bridle-core 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,14 @@
+Bridle
+Copyright 2026 Shape (shape-labs.com)
+
+This product includes software developed at Shape.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

package/dist/src/envelope.d.ts

@@ -0,0 +1,101 @@
+import type { SealedBox } from "./seal.js";
+/**
+ * The four verbs. This list is closed on purpose: a protocol that can express
+ * anything is a protocol you cannot write a policy for.
+ */
+export declare const VERBS: readonly ["context.push", "task.queue", "state.read", "run.request"];
+export type Verb = (typeof VERBS)[number];
+export type Verdict = "allow" | "ask" | "deny";
+/** Where a piece of handed-off work has got to. */
+export declare const TASK_STATUSES: readonly ["accepted", "working", "done", "blocked"];
+export type TaskStatus = (typeof TASK_STATUSES)[number];
+export interface ContextPush {
+    note?: string;
+    decision?: string;
+    /** Present when this push reports on work someone handed you. */
+    status?: TaskStatus;
+    files?: {
+        path: string;
+        sha256: string;
+        bytes: number;
+        content?: string;
+    }[];
+    links?: string[];
+}
+export interface TaskQueue {
+    title: string;
+    detail?: string;
+    repo?: string;
+}
+export interface StateRead {
+    fields: ("branch" | "diffstat" | "openFiles" | "task")[];
+}
+export interface RunRequest {
+    command: string;
+    cwd?: string;
+    reason?: string;
+}
+export type Payload = ContextPush | TaskQueue | StateRead | RunRequest;
+export interface Envelope {
+    /** Protocol version. Bumped only for breaking envelope changes. */
+    v: 1;
+    id: string;
+    ts: string;
+    verb: Verb;
+    /** Sending node name, e.g. "marko.dev". */
+    from: string;
+    /** Sender's Ed25519 public key, base64. Carried so a receiver can verify offline. */
+    fromKey: string;
+    /** Receiving node name. */
+    to: string;
+    scope: {
+        repo?: string;
+        tools?: string[];
+    };
+    /**
+     * The envelope this one answers. Set when reporting back on work someone
+     * handed you, so the sender can correlate a reply with what they asked for.
+     */
+    ref?: string;
+    /** Present before sealing and after opening. Never on the wire. */
+    payload?: Payload;
+    /** What actually crosses the relay. The relay cannot open this. */
+    sealed?: SealedBox;
+    /** Base64 Ed25519 signature over the canonical form of every field above. */
+    sig?: string;
+}
+/**
+ * Deterministic serialisation for signing. Keys are sorted at every level so
+ * two implementations in two languages agree byte-for-byte.
+ */
+export declare function canonical(value: unknown): string;
+/** The exact bytes that get signed: the envelope minus its own signature. */
+export declare function signingBytes(env: Envelope): Buffer;
+export declare function envelopeDigest(env: Envelope): string;
+export interface DraftEnvelope {
+    ref?: string;
+    verb: Verb;
+    from: string;
+    fromKey: string;
+    to: string;
+    payload: Payload;
+    scope?: {
+        repo?: string;
+        tools?: string[];
+    };
+    /** Injectable for tests; defaults to now. */
+    ts?: string;
+    id?: string;
+}
+export declare function createEnvelope(draft: DraftEnvelope): Envelope;
+export declare class EnvelopeError extends Error {
+}
+/**
+ * Structural validation. This runs before anything else touches an envelope —
+ * a malformed envelope is rejected, never "best-effort" interpreted.
+ */
+export declare function validateEnvelope(input: unknown): Envelope;
+export declare function validatePayload(verb: Verb, p: Record<string, unknown>): void;
+/** Size of what is actually carried — ciphertext while sealed, plaintext once open. */
+export declare function payloadBytes(env: Envelope): number;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/src/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/envelope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,KAAK,sEAAuE,CAAC;AAC1F,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE/C,mDAAmD;AACnD,eAAO,MAAM,aAAa,qDAAsD,CAAC;AACjF,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AACD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AACD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,CAAC,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;CAC1D;AACD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAEvE,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,CAAC,EAAE,CAAC,CAAC;IACL,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,IAAI,CAAC;IACX,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3C;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMhD;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAGlD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAEpD;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5C,6CAA6C;IAC7C,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,QAAQ,CAa7D;AAED,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAI3C;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAgCzD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA+B5E;AAED,uFAAuF;AACvF,wBAAgB,YAAY,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAGlD"}

package/dist/src/envelope.js

@@ -0,0 +1,137 @@
+import { randomUUID, createHash } from "node:crypto";
+/**
+ * The four verbs. This list is closed on purpose: a protocol that can express
+ * anything is a protocol you cannot write a policy for.
+ */
+export const VERBS = ["context.push", "task.queue", "state.read", "run.request"];
+/** Where a piece of handed-off work has got to. */
+export const TASK_STATUSES = ["accepted", "working", "done", "blocked"];
+/**
+ * Deterministic serialisation for signing. Keys are sorted at every level so
+ * two implementations in two languages agree byte-for-byte.
+ */
+export function canonical(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value) ?? "null";
+    if (Array.isArray(value))
+        return "[" + value.map(canonical).join(",") + "]";
+    const obj = value;
+    const keys = Object.keys(obj).filter((k) => obj[k] !== undefined).sort();
+    return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonical(obj[k])).join(",") + "}";
+}
+/** The exact bytes that get signed: the envelope minus its own signature. */
+export function signingBytes(env) {
+    const { sig: _drop, ...rest } = env;
+    return Buffer.from(canonical(rest), "utf8");
+}
+export function envelopeDigest(env) {
+    return createHash("sha256").update(signingBytes(env)).digest("hex");
+}
+export function createEnvelope(draft) {
+    return {
+        v: 1,
+        id: draft.id ?? randomUUID(),
+        ts: draft.ts ?? new Date().toISOString(),
+        verb: draft.verb,
+        from: draft.from,
+        fromKey: draft.fromKey,
+        to: draft.to,
+        scope: draft.scope ?? {},
+        ...(draft.ref ? { ref: draft.ref } : {}),
+        payload: draft.payload,
+    };
+}
+export class EnvelopeError extends Error {
+}
+const NAME_RE = /^[a-z0-9][a-z0-9._-]{1,62}$/i;
+/**
+ * Structural validation. This runs before anything else touches an envelope —
+ * a malformed envelope is rejected, never "best-effort" interpreted.
+ */
+export function validateEnvelope(input) {
+    if (typeof input !== "object" || input === null)
+        throw new EnvelopeError("envelope must be an object");
+    const e = input;
+    if (e.v !== 1)
+        throw new EnvelopeError(`unsupported envelope version: ${String(e.v)}`);
+    for (const field of ["id", "ts", "from", "fromKey", "to"]) {
+        if (typeof e[field] !== "string" || !e[field].length) {
+            throw new EnvelopeError(`missing or invalid field: ${field}`);
+        }
+    }
+    if (!VERBS.includes(e.verb))
+        throw new EnvelopeError(`unknown verb: ${String(e.verb)}`);
+    if (!NAME_RE.test(e.from))
+        throw new EnvelopeError("invalid sender name");
+    if (!NAME_RE.test(e.to))
+        throw new EnvelopeError("invalid recipient name");
+    if (Number.isNaN(Date.parse(e.ts)))
+        throw new EnvelopeError("invalid timestamp");
+    if (e.ref !== undefined && (typeof e.ref !== "string" || !e.ref.length)) {
+        throw new EnvelopeError("ref must be an envelope id");
+    }
+    if (typeof e.scope !== "object" || e.scope === null)
+        throw new EnvelopeError("scope must be an object");
+    const hasPayload = typeof e.payload === "object" && e.payload !== null;
+    const hasSealed = typeof e.sealed === "object" && e.sealed !== null;
+    if (!hasPayload && !hasSealed)
+        throw new EnvelopeError("envelope carries neither a payload nor a sealed box");
+    if (hasPayload && hasSealed)
+        throw new EnvelopeError("envelope carries both a payload and a sealed box");
+    if (hasSealed) {
+        for (const f of ["epk", "iv", "ct", "tag"]) {
+            if (typeof e.sealed[f] !== "string") {
+                throw new EnvelopeError(`sealed box is missing ${f}`);
+            }
+        }
+    }
+    if (hasPayload)
+        validatePayload(e.verb, e.payload);
+    return e;
+}
+export function validatePayload(verb, p) {
+    const str = (v) => typeof v === "string";
+    switch (verb) {
+        case "context.push":
+            if (p.note !== undefined && !str(p.note))
+                throw new EnvelopeError("context.push.note must be a string");
+            if (p.decision !== undefined && !str(p.decision))
+                throw new EnvelopeError("context.push.decision must be a string");
+            if (p.files !== undefined && !Array.isArray(p.files))
+                throw new EnvelopeError("context.push.files must be an array");
+            if (p.links !== undefined && !Array.isArray(p.links))
+                throw new EnvelopeError("context.push.links must be an array");
+            if (p.status !== undefined && !TASK_STATUSES.includes(p.status)) {
+                throw new EnvelopeError(`unknown status: ${String(p.status)}`);
+            }
+            if (p.note === undefined && p.decision === undefined && p.files === undefined &&
+                p.links === undefined && p.status === undefined) {
+                throw new EnvelopeError("context.push needs at least one of: note, decision, files, links, status");
+            }
+            return;
+        case "task.queue":
+            if (!str(p.title) || !p.title.trim())
+                throw new EnvelopeError("task.queue.title is required");
+            return;
+        case "state.read": {
+            if (!Array.isArray(p.fields) || p.fields.length === 0)
+                throw new EnvelopeError("state.read.fields is required");
+            const allowed = new Set(["branch", "diffstat", "openFiles", "task"]);
+            for (const f of p.fields)
+                if (!allowed.has(f))
+                    throw new EnvelopeError(`unknown state field: ${String(f)}`);
+            return;
+        }
+        case "run.request":
+            if (!str(p.command) || !p.command.trim())
+                throw new EnvelopeError("run.request.command is required");
+            return;
+    }
+}
+/** Size of what is actually carried — ciphertext while sealed, plaintext once open. */
+export function payloadBytes(env) {
+    if (env.sealed)
+        return Buffer.from(env.sealed.ct, "base64").byteLength;
+    return Buffer.byteLength(canonical(env.payload), "utf8");
+}
+//# sourceMappingURL=envelope.js.map

package/dist/src/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD;;;GAGG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,CAAU,CAAC;AAK1F,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAqDjF;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACxF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC5E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAC5F,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,GAAa;IACxC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAa;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAeD,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE;QAC5B,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;CAAG;AAE3C,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACvG,MAAM,CAAC,GAAG,KAAgC,CAAC;IAE3C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,iCAAiC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAU,EAAE,CAAC;QACnE,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAE,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,EAAE,CAAC;YACjE,MAAM,IAAI,aAAa,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAY,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAc,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACpF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAY,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAY,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,CAAC;IAExG,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;IACpE,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,aAAa,CAAC,qDAAqD,CAAC,CAAC;IAC9G,IAAI,UAAU,IAAI,SAAS;QAAE,MAAM,IAAI,aAAa,CAAC,kDAAkD,CAAC,CAAC;IACzG,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAU,EAAE,CAAC;YACpD,IAAI,OAAQ,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjE,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,UAAU;QAAE,eAAe,CAAC,CAAC,CAAC,IAAY,EAAE,CAAC,CAAC,OAAkC,CAAC,CAAC;IACtF,OAAO,CAAwB,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAU,EAAE,CAA0B;IACpE,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;IAClD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc;YACjB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,oCAAoC,CAAC,CAAC;YACxG,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,wCAAwC,CAAC,CAAC;YACpH,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,qCAAqC,CAAC,CAAC;YACrH,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,qCAAqC,CAAC,CAAC;YACrH,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAoB,CAAC,EAAE,CAAC;gBAC9E,MAAM,IAAI,aAAa,CAAC,mBAAmB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,IACE,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBACzE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAC/C,CAAC;gBACD,MAAM,IAAI,aAAa,CAAC,0EAA0E,CAAC,CAAC;YACtG,CAAC;YACD,OAAO;QACT,KAAK,YAAY;YACf,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,CAAC,KAAgB,CAAC,IAAI,EAAE;gBAAE,MAAM,IAAI,aAAa,CAAC,8BAA8B,CAAC,CAAC;YAC1G,OAAO;QACT,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,+BAA+B,CAAC,CAAC;YAChH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;YACrE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAW,CAAC;oBAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtH,OAAO;QACT,CAAC;QACD,KAAK,aAAa;YAChB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAE,CAAC,CAAC,OAAkB,CAAC,IAAI,EAAE;gBAAE,MAAM,IAAI,aAAa,CAAC,iCAAiC,CAAC,CAAC;YACjH,OAAO;IACX,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAAC,GAAa;IACxC,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC;IACvE,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;AAC3D,CAAC"}

package/dist/src/identity.d.ts

@@ -0,0 +1,31 @@
+import { type Envelope } from "./envelope.js";
+export interface Identity {
+    /** Node name inside the bridlenet, e.g. "marko.dev". */
+    name: string;
+    /** Ed25519 — proves who sent an envelope. */
+    publicKey: string;
+    privateKey: string;
+    /** X25519 — decides who can read one. */
+    sealPublicKey: string;
+    sealPrivateKey: string;
+}
+export declare function generateIdentity(name: string): Identity;
+/** Short, human-comparable fingerprint — the thing two people read aloud when pairing. */
+export declare function fingerprint(publicKeyB64: string): string;
+export declare function signEnvelope(env: Envelope, identity: Identity): Envelope;
+/**
+ * Verifies the signature against the key carried *in the envelope*. The caller
+ * must separately confirm that key is the one they granted a scope to —
+ * see `verifyFrom`.
+ */
+export declare function verifyEnvelope(env: Envelope): boolean;
+/**
+ * The check that actually matters: the signature is valid AND the key belongs to
+ * the peer we think we are talking to. Verifying the signature alone would let
+ * anyone claim to be anyone by bringing their own key.
+ */
+export declare function verifyFrom(env: Envelope, expectedKeyB64: string | undefined): {
+    ok: boolean;
+    reason?: string;
+};
+//# sourceMappingURL=identity.d.ts.map

package/dist/src/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAQA,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG5D,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAUvD;AASD,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAMxE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAOrD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAK9G"}

package/dist/src/identity.js

@@ -0,0 +1,63 @@
+import { generateKeyPairSync, sign as nodeSign, verify as nodeVerify, createPublicKey, createPrivateKey, } from "node:crypto";
+import { signingBytes } from "./envelope.js";
+import { generateSealingKeys } from "./seal.js";
+export function generateIdentity(name) {
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    const sealing = generateSealingKeys();
+    return {
+        name,
+        publicKey: publicKey.export({ type: "spki", format: "der" }).toString("base64"),
+        privateKey: privateKey.export({ type: "pkcs8", format: "der" }).toString("base64"),
+        sealPublicKey: sealing.publicKey,
+        sealPrivateKey: sealing.privateKey,
+    };
+}
+function toPublic(b64) {
+    return createPublicKey({ key: Buffer.from(b64, "base64"), format: "der", type: "spki" });
+}
+function toPrivate(b64) {
+    return createPrivateKey({ key: Buffer.from(b64, "base64"), format: "der", type: "pkcs8" });
+}
+/** Short, human-comparable fingerprint — the thing two people read aloud when pairing. */
+export function fingerprint(publicKeyB64) {
+    const raw = Buffer.from(publicKeyB64, "base64").subarray(-32);
+    const hex = raw.toString("hex").slice(0, 16).toUpperCase();
+    return (hex.match(/.{4}/g) ?? []).join("-");
+}
+export function signEnvelope(env, identity) {
+    if (env.fromKey !== identity.publicKey) {
+        throw new Error("refusing to sign: envelope.fromKey does not match this identity");
+    }
+    const sig = nodeSign(null, signingBytes(env), toPrivate(identity.privateKey));
+    return { ...env, sig: sig.toString("base64") };
+}
+/**
+ * Verifies the signature against the key carried *in the envelope*. The caller
+ * must separately confirm that key is the one they granted a scope to —
+ * see `verifyFrom`.
+ */
+export function verifyEnvelope(env) {
+    if (!env.sig)
+        return false;
+    try {
+        return nodeVerify(null, signingBytes(env), toPublic(env.fromKey), Buffer.from(env.sig, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The check that actually matters: the signature is valid AND the key belongs to
+ * the peer we think we are talking to. Verifying the signature alone would let
+ * anyone claim to be anyone by bringing their own key.
+ */
+export function verifyFrom(env, expectedKeyB64) {
+    if (!env.sig)
+        return { ok: false, reason: "envelope is unsigned" };
+    if (!expectedKeyB64)
+        return { ok: false, reason: `no known key for peer "${env.from}"` };
+    if (env.fromKey !== expectedKeyB64)
+        return { ok: false, reason: `key mismatch for peer "${env.from}"` };
+    return verifyEnvelope(env) ? { ok: true } : { ok: false, reason: "bad signature" };
+}
+//# sourceMappingURL=identity.js.map

package/dist/src/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,IAAI,IAAI,QAAQ,EAChB,MAAM,IAAI,UAAU,EACpB,eAAe,EACf,gBAAgB,GAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAiB,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAahD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/E,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClF,aAAa,EAAE,OAAO,CAAC,SAAS;QAChC,cAAc,EAAE,OAAO,CAAC,UAAU;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3F,CAAC;AACD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,YAAoB;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAa,EAAE,QAAkB;IAC5D,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9E,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAa;IAC1C,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAa,EAAE,cAAkC;IAC1E,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACnE,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACzF,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACxG,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrF,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./envelope.js";
+export * from "./identity.js";
+export * from "./policy.js";
+export * from "./redact.js";
+export * from "./seal.js";
+export * from "./transport.js";
+export * from "./render.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/dist/src/index.js

@@ -0,0 +1,8 @@
+export * from "./envelope.js";
+export * from "./identity.js";
+export * from "./policy.js";
+export * from "./redact.js";
+export * from "./seal.js";
+export * from "./transport.js";
+export * from "./render.js";
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}