@private.me/xbind 1.2.0

package/dist-standalone/email-transport.d.ts

@@ -0,0 +1,139 @@
+/**
+ * @module email-transport
+ * Email-based transport adapter for xBind agent invitations.
+ *
+ * Enables viral growth through email-based connection discovery:
+ * - Agent A sends email invite to Agent B
+ * - Email contains one-click acceptance link
+ * - Agent B clicks link, connection established
+ * - No manual DID exchange required
+ *
+ * @example
+ * ```ts
+ * import { EmailTransport } from '@private.me/xbind/email-transport';
+ *
+ * const transport = new EmailTransport({
+ *   smtpHost: process.env.SMTP_HOST,
+ *   smtpPort: 587,
+ *   smtpUser: process.env.SMTP_USER,
+ *   smtpPass: process.env.SMTP_PASS,
+ *   fromEmail: 'noreply@private.me',
+ *   acceptBaseUrl: 'https://private.me/xbind/accept'
+ * });
+ *
+ * const agent = await Agent.create({
+ *   name: 'payment-processor',
+ *   transport
+ * });
+ *
+ * await agent.invite({
+ *   to: 'fulfillment@acme.com',
+ *   message: 'Connect our systems'
+ * });
+ * ```
+ */
+import { Result } from '@private.me/shared';
+import type { XailTransportAdapter, TransportError, EnvelopeHandler } from './transport.js';
+/**
+ * Email transport configuration.
+ */
+export interface EmailTransportConfig {
+    /** SMTP server hostname */
+    smtpHost: string;
+    /** SMTP server port (typically 587 for TLS) */
+    smtpPort: number;
+    /** SMTP authentication username */
+    smtpUser: string;
+    /** SMTP authentication password */
+    smtpPass: string;
+    /** Sender email address (e.g., noreply@private.me) */
+    fromEmail: string;
+    /** Sender display name (e.g., Private.Me) */
+    fromName: string;
+    /** Base URL for acceptance links (e.g., https://private.me/xbind/accept) */
+    acceptBaseUrl: string;
+    /** Rate limit: max invites per hour per agent (default: 10) */
+    rateLimit?: number;
+    /** Token expiration in hours (default: 48) */
+    tokenExpiryHours?: number;
+}
+/**
+ * Email-based transport adapter for xBind invitations.
+ *
+ * Sends invitation emails with branded templates and one-click acceptance links.
+ * Enforces rate limiting and token expiration for security.
+ *
+ * Note: Email transport is one-way (sending only). onReceive() is not supported.
+ */
+export declare class EmailTransport implements XailTransportAdapter {
+    private config;
+    private transporter;
+    private rateLimits;
+    /**
+     * Create email transport adapter.
+     *
+     * @param config - SMTP and email configuration
+     */
+    constructor(config: EmailTransportConfig);
+    /**
+     * Send invitation email.
+     *
+     * @param envelope - Transport envelope
+     * @param recipientDid - Recipient DID (email address for email transport)
+     * @returns Result with void on success
+     */
+    send(envelope: any, recipientDid: string): Promise<Result<void, TransportError>>;
+    /**
+     * Validate email address format.
+     *
+     * @param email - Email address to validate
+     * @returns True if valid
+     */
+    private isValidEmail;
+    /**
+     * Check if agent has exceeded rate limit.
+     *
+     * @param agentDid - Agent DID
+     * @returns Result indicating if rate limit is OK
+     */
+    private checkRateLimit;
+    /**
+     * Increment rate limit counter for agent.
+     *
+     * @param agentDid - Agent DID
+     */
+    private incrementRateLimit;
+    /**
+     * Generate secure invitation token.
+     *
+     * Token contains: sender DID, sender public key, timestamp, expiry.
+     * Encoded as base64url for URL safety.
+     *
+     * @param envelope - Message envelope
+     * @returns Invitation token
+     */
+    private generateInviteToken;
+    /**
+     * Verify connection to SMTP server.
+     *
+     * @returns Result indicating if SMTP connection is OK
+     */
+    verify(): Promise<Result<void, TransportError>>;
+    /**
+     * Close SMTP connection.
+     */
+    close(): Promise<void>;
+    /**
+     * Register handler for incoming envelopes.
+     *
+     * Note: Email transport is one-way (sending only).
+     * This method exists for interface compliance but is a no-op.
+     *
+     * @param handler - Envelope handler (unused)
+     */
+    onReceive(handler: EnvelopeHandler): void;
+    /**
+     * Shut down the transport (close SMTP connection).
+     */
+    dispose(): void;
+}

package/dist-standalone/email-transport.js

@@ -0,0 +1,232 @@
+/**
+ * @module email-transport
+ * Email-based transport adapter for xBind agent invitations.
+ *
+ * Enables viral growth through email-based connection discovery:
+ * - Agent A sends email invite to Agent B
+ * - Email contains one-click acceptance link
+ * - Agent B clicks link, connection established
+ * - No manual DID exchange required
+ *
+ * @example
+ * ```ts
+ * import { EmailTransport } from '@private.me/xbind/email-transport';
+ *
+ * const transport = new EmailTransport({
+ *   smtpHost: process.env.SMTP_HOST,
+ *   smtpPort: 587,
+ *   smtpUser: process.env.SMTP_USER,
+ *   smtpPass: process.env.SMTP_PASS,
+ *   fromEmail: 'noreply@private.me',
+ *   acceptBaseUrl: 'https://private.me/xbind/accept'
+ * });
+ *
+ * const agent = await Agent.create({
+ *   name: 'payment-processor',
+ *   transport
+ * });
+ *
+ * await agent.invite({
+ *   to: 'fulfillment@acme.com',
+ *   message: 'Connect our systems'
+ * });
+ * ```
+ */
+import { ok, err } from"./_deps/shared/index.js";
+import { renderInviteEmail } from './email-templates.js';
+import nodemailer from 'nodemailer';
+/**
+ * Email-based transport adapter for xBind invitations.
+ *
+ * Sends invitation emails with branded templates and one-click acceptance links.
+ * Enforces rate limiting and token expiration for security.
+ *
+ * Note: Email transport is one-way (sending only). onReceive() is not supported.
+ */
+export class EmailTransport {
+    config;
+    transporter;
+    rateLimits;
+    /**
+     * Create email transport adapter.
+     *
+     * @param config - SMTP and email configuration
+     */
+    constructor(config) {
+        this.config = {
+            ...config,
+            rateLimit: config.rateLimit ?? 10,
+            tokenExpiryHours: config.tokenExpiryHours ?? 48,
+        };
+        // Create nodemailer transporter
+        this.transporter = nodemailer.createTransport({
+            host: this.config.smtpHost,
+            port: this.config.smtpPort,
+            secure: false, // TLS on port 587
+            auth: {
+                user: this.config.smtpUser,
+                pass: this.config.smtpPass,
+            },
+        });
+        this.rateLimits = new Map();
+    }
+    /**
+     * Send invitation email.
+     *
+     * @param envelope - Transport envelope
+     * @param recipientDid - Recipient DID (email address for email transport)
+     * @returns Result with void on success
+     */
+    async send(envelope, recipientDid) {
+        // Extract invitation data from envelope
+        const { from, to, payload } = envelope;
+        // Validate email address
+        if (!this.isValidEmail(to)) {
+            return err('SEND_FAILED');
+        }
+        // Check rate limit
+        const rateLimitCheck = this.checkRateLimit(from);
+        if (!rateLimitCheck.ok) {
+            return err('SEND_FAILED');
+        }
+        try {
+            // Generate secure invitation token
+            const token = await this.generateInviteToken(envelope);
+            // Construct acceptance URL
+            const acceptUrl = `${this.config.acceptBaseUrl}/${token}`;
+            // Render branded email template
+            const html = renderInviteEmail({
+                agentName: payload.agentName || from,
+                did: from,
+                acceptUrl,
+                message: payload.message,
+            });
+            // Send email via SMTP
+            await this.transporter.sendMail({
+                from: `"${this.config.fromName}" <${this.config.fromEmail}>`,
+                to,
+                subject: `${payload.agentName || 'Agent'} wants to connect`,
+                html,
+            });
+            // Update rate limit counter
+            this.incrementRateLimit(from);
+            return ok(undefined);
+        }
+        catch (error) {
+            return err('NETWORK_ERROR');
+        }
+    }
+    /**
+     * Validate email address format.
+     *
+     * @param email - Email address to validate
+     * @returns True if valid
+     */
+    isValidEmail(email) {
+        const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+        return emailRegex.test(email);
+    }
+    /**
+     * Check if agent has exceeded rate limit.
+     *
+     * @param agentDid - Agent DID
+     * @returns Result indicating if rate limit is OK
+     */
+    checkRateLimit(agentDid) {
+        const now = Date.now();
+        const entry = this.rateLimits.get(agentDid);
+        if (!entry) {
+            return ok(undefined);
+        }
+        // Reset if hour has passed
+        if (now >= entry.resetAt) {
+            this.rateLimits.delete(agentDid);
+            return ok(undefined);
+        }
+        // Check if limit exceeded
+        if (entry.count >= this.config.rateLimit) {
+            return err(undefined);
+        }
+        return ok(undefined);
+    }
+    /**
+     * Increment rate limit counter for agent.
+     *
+     * @param agentDid - Agent DID
+     */
+    incrementRateLimit(agentDid) {
+        const now = Date.now();
+        const entry = this.rateLimits.get(agentDid);
+        if (!entry) {
+            this.rateLimits.set(agentDid, {
+                count: 1,
+                resetAt: now + (60 * 60 * 1000), // 1 hour
+            });
+        }
+        else {
+            entry.count += 1;
+        }
+    }
+    /**
+     * Generate secure invitation token.
+     *
+     * Token contains: sender DID, sender public key, timestamp, expiry.
+     * Encoded as base64url for URL safety.
+     *
+     * @param envelope - Message envelope
+     * @returns Invitation token
+     */
+    async generateInviteToken(envelope) {
+        const tokenData = {
+            from: envelope.from,
+            publicKey: envelope.payload.publicKey,
+            endpoint: envelope.payload.endpoint,
+            timestamp: Date.now(),
+            expiresAt: Date.now() + (this.config.tokenExpiryHours * 60 * 60 * 1000),
+        };
+        // Encode as base64url
+        const json = JSON.stringify(tokenData);
+        const base64 = Buffer.from(json).toString('base64')
+            .replace(/\+/g, '-')
+            .replace(/\//g, '_')
+            .replace(/=/g, '');
+        return base64;
+    }
+    /**
+     * Verify connection to SMTP server.
+     *
+     * @returns Result indicating if SMTP connection is OK
+     */
+    async verify() {
+        try {
+            await this.transporter.verify();
+            return ok(undefined);
+        }
+        catch (error) {
+            return err('NETWORK_ERROR');
+        }
+    }
+    /**
+     * Close SMTP connection.
+     */
+    async close() {
+        this.transporter.close();
+    }
+    /**
+     * Register handler for incoming envelopes.
+     *
+     * Note: Email transport is one-way (sending only).
+     * This method exists for interface compliance but is a no-op.
+     *
+     * @param handler - Envelope handler (unused)
+     */
+    onReceive(handler) {
+        // Email transport is one-way - no incoming messages
+    }
+    /**
+     * Shut down the transport (close SMTP connection).
+     */
+    dispose() {
+        this.transporter.close();
+    }
+}

package/dist-standalone/envelope.d.ts

@@ -0,0 +1,288 @@
+import type { Result } from '@private.me/shared';
+/** Envelope v1 format matching xail.io/sdk specification. */
+export interface TransportEnvelope {
+    readonly v: 1;
+    readonly alg: 'Ed25519';
+    readonly sender: string;
+    readonly recipient: string;
+    readonly timestamp: number;
+    readonly nonce: string;
+    readonly scope: string;
+    readonly payload: string;
+    readonly signature: string;
+    /** Base64-encoded ephemeral X25519 public key for forward secrecy. */
+    readonly ephemeralPub?: string;
+    /** Share index for split-channel delivery (0-based). */
+    readonly shareIndex?: number;
+    /** Total shares for split-channel delivery. */
+    readonly shareTotal?: number;
+    /** Threshold for split-channel reconstruction. */
+    readonly shareThreshold?: number;
+    /** UUID linking all shares of a split-channel message. */
+    readonly shareGroupId?: string;
+    /** Base64-encoded HMAC key for split-channel integrity. */
+    readonly shareHmacKey?: string;
+    /** Base64-encoded HMAC signature for split-channel integrity. */
+    readonly shareHmacSig?: string;
+    /** Protocol identifier for viral exposure: "PRIVATE.ME/xBind/v3" */
+    readonly protocol?: string;
+    /** Documentation URL for the protocol */
+    readonly documentationUrl?: string;
+}
+/** Envelope v2 format with hybrid post-quantum KEM. */
+export interface TransportEnvelopeV2 {
+    readonly v: 2;
+    readonly alg: 'Ed25519';
+    readonly kem: 'X25519-MLKEM768';
+    readonly sender: string;
+    readonly recipient: string;
+    readonly timestamp: number;
+    readonly nonce: string;
+    readonly scope: string;
+    readonly payload: string;
+    readonly signature: string;
+    /** Base64-encoded ephemeral X25519 public key (32B). */
+    readonly ephemeralPub: string;
+    /** Base64-encoded ML-KEM-768 ciphertext (1088B). */
+    readonly kemCiphertext: string;
+    /** Share index for split-channel delivery (0-based). */
+    readonly shareIndex?: number;
+    /** Total shares for split-channel delivery. */
+    readonly shareTotal?: number;
+    /** Threshold for split-channel reconstruction. */
+    readonly shareThreshold?: number;
+    /** UUID linking all shares of a split-channel message. */
+    readonly shareGroupId?: string;
+    /** Base64-encoded HMAC key for split-channel integrity. */
+    readonly shareHmacKey?: string;
+    /** Base64-encoded HMAC signature for split-channel integrity. */
+    readonly shareHmacSig?: string;
+    /** Protocol identifier for viral exposure: "PRIVATE.ME/xBind/v3" */
+    readonly protocol?: string;
+    /** Documentation URL for the protocol */
+    readonly documentationUrl?: string;
+}
+/** Envelope v3 format with hybrid KEM + dual PQ signatures. */
+export interface TransportEnvelopeV3 {
+    readonly v: 3;
+    readonly alg: 'Ed25519';
+    /** Signature scheme: dual Ed25519 + ML-DSA-65. */
+    readonly sig: 'Ed25519+MLDSA65';
+    readonly kem: 'X25519-MLKEM768';
+    readonly sender: string;
+    readonly recipient: string;
+    readonly timestamp: number;
+    readonly nonce: string;
+    readonly scope: string;
+    readonly payload: string;
+    /** Base64-encoded Ed25519 signature (64B). */
+    readonly signature: string;
+    /** Base64-encoded ML-DSA-65 signature (3309B). */
+    readonly pqSignature: string;
+    /** Base64-encoded ephemeral X25519 public key (32B). */
+    readonly ephemeralPub: string;
+    /** Base64-encoded ML-KEM-768 ciphertext (1088B). */
+    readonly kemCiphertext: string;
+    /** Share index for split-channel delivery (0-based). */
+    readonly shareIndex?: number;
+    /** Total shares for split-channel delivery. */
+    readonly shareTotal?: number;
+    /** Threshold for split-channel reconstruction. */
+    readonly shareThreshold?: number;
+    /** UUID linking all shares of a split-channel message. */
+    readonly shareGroupId?: string;
+    /** Base64-encoded HMAC key for split-channel integrity. */
+    readonly shareHmacKey?: string;
+    /** Base64-encoded HMAC signature for split-channel integrity. */
+    readonly shareHmacSig?: string;
+    /** Protocol identifier for viral exposure: "PRIVATE.ME/xBind/v3" */
+    readonly protocol?: string;
+    /** Documentation URL for the protocol */
+    readonly documentationUrl?: string;
+}
+/**
+ * Xchange mode envelope (wire format v:4).
+ *
+ * Opt-in performance mode activated via `xchange: true`. Single security
+ * layer (information-theoretic XorIDA split) + Ed25519 authentication.
+ * ~180x faster than V3 split-channel. No per-share encryption, no KEM.
+ */
+export interface TransportEnvelopeV4 {
+    readonly v: 4;
+    readonly alg: 'Ed25519';
+    /** Key transport method: Xchange (random key bundled + split). */
+    readonly kem: 'Xchange';
+    readonly sender: string;
+    readonly recipient: string;
+    readonly timestamp: number;
+    readonly nonce: string;
+    readonly scope: string;
+    /** Base64-encoded XorIDA share (NOT encrypted — the split IS the security). */
+    readonly payload: string;
+    /** Base64-encoded Ed25519 signature (64B) — sender auth only. */
+    readonly signature: string;
+    /** Share index for split-channel delivery (0-based). */
+    readonly shareIndex: number;
+    /** Total shares for split-channel delivery. */
+    readonly shareTotal: number;
+    /** Threshold for split-channel reconstruction. */
+    readonly shareThreshold: number;
+    /** UUID linking all shares of a split-channel message. */
+    readonly shareGroupId: string;
+    /** Base64-encoded HMAC key for split-channel integrity. */
+    readonly shareHmacKey: string;
+    /** Base64-encoded HMAC signature for split-channel integrity. */
+    readonly shareHmacSig: string;
+    /** Protocol identifier for viral exposure: "PRIVATE.ME/xBind/v3" */
+    readonly protocol?: string;
+    /** Documentation URL for the protocol */
+    readonly documentationUrl?: string;
+}
+/** Union of all supported envelope versions. */
+export type AnyTransportEnvelope = TransportEnvelope | TransportEnvelopeV2 | TransportEnvelopeV3 | TransportEnvelopeV4;
+/** Options for creating an envelope. */
+export interface CreateEnvelopeOptions {
+    readonly senderDid: string;
+    readonly recipientDid: string;
+    readonly scope: string;
+    readonly plaintext: Uint8Array;
+    readonly privateKey: CryptoKey;
+    readonly sharedKey: CryptoKey;
+    /** Raw ephemeral X25519 public key to include for forward secrecy. */
+    readonly ephemeralPublicKey?: Uint8Array;
+    /** Split-channel share metadata. */
+    readonly shareIndex?: number;
+    readonly shareTotal?: number;
+    readonly shareThreshold?: number;
+    readonly shareGroupId?: string;
+    readonly shareHmacKey?: string;
+    readonly shareHmacSig?: string;
+}
+/** Options for creating a v2 hybrid-KEM envelope. */
+export interface CreateEnvelopeV2Options {
+    readonly senderDid: string;
+    readonly recipientDid: string;
+    readonly scope: string;
+    readonly plaintext: Uint8Array;
+    readonly privateKey: CryptoKey;
+    readonly sharedKey: CryptoKey;
+    /** Raw ephemeral X25519 public key (32B). */
+    readonly ephemeralPublicKey: Uint8Array;
+    /** ML-KEM-768 ciphertext (1088B). */
+    readonly kemCiphertext: Uint8Array;
+    /** Split-channel share metadata. */
+    readonly shareIndex?: number;
+    readonly shareTotal?: number;
+    readonly shareThreshold?: number;
+    readonly shareGroupId?: string;
+    readonly shareHmacKey?: string;
+    readonly shareHmacSig?: string;
+}
+/** Options for creating a v3 hybrid-KEM + dual-sig envelope. */
+export interface CreateEnvelopeV3Options {
+    readonly senderDid: string;
+    readonly recipientDid: string;
+    readonly scope: string;
+    readonly plaintext: Uint8Array;
+    readonly privateKey: CryptoKey;
+    readonly sharedKey: CryptoKey;
+    /** Raw ephemeral X25519 public key (32B). */
+    readonly ephemeralPublicKey: Uint8Array;
+    /** ML-KEM-768 ciphertext (1088B). */
+    readonly kemCiphertext: Uint8Array;
+    /** ML-DSA-65 secret key (4032B) for post-quantum signature. */
+    readonly mlDsaSecretKey: Uint8Array;
+    /** Split-channel share metadata. */
+    readonly shareIndex?: number;
+    readonly shareTotal?: number;
+    readonly shareThreshold?: number;
+    readonly shareGroupId?: string;
+    readonly shareHmacKey?: string;
+    readonly shareHmacSig?: string;
+}
+/** Options for creating a Xchange mode envelope (no encryption — share IS the payload). */
+export interface CreateEnvelopeV4Options {
+    readonly senderDid: string;
+    readonly recipientDid: string;
+    readonly scope: string;
+    /** Raw share data (already an XorIDA share — NOT encrypted). */
+    readonly shareData: Uint8Array;
+    readonly privateKey: CryptoKey;
+    /** Split-channel share metadata (all REQUIRED for v4). */
+    readonly shareIndex: number;
+    readonly shareTotal: number;
+    readonly shareThreshold: number;
+    readonly shareGroupId: string;
+    readonly shareHmacKey: string;
+    readonly shareHmacSig: string;
+}
+/** Options for creating a signed (unencrypted) envelope. */
+export interface CreateSignedEnvelopeOptions {
+    readonly senderDid: string;
+    readonly recipientDid: string;
+    readonly scope: string;
+    readonly plaintext: Uint8Array;
+    readonly privateKey: CryptoKey;
+}
+/** Envelope error codes. */
+export type EnvelopeError = 'INVALID_VERSION' | 'INVALID_ALG' | 'INVALID_KEM' | 'INVALID_DID' | 'INVALID_NONCE' | 'INVALID_FIELDS' | 'ENCRYPT_FAILED' | 'DECRYPT_FAILED' | 'SIGN_FAILED' | 'PQ_SIGN_FAILED' | 'VERIFY_FAILED' | 'PARSE_FAILED';
+/**
+ * Create a signed, encrypted TransportEnvelope.
+ *
+ * Encrypt-then-sign: AES-256-GCM encrypts payload, Ed25519 signs ciphertext.
+ */
+export declare function createEnvelope(opts: CreateEnvelopeOptions): Promise<Result<TransportEnvelope, EnvelopeError>>;
+/**
+ * Create a signed, encrypted TransportEnvelopeV2 with hybrid KEM.
+ *
+ * Same encrypt-then-sign as v1, but includes ML-KEM-768 ciphertext.
+ */
+export declare function createEnvelopeV2(opts: CreateEnvelopeV2Options): Promise<Result<TransportEnvelopeV2, EnvelopeError>>;
+/**
+ * Create a signed, encrypted TransportEnvelopeV3 with hybrid KEM + dual signatures.
+ *
+ * Encrypt-then-sign: AES-256-GCM encrypts payload, Ed25519 AND ML-DSA-65 sign ciphertext.
+ * Both signatures must verify for the envelope to be accepted.
+ */
+export declare function createEnvelopeV3(opts: CreateEnvelopeV3Options): Promise<Result<TransportEnvelopeV3, EnvelopeError>>;
+/**
+ * Create a signed Xchange mode envelope (v4 wire format).
+ *
+ * Opt-in performance mode. No encryption — the share IS the payload.
+ * Ed25519 signs the raw share data for sender authentication.
+ * The XorIDA split provides confidentiality (information-theoretic).
+ */
+export declare function createEnvelopeV4(opts: CreateEnvelopeV4Options): Promise<Result<TransportEnvelopeV4, EnvelopeError>>;
+/**
+ * Decrypt the payload from a v1, v2, or v3 TransportEnvelope.
+ * Caller must verify signature before calling this.
+ */
+export declare function decryptPayload(envelope: AnyTransportEnvelope, sharedKey: CryptoKey): Promise<Result<Uint8Array, EnvelopeError>>;
+/** Serialize envelope to UTF-8 bytes. */
+export declare function serializeEnvelope(envelope: AnyTransportEnvelope): Uint8Array;
+/** Deserialize bytes to a validated v1 or v2 TransportEnvelope. */
+export declare function deserializeEnvelope(bytes: Uint8Array): Result<AnyTransportEnvelope, EnvelopeError>;
+/** Validate a parsed object is a valid v1 or v2 TransportEnvelope. */
+export declare function validateEnvelope(obj: unknown): Result<AnyTransportEnvelope, EnvelopeError>;
+/** Generate an AES-256-GCM key for envelope encryption. */
+export declare function generateSharedKey(): Promise<CryptoKey>;
+/**
+ * Create a signed but unencrypted TransportEnvelope.
+ *
+ * Payload is base64-encoded plaintext (NOT encrypted).
+ * Signature covers the raw plaintext bytes.
+ * Use for public announcements, audit logs, or telemetry where
+ * confidentiality is not required but integrity is.
+ *
+ * @param opts - Sender, recipient, scope, plaintext, and signing key.
+ * @returns Signed envelope or error.
+ */
+export declare function createSignedEnvelope(opts: CreateSignedEnvelopeOptions): Promise<Result<TransportEnvelope, EnvelopeError>>;
+/**
+ * Verify signature on a signed (unencrypted) envelope and return plaintext.
+ *
+ * @param envelope - The signed envelope to verify.
+ * @param senderPublicKey - The sender's Ed25519 public key.
+ * @returns Plaintext bytes if signature is valid, error otherwise.
+ */
+export declare function openSignedEnvelope(envelope: TransportEnvelope, senderPublicKey: CryptoKey): Promise<Result<Uint8Array, EnvelopeError>>;