    offset += typeLen;
+    const { value: len, length: lenLen } = decodeVarint(buf, offset);
+    offset += lenLen;
+    if (offset + len > buf.length) {
+      throw new Error(`TLV violation: Length ${len} exceeds buffer`);
+    }
+    const value = buf.slice(offset, offset + len);
+    list.push({ type, value });
+    offset += len;
+  }
+  return list;
+}
+function decodeTLVs(buf) {
+  const map2 = /* @__PURE__ */ new Map();
+  let offset = 0;
+  let lastType = -1;
+  while (offset < buf.length) {
+    const { value: type, length: typeLen } = decodeVarint(buf, offset);
+    offset += typeLen;
+    if (type <= lastType) {
+      throw new Error(
+        `TLV violation: Unsorted or duplicate type ${type} after ${lastType}`
+      );
+    }
+    lastType = type;
+    const { value: len, length: lenLen } = decodeVarint(buf, offset);
+    offset += lenLen;
+    if (offset + len > buf.length) {
+      throw new Error(`TLV violation: Length ${len} exceeds buffer`);
+    }
+    const value = buf.slice(offset, offset + len);
+    map2.set(type, value);
+    offset += len;
+  }
+  return map2;
+}
+function decodeObject(bytes, depth = 0, limits = { maxDepth: 8, maxItems: 128 }) {
+  if (depth > limits.maxDepth) {
+    throw new Error("OBJECT_DEPTH_EXCEEDED");
+  }
+  const map2 = decodeTLVs(bytes);
+  return map2;
+}
+function decodeArray(bytes, itemType, maxItems = 256) {
+  const list = decodeTLVsList(bytes, maxItems);
+  const items = [];
+  for (const tlv of list) {
+    if (tlv.type !== itemType) {
+      throw new Error(`INVALID_ARRAY_ITEM:${tlv.type}`);
+    }
+    items.push(tlv.value);
+  }
+  return items;
+}
+
+// src/core/axis-bin.ts
+import * as z from "zod";
+var AxisFrameZ = z.object({
+  /** Flag bits for protocol control (e.g., encryption, compression) */
+  flags: z.number().int().nonnegative(),
+  /** A map of TLV headers where key=Tag and value=BinaryData */
+  headers: z.map(
+    z.number(),
+    z.custom((v) => v instanceof Uint8Array)
+  ),
+  /** The main payload of the frame */
+  body: z.custom((v) => v instanceof Uint8Array),
+  /** The cryptographic signature covering the frame (except the signature itself) */
+  sig: z.custom((v) => v instanceof Uint8Array)
+});
+function encodeFrame(frame) {
+  const hdrBytes = encodeTLVs(
+    Array.from(frame.headers.entries()).map(([t, v]) => ({
+      type: t,
+      value: v
+    }))
+  );
+  if (hdrBytes.length > MAX_HDR_LEN) throw new Error("Header too large");
+  if (frame.body.length > MAX_BODY_LEN) throw new Error("Body too large");
+  if (frame.sig.length > MAX_SIG_LEN) throw new Error("Signature too large");
+  const hdrLenBytes = encodeVarint(hdrBytes.length);
+  const bodyLenBytes = encodeVarint(frame.body.length);
+  const sigLenBytes = encodeVarint(frame.sig.length);
+  const totalLen = 5 + // Magic (AXIS1)
+  1 + // Version
+  1 + // Flags
+  hdrLenBytes.length + bodyLenBytes.length + sigLenBytes.length + hdrBytes.length + frame.body.length + frame.sig.length;
+  if (totalLen > MAX_FRAME_LEN) throw new Error("Total frame too large");
+  const buf = new Uint8Array(totalLen);
+  let offset = 0;
+  buf.set(AXIS_MAGIC, offset);
+  offset += 5;
+  buf[offset++] = AXIS_VERSION;
+  buf[offset++] = frame.flags;
+  buf.set(hdrLenBytes, offset);
+  offset += hdrLenBytes.length;
+  buf.set(bodyLenBytes, offset);
+  offset += bodyLenBytes.length;
+  buf.set(sigLenBytes, offset);
+  offset += sigLenBytes.length;
+  buf.set(hdrBytes, offset);
+  offset += hdrBytes.length;
+  buf.set(frame.body, offset);
+  offset += frame.body.length;
+  buf.set(frame.sig, offset);
+  offset += frame.sig.length;
+  return buf;
+}
+function decodeFrame(buf) {
+  let offset = 0;
+  if (offset + 5 > buf.length) throw new Error("Packet too short");
+  for (let i = 0; i < 5; i++) {
+    if (buf[offset + i] !== AXIS_MAGIC[i]) throw new Error("Invalid Magic");
+  }
+  offset += 5;
+  const ver = buf[offset++];
+  if (ver !== AXIS_VERSION) throw new Error(`Unsupported version: ${ver}`);
+  const flags = buf[offset++];
+  const { value: hdrLen, length: hlLen } = decodeVarint(buf, offset);
+  offset += hlLen;
+  if (hdrLen > MAX_HDR_LEN) throw new Error("Header limit exceeded");
+  const { value: bodyLen, length: blLen } = decodeVarint(buf, offset);
+  offset += blLen;
+  if (bodyLen > MAX_BODY_LEN) throw new Error("Body limit exceeded");
+  const { value: sigLen, length: slLen } = decodeVarint(buf, offset);
+  offset += slLen;
+  if (sigLen > MAX_SIG_LEN) throw new Error("Signature limit exceeded");
+  if (offset + hdrLen + bodyLen + sigLen > buf.length) {
+    throw new Error("Frame truncated");
+  }
+  const hdrBytes = buf.slice(offset, offset + hdrLen);
+  offset += hdrLen;
+  const bodyBytes = buf.slice(offset, offset + bodyLen);
+  offset += bodyLen;
+  const sigBytes = buf.slice(offset, offset + sigLen);
+  offset += sigLen;
+  const headers = decodeTLVs(hdrBytes);
+  return {
+    flags,
+    headers,
+    body: bodyBytes,
+    sig: sigBytes
+  };
+}
+function getSignTarget(frame) {
+  return encodeFrame({
+    ...frame,
+    sig: new Uint8Array(0)
+  });
+}
+
+// src/core/signature.ts
+import * as crypto from "crypto";
+function computeSignaturePayload(frame) {
+  const frameWithoutSig = {
+    ...frame,
+    sig: new Uint8Array(0)
+  };
+  const encoded = encodeFrame(frameWithoutSig);
+  return Buffer.from(encoded);
+}
+function signFrame(frame, privateKey) {
+  const payload = computeSignaturePayload(frame);
+  let keyObject;
+  if (privateKey.length === 32) {
+    const pkcs8Prefix = Buffer.from([
+      48,
+      46,
+      2,
+      1,
+      0,
+      48,
+      5,
+      6,
+      3,
+      43,
+      101,
+      112,
+      4,
+      34,
+      4,
+      32
+    ]);
+    const pkcs8Key = Buffer.concat([pkcs8Prefix, privateKey]);
+    keyObject = crypto.createPrivateKey({
+      key: pkcs8Key,
+      format: "der",
+      type: "pkcs8"
+    });
+  } else {
+    keyObject = crypto.createPrivateKey({
+      key: privateKey,
+      format: "der",
+      type: "pkcs8"
+    });
+  }
+  const signature = crypto.sign(null, payload, keyObject);
+  if (signature.length !== 64) {
+    throw new Error("Ed25519 signature must be 64 bytes");
+  }
+  return signature;
+}
+function verifyFrameSignature(frame, publicKey) {
+  if (frame.sig.length === 0) {
+    return false;
+  }
+  if (frame.sig.length !== 64) {
+    throw new Error("Ed25519 signature must be 64 bytes");
+  }
+  const payload = computeSignaturePayload(frame);
+  try {
+    let keyObject;
+    if (publicKey.length === 32) {
+      const spkiPrefix = Buffer.from([
+        48,
+        42,
+        48,
+        5,
+        6,
+        3,
+        43,
+        101,
+        112,
+        3,
+        33,
+        0
+      ]);
+      const spkiKey = Buffer.concat([spkiPrefix, publicKey]);
+      keyObject = crypto.createPublicKey({
+        key: spkiKey,
+        format: "der",
+        type: "spki"
+      });
+    } else {
+      keyObject = crypto.createPublicKey({
+        key: publicKey,
+        format: "der",
+        type: "spki"
+      });
+    }
+    const valid = crypto.verify(
+      null,
+      payload,
+      keyObject,
+      Buffer.from(frame.sig)
+    );
+    return valid;
+  } catch (error) {
+    return false;
+  }
+}
+function generateEd25519KeyPair() {
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519");
+  return {
+    privateKey: privateKey.export({ type: "pkcs8", format: "der" }),
+    publicKey: publicKey.export({ type: "spki", format: "der" })
+  };
+}
+function sha256(data) {
+  return crypto.createHash("sha256").update(data).digest();
+}
+function computeReceiptHash(receiptBytes, prevHash) {
+  const hasher = crypto.createHash("sha256");
+  hasher.update(receiptBytes);
+  if (prevHash && prevHash.length > 0) {
+    hasher.update(prevHash);
+  }
+  return hasher.digest();
+}
+export {
+  AXIS_MAGIC,
+  AXIS_VERSION,
+  AxisFrameZ,
+  ERR_BAD_SIGNATURE,
+  ERR_CONTRACT_VIOLATION,
+  ERR_INVALID_PACKET,
+  ERR_REPLAY_DETECTED,
+  FLAG_BODY_TLV,
+  FLAG_CHAIN_REQ,
+  FLAG_HAS_WITNESS,
+  MAX_BODY_LEN,
+  MAX_FRAME_LEN,
+  MAX_HDR_LEN,
+  MAX_SIG_LEN,
+  PROOF_CAPSULE,
+  PROOF_JWT,
+  PROOF_LOOM,
+  PROOF_MTLS,
+  TLV_ACTOR_ID,
+  TLV_AUD,
+  TLV_EFFECT,
+  TLV_ERROR_CODE,
+  TLV_ERROR_MSG,
+  TLV_INTENT,
+  TLV_KID,
+  TLV_LOOM_PRESENCE_ID,
+  TLV_LOOM_THREAD_HASH,
+  TLV_LOOM_WRIT,
+  TLV_NODE,
+  TLV_NODE_CERT_HASH,
+  TLV_NODE_KID,
+  TLV_NONCE,
+  TLV_OK,
+  TLV_PID,
+  TLV_PREV_HASH,
+  TLV_PROOF_REF,
+  TLV_PROOF_TYPE,
+  TLV_RECEIPT_HASH,
+  TLV_RID,
+  TLV_TRACE_ID,
+  TLV_TS,
+  computeReceiptHash,
+  computeSignaturePayload,
+  decodeArray,
+  decodeFrame,
+  decodeObject,
+  decodeTLVs,
+  decodeTLVsList,
+  decodeVarint,
+  encodeFrame,
+  encodeTLVs,
+  encodeVarint,
+  generateEd25519KeyPair,
+  getSignTarget,
+  sha256,
+  signFrame,
+  varintLength,
+  verifyFrameSignature
+};
+//# sourceMappingURL=index.mjs.map

package/dist/core/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/constants.ts","../../src/core/varint.ts","../../src/core/tlv.ts","../../src/core/axis-bin.ts","../../src/core/signature.ts"],"sourcesContent":["/**\n * AXIS Protocol Magic Bytes (e.g., 'AXIS1')\n */\nexport const AXIS_MAGIC = new Uint8Array([0x41, 0x58, 0x49, 0x53, 0x31]);\n\n/**\n * AXIS Protocol Version\n */\nexport const AXIS_VERSION = 0x01;\n\n/**\n * Maximum allowed size for the Header section in bytes.\n */\nexport const MAX_HDR_LEN = 2048;\n\n/**\n * Maximum allowed size for the Body section in bytes.\n */\nexport const MAX_BODY_LEN = 65536;\n\n/**\n * Maximum allowed size for the Signature section in bytes.\n */\nexport const MAX_SIG_LEN = 128;\n\n/**\n * Total maximum allowed size for a single AXIS frame.\n */\nexport const MAX_FRAME_LEN = 70 * 1024; // 70 KB\n\n/**\n * Frame Control Flags\n */\nexport const FLAG_BODY_TLV = 0x01;\nexport const FLAG_CHAIN_REQ = 0x02;\nexport const FLAG_HAS_WITNESS = 0x04;\n\n/**\n * TLV Tags for Header Section\n */\nexport const TLV_PID = 1;\nexport const TLV_TS = 2;\nexport const TLV_INTENT = 3;\nexport const TLV_ACTOR_ID = 4;\nexport const TLV_PROOF_TYPE = 5;\nexport const TLV_PROOF_REF = 6;\nexport const TLV_NONCE = 7;\nexport const TLV_AUD = 8;\nexport const TLV_NODE = 9;\nexport const TLV_TRACE_ID = 10;\n/** Key ID for key rotation support */\nexport const TLV_KID = 11;\n\n/**\n * TLV Tags for Receipt Section\n */\nexport const TLV_RID = 15;\nexport const TLV_OK = 16;\nexport const TLV_EFFECT = 17;\nexport const TLV_ERROR_CODE = 18;\nexport const TLV_ERROR_MSG = 19;\nexport const TLV_PREV_HASH = 20;\nexport const TLV_RECEIPT_HASH = 21;\nexport const TLV_NODE_KID = 30;\nexport const TLV_NODE_CERT_HASH = 34;\n\n/**\n * TLV Tags for Loom Runtime (Lawful Execution)\n */\n/** Presence ID - liveness proof (UTF-8 string, e.g., \"pr_abc123\") */\nexport const TLV_LOOM_PRESENCE_ID = 91;\n/** Writ - executable intent (canonical JSON, UTF-8 encoded) */\nexport const TLV_LOOM_WRIT = 92;\n/** Thread Hash - causal continuity (32 bytes, raw binary) */\nexport const TLV_LOOM_THREAD_HASH = 93;\n\n/**\n * Supported Authentication Proof Types\n */\nexport const PROOF_CAPSULE = 1;\nexport const PROOF_JWT = 2;\nexport const PROOF_MTLS = 3;\n/** Loom Presence + Writ proof */\nexport const PROOF_LOOM = 4;\n\n/**\n * Standard Protocol Error Codes\n */\nexport const ERR_INVALID_PACKET = 'INVALID_PACKET';\nexport const ERR_BAD_SIGNATURE = 'BAD_SIGNATURE';\nexport const ERR_REPLAY_DETECTED = 'REPLAY_DETECTED';\nexport const ERR_CONTRACT_VIOLATION = 'CONTRACT_VIOLATION';\n","/**\n * Encodes a number (up to 53 bits safe integer) into a Varint buffer.\n * Varints are a way of encoding integers using one or more bytes.\n * Smaller numbers take fewer bytes.\n *\n * @param {number} value - The unsigned integer to encode\n * @returns {Uint8Array} The encoded binary buffer\n * @throws {Error} If the value is negative\n */\nexport function encodeVarint(value: number): Uint8Array {\n  if (value < 0) throw new Error('Varint must be unsigned');\n  const bytes: number[] = [];\n  while (true) {\n    const byte = value & 0x7f;\n    value >>>= 7;\n    if (value === 0) {\n      bytes.push(byte);\n      break;\n    }\n    bytes.push(byte | 0x80);\n  }\n  return new Uint8Array(bytes);\n}\n\n/**\n * Decodes a Varint from a buffer starting at a specific offset.\n *\n * @param {Uint8Array} buf - The buffer containing the encoded varint\n * @param {number} [offset=0] - The starting position in the buffer\n * @returns {Object} The decoded numeric value and the number of bytes consumed (length)\n * @throws {Error} If the buffer is too small or the varint exceeds 8 bytes (max 53-bit safe int)\n */\nexport function decodeVarint(\n  buf: Uint8Array,\n  offset = 0,\n): { value: number; length: number } {\n  let value = 0;\n  let shift = 0;\n  let length = 0;\n\n  while (true) {\n    if (offset + length >= buf.length) {\n      throw new Error('Varint decode out of bounds');\n    }\n    const byte = buf[offset + length];\n    value += (byte & 0x7f) * Math.pow(2, shift);\n    length++;\n    shift += 7;\n    if ((byte & 0x80) === 0) {\n      break;\n    }\n    if (length > 8) throw new Error('Varint too large');\n  }\n\n  return { value, length };\n}\n\n/**\n * Calculates the number of bytes required to encode a value as a varint.\n * Useful for pre-allocating buffers.\n *\n * @param {number} value - The unsigned integer to check\n * @returns {number} The byte length\n * @throws {Error} If the value is negative\n */\nexport function varintLength(value: number): number {\n  if (value < 0) throw new Error('Varint must be unsigned');\n  let len = 0;\n  do {\n    value >>>= 7;\n    len++;\n  } while (value !== 0);\n  return len;\n}\n","import { encodeVarint, decodeVarint, varintLength } from './varint';\n\n/**\n * Represents a basic Type-Length-Value structure.\n *\n * @interface TLV\n */\nexport interface TLV {\n  /** The tag or type identifier */\n  type: number;\n  /** The raw binary value */\n  value: Uint8Array;\n}\n\n/**\n * Encodes an array of TLVs into a canonical binary buffer.\n *\n * **Canonical Rules:**\n * 1. TLVs MUST be sorted by `type` in ascending order.\n * 2. Duplicate `type` entries are NOT allowed.\n * 3. Format: `[type_varint][len_varint][value_bytes]`\n *\n * @param {TLV[]} tlvs - The list of TLV entries to encode\n * @returns {Uint8Array} The sorted and encoded binary buffer\n * @throws {Error} If duplicate types are detected\n */\nexport function encodeTLVs(tlvs: TLV[]): Uint8Array {\n  // 1. Sort by TYPE ascending\n  // Create a copy to avoid mutating input\n  const sorted = [...tlvs].sort((a, b) => a.type - b.type);\n\n  // 2. Check for duplicates\n  for (let i = 0; i < sorted.length - 1; i++) {\n    if (sorted[i].type === sorted[i + 1].type) {\n      throw new Error(`Duplicate TLV type: ${sorted[i].type}`);\n    }\n  }\n\n  // 3. Calculate total size\n  let totalSize = 0;\n  for (const t of sorted) {\n    totalSize += varintLength(t.type);\n    totalSize += varintLength(t.value.length);\n    totalSize += t.value.length;\n  }\n\n  // 4. Encode\n  const buf = new Uint8Array(totalSize);\n  let offset = 0;\n  for (const t of sorted) {\n    const typeBytes = encodeVarint(t.type);\n    buf.set(typeBytes, offset);\n    offset += typeBytes.length;\n\n    const lenBytes = encodeVarint(t.value.length);\n    buf.set(lenBytes, offset);\n    offset += lenBytes.length;\n\n    buf.set(t.value, offset);\n    offset += t.value.length;\n  }\n\n  return buf;\n}\n\n/**\n * Decodes a binary buffer of TLVs into a flat list.\n * Preserves the original wire order and allows duplicate types.\n *\n * @param {Uint8Array} buf - The buffer containing TLV-encoded data\n * @param {number} [maxItems=1024] - Security limit for the number of parsed items\n * @returns {TLV[]} A list of decoded TLV entries\n * @throws {Error} If the buffer is truncated or malformed\n */\nexport function decodeTLVsList(buf: Uint8Array, maxItems = 1024): TLV[] {\n  const list: TLV[] = [];\n  let offset = 0;\n\n  while (offset < buf.length) {\n    if (list.length >= maxItems) throw new Error('TLV_LIMIT');\n\n    // Decode TYPE\n    const { value: type, length: typeLen } = decodeVarint(buf, offset);\n    offset += typeLen;\n\n    // Decode LEN\n    const { value: len, length: lenLen } = decodeVarint(buf, offset);\n    offset += lenLen;\n\n    // Check bounds\n    if (offset + len > buf.length) {\n      throw new Error(`TLV violation: Length ${len} exceeds buffer`);\n    }\n\n    // Extract VALUE\n    const value = buf.slice(offset, offset + len);\n    list.push({ type, value });\n    offset += len;\n  }\n\n  return list;\n}\n\n/**\n * Decodes a binary buffer of TLVs into a Map for efficient access.\n * Enforces strict canonical order (sorted tiles) and forbids duplicate types.\n *\n * @param {Uint8Array} buf - The buffer containing canonical TLV data\n * @returns {Map<number, Uint8Array>} Map of Tag -> Value\n * @throws {Error} If canonical order is violated or duplicates are found\n */\nexport function decodeTLVs(buf: Uint8Array): Map<number, Uint8Array> {\n  const map = new Map<number, Uint8Array>();\n  let offset = 0;\n  let lastType = -1;\n\n  while (offset < buf.length) {\n    // Decode TYPE\n    const { value: type, length: typeLen } = decodeVarint(buf, offset);\n    offset += typeLen;\n\n    // Check canonical order\n    if (type <= lastType) {\n      throw new Error(\n        `TLV violation: Unsorted or duplicate type ${type} after ${lastType}`,\n      );\n    }\n    lastType = type;\n\n    // Decode LEN\n    const { value: len, length: lenLen } = decodeVarint(buf, offset);\n    offset += lenLen;\n\n    // Check bounds\n    if (offset + len > buf.length) {\n      throw new Error(`TLV violation: Length ${len} exceeds buffer`);\n    }\n\n    // Extract VALUE\n    const value = buf.slice(offset, offset + len);\n    map.set(type, value);\n    offset += len;\n  }\n\n  return map;\n}\n\n/**\n * Recursive Object Decoder (safe nesting).\n * This follows the AXIS Option A: Nested TLV objects.\n */\nexport function decodeObject(\n  bytes: Uint8Array,\n  depth = 0,\n  limits = { maxDepth: 8, maxItems: 128 },\n): Map<number, any> {\n  if (depth > limits.maxDepth) {\n    throw new Error('OBJECT_DEPTH_EXCEEDED');\n  }\n\n  const map = decodeTLVs(bytes);\n  // In v1, we leave values as Uint8Array unless schema-driven.\n  // The IntentSchemaValidator will handle deeper recursion.\n  return map;\n}\n\n/**\n * Array Decoder (explicit container).\n * VALUE = repeated TLVs of one ITEM type.\n */\nexport function decodeArray(\n  bytes: Uint8Array,\n  itemType: number,\n  maxItems = 256,\n): Uint8Array[] {\n  const list = decodeTLVsList(bytes, maxItems);\n  const items: Uint8Array[] = [];\n\n  for (const tlv of list) {\n    if (tlv.type !== itemType) {\n      throw new Error(`INVALID_ARRAY_ITEM:${tlv.type}`);\n    }\n    items.push(tlv.value);\n  }\n\n  return items;\n}\n","import * as z from 'zod';\n\n/**\n * AxisFrame Schema\n *\n * Defines the logical structure of an AXIS frame using Zod for runtime validation.\n * This is used for internal processing after the low-level binary parsing is complete.\n */\nexport const AxisFrameZ = z.object({\n  /** Flag bits for protocol control (e.g., encryption, compression) */\n  flags: z.number().int().nonnegative(),\n  /** A map of TLV headers where key=Tag and value=BinaryData */\n  headers: z.map(\n    z.number(),\n    z.custom<Uint8Array>((v) => v instanceof Uint8Array),\n  ),\n  /** The main payload of the frame */\n  body: z.custom<Uint8Array>((v) => v instanceof Uint8Array),\n  /** The cryptographic signature covering the frame (except the signature itself) */\n  sig: z.custom<Uint8Array>((v) => v instanceof Uint8Array),\n});\n\n/**\n * Represents a structured AXIS frame.\n * @typedef {Object} AxisFrame\n */\nexport type AxisFrame = z.infer<typeof AxisFrameZ>;\nimport {\n  AXIS_MAGIC,\n  AXIS_VERSION,\n  MAX_BODY_LEN,\n  MAX_FRAME_LEN,\n  MAX_HDR_LEN,\n  MAX_SIG_LEN,\n} from './constants';\nimport { decodeTLVs, encodeTLVs } from './tlv';\nimport { decodeVarint, encodeVarint } from './varint';\n\n/**\n * Encodes a structured AxisFrame into its binary wire representation.\n *\n * **Encoding Steps:**\n * 1. Encodes header TLV map into a single buffer.\n * 2. Validates lengths against MAX_* constants.\n * 3. Encodes lengths (HDR, BODY, SIG) as varints.\n * 4. Assembles the final byte array with magic, version, and flags.\n *\n * @param {AxisFrame} frame - The structured frame to encode\n * @returns {Uint8Array} The full binary frame\n * @throws {Error} If any section exceeds protocol limits\n */\nexport function encodeFrame(frame: AxisFrame): Uint8Array {\n  const hdrBytes = encodeTLVs(\n    Array.from(frame.headers.entries()).map(([t, v]) => ({\n      type: t,\n      value: v,\n    })),\n  );\n\n  if (hdrBytes.length > MAX_HDR_LEN) throw new Error('Header too large');\n  if (frame.body.length > MAX_BODY_LEN) throw new Error('Body too large');\n  if (frame.sig.length > MAX_SIG_LEN) throw new Error('Signature too large');\n\n  // Header Len, Body Len, Sig Len\n  const hdrLenBytes = encodeVarint(hdrBytes.length);\n  const bodyLenBytes = encodeVarint(frame.body.length);\n  const sigLenBytes = encodeVarint(frame.sig.length);\n\n  const totalLen =\n    5 + // Magic (AXIS1)\n    1 + // Version\n    1 + // Flags\n    hdrLenBytes.length +\n    bodyLenBytes.length +\n    sigLenBytes.length +\n    hdrBytes.length +\n    frame.body.length +\n    frame.sig.length;\n\n  if (totalLen > MAX_FRAME_LEN) throw new Error('Total frame too large');\n\n  const buf = new Uint8Array(totalLen);\n  let offset = 0;\n\n  // Magic (AXIS1 - 5 bytes)\n  buf.set(AXIS_MAGIC, offset);\n  offset += 5;\n\n  // Version\n  buf[offset++] = AXIS_VERSION;\n\n  // Flags\n  buf[offset++] = frame.flags;\n\n  // Lengths\n  buf.set(hdrLenBytes, offset);\n  offset += hdrLenBytes.length;\n\n  buf.set(bodyLenBytes, offset);\n  offset += bodyLenBytes.length;\n\n  buf.set(sigLenBytes, offset);\n  offset += sigLenBytes.length;\n\n  // Payloads\n  buf.set(hdrBytes, offset);\n  offset += hdrBytes.length;\n\n  buf.set(frame.body, offset);\n  offset += frame.body.length;\n\n  buf.set(frame.sig, offset);\n  offset += frame.sig.length;\n\n  return buf;\n}\n\n/**\n * Decodes a binary buffer into a structured AxisFrame with strict validation.\n *\n * @param {Uint8Array} buf - Raw bytes from the wire\n * @returns {AxisFrame} The parsed and validated frame\n * @throws {Error} If magic, version, or lengths are invalid\n */\nexport function decodeFrame(buf: Uint8Array): AxisFrame {\n  let offset = 0;\n\n  // 1. Magic (AXIS1 - 5 bytes)\n  if (offset + 5 > buf.length) throw new Error('Packet too short');\n  for (let i = 0; i < 5; i++) {\n    if (buf[offset + i] !== AXIS_MAGIC[i]) throw new Error('Invalid Magic');\n  }\n  offset += 5;\n\n  // 2. Version\n  const ver = buf[offset++];\n  if (ver !== AXIS_VERSION) throw new Error(`Unsupported version: ${ver}`);\n\n  // 3. Flags\n  const flags = buf[offset++];\n\n  // 4. Lengths\n  const { value: hdrLen, length: hlLen } = decodeVarint(buf, offset);\n  offset += hlLen;\n  if (hdrLen > MAX_HDR_LEN) throw new Error('Header limit exceeded');\n\n  const { value: bodyLen, length: blLen } = decodeVarint(buf, offset);\n  offset += blLen;\n  if (bodyLen > MAX_BODY_LEN) throw new Error('Body limit exceeded');\n\n  const { value: sigLen, length: slLen } = decodeVarint(buf, offset);\n  offset += slLen;\n  if (sigLen > MAX_SIG_LEN) throw new Error('Signature limit exceeded');\n\n  // 5. Extract Bytes\n  if (offset + hdrLen + bodyLen + sigLen > buf.length) {\n    throw new Error('Frame truncated');\n  }\n\n  const hdrBytes = buf.slice(offset, offset + hdrLen);\n  offset += hdrLen;\n\n  const bodyBytes = buf.slice(offset, offset + bodyLen);\n  offset += bodyLen;\n\n  const sigBytes = buf.slice(offset, offset + sigLen);\n  offset += sigLen;\n\n  // 6. Decode Header TLVs\n  const headers = decodeTLVs(hdrBytes);\n\n  return {\n    flags,\n    headers,\n    body: bodyBytes,\n    sig: sigBytes,\n  };\n}\n\n/**\n * Helper to get canonical bytes for signing.\n * SigTarget = All bytes up to SigLen, with SigLen=0, and no SigBytes.\n */\nexport function getSignTarget(frame: AxisFrame): Uint8Array {\n  // Re-encode frame but with empty signature\n  // Note: This is efficient enough for v1 (tens of KB).\n  return encodeFrame({\n    ...frame,\n    sig: new Uint8Array(0),\n  });\n}\n","import * as crypto from 'crypto';\n\nimport { AxisFrame, encodeFrame } from './axis-bin';\n\n/**\n * Signature utilities for AXIS binary frames\n * Supports Ed25519 signature generation and verification\n */\n\n/**\n * Computes the canonical payload for signing an AXIS frame.\n * The signature covers all bytes of the encoded frame EXCEPT the signature field itself.\n *\n * @param {AxisFrame} frame - The frame to prepare for signing\n * @returns {Buffer} The serialized canonical bytes for the signature algorithm\n */\nexport function computeSignaturePayload(frame: AxisFrame): Buffer {\n  // Re-encode frame with empty signature\n  const frameWithoutSig: AxisFrame = {\n    ...frame,\n    sig: new Uint8Array(0),\n  };\n\n  const encoded = encodeFrame(frameWithoutSig);\n  return Buffer.from(encoded);\n}\n\n/**\n * Signs an AXIS frame using the Ed25519 algorithm.\n * Automatically handles both raw 32-byte seeds and pkcs8 DER-encoded private keys.\n *\n * @param {AxisFrame} frame - The frame to sign\n * @param {Buffer} privateKey - Ed25519 private key (32-byte raw OR pkcs8 DER)\n * @returns {Buffer} The 64-byte Ed25519 signature\n * @throws {Error} If key format is invalid or signing fail\n */\nexport function signFrame(frame: AxisFrame, privateKey: Buffer): Buffer {\n  const payload = computeSignaturePayload(frame);\n\n  let keyObject: crypto.KeyObject;\n\n  // Check if key is raw 32-byte seed or DER-encoded\n  if (privateKey.length === 32) {\n    // Raw seed - wrap in pkcs8 DER format\n    // pkcs8 prefix for Ed25519: 0x302e020100300506032b657004220420\n    const pkcs8Prefix = Buffer.from([\n      0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70,\n      0x04, 0x22, 0x04, 0x20,\n    ]);\n    const pkcs8Key = Buffer.concat([pkcs8Prefix, privateKey]);\n\n    keyObject = crypto.createPrivateKey({\n      key: pkcs8Key,\n      format: 'der',\n      type: 'pkcs8',\n    });\n  } else {\n    // Assume already DER-encoded pkcs8\n    keyObject = crypto.createPrivateKey({\n      key: privateKey,\n      format: 'der',\n      type: 'pkcs8',\n    });\n  }\n\n  const signature = crypto.sign(null, payload, keyObject);\n\n  if (signature.length !== 64) {\n    throw new Error('Ed25519 signature must be 64 bytes');\n  }\n\n  return signature;\n}\n\n/**\n * Verifies an Ed25519 signature on an AXIS frame.\n * Automatically handles both raw 32-byte public keys and spki DER-encoded public keys.\n *\n * @param {AxisFrame} frame - The frame containing the signature to verify\n * @param {Buffer} publicKey - Ed25519 public key (32-byte raw OR spki DER)\n * @returns {boolean} True if the signature is cryptographically valid\n * @throws {Error} If signature length is invalid\n */\nexport function verifyFrameSignature(\n  frame: AxisFrame,\n  publicKey: Buffer,\n): boolean {\n  if (frame.sig.length === 0) {\n    return false; // No signature\n  }\n\n  if (frame.sig.length !== 64) {\n    throw new Error('Ed25519 signature must be 64 bytes');\n  }\n\n  const payload = computeSignaturePayload(frame);\n\n  try {\n    let keyObject: crypto.KeyObject;\n\n    // Check if key is raw 32-byte or DER-encoded\n    if (publicKey.length === 32) {\n      // Raw key - wrap in spki DER format\n      // spki prefix for Ed25519: 0x302a300506032b6570032100\n      const spkiPrefix = Buffer.from([\n        0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,\n      ]);\n      const spkiKey = Buffer.concat([spkiPrefix, publicKey]);\n\n      keyObject = crypto.createPublicKey({\n        key: spkiKey,\n        format: 'der',\n        type: 'spki',\n      });\n    } else {\n      // Assume already DER-encoded spki\n      keyObject = crypto.createPublicKey({\n        key: publicKey,\n        format: 'der',\n        type: 'spki',\n      });\n    }\n\n    const valid = crypto.verify(\n      null,\n      payload,\n      keyObject,\n      Buffer.from(frame.sig),\n    );\n    return valid;\n  } catch (error) {\n    return false;\n  }\n}\n\n/**\n * Generates a new Ed25519 key pair for use with the AXIS protocol.\n * Returns keys in canonical DER format (pkcs8 for private, spki for public).\n *\n * @returns {Object} An object containing the privateKey and publicKey as Buffers\n */\nexport function generateEd25519KeyPair(): {\n  privateKey: Buffer;\n  publicKey: Buffer;\n} {\n  const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519');\n\n  return {\n    privateKey: privateKey.export({ type: 'pkcs8', format: 'der' }) as Buffer,\n    publicKey: publicKey.export({ type: 'spki', format: 'der' }) as Buffer,\n  };\n}\n\n/**\n * Computes a standard SHA-256 hash of the provided data.\n *\n * @param {Buffer | Uint8Array} data - The input data to hash\n * @returns {Buffer} The 32-byte SHA-256 digest\n */\nexport function sha256(data: Buffer | Uint8Array): Buffer {\n  return crypto.createHash('sha256').update(data).digest();\n}\n\n/**\n * Computes a hash for an AXIS receipt, optionally chaining it to a previous hash.\n * This is used for generating an immutable transaction chain.\n *\n * @param {Buffer | Uint8Array} receiptBytes - The canonical binary representation of the receipt\n * @param {Buffer | Uint8Array} [prevHash] - The hash of the previous receipt in the chain\n * @returns {Buffer} The 32-byte SHA-256 hash of the receipt (and link)\n */\nexport function computeReceiptHash(\n  receiptBytes: Buffer | Uint8Array,\n  prevHash?: Buffer | Uint8Array,\n): Buffer {\n  const hasher = crypto.createHash('sha256');\n  hasher.update(receiptBytes);\n\n  if (prevHash && prevHash.length > 0) {\n    hasher.update(prevHash);\n  }\n\n  return hasher.digest();\n}\n"],"mappings":";AAGO,IAAM,aAAa,IAAI,WAAW,CAAC,IAAM,IAAM,IAAM,IAAM,EAAI,CAAC;AAKhE,IAAM,eAAe;AAKrB,IAAM,cAAc;AAKpB,IAAM,eAAe;AAKrB,IAAM,cAAc;AAKpB,IAAM,gBAAgB,KAAK;AAK3B,IAAM,gBAAgB;AACtB,IAAM,iBAAiB;AACvB,IAAM,mBAAmB;AAKzB,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,eAAe;AACrB,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,YAAY;AAClB,IAAM,UAAU;AAChB,IAAM,WAAW;AACjB,IAAM,eAAe;AAErB,IAAM,UAAU;AAKhB,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AACzB,IAAM,eAAe;AACrB,IAAM,qBAAqB;AAM3B,IAAM,uBAAuB;AAE7B,IAAM,gBAAgB;AAEtB,IAAM,uBAAuB;AAK7B,IAAM,gBAAgB;AACtB,IAAM,YAAY;AAClB,IAAM,aAAa;AAEnB,IAAM,aAAa;AAKnB,IAAM,qBAAqB;AAC3B,IAAM,oBAAoB;AAC1B,IAAM,sBAAsB;AAC5B,IAAM,yBAAyB;;;AClF/B,SAAS,aAAa,OAA2B;AACtD,MAAI,QAAQ,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACxD,QAAM,QAAkB,CAAC;AACzB,SAAO,MAAM;AACX,UAAM,OAAO,QAAQ;AACrB,eAAW;AACX,QAAI,UAAU,GAAG;AACf,YAAM,KAAK,IAAI;AACf;AAAA,IACF;AACA,UAAM,KAAK,OAAO,GAAI;AAAA,EACxB;AACA,SAAO,IAAI,WAAW,KAAK;AAC7B;AAUO,SAAS,aACd,KACA,SAAS,GAC0B;AACnC,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,SAAS;AAEb,SAAO,MAAM;AACX,QAAI,SAAS,UAAU,IAAI,QAAQ;AACjC,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AACA,UAAM,OAAO,IAAI,SAAS,MAAM;AAChC,cAAU,OAAO,OAAQ,KAAK,IAAI,GAAG,KAAK;AAC1C;AACA,aAAS;AACT,SAAK,OAAO,SAAU,GAAG;AACvB;AAAA,IACF;AACA,QAAI,SAAS,EAAG,OAAM,IAAI,MAAM,kBAAkB;AAAA,EACpD;AAEA,SAAO,EAAE,OAAO,OAAO;AACzB;AAUO,SAAS,aAAa,OAAuB;AAClD,MAAI,QAAQ,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACxD,MAAI,MAAM;AACV,KAAG;AACD,eAAW;AACX;AAAA,EACF,SAAS,UAAU;AACnB,SAAO;AACT;;;AC/CO,SAAS,WAAW,MAAyB;AAGlD,QAAM,SAAS,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI;AAGvD,WAAS,IAAI,GAAG,IAAI,OAAO,SAAS,GAAG,KAAK;AAC1C,QAAI,OAAO,CAAC,EAAE,SAAS,OAAO,IAAI,CAAC,EAAE,MAAM;AACzC,YAAM,IAAI,MAAM,uBAAuB,OAAO,CAAC,EAAE,IAAI,EAAE;AAAA,IACzD;AAAA,EACF;AAGA,MAAI,YAAY;AAChB,aAAW,KAAK,QAAQ;AACtB,iBAAa,aAAa,EAAE,IAAI;AAChC,iBAAa,aAAa,EAAE,MAAM,MAAM;AACxC,iBAAa,EAAE,MAAM;AAAA,EACvB;AAGA,QAAM,MAAM,IAAI,WAAW,SAAS;AACpC,MAAI,SAAS;AACb,aAAW,KAAK,QAAQ;AACtB,UAAM,YAAY,aAAa,EAAE,IAAI;AACrC,QAAI,IAAI,WAAW,MAAM;AACzB,cAAU,UAAU;AAEpB,UAAM,WAAW,aAAa,EAAE,MAAM,MAAM;AAC5C,QAAI,IAAI,UAAU,MAAM;AACxB,cAAU,SAAS;AAEnB,QAAI,IAAI,EAAE,OAAO,MAAM;AACvB,cAAU,EAAE,MAAM;AAAA,EACpB;AAEA,SAAO;AACT;AAWO,SAAS,eAAe,KAAiB,WAAW,MAAa;AACtE,QAAM,OAAc,CAAC;AACrB,MAAI,SAAS;AAEb,SAAO,SAAS,IAAI,QAAQ;AAC1B,QAAI,KAAK,UAAU,SAAU,OAAM,IAAI,MAAM,WAAW;AAGxD,UAAM,EAAE,OAAO,MAAM,QAAQ,QAAQ,IAAI,aAAa,KAAK,MAAM;AACjE,cAAU;AAGV,UAAM,EAAE,OAAO,KAAK,QAAQ,OAAO,IAAI,aAAa,KAAK,MAAM;AAC/D,cAAU;AAGV,QAAI,SAAS,MAAM,IAAI,QAAQ;AAC7B,YAAM,IAAI,MAAM,yBAAyB,GAAG,iBAAiB;AAAA,IAC/D;AAGA,UAAM,QAAQ,IAAI,MAAM,QAAQ,SAAS,GAAG;AAC5C,SAAK,KAAK,EAAE,MAAM,MAAM,CAAC;AACzB,cAAU;AAAA,EACZ;AAEA,SAAO;AACT;AAUO,SAAS,WAAW,KAA0C;AACnE,QAAMA,OAAM,oBAAI,IAAwB;AACxC,MAAI,SAAS;AACb,MAAI,WAAW;AAEf,SAAO,SAAS,IAAI,QAAQ;AAE1B,UAAM,EAAE,OAAO,MAAM,QAAQ,QAAQ,IAAI,aAAa,KAAK,MAAM;AACjE,cAAU;AAGV,QAAI,QAAQ,UAAU;AACpB,YAAM,IAAI;AAAA,QACR,6CAA6C,IAAI,UAAU,QAAQ;AAAA,MACrE;AAAA,IACF;AACA,eAAW;AAGX,UAAM,EAAE,OAAO,KAAK,QAAQ,OAAO,IAAI,aAAa,KAAK,MAAM;AAC/D,cAAU;AAGV,QAAI,SAAS,MAAM,IAAI,QAAQ;AAC7B,YAAM,IAAI,MAAM,yBAAyB,GAAG,iBAAiB;AAAA,IAC/D;AAGA,UAAM,QAAQ,IAAI,MAAM,QAAQ,SAAS,GAAG;AAC5C,IAAAA,KAAI,IAAI,MAAM,KAAK;AACnB,cAAU;AAAA,EACZ;AAEA,SAAOA;AACT;AAMO,SAAS,aACd,OACA,QAAQ,GACR,SAAS,EAAE,UAAU,GAAG,UAAU,IAAI,GACpB;AAClB,MAAI,QAAQ,OAAO,UAAU;AAC3B,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AAEA,QAAMA,OAAM,WAAW,KAAK;AAG5B,SAAOA;AACT;AAMO,SAAS,YACd,OACA,UACA,WAAW,KACG;AACd,QAAM,OAAO,eAAe,OAAO,QAAQ;AAC3C,QAAM,QAAsB,CAAC;AAE7B,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,SAAS,UAAU;AACzB,YAAM,IAAI,MAAM,sBAAsB,IAAI,IAAI,EAAE;AAAA,IAClD;AACA,UAAM,KAAK,IAAI,KAAK;AAAA,EACtB;AAEA,SAAO;AACT;;;AC1LA,YAAY,OAAO;AAQZ,IAAM,aAAe,SAAO;AAAA;AAAA,EAEjC,OAAS,SAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAEpC,SAAW;AAAA,IACP,SAAO;AAAA,IACP,SAAmB,CAAC,MAAM,aAAa,UAAU;AAAA,EACrD;AAAA;AAAA,EAEA,MAAQ,SAAmB,CAAC,MAAM,aAAa,UAAU;AAAA;AAAA,EAEzD,KAAO,SAAmB,CAAC,MAAM,aAAa,UAAU;AAC1D,CAAC;AA+BM,SAAS,YAAY,OAA8B;AACxD,QAAM,WAAW;AAAA,IACf,MAAM,KAAK,MAAM,QAAQ,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO;AAAA,MACnD,MAAM;AAAA,MACN,OAAO;AAAA,IACT,EAAE;AAAA,EACJ;AAEA,MAAI,SAAS,SAAS,YAAa,OAAM,IAAI,MAAM,kBAAkB;AACrE,MAAI,MAAM,KAAK,SAAS,aAAc,OAAM,IAAI,MAAM,gBAAgB;AACtE,MAAI,MAAM,IAAI,SAAS,YAAa,OAAM,IAAI,MAAM,qBAAqB;AAGzE,QAAM,cAAc,aAAa,SAAS,MAAM;AAChD,QAAM,eAAe,aAAa,MAAM,KAAK,MAAM;AACnD,QAAM,cAAc,aAAa,MAAM,IAAI,MAAM;AAEjD,QAAM,WACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY,SACZ,aAAa,SACb,YAAY,SACZ,SAAS,SACT,MAAM,KAAK,SACX,MAAM,IAAI;AAEZ,MAAI,WAAW,cAAe,OAAM,IAAI,MAAM,uBAAuB;AAErE,QAAM,MAAM,IAAI,WAAW,QAAQ;AACnC,MAAI,SAAS;AAGb,MAAI,IAAI,YAAY,MAAM;AAC1B,YAAU;AAGV,MAAI,QAAQ,IAAI;AAGhB,MAAI,QAAQ,IAAI,MAAM;AAGtB,MAAI,IAAI,aAAa,MAAM;AAC3B,YAAU,YAAY;AAEtB,MAAI,IAAI,cAAc,MAAM;AAC5B,YAAU,aAAa;AAEvB,MAAI,IAAI,aAAa,MAAM;AAC3B,YAAU,YAAY;AAGtB,MAAI,IAAI,UAAU,MAAM;AACxB,YAAU,SAAS;AAEnB,MAAI,IAAI,MAAM,MAAM,MAAM;AAC1B,YAAU,MAAM,KAAK;AAErB,MAAI,IAAI,MAAM,KAAK,MAAM;AACzB,YAAU,MAAM,IAAI;AAEpB,SAAO;AACT;AASO,SAAS,YAAY,KAA4B;AACtD,MAAI,SAAS;AAGb,MAAI,SAAS,IAAI,IAAI,OAAQ,OAAM,IAAI,MAAM,kBAAkB;AAC/D,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,QAAI,IAAI,SAAS,CAAC,MAAM,WAAW,CAAC,EAAG,OAAM,IAAI,MAAM,eAAe;AAAA,EACxE;AACA,YAAU;AAGV,QAAM,MAAM,IAAI,QAAQ;AACxB,MAAI,QAAQ,aAAc,OAAM,IAAI,MAAM,wBAAwB,GAAG,EAAE;AAGvE,QAAM,QAAQ,IAAI,QAAQ;AAG1B,QAAM,EAAE,OAAO,QAAQ,QAAQ,MAAM,IAAI,aAAa,KAAK,MAAM;AACjE,YAAU;AACV,MAAI,SAAS,YAAa,OAAM,IAAI,MAAM,uBAAuB;AAEjE,QAAM,EAAE,OAAO,SAAS,QAAQ,MAAM,IAAI,aAAa,KAAK,MAAM;AAClE,YAAU;AACV,MAAI,UAAU,aAAc,OAAM,IAAI,MAAM,qBAAqB;AAEjE,QAAM,EAAE,OAAO,QAAQ,QAAQ,MAAM,IAAI,aAAa,KAAK,MAAM;AACjE,YAAU;AACV,MAAI,SAAS,YAAa,OAAM,IAAI,MAAM,0BAA0B;AAGpE,MAAI,SAAS,SAAS,UAAU,SAAS,IAAI,QAAQ;AACnD,UAAM,IAAI,MAAM,iBAAiB;AAAA,EACnC;AAEA,QAAM,WAAW,IAAI,MAAM,QAAQ,SAAS,MAAM;AAClD,YAAU;AAEV,QAAM,YAAY,IAAI,MAAM,QAAQ,SAAS,OAAO;AACpD,YAAU;AAEV,QAAM,WAAW,IAAI,MAAM,QAAQ,SAAS,MAAM;AAClD,YAAU;AAGV,QAAM,UAAU,WAAW,QAAQ;AAEnC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,KAAK;AAAA,EACP;AACF;AAMO,SAAS,cAAc,OAA8B;AAG1D,SAAO,YAAY;AAAA,IACjB,GAAG;AAAA,IACH,KAAK,IAAI,WAAW,CAAC;AAAA,EACvB,CAAC;AACH;;;AC9LA,YAAY,YAAY;AAgBjB,SAAS,wBAAwB,OAA0B;AAEhE,QAAM,kBAA6B;AAAA,IACjC,GAAG;AAAA,IACH,KAAK,IAAI,WAAW,CAAC;AAAA,EACvB;AAEA,QAAM,UAAU,YAAY,eAAe;AAC3C,SAAO,OAAO,KAAK,OAAO;AAC5B;AAWO,SAAS,UAAU,OAAkB,YAA4B;AACtE,QAAM,UAAU,wBAAwB,KAAK;AAE7C,MAAI;AAGJ,MAAI,WAAW,WAAW,IAAI;AAG5B,UAAM,cAAc,OAAO,KAAK;AAAA,MAC9B;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,MAClE;AAAA,MAAM;AAAA,MAAM;AAAA,MAAM;AAAA,IACpB,CAAC;AACD,UAAM,WAAW,OAAO,OAAO,CAAC,aAAa,UAAU,CAAC;AAExD,gBAAmB,wBAAiB;AAAA,MAClC,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH,OAAO;AAEL,gBAAmB,wBAAiB;AAAA,MAClC,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,QAAM,YAAmB,YAAK,MAAM,SAAS,SAAS;AAEtD,MAAI,UAAU,WAAW,IAAI;AAC3B,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AAEA,SAAO;AACT;AAWO,SAAS,qBACd,OACA,WACS;AACT,MAAI,MAAM,IAAI,WAAW,GAAG;AAC1B,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,IAAI,WAAW,IAAI;AAC3B,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AAEA,QAAM,UAAU,wBAAwB,KAAK;AAE7C,MAAI;AACF,QAAI;AAGJ,QAAI,UAAU,WAAW,IAAI;AAG3B,YAAM,aAAa,OAAO,KAAK;AAAA,QAC7B;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,QAAM;AAAA,MACpE,CAAC;AACD,YAAM,UAAU,OAAO,OAAO,CAAC,YAAY,SAAS,CAAC;AAErD,kBAAmB,uBAAgB;AAAA,QACjC,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AAAA,IACH,OAAO;AAEL,kBAAmB,uBAAgB;AAAA,QACjC,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,QAAe;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,KAAK,MAAM,GAAG;AAAA,IACvB;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO;AAAA,EACT;AACF;AAQO,SAAS,yBAGd;AACA,QAAM,EAAE,YAAY,UAAU,IAAW,2BAAoB,SAAS;AAEtE,SAAO;AAAA,IACL,YAAY,WAAW,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,CAAC;AAAA,IAC9D,WAAW,UAAU,OAAO,EAAE,MAAM,QAAQ,QAAQ,MAAM,CAAC;AAAA,EAC7D;AACF;AAQO,SAAS,OAAO,MAAmC;AACxD,SAAc,kBAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO;AACzD;AAUO,SAAS,mBACd,cACA,UACQ;AACR,QAAM,SAAgB,kBAAW,QAAQ;AACzC,SAAO,OAAO,YAAY;AAE1B,MAAI,YAAY,SAAS,SAAS,GAAG;AACnC,WAAO,OAAO,QAAQ;AAAA,EACxB;AAEA,SAAO,OAAO,OAAO;AACvB;","names":["map"]}

package/dist/index.d.mts

@@ -1,4 +1,7 @@
+import { AxisFrame } from './core/index.mjs';
+export { AXIS_MAGIC, AXIS_VERSION, AxisFrameZ, ERR_BAD_SIGNATURE, ERR_CONTRACT_VIOLATION, ERR_INVALID_PACKET, ERR_REPLAY_DETECTED, FLAG_BODY_TLV, FLAG_CHAIN_REQ, FLAG_HAS_WITNESS, MAX_BODY_LEN, MAX_FRAME_LEN, MAX_HDR_LEN, MAX_SIG_LEN, PROOF_CAPSULE, PROOF_JWT, PROOF_LOOM, PROOF_MTLS, TLV, TLV_ACTOR_ID, TLV_AUD, TLV_EFFECT, TLV_ERROR_CODE, TLV_ERROR_MSG, TLV_INTENT, TLV_KID, TLV_LOOM_PRESENCE_ID, TLV_LOOM_THREAD_HASH, TLV_LOOM_WRIT, TLV_NODE, TLV_NODE_CERT_HASH, TLV_NODE_KID, TLV_NONCE, TLV_OK, TLV_PID, TLV_PREV_HASH, TLV_PROOF_REF, TLV_PROOF_TYPE, TLV_RECEIPT_HASH, TLV_RID, TLV_TRACE_ID, TLV_TS, computeReceiptHash, computeSignaturePayload, decodeArray, decodeFrame, decodeObject, decodeTLVs, decodeTLVsList, decodeVarint, encodeFrame, encodeTLVs, encodeVarint, generateEd25519KeyPair, getSignTarget, sha256, signFrame, varintLength, verifyFrameSignature } from './core/index.mjs';
 import { OnModuleInit } from '@nestjs/common';
+import 'zod';
 
 declare const HANDLER_METADATA_KEY = "axis:handler";
 declare function Handler(intent?: string): ClassDecorator;
@@ -16,14 +19,6 @@ interface IntentOptions {
 }
 declare function Intent(action: string, options?: IntentOptions): MethodDecorator;
 
-interface AxisFrame {
-    flags: number;
-    headers: Map<number, Uint8Array>;
-    body: Uint8Array;
-    sig: Uint8Array;
-    metadata?: Record<string, any>;
-}
-
 interface AxisEffect {
     ok: boolean;
     effect: string;
@@ -56,4 +51,4 @@ interface AxisCrudHandler extends AxisHandlerInit {
     remove(body: Uint8Array, headers?: Map<number, Uint8Array>): Promise<Uint8Array>;
 }
 
-export { type AxisCrudHandler, type AxisEffect, type AxisFrame, type AxisHandler, type AxisHandlerInit, HANDLER_METADATA_KEY, Handler, INTENT_ROUTES_KEY, Intent, type IntentOptions, type IntentRoute, IntentRouter };
+export { type AxisCrudHandler, type AxisEffect, AxisFrame, type AxisHandler, type AxisHandlerInit, HANDLER_METADATA_KEY, Handler, INTENT_ROUTES_KEY, Intent, type IntentOptions, type IntentRoute, IntentRouter };

package/dist/index.d.ts

@@ -1,4 +1,7 @@
+import { AxisFrame } from './core/index.js';
+export { AXIS_MAGIC, AXIS_VERSION, AxisFrameZ, ERR_BAD_SIGNATURE, ERR_CONTRACT_VIOLATION, ERR_INVALID_PACKET, ERR_REPLAY_DETECTED, FLAG_BODY_TLV, FLAG_CHAIN_REQ, FLAG_HAS_WITNESS, MAX_BODY_LEN, MAX_FRAME_LEN, MAX_HDR_LEN, MAX_SIG_LEN, PROOF_CAPSULE, PROOF_JWT, PROOF_LOOM, PROOF_MTLS, TLV, TLV_ACTOR_ID, TLV_AUD, TLV_EFFECT, TLV_ERROR_CODE, TLV_ERROR_MSG, TLV_INTENT, TLV_KID, TLV_LOOM_PRESENCE_ID, TLV_LOOM_THREAD_HASH, TLV_LOOM_WRIT, TLV_NODE, TLV_NODE_CERT_HASH, TLV_NODE_KID, TLV_NONCE, TLV_OK, TLV_PID, TLV_PREV_HASH, TLV_PROOF_REF, TLV_PROOF_TYPE, TLV_RECEIPT_HASH, TLV_RID, TLV_TRACE_ID, TLV_TS, computeReceiptHash, computeSignaturePayload, decodeArray, decodeFrame, decodeObject, decodeTLVs, decodeTLVsList, decodeVarint, encodeFrame, encodeTLVs, encodeVarint, generateEd25519KeyPair, getSignTarget, sha256, signFrame, varintLength, verifyFrameSignature } from './core/index.js';
 import { OnModuleInit } from '@nestjs/common';
+import 'zod';
 
 declare const HANDLER_METADATA_KEY = "axis:handler";
 declare function Handler(intent?: string): ClassDecorator;
@@ -16,14 +19,6 @@ interface IntentOptions {
 }
 declare function Intent(action: string, options?: IntentOptions): MethodDecorator;
 
-interface AxisFrame {
-    flags: number;
-    headers: Map<number, Uint8Array>;
-    body: Uint8Array;
-    sig: Uint8Array;
-    metadata?: Record<string, any>;
-}
-
 interface AxisEffect {
     ok: boolean;
     effect: string;
@@ -56,4 +51,4 @@ interface AxisCrudHandler extends AxisHandlerInit {
     remove(body: Uint8Array, headers?: Map<number, Uint8Array>): Promise<Uint8Array>;
 }
 
-export { type AxisCrudHandler, type AxisEffect, type AxisFrame, type AxisHandler, type AxisHandlerInit, HANDLER_METADATA_KEY, Handler, INTENT_ROUTES_KEY, Intent, type IntentOptions, type IntentRoute, IntentRouter };
+export { type AxisCrudHandler, type AxisEffect, AxisFrame, type AxisHandler, type AxisHandlerInit, HANDLER_METADATA_KEY, Handler, INTENT_ROUTES_KEY, Intent, type IntentOptions, type IntentRoute, IntentRouter };