@private.me/xbind 3.0.0 → 3.0.2

package/dist-standalone/cjs/runtime/edge.js

@@ -1 +1,526 @@
-"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.EdgeTransportAdapter=exports.KVTrustRegistry=exports.KVNonceStore=exports.DenoKVAdapter=exports.VercelKVAdapter=exports.CloudflareKVAdapter=void 0,exports.detectRuntime=detectRuntime,exports.isEdgeRuntime=isEdgeRuntime,exports.validateEdgeRuntime=validateEdgeRuntime,exports.createEdgeAgent=createEdgeAgent,exports.checkBundleSize=checkBundleSize,exports.getOptimizationTips=getOptimizationTips;const shared_1=require("../../_deps/shared/index.js");function detectRuntime(){const e=globalThis;return void 0!==e.caches&&"string"==typeof e.EdgeRuntime?"cloudflare":"string"==typeof e.EdgeRuntime&&"undefined"!=typeof process&&"1"===process.env?.VERCEL?"vercel":void 0!==e.Deno?"deno":"undefined"!=typeof process&&"string"==typeof process.versions?.node?"node":"unknown"}function isEdgeRuntime(){const e=detectRuntime();return"cloudflare"===e||"vercel"===e||"deno"===e}function validateEdgeRuntime(){if(void 0===globalThis.crypto)return(0,shared_1.err)("Missing globalThis.crypto");if(void 0===globalThis.crypto.subtle)return(0,shared_1.err)("Missing crypto.subtle");if("function"!=typeof globalThis.crypto.getRandomValues)return(0,shared_1.err)("Missing crypto.getRandomValues");const e=["generateKey","sign","verify","encrypt","decrypt","deriveBits","importKey","exportKey"];for(const t of e)if("function"!=typeof globalThis.crypto.subtle[t])return(0,shared_1.err)(`Missing crypto.subtle.${t}`);return void 0===globalThis.TextEncoder?(0,shared_1.err)("Missing TextEncoder"):void 0===globalThis.TextDecoder?(0,shared_1.err)("Missing TextDecoder"):"function"!=typeof globalThis.fetch?(0,shared_1.err)("Missing fetch API"):(0,shared_1.ok)(void 0)}class CloudflareKVAdapter{namespace;constructor(e){this.namespace=e}async get(e){return await this.namespace.get(e)}async put(e,t,r){const s=r?{expirationTtl:r}:void 0;await this.namespace.put(e,t,s)}async delete(e){await this.namespace.delete(e)}async list(e,t){return(await this.namespace.list({prefix:e,limit:t})).keys.map(e=>e.name)}}exports.CloudflareKVAdapter=CloudflareKVAdapter;class VercelKVAdapter{client;constructor(e){this.client=e}async get(e){return await this.client.get(e)}async put(e,t,r){const s=r?{ex:r}:void 0;await this.client.set(e,t,s)}async delete(e){await this.client.del(e)}async list(e,t){const r=e?`${e}*`:"*",s=await this.client.keys(r);return t?s.slice(0,t):s}}exports.VercelKVAdapter=VercelKVAdapter;class DenoKVAdapter{kv;constructor(e){this.kv=e}async get(e){return(await this.kv.get([e])).value}async put(e,t,r){const s=r?{expireIn:1e3*r}:void 0;await this.kv.set([e],t,s)}async delete(e){await this.kv.delete([e])}async list(e,t){const r={prefix:e?[e]:[]},s=[];for await(const e of this.kv.list(r))if(s.push(e.key.join("/")),t&&s.length>=t)break;return s}}exports.DenoKVAdapter=DenoKVAdapter;class KVNonceStore{kv;ttlSeconds;constructor(e,t=6e5){this.kv=e,this.ttlSeconds=Math.floor(t/1e3)}buildKey(e,t,r){const s=`xbind:nonce:${t}:${e}`;if(!r)return s;return`${s}:${r.shareGroupId??""}:${void 0!==r.shareIndex?String(r.shareIndex):""}`}async check(e,t,r){const s=this.buildKey(e,t,r);return null===await this.kv.get(s)&&(await this.kv.put(s,Date.now().toString(),this.ttlSeconds),!0)}cleanup(){}dispose(){}}exports.KVNonceStore=KVNonceStore;class KVTrustRegistry{kv;constructor(e){this.kv=e}buildKey(e){return`xbind:trust:${e}`}async register(e,t,r,s,i,n,o,a,c,d,l,u,p){const h=this.buildKey(e),y=e=>btoa(String.fromCharCode(...Array.from(e))),g={did:e,publicKey:y(t),name:r,scopes:s??[],x25519PublicKey:i?y(i):void 0,mlKemPublicKey:n?y(n):void 0,mlDsaPublicKey:o?y(o):void 0,xchange:a??!1,receiveScopes:c??[],sdkVersion:d,minEnvelopeVersion:l,maxEnvelopeVersion:u,registeredAt:Date.now(),rotation_sequence:0};try{const e=p?Math.floor(p/1e3):void 0;return await this.kv.put(h,JSON.stringify(g),e),(0,shared_1.ok)(void 0)}catch(e){return(0,shared_1.err)("NETWORK_ERROR")}}async resolve(e){const t=this.buildKey(e);try{const e=await this.kv.get(t);if(null===e)return(0,shared_1.err)("NOT_FOUND");const r=JSON.parse(e),s=e=>Uint8Array.from(atob(e),e=>e.charCodeAt(0));return(0,shared_1.ok)(s(r.publicKey))}catch(e){return(0,shared_1.err)("NETWORK_ERROR")}}async hasScope(e,t){const r=this.buildKey(e);try{const e=await this.kv.get(r);if(null===e)return!1;const s=JSON.parse(e);return s.scopes?.includes(t)??!1}catch{return!1}}async hasReceiveScope(e,t){const r=this.buildKey(e);try{const e=await this.kv.get(r);if(null===e)return!1;const s=JSON.parse(e);return s.receiveScopes?.includes(t)??!1}catch{return!1}}async revoke(e){const t=this.buildKey(e);try{return await this.kv.delete(t),(0,shared_1.ok)(void 0)}catch(e){return(0,shared_1.err)("NETWORK_ERROR")}}async list(){try{return(await this.kv.list("xbind:trust:",1e3)).map(e=>e.replace("xbind:trust:",""))}catch{return[]}}async getEntry(e){const t=this.buildKey(e);try{const e=await this.kv.get(t);if(null===e)return(0,shared_1.err)("NOT_FOUND");const r=JSON.parse(e),s=e=>Uint8Array.from(atob(e),e=>e.charCodeAt(0)),i={did:r.did,publicKey:s(r.publicKey),name:r.name,scopes:new Set(r.scopes),receiveScopes:r.receiveScopes?new Set(r.receiveScopes):void 0,revoked:!1,x25519PublicKey:r.x25519PublicKey?s(r.x25519PublicKey):void 0,mlKemPublicKey:r.mlKemPublicKey?s(r.mlKemPublicKey):void 0,mlDsaPublicKey:r.mlDsaPublicKey?s(r.mlDsaPublicKey):void 0,xchange:r.xchange,rotation_sequence:r.rotation_sequence,sdkVersion:r.sdkVersion,minEnvelopeVersion:r.minEnvelopeVersion,maxEnvelopeVersion:r.maxEnvelopeVersion};return(0,shared_1.ok)(i)}catch(e){return(0,shared_1.err)("NETWORK_ERROR")}}async getFullEntry(e){const t=this.buildKey(e);try{const e=await this.kv.get(t);if(null===e)return(0,shared_1.err)("NOT_FOUND");const r=JSON.parse(e);return(0,shared_1.ok)(r)}catch(e){return(0,shared_1.err)("NETWORK_ERROR")}}dispose(){}}exports.KVTrustRegistry=KVTrustRegistry;class EdgeTransportAdapter{baseUrl;timeoutMs;handlers=[];constructor(e){this.baseUrl=e.baseUrl.replace(/\/$/,""),this.timeoutMs=e.timeoutMs??1e4}async send(e,t){const r=`${this.baseUrl}/deliver/${encodeURIComponent(t)}`;try{const t=new AbortController,s=setTimeout(()=>t.abort(),this.timeoutMs),i=await globalThis.fetch(r,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e),signal:t.signal});return clearTimeout(s),i.ok?(0,shared_1.ok)(void 0):(0,shared_1.err)(404===i.status?"RECIPIENT_UNREACHABLE":"SEND_FAILED")}catch(e){return e instanceof DOMException&&"AbortError"===e.name?(0,shared_1.err)("TIMEOUT"):(0,shared_1.err)("NETWORK_ERROR")}}onReceive(e){this.handlers.push(e)}dispatch(e){for(const t of this.handlers)t(e)}dispose(){this.handlers=[]}}function createEdgeAgent(e){return{nonceStore:new KVNonceStore(e.kv,e.nonceTtlMs),trustRegistry:new KVTrustRegistry(e.kv),transport:new EdgeTransportAdapter({baseUrl:e.baseUrl,timeoutMs:e.timeoutMs})}}function checkBundleSize(e){const t=1048576;if(e>t){const t=(e/1024/1024).toFixed(2),r=1..toFixed(2);return(0,shared_1.err)(`Bundle size ${t}MB exceeds edge runtime limit of ${r}MB. Consider using tree-shaking or dynamic imports.`)}return(0,shared_1.ok)(void 0)}function getOptimizationTips(){return["1. Use tree-shaking: Import only required functions","2. Enable minification in bundler config","3. Use dynamic imports for large dependencies (mlkem, mldsa)","4. Exclude Node.js polyfills (crypto, fs, process)","5. Use Brotli compression for Cloudflare Workers","6. Consider splitting post-quantum crypto into separate bundle","7. Use KV storage instead of in-memory caches"]}exports.EdgeTransportAdapter=EdgeTransportAdapter;
+"use strict";
+/**
+ * Edge Runtime Support for xBind
+ *
+ * Enables xBind to run on edge compute platforms:
+ * - Cloudflare Workers
+ * - Vercel Edge Functions
+ * - Deno Deploy
+ *
+ * Key Features:
+ * - Edge-compatible crypto operations (Web Crypto API only)
+ * - KV storage integration for nonce stores and trust registry
+ * - Size-optimized build (<1MB constraint)
+ * - No Node.js dependencies (no fs, crypto, process)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EdgeTransportAdapter = exports.KVTrustRegistry = exports.KVNonceStore = exports.DenoKVAdapter = exports.VercelKVAdapter = exports.CloudflareKVAdapter = void 0;
+exports.detectRuntime = detectRuntime;
+exports.isEdgeRuntime = isEdgeRuntime;
+exports.validateEdgeRuntime = validateEdgeRuntime;
+exports.createEdgeAgent = createEdgeAgent;
+exports.checkBundleSize = checkBundleSize;
+exports.getOptimizationTips = getOptimizationTips;
+const shared_1 = require("../../_deps/shared/index.js");
+/**
+ * Detect the current edge runtime environment.
+ *
+ * Detection order:
+ * 1. Cloudflare Workers: globalThis.caches + EdgeRuntime
+ * 2. Vercel Edge: process.env.VERCEL + EdgeRuntime
+ * 3. Deno Deploy: globalThis.Deno
+ * 4. Node.js: process.versions.node
+ * 5. Unknown: fallback
+ */
+function detectRuntime() {
+    // SAFETY: Edge runtime detection requires checking for vendor-specific globals
+    const global = globalThis;
+    // Cloudflare Workers: Has global caches API and no process
+    if (typeof global.caches !== 'undefined' &&
+        typeof global.EdgeRuntime === 'string') {
+        return 'cloudflare';
+    }
+    // Vercel Edge: Has EdgeRuntime and process.env.VERCEL
+    if (typeof global.EdgeRuntime === 'string' &&
+        typeof process !== 'undefined' &&
+        process.env?.VERCEL === '1') {
+        return 'vercel';
+    }
+    // Deno Deploy: Has global Deno object
+    if (typeof global.Deno !== 'undefined') {
+        return 'deno';
+    }
+    // Node.js: Has process.versions.node
+    if (typeof process !== 'undefined' &&
+        typeof process.versions?.node === 'string') {
+        return 'node';
+    }
+    return 'unknown';
+}
+/**
+ * Check if the current runtime is an edge environment.
+ */
+function isEdgeRuntime() {
+    const runtime = detectRuntime();
+    return runtime === 'cloudflare' || runtime === 'vercel' || runtime === 'deno';
+}
+/**
+ * Validate that the runtime supports required Web Crypto APIs.
+ *
+ * Edge runtimes MUST provide:
+ * - crypto.subtle (Ed25519, X25519, AES-GCM, HMAC)
+ * - crypto.getRandomValues()
+ * - TextEncoder/TextDecoder
+ */
+function validateEdgeRuntime() {
+    // Check Web Crypto API
+    if (typeof globalThis.crypto === 'undefined') {
+        return (0, shared_1.err)('Missing globalThis.crypto');
+    }
+    if (typeof globalThis.crypto.subtle === 'undefined') {
+        return (0, shared_1.err)('Missing crypto.subtle');
+    }
+    if (typeof globalThis.crypto.getRandomValues !== 'function') {
+        return (0, shared_1.err)('Missing crypto.getRandomValues');
+    }
+    // Check required subtle crypto methods
+    const requiredMethods = [
+        'generateKey',
+        'sign',
+        'verify',
+        'encrypt',
+        'decrypt',
+        'deriveBits',
+        'importKey',
+        'exportKey',
+    ];
+    for (const method of requiredMethods) {
+        if (typeof globalThis.crypto.subtle[method] !== 'function') {
+            return (0, shared_1.err)(`Missing crypto.subtle.${method}`);
+        }
+    }
+    // Check TextEncoder/TextDecoder
+    if (typeof globalThis.TextEncoder === 'undefined') {
+        return (0, shared_1.err)('Missing TextEncoder');
+    }
+    if (typeof globalThis.TextDecoder === 'undefined') {
+        return (0, shared_1.err)('Missing TextDecoder');
+    }
+    // Check fetch API
+    if (typeof globalThis.fetch !== 'function') {
+        return (0, shared_1.err)('Missing fetch API');
+    }
+    return (0, shared_1.ok)(undefined);
+}
+/**
+ * Adapter for Cloudflare Workers KV.
+ */
+class CloudflareKVAdapter {
+    namespace;
+    constructor(namespace) {
+        this.namespace = namespace;
+    }
+    async get(key) {
+        return await this.namespace.get(key);
+    }
+    async put(key, value, ttlSeconds) {
+        const options = ttlSeconds ? { expirationTtl: ttlSeconds } : undefined;
+        await this.namespace.put(key, value, options);
+    }
+    async delete(key) {
+        await this.namespace.delete(key);
+    }
+    async list(prefix, limit) {
+        const result = await this.namespace.list({ prefix, limit });
+        return result.keys.map((k) => k.name);
+    }
+}
+exports.CloudflareKVAdapter = CloudflareKVAdapter;
+/**
+ * Adapter for Vercel KV (Redis).
+ */
+class VercelKVAdapter {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async get(key) {
+        return await this.client.get(key);
+    }
+    async put(key, value, ttlSeconds) {
+        const options = ttlSeconds ? { ex: ttlSeconds } : undefined;
+        await this.client.set(key, value, options);
+    }
+    async delete(key) {
+        await this.client.del(key);
+    }
+    async list(prefix, limit) {
+        const pattern = prefix ? `${prefix}*` : '*';
+        const allKeys = await this.client.keys(pattern);
+        return limit ? allKeys.slice(0, limit) : allKeys;
+    }
+}
+exports.VercelKVAdapter = VercelKVAdapter;
+/**
+ * Adapter for Deno KV.
+ */
+class DenoKVAdapter {
+    kv;
+    constructor(kv) {
+        this.kv = kv;
+    }
+    async get(key) {
+        const result = await this.kv.get([key]);
+        return result.value;
+    }
+    async put(key, value, ttlSeconds) {
+        const options = ttlSeconds ? { expireIn: ttlSeconds * 1000 } : undefined;
+        await this.kv.set([key], value, options);
+    }
+    async delete(key) {
+        await this.kv.delete([key]);
+    }
+    async list(prefix, limit) {
+        const selector = { prefix: prefix ? [prefix] : [] };
+        const keys = [];
+        for await (const entry of this.kv.list(selector)) {
+            keys.push(entry.key.join('/'));
+            if (limit && keys.length >= limit)
+                break;
+        }
+        return keys;
+    }
+}
+exports.DenoKVAdapter = DenoKVAdapter;
+/* ── KV-Backed Nonce Store ── */
+/**
+ * Nonce store implementation using KV storage.
+ *
+ * Suitable for edge runtimes where in-memory storage
+ * is ephemeral across invocations.
+ */
+class KVNonceStore {
+    kv;
+    ttlSeconds;
+    constructor(kv, ttlMs = 10 * 60 * 1000) {
+        this.kv = kv;
+        this.ttlSeconds = Math.floor(ttlMs / 1000);
+    }
+    /**
+     * Build composite key: xbind:nonce:{senderDid}:{nonce}:{shareGroupId}:{shareIndex}
+     */
+    buildKey(nonce, senderDid, shareContext) {
+        const base = `xbind:nonce:${senderDid}:${nonce}`;
+        if (!shareContext)
+            return base;
+        const groupId = shareContext.shareGroupId ?? '';
+        const index = shareContext.shareIndex !== undefined ? String(shareContext.shareIndex) : '';
+        return `${base}:${groupId}:${index}`;
+    }
+    async check(nonce, senderDid, shareContext) {
+        const key = this.buildKey(nonce, senderDid, shareContext);
+        const existing = await this.kv.get(key);
+        if (existing !== null) {
+            // Nonce already seen
+            return false;
+        }
+        // Record nonce with TTL
+        await this.kv.put(key, Date.now().toString(), this.ttlSeconds);
+        return true;
+    }
+    cleanup() {
+        // KV stores auto-expire via TTL, no manual cleanup needed
+    }
+    dispose() {
+        // No resources to clean up
+    }
+}
+exports.KVNonceStore = KVNonceStore;
+/* ── KV-Backed Trust Registry ── */
+/**
+ * Trust registry implementation using KV storage.
+ *
+ * Stores DID registrations in edge KV for distributed lookups.
+ * Simplified version suitable for edge runtimes - stores minimal metadata.
+ */
+class KVTrustRegistry {
+    kv;
+    constructor(kv) {
+        this.kv = kv;
+    }
+    /**
+     * Build key: xbind:trust:{did}
+     */
+    buildKey(did) {
+        return `xbind:trust:${did}`;
+    }
+    async register(did, publicKey, name, scopes, x25519PublicKey, mlKemPublicKey, mlDsaPublicKey, xchange, receiveScopes, sdkVersion, minEnvelopeVersion, maxEnvelopeVersion, ttlMs) {
+        const key = this.buildKey(did);
+        // Convert Uint8Arrays to base64 for JSON storage
+        const toBase64 = (arr) => btoa(String.fromCharCode(...Array.from(arr)));
+        const entry = {
+            did,
+            publicKey: toBase64(publicKey),
+            name,
+            scopes: scopes ?? [],
+            x25519PublicKey: x25519PublicKey ? toBase64(x25519PublicKey) : undefined,
+            mlKemPublicKey: mlKemPublicKey ? toBase64(mlKemPublicKey) : undefined,
+            mlDsaPublicKey: mlDsaPublicKey ? toBase64(mlDsaPublicKey) : undefined,
+            xchange: xchange ?? false,
+            receiveScopes: receiveScopes ?? [],
+            sdkVersion,
+            minEnvelopeVersion,
+            maxEnvelopeVersion,
+            registeredAt: Date.now(),
+            rotation_sequence: 0,
+        };
+        try {
+            const ttlSeconds = ttlMs ? Math.floor(ttlMs / 1000) : undefined;
+            await this.kv.put(key, JSON.stringify(entry), ttlSeconds);
+            return (0, shared_1.ok)(undefined);
+        }
+        catch (e) {
+            return (0, shared_1.err)('NETWORK_ERROR');
+        }
+    }
+    async resolve(did) {
+        const key = this.buildKey(did);
+        try {
+            const value = await this.kv.get(key);
+            if (value === null) {
+                return (0, shared_1.err)('NOT_FOUND');
+            }
+            const entry = JSON.parse(value);
+            // Convert base64 back to Uint8Array
+            const fromBase64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+            return (0, shared_1.ok)(fromBase64(entry.publicKey));
+        }
+        catch (e) {
+            return (0, shared_1.err)('NETWORK_ERROR');
+        }
+    }
+    async hasScope(did, scope) {
+        const key = this.buildKey(did);
+        try {
+            const value = await this.kv.get(key);
+            if (value === null)
+                return false;
+            const entry = JSON.parse(value);
+            return entry.scopes?.includes(scope) ?? false;
+        }
+        catch {
+            return false;
+        }
+    }
+    async hasReceiveScope(did, scope) {
+        const key = this.buildKey(did);
+        try {
+            const value = await this.kv.get(key);
+            if (value === null)
+                return false;
+            const entry = JSON.parse(value);
+            return entry.receiveScopes?.includes(scope) ?? false;
+        }
+        catch {
+            return false;
+        }
+    }
+    async revoke(did) {
+        const key = this.buildKey(did);
+        try {
+            await this.kv.delete(key);
+            return (0, shared_1.ok)(undefined);
+        }
+        catch (e) {
+            return (0, shared_1.err)('NETWORK_ERROR');
+        }
+    }
+    async list() {
+        try {
+            const keys = await this.kv.list('xbind:trust:', 1000);
+            return keys.map((k) => k.replace('xbind:trust:', ''));
+        }
+        catch {
+            return [];
+        }
+    }
+    async getEntry(did) {
+        const key = this.buildKey(did);
+        try {
+            const value = await this.kv.get(key);
+            if (value === null) {
+                return (0, shared_1.err)('NOT_FOUND');
+            }
+            const stored = JSON.parse(value);
+            // Convert base64 back to Uint8Array
+            const fromBase64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+            const entry = {
+                did: stored.did,
+                publicKey: fromBase64(stored.publicKey),
+                name: stored.name,
+                scopes: new Set(stored.scopes),
+                receiveScopes: stored.receiveScopes ? new Set(stored.receiveScopes) : undefined,
+                revoked: false,
+                x25519PublicKey: stored.x25519PublicKey ? fromBase64(stored.x25519PublicKey) : undefined,
+                mlKemPublicKey: stored.mlKemPublicKey ? fromBase64(stored.mlKemPublicKey) : undefined,
+                mlDsaPublicKey: stored.mlDsaPublicKey ? fromBase64(stored.mlDsaPublicKey) : undefined,
+                xchange: stored.xchange,
+                rotation_sequence: stored.rotation_sequence,
+                sdkVersion: stored.sdkVersion,
+                minEnvelopeVersion: stored.minEnvelopeVersion,
+                maxEnvelopeVersion: stored.maxEnvelopeVersion,
+            };
+            return (0, shared_1.ok)(entry);
+        }
+        catch (e) {
+            return (0, shared_1.err)('NETWORK_ERROR');
+        }
+    }
+    /** Additional methods for edge compatibility */
+    async getFullEntry(did) {
+        const key = this.buildKey(did);
+        try {
+            const value = await this.kv.get(key);
+            if (value === null) {
+                return (0, shared_1.err)('NOT_FOUND');
+            }
+            const entry = JSON.parse(value);
+            return (0, shared_1.ok)(entry);
+        }
+        catch (e) {
+            return (0, shared_1.err)('NETWORK_ERROR');
+        }
+    }
+    dispose() {
+        // No resources to clean up
+    }
+}
+exports.KVTrustRegistry = KVTrustRegistry;
+/* ── Edge-Compatible Transport ── */
+/**
+ * Edge-compatible HTTPS transport adapter.
+ *
+ * Uses standard fetch API (available in all edge runtimes).
+ * Optimized for edge constraints:
+ * - No Node.js http/https modules
+ * - No setTimeout (uses AbortSignal.timeout)
+ * - Minimal allocations
+ */
+class EdgeTransportAdapter {
+    baseUrl;
+    timeoutMs;
+    handlers = [];
+    constructor(opts) {
+        this.baseUrl = opts.baseUrl.replace(/\/$/, '');
+        this.timeoutMs = opts.timeoutMs ?? 10_000;
+    }
+    async send(envelope, recipientDid) {
+        const url = `${this.baseUrl}/deliver/${encodeURIComponent(recipientDid)}`;
+        try {
+            // Use AbortSignal.timeout (supported in modern edge runtimes)
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);
+            const response = await globalThis.fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(envelope),
+                signal: controller.signal,
+            });
+            clearTimeout(timeoutId);
+            if (!response.ok) {
+                return (0, shared_1.err)(response.status === 404 ? 'RECIPIENT_UNREACHABLE' : 'SEND_FAILED');
+            }
+            return (0, shared_1.ok)(undefined);
+        }
+        catch (e) {
+            if (e instanceof DOMException && e.name === 'AbortError') {
+                return (0, shared_1.err)('TIMEOUT');
+            }
+            return (0, shared_1.err)('NETWORK_ERROR');
+        }
+    }
+    onReceive(handler) {
+        this.handlers.push(handler);
+    }
+    /**
+     * Dispatch received envelope to all handlers.
+     * Called by edge function handler when processing incoming requests.
+     */
+    dispatch(envelope) {
+        for (const handler of this.handlers) {
+            handler(envelope);
+        }
+    }
+    dispose() {
+        this.handlers = [];
+    }
+}
+exports.EdgeTransportAdapter = EdgeTransportAdapter;
+/**
+ * Create edge-compatible xBind components.
+ *
+ * Returns nonce store, trust registry, and transport adapter
+ * configured for the edge runtime.
+ *
+ * @example
+ * ```typescript
+ * // Cloudflare Workers
+ * const kv = new CloudflareKVAdapter(env.XBIND_KV);
+ * const { nonceStore, trustRegistry, transport } = createEdgeAgent({
+ *   kv,
+ *   baseUrl: 'https://private.me/relay',
+ * });
+ *
+ * const agent = new Agent({
+ *   identity: 'persistent',
+ *   nonceStore,
+ *   trustRegistry,
+ *   transport,
+ * });
+ * ```
+ */
+function createEdgeAgent(opts) {
+    const nonceStore = new KVNonceStore(opts.kv, opts.nonceTtlMs);
+    const trustRegistry = new KVTrustRegistry(opts.kv);
+    const transport = new EdgeTransportAdapter({
+        baseUrl: opts.baseUrl,
+        timeoutMs: opts.timeoutMs,
+    });
+    return {
+        nonceStore,
+        trustRegistry,
+        transport,
+    };
+}
+/* ── Size Optimization Helpers ── */
+/**
+ * Check if the bundled size is within edge runtime limits.
+ *
+ * Cloudflare Workers: 1MB compressed limit
+ * Vercel Edge: 1MB limit
+ * Deno Deploy: 1MB limit
+ */
+function checkBundleSize(bundleSizeBytes) {
+    const MAX_SIZE_BYTES = 1024 * 1024; // 1MB
+    if (bundleSizeBytes > MAX_SIZE_BYTES) {
+        const sizeMB = (bundleSizeBytes / 1024 / 1024).toFixed(2);
+        const limitMB = (MAX_SIZE_BYTES / 1024 / 1024).toFixed(2);
+        return (0, shared_1.err)(`Bundle size ${sizeMB}MB exceeds edge runtime limit of ${limitMB}MB. ` +
+            `Consider using tree-shaking or dynamic imports.`);
+    }
+    return (0, shared_1.ok)(undefined);
+}
+/**
+ * Get edge-optimized build recommendations.
+ */
+function getOptimizationTips() {
+    return [
+        '1. Use tree-shaking: Import only required functions',
+        '2. Enable minification in bundler config',
+        '3. Use dynamic imports for large dependencies (mlkem, mldsa)',
+        '4. Exclude Node.js polyfills (crypto, fs, process)',
+        '5. Use Brotli compression for Cloudflare Workers',
+        '6. Consider splitting post-quantum crypto into separate bundle',
+        '7. Use KV storage instead of in-memory caches',
+    ];
+}