phaibel 4.0.7

package/dist/pamp/client.js

@@ -0,0 +1,336 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// PAMP — Post Office REST API Client
+// ─────────────────────────────────────────────────────────────────────────────
+//
+// Uses native fetch(). Handles API key auth, standard response envelope,
+// and descriptive error messages.
+// ─────────────────────────────────────────────────────────────────────────────
+import { PAMP_VERSION } from './types.js';
+import { generateIdentityKeyPair, generateExchangeKeyPair, generateMessageId, computeChainHash, } from './crypto.js';
+import { buildEnvelope, parseEnvelope, decryptEnvelope } from './envelope.js';
+import { saveIdentity, saveSession, loadSession, saveContact, loadContactByAddress, saveMessage, addToThread, } from './storage.js';
+export class PampClient {
+    identity;
+    constructor(identity) {
+        this.identity = identity;
+    }
+    headers() {
+        return {
+            'Authorization': `Bearer ${this.identity.apiKey}`,
+            'PAMP-Mailbox': this.identity.mailboxId,
+            'Content-Type': 'application/json',
+        };
+    }
+    url(path) {
+        return `${this.identity.postOffice}${path}`;
+    }
+    async request(method, path, body) {
+        const init = {
+            method,
+            headers: this.headers(),
+        };
+        if (body !== undefined) {
+            init.body = JSON.stringify(body);
+        }
+        const response = await fetch(this.url(path), init);
+        const json = await response.json();
+        if (!json.ok) {
+            const err = json.error;
+            throw new Error(`PAMP API error [${err.code}]: ${err.message}`);
+        }
+        return json.data;
+    }
+    // ── Mailbox ───────────────────────────────────────────────────────────
+    /**
+     * Register a new mailbox at a Post Office.
+     * This is a static method — no identity needed yet.
+     */
+    static async register(postOffice, displayName, preferredId) {
+        const identityKeyPair = generateIdentityKeyPair();
+        const response = await fetch(`${postOffice}/mailbox/register`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                preferred_id: preferredId,
+                public_key: identityKeyPair.publicKey,
+                display_name: displayName,
+            }),
+        });
+        const json = await response.json();
+        if (!json.ok) {
+            throw new Error(`PAMP registration failed [${json.error.code}]: ${json.error.message}`);
+        }
+        const identity = {
+            mailboxId: json.data.mailbox_id,
+            address: json.data.address,
+            postOffice,
+            apiKey: json.data.api_key,
+            displayName,
+            identityKeyPair,
+            registeredAt: json.data.registered_at,
+        };
+        await saveIdentity(identity);
+        return identity;
+    }
+    async getMailboxInfo(mailboxId) {
+        return this.request('GET', `/mailbox/${mailboxId}`);
+    }
+    async rotateApiKey() {
+        const data = await this.request('POST', `/mailbox/${this.identity.mailboxId}/rotate-api-key`);
+        this.identity.apiKey = data.api_key;
+        await saveIdentity(this.identity);
+        return data.api_key;
+    }
+    // ── Agreements ────────────────────────────────────────────────────────
+    async requestAgreement(toAddress, type = 'bilateral') {
+        const exchangeKeyPair = generateExchangeKeyPair();
+        const data = await this.request('POST', '/agreement/request', {
+            from: this.identity.address,
+            to: toAddress,
+            type,
+            public_key: exchangeKeyPair.publicKey,
+        });
+        const agreement = {
+            agreementId: data.agreement_id,
+            type,
+            initiator: this.identity.address,
+            responder: toAddress,
+            status: 'pending',
+            permissions: {
+                initiatorCanSend: type === 'bilateral',
+                responderCanSend: true,
+            },
+            createdAt: new Date().toISOString(),
+        };
+        // Save session with our keypair (contact key not yet known)
+        const session = {
+            agreementId: data.agreement_id,
+            contactAddress: toAddress,
+            exchangeKeyPair,
+            contactPublicKey: '', // populated when agreement is accepted
+            establishedAt: new Date().toISOString(),
+        };
+        await saveSession(session);
+        // Fetch and save contact info
+        const contactMailboxId = toAddress.split('@')[0];
+        try {
+            const info = await this.getMailboxInfo(contactMailboxId);
+            await saveContact({
+                address: toAddress,
+                displayName: info.display_name,
+                identityPublicKey: info.public_key,
+                agreementId: data.agreement_id,
+            });
+        }
+        catch {
+            // Contact info will be populated later
+            await saveContact({
+                address: toAddress,
+                identityPublicKey: '',
+                agreementId: data.agreement_id,
+            });
+        }
+        return agreement;
+    }
+    async listPendingAgreements() {
+        const data = await this.request('GET', '/agreement/pending');
+        return data.map(a => ({
+            agreementId: a.agreement_id,
+            type: a.type,
+            initiator: a.initiator,
+            responder: a.responder,
+            status: a.status,
+            permissions: {
+                initiatorCanSend: a.permissions.initiator_can_send,
+                responderCanSend: a.permissions.responder_can_send,
+            },
+            publicKeys: a.public_keys ? {
+                initiator: a.public_keys.initiator,
+                responder: a.public_keys.responder ?? '',
+            } : undefined,
+            createdAt: a.created_at,
+        }));
+    }
+    async acceptAgreement(agreementId) {
+        const exchangeKeyPair = generateExchangeKeyPair();
+        const data = await this.request('POST', `/agreement/${agreementId}/accept`, {
+            public_key: exchangeKeyPair.publicKey,
+        });
+        // Save session with both keypairs
+        const session = {
+            agreementId,
+            contactAddress: data.initiator,
+            exchangeKeyPair,
+            contactPublicKey: data.public_keys.initiator,
+            establishedAt: new Date().toISOString(),
+        };
+        await saveSession(session);
+        // Save/update contact info
+        const contactMailboxId = data.initiator.split('@')[0];
+        try {
+            const info = await this.getMailboxInfo(contactMailboxId);
+            await saveContact({
+                address: data.initiator,
+                displayName: info.display_name,
+                identityPublicKey: info.public_key,
+                agreementId,
+            });
+        }
+        catch {
+            await saveContact({
+                address: data.initiator,
+                identityPublicKey: '',
+                agreementId,
+            });
+        }
+        return {
+            agreementId: data.agreement_id,
+            type: data.type,
+            initiator: data.initiator,
+            responder: data.responder,
+            status: data.status,
+            permissions: {
+                initiatorCanSend: data.permissions.initiator_can_send,
+                responderCanSend: data.permissions.responder_can_send,
+            },
+            publicKeys: data.public_keys,
+            createdAt: data.created_at,
+            acceptedAt: data.accepted_at,
+        };
+    }
+    async declineAgreement(agreementId) {
+        await this.request('POST', `/agreement/${agreementId}/decline`);
+    }
+    async revokeAgreement(agreementId) {
+        await this.request('POST', `/agreement/${agreementId}/revoke`);
+    }
+    async getAgreement(agreementId) {
+        const data = await this.request('GET', `/agreement/${agreementId}`);
+        // If agreement is now active and we don't have the contact's public key,
+        // update our session
+        if (data.status === 'active' && data.public_keys) {
+            const session = await loadSession(agreementId);
+            if (session && !session.contactPublicKey) {
+                session.contactPublicKey = data.public_keys.initiator === session.exchangeKeyPair.publicKey
+                    ? data.public_keys.responder
+                    : data.public_keys.initiator;
+                await saveSession(session);
+            }
+        }
+        return {
+            agreementId: data.agreement_id,
+            type: data.type,
+            initiator: data.initiator,
+            responder: data.responder,
+            status: data.status,
+            permissions: {
+                initiatorCanSend: data.permissions.initiator_can_send,
+                responderCanSend: data.permissions.responder_can_send,
+            },
+            publicKeys: data.public_keys,
+            createdAt: data.created_at,
+            acceptedAt: data.accepted_at,
+        };
+    }
+    // ── Messages ──────────────────────────────────────────────────────────
+    async sendMessage(toAddress, body, contentType = 'text/plain', replyToId) {
+        // Find the contact and session for this address
+        const contact = await loadContactByAddress(toAddress);
+        if (!contact) {
+            throw new Error(`No contact found for ${toAddress}. Create an agreement first.`);
+        }
+        const session = await loadSession(contact.agreementId);
+        if (!session) {
+            throw new Error(`No session found for agreement ${contact.agreementId}.`);
+        }
+        if (!session.contactPublicKey) {
+            throw new Error(`Agreement ${contact.agreementId} is not yet active — contact has not accepted.`);
+        }
+        // Build chain
+        const chain = [];
+        if (replyToId) {
+            // TODO: load the parent message and copy its chain + append its ID
+            chain.push(replyToId);
+        }
+        const messageId = generateMessageId();
+        const now = new Date().toISOString();
+        const chainHash = computeChainHash(chain);
+        const header = {
+            pamp: PAMP_VERSION,
+            message_id: messageId,
+            agreement_id: contact.agreementId,
+            from: this.identity.address,
+            to: toAddress,
+            created_at: now,
+            read_at: null,
+            chain,
+            chain_hash: chainHash,
+            content_type: contentType,
+        };
+        // Build the encrypted envelope
+        const envelope = buildEnvelope(body, header, session, this.identity);
+        // Send to Post Office
+        await this.request('POST', '/message/send', {
+            envelope,
+        });
+        // Build the full message for local storage
+        const message = {
+            header: { ...header, signature: '(local)' },
+            body,
+            fetchedAt: now,
+        };
+        // Save locally
+        await saveMessage(message, 'sent');
+        // Update thread index
+        const threadRoot = chain.length > 0 ? chain[0] : messageId;
+        await addToThread(threadRoot, messageId);
+        return message;
+    }
+    async listMessages(options) {
+        const query = options?.unread ? '?unread=true' : '';
+        return this.request('GET', `/mailbox/${this.identity.mailboxId}/messages${query}`);
+    }
+    async fetchMessage(messageId) {
+        return this.request('GET', `/message/${messageId}`);
+    }
+    async fetchAndDecryptMessage(messageId) {
+        // Fetch the base64 envelope from Post Office
+        const base64Envelope = await this.fetchMessage(messageId);
+        // Parse the envelope
+        const { header, encryptedBody } = parseEnvelope(base64Envelope);
+        // Load session for this agreement
+        const session = await loadSession(header.agreement_id);
+        if (!session) {
+            throw new Error(`No session found for agreement ${header.agreement_id}.`);
+        }
+        // Load sender's identity public key for signature verification
+        const senderMailboxId = header.from.split('@')[0];
+        const contact = await loadContactByAddress(header.from);
+        let senderPublicKey = contact?.identityPublicKey;
+        if (!senderPublicKey) {
+            // Fetch from Post Office
+            const info = await this.getMailboxInfo(senderMailboxId);
+            senderPublicKey = info.public_key;
+            if (contact) {
+                await saveContact({ ...contact, identityPublicKey: senderPublicKey });
+            }
+        }
+        // Decrypt and verify
+        const message = decryptEnvelope(header, encryptedBody, session, senderPublicKey);
+        // Save locally
+        await saveMessage(message, 'inbox');
+        // Update thread index
+        const threadRoot = message.header.chain.length > 0
+            ? message.header.chain[0]
+            : message.header.message_id;
+        await addToThread(threadRoot, message.header.message_id);
+        return message;
+    }
+    async markRead(messageId) {
+        await this.request('POST', `/message/${messageId}/read`);
+    }
+    async listThreads() {
+        return this.request('GET', `/mailbox/${this.identity.mailboxId}/threads`);
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/pamp/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/pamp/client.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,kCAAkC;AAClC,gFAAgF;AAWhF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACH,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EACH,YAAY,EACZ,WAAW,EACX,WAAW,EACX,WAAW,EACX,oBAAoB,EACpB,WAAW,EACX,WAAW,GACd,MAAM,cAAc,CAAC;AAEtB,MAAM,OAAO,UAAU;IACC;IAApB,YAAoB,QAAsB;QAAtB,aAAQ,GAAR,QAAQ,CAAc;IAAG,CAAC;IAEtC,OAAO;QACX,OAAO;YACH,eAAe,EAAE,UAAU,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YACjD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YACvC,cAAc,EAAE,kBAAkB;SACrC,CAAC;IACN,CAAC;IAEO,GAAG,CAAC,IAAY;QACpB,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,MAAM,IAAI,GAAgB;YACtB,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SAC1B,CAAC;QACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAC;QAEzD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,yEAAyE;IAEzE;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CACjB,UAAkB,EAClB,WAAmB,EACnB,WAAoB;QAEpB,MAAM,eAAe,GAAG,uBAAuB,EAAE,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,mBAAmB,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACjB,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,eAAe,CAAC,SAAS;gBACrC,YAAY,EAAE,WAAW;aAC5B,CAAC;SACL,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAK9B,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,QAAQ,GAAiB;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,UAAU;YACV,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YACzB,WAAW;YACX,eAAe;YACf,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;SACxC,CAAC;QAEF,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QAKlC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,YAAY;QACd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC3B,MAAM,EACN,YAAY,IAAI,CAAC,QAAQ,CAAC,SAAS,iBAAiB,CACvD,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QACpC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,yEAAyE;IAEzE,KAAK,CAAC,gBAAgB,CAClB,SAAiB,EACjB,OAAmC,WAAW;QAE9C,MAAM,eAAe,GAAG,uBAAuB,EAAE,CAAC;QAElD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAG5B,MAAM,EAAE,oBAAoB,EAAE;YAC7B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;YAC3B,EAAE,EAAE,SAAS;YACb,IAAI;YACJ,UAAU,EAAE,eAAe,CAAC,SAAS;SACxC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAkB;YAC7B,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;YAChC,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE;gBACT,gBAAgB,EAAE,IAAI,KAAK,WAAW;gBACtC,gBAAgB,EAAE,IAAI;aACzB;YACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QAEF,4DAA4D;QAC5D,MAAM,OAAO,GAAgB;YACzB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,cAAc,EAAE,SAAS;YACzB,eAAe;YACf,gBAAgB,EAAE,EAAE,EAAE,uCAAuC;YAC7D,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC1C,CAAC;QACF,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAE3B,8BAA8B;QAC9B,MAAM,gBAAgB,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;YACzD,MAAM,WAAW,CAAC;gBACd,OAAO,EAAE,SAAS;gBAClB,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,iBAAiB,EAAE,IAAI,CAAC,UAAU;gBAClC,WAAW,EAAE,IAAI,CAAC,YAAY;aACjC,CAAC,CAAC;QACP,CAAC;QAAC,MAAM,CAAC;YACL,uCAAuC;YACvC,MAAM,WAAW,CAAC;gBACd,OAAO,EAAE,SAAS;gBAClB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,IAAI,CAAC,YAAY;aACjC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,qBAAqB;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAS3B,KAAK,EAAE,oBAAoB,CAAC,CAAC;QAEjC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClB,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,MAAiC;YAC3C,WAAW,EAAE;gBACT,gBAAgB,EAAE,CAAC,CAAC,WAAW,CAAC,kBAAkB;gBAClD,gBAAgB,EAAE,CAAC,CAAC,WAAW,CAAC,kBAAkB;aACrD;YACD,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;gBACxB,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,SAAS;gBAClC,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE;aAC3C,CAAC,CAAC,CAAC,SAAS;YACb,SAAS,EAAE,CAAC,CAAC,UAAU;SAC1B,CAAC,CAAC,CAAC;IACR,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB;QACrC,MAAM,eAAe,GAAG,uBAAuB,EAAE,CAAC;QAElD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAU5B,MAAM,EAAE,cAAc,WAAW,SAAS,EAAE;YAC3C,UAAU,EAAE,eAAe,CAAC,SAAS;SACxC,CAAC,CAAC;QAEH,kCAAkC;QAClC,MAAM,OAAO,GAAgB;YACzB,WAAW;YACX,cAAc,EAAE,IAAI,CAAC,SAAS;YAC9B,eAAe;YACf,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;YAC5C,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC1C,CAAC;QACF,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAE3B,2BAA2B;QAC3B,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;YACzD,MAAM,WAAW,CAAC;gBACd,OAAO,EAAE,IAAI,CAAC,SAAS;gBACvB,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,iBAAiB,EAAE,IAAI,CAAC,UAAU;gBAClC,WAAW;aACd,CAAC,CAAC;QACP,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,WAAW,CAAC;gBACd,OAAO,EAAE,IAAI,CAAC,SAAS;gBACvB,iBAAiB,EAAE,EAAE;gBACrB,WAAW;aACd,CAAC,CAAC;QACP,CAAC;QAED,OAAO;YACH,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAiC;YAC9C,WAAW,EAAE;gBACT,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB;gBACrD,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB;aACxD;YACD,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,UAAU,EAAE,IAAI,CAAC,WAAW;SAC/B,CAAC;IACN,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACtC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,WAAW,UAAU,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB;QACrC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,WAAW,SAAS,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAU5B,KAAK,EAAE,cAAc,WAAW,EAAE,CAAC,CAAC;QAEvC,yEAAyE;QACzE,qBAAqB;QACrB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACvC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,KAAK,OAAO,CAAC,eAAe,CAAC,SAAS;oBACvF,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS;oBAC5B,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;gBACjC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;QAED,OAAO;YACH,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAiC;YAC9C,WAAW,EAAE;gBACT,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB;gBACrD,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB;aACxD;YACD,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,UAAU,EAAE,IAAI,CAAC,WAAW;SAC/B,CAAC;IACN,CAAC;IAED,yEAAyE;IAEzE,KAAK,CAAC,WAAW,CACb,SAAiB,EACjB,IAAY,EACZ,WAAW,GAAG,YAAY,EAC1B,SAAkB;QAElB,gDAAgD;QAChD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,8BAA8B,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,aAAa,OAAO,CAAC,WAAW,gDAAgD,CAAC,CAAC;QACtG,CAAC;QAED,cAAc;QACd,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,SAAS,EAAE,CAAC;YACZ,mEAAmE;YACnE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,MAAM,GAA0C;YAClD,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;YAC3B,EAAE,EAAE,SAAS;YACb,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI;YACb,KAAK;YACL,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,WAAW;SAC5B,CAAC;QAEF,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErE,sBAAsB;QACtB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE;YACxC,QAAQ;SACX,CAAC,CAAC;QAEH,2CAA2C;QAC3C,MAAM,OAAO,GAAgB;YACzB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE;YAC3C,IAAI;YACJ,SAAS,EAAE,GAAG;SACjB,CAAC;QAEF,eAAe;QACf,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEnC,sBAAsB;QACtB,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEzC,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA8B;QAC7C,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,QAAQ,CAAC,SAAS,YAAY,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,SAAiB;QAC1C,6CAA6C;QAC7C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAE1D,qBAAqB;QACrB,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAEhE,kCAAkC;QAClC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;QAC9E,CAAC;QAED,+DAA+D;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,eAAe,GAAG,OAAO,EAAE,iBAAiB,CAAC;QAEjD,IAAI,CAAC,eAAe,EAAE,CAAC;YACnB,yBAAyB;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YACxD,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC;YAClC,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1E,CAAC;QACL,CAAC;QAED,qBAAqB;QACrB,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAEjF,eAAe;QACf,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEpC,sBAAsB;QACtB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAC9C,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAChC,MAAM,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEzD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,SAAS,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,WAAW;QAMb,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,QAAQ,CAAC,SAAS,UAAU,CAAC,CAAC;IAC9E,CAAC;CACJ"}

package/dist/pamp/crypto.d.ts

@@ -0,0 +1,23 @@
+export declare function generateMailboxId(): string;
+export declare function generateMessageId(): string;
+export declare function generateAgreementId(): string;
+export declare function generateIdentityKeyPair(): {
+    publicKey: string;
+    privateKey: string;
+};
+export declare function generateExchangeKeyPair(): {
+    publicKey: string;
+    privateKey: string;
+};
+export interface EncryptedPackage {
+    encrypted_key: string;
+    nonce: string;
+    auth_tag: string;
+    ciphertext: string;
+}
+export declare function encryptBody(plaintext: string, recipientPublicKeyBase64: string, senderPrivateKeyBase64: string): string;
+export declare function decryptBody(encryptedPackageBase64: string, recipientPrivateKeyBase64: string, senderPublicKeyBase64: string): string;
+export declare function signMessage(headerJson: string, bodyCiphertext: string, privateKeyPem: string): string;
+export declare function verifySignature(headerJson: string, bodyCiphertext: string, signature: string, publicKeyPem: string): boolean;
+export declare function computeChainHash(chain: string[]): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/pamp/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/pamp/crypto.ts"],"names":[],"mappings":"AAyBA,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAID,wBAAgB,uBAAuB,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAOnF;AAID,wBAAgB,uBAAuB,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAQnF;AAID,MAAM,WAAW,gBAAgB;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,WAAW,CACvB,SAAS,EAAE,MAAM,EACjB,wBAAwB,EAAE,MAAM,EAChC,sBAAsB,EAAE,MAAM,GAC/B,MAAM,CAqCR;AAED,wBAAgB,WAAW,CACvB,sBAAsB,EAAE,MAAM,EAC9B,yBAAyB,EAAE,MAAM,EACjC,qBAAqB,EAAE,MAAM,GAC9B,MAAM,CAsCR;AAID,wBAAgB,WAAW,CACvB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EACtB,aAAa,EAAE,MAAM,GACtB,MAAM,CAMR;AAED,wBAAgB,eAAe,CAC3B,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACrB,OAAO,CAMT;AAID,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAExD"}

package/dist/pamp/crypto.js

@@ -0,0 +1,130 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// PAMP — Cryptographic Operations
+// ─────────────────────────────────────────────────────────────────────────────
+//
+// All crypto uses Node.js built-in `crypto` module:
+//   - RSA-4096 for identity key signing/verification
+//   - X25519 for session key exchange (ECDH)
+//   - AES-256-GCM for message body encryption
+// ─────────────────────────────────────────────────────────────────────────────
+import crypto from 'crypto';
+// ── ID Generation ───────────────────────────────────────────────────────────
+const BASE36_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+function randomBase36(length) {
+    const bytes = crypto.randomBytes(length);
+    let result = '';
+    for (let i = 0; i < length; i++) {
+        result += BASE36_CHARS[bytes[i] % 36];
+    }
+    return result;
+}
+export function generateMailboxId() {
+    return randomBase36(8);
+}
+export function generateMessageId() {
+    return `msg-${randomBase36(8)}`;
+}
+export function generateAgreementId() {
+    return `agr-${randomBase36(8)}`;
+}
+// ── Identity Key Pair (RSA-4096) ────────────────────────────────────────────
+export function generateIdentityKeyPair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 4096,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    return { publicKey, privateKey };
+}
+// ── Exchange Key Pair (X25519) ──────────────────────────────────────────────
+export function generateExchangeKeyPair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('x25519');
+    const pubRaw = publicKey.export({ type: 'spki', format: 'der' });
+    const privRaw = privateKey.export({ type: 'pkcs8', format: 'der' });
+    return {
+        publicKey: pubRaw.toString('base64'),
+        privateKey: privRaw.toString('base64'),
+    };
+}
+export function encryptBody(plaintext, recipientPublicKeyBase64, senderPrivateKeyBase64) {
+    // Derive shared secret via X25519 ECDH
+    const senderPrivate = crypto.createPrivateKey({
+        key: Buffer.from(senderPrivateKeyBase64, 'base64'),
+        format: 'der',
+        type: 'pkcs8',
+    });
+    const recipientPublic = crypto.createPublicKey({
+        key: Buffer.from(recipientPublicKeyBase64, 'base64'),
+        format: 'der',
+        type: 'spki',
+    });
+    const sharedSecret = crypto.diffieHellman({
+        privateKey: senderPrivate,
+        publicKey: recipientPublic,
+    });
+    // Derive AES key from shared secret using HKDF
+    const aesKey = crypto.hkdfSync('sha256', sharedSecret, '', 'pamp-aes-key', 32);
+    // AES-256-GCM encrypt
+    const nonce = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', Buffer.from(aesKey), nonce);
+    const ciphertext = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+    const pkg = {
+        encrypted_key: '', // Not needed — key derived from ECDH shared secret
+        nonce: nonce.toString('base64'),
+        auth_tag: authTag.toString('base64'),
+        ciphertext: ciphertext.toString('base64'),
+    };
+    return Buffer.from(JSON.stringify(pkg)).toString('base64');
+}
+export function decryptBody(encryptedPackageBase64, recipientPrivateKeyBase64, senderPublicKeyBase64) {
+    const pkg = JSON.parse(Buffer.from(encryptedPackageBase64, 'base64').toString('utf8'));
+    // Derive shared secret via X25519 ECDH (reverse direction)
+    const recipientPrivate = crypto.createPrivateKey({
+        key: Buffer.from(recipientPrivateKeyBase64, 'base64'),
+        format: 'der',
+        type: 'pkcs8',
+    });
+    const senderPublic = crypto.createPublicKey({
+        key: Buffer.from(senderPublicKeyBase64, 'base64'),
+        format: 'der',
+        type: 'spki',
+    });
+    const sharedSecret = crypto.diffieHellman({
+        privateKey: recipientPrivate,
+        publicKey: senderPublic,
+    });
+    // Derive same AES key
+    const aesKey = crypto.hkdfSync('sha256', sharedSecret, '', 'pamp-aes-key', 32);
+    // AES-256-GCM decrypt
+    const decipher = crypto.createDecipheriv('aes-256-gcm', Buffer.from(aesKey), Buffer.from(pkg.nonce, 'base64'));
+    decipher.setAuthTag(Buffer.from(pkg.auth_tag, 'base64'));
+    const plaintext = Buffer.concat([
+        decipher.update(Buffer.from(pkg.ciphertext, 'base64')),
+        decipher.final(),
+    ]);
+    return plaintext.toString('utf8');
+}
+// ── RSA Signing / Verification ──────────────────────────────────────────────
+export function signMessage(headerJson, bodyCiphertext, privateKeyPem) {
+    const payload = headerJson + bodyCiphertext;
+    const sign = crypto.createSign('SHA256');
+    sign.update(payload);
+    sign.end();
+    return sign.sign(privateKeyPem, 'base64');
+}
+export function verifySignature(headerJson, bodyCiphertext, signature, publicKeyPem) {
+    const payload = headerJson + bodyCiphertext;
+    const verify = crypto.createVerify('SHA256');
+    verify.update(payload);
+    verify.end();
+    return verify.verify(publicKeyPem, signature, 'base64');
+}
+// ── Chain Hash ──────────────────────────────────────────────────────────────
+export function computeChainHash(chain) {
+    return crypto.createHash('sha256').update(chain.join('|')).digest('hex');
+}
+//# sourceMappingURL=crypto.js.map

package/dist/pamp/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/pamp/crypto.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAChF,EAAE;AACF,oDAAoD;AACpD,qDAAqD;AACrD,6CAA6C;AAC7C,8CAA8C;AAC9C,gFAAgF;AAEhF,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,+EAA+E;AAE/E,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAE5D,SAAS,YAAY,CAAC,MAAc;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC7B,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC7B,OAAO,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,mBAAmB;IAC/B,OAAO,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;AACpC,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,uBAAuB;IACnC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QAChE,aAAa,EAAE,IAAI;QACnB,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACvD,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,uBAAuB;IACnC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,OAAO;QACH,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACzC,CAAC;AACN,CAAC;AAWD,MAAM,UAAU,WAAW,CACvB,SAAiB,EACjB,wBAAgC,EAChC,sBAA8B;IAE9B,uCAAuC;IACvC,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC1C,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC;QAClD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KAChB,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC3C,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,QAAQ,CAAC;QACpD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACf,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QACtC,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,eAAe;KAC7B,CAAC,CAAC;IAEH,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAE/E,sBAAsB;IACtB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,MAAM,GAAG,GAAqB;QAC1B,aAAa,EAAE,EAAE,EAAE,mDAAmD;QACtE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC5C,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,WAAW,CACvB,sBAA8B,EAC9B,yBAAiC,EACjC,qBAA6B;IAE7B,MAAM,GAAG,GAAqB,IAAI,CAAC,KAAK,CACpC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjE,CAAC;IAEF,2DAA2D;IAC3D,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC7C,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC;QACrD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KAChB,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC;QACxC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC;QACjD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACf,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QACtC,UAAU,EAAE,gBAAgB;QAC5B,SAAS,EAAE,YAAY;KAC1B,CAAC,CAAC;IAEH,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAE/E,sBAAsB;IACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACpC,aAAa,EACb,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CACnC,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACtD,QAAQ,CAAC,KAAK,EAAE;KACnB,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,WAAW,CACvB,UAAkB,EAClB,cAAsB,EACtB,aAAqB;IAErB,MAAM,OAAO,GAAG,UAAU,GAAG,cAAc,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAC3B,UAAkB,EAClB,cAAsB,EACtB,SAAiB,EACjB,YAAoB;IAEpB,MAAM,OAAO,GAAG,UAAU,GAAG,cAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,EAAE,CAAC;IACb,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,gBAAgB,CAAC,KAAe;IAC5C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC"}

package/dist/pamp/envelope.d.ts

@@ -0,0 +1,23 @@
+import type { PampEnvelopeHeader, PampIdentity, PampMessage, PampSession } from './types.js';
+/**
+ * Build a full Base64-encoded PAMP envelope.
+ *
+ * 1. Encrypts the body using session keys
+ * 2. Signs header + ciphertext with identity RSA key
+ * 3. Assembles header JSON + delimiter + encrypted body
+ * 4. Base64-encodes the whole thing
+ */
+export declare function buildEnvelope(body: string, header: Omit<PampEnvelopeHeader, 'signature'>, session: PampSession, identity: PampIdentity): string;
+/**
+ * Parse a Base64 envelope into header + encrypted body.
+ * Does NOT decrypt or verify — call decryptEnvelope() for that.
+ */
+export declare function parseEnvelope(base64Envelope: string): {
+    header: PampEnvelopeHeader;
+    encryptedBody: string;
+};
+/**
+ * Verify signature and decrypt the body of a parsed envelope.
+ */
+export declare function decryptEnvelope(header: PampEnvelopeHeader, encryptedBody: string, session: PampSession, senderIdentityPublicKey: string): PampMessage;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/pamp/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/pamp/envelope.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAI7F;;;;;;;GAOG;AACH,wBAAgB,aAAa,CACzB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAC7C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GACvB,MAAM,CAyBR;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG;IACnD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACzB,CAYA;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC3B,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,WAAW,EACpB,uBAAuB,EAAE,MAAM,GAChC,WAAW,CA4Bb"}

package/dist/pamp/envelope.js

@@ -0,0 +1,67 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// PAMP — Envelope Wire Format
+// ─────────────────────────────────────────────────────────────────────────────
+//
+// Handles encoding/decoding of Base64 PAMP envelopes:
+//   Header (JSON) + delimiter + Encrypted Body → Base64
+// ─────────────────────────────────────────────────────────────────────────────
+import { PAMP_BODY_DELIMITER } from './types.js';
+import { encryptBody, decryptBody, signMessage, verifySignature } from './crypto.js';
+/**
+ * Build a full Base64-encoded PAMP envelope.
+ *
+ * 1. Encrypts the body using session keys
+ * 2. Signs header + ciphertext with identity RSA key
+ * 3. Assembles header JSON + delimiter + encrypted body
+ * 4. Base64-encodes the whole thing
+ */
+export function buildEnvelope(body, header, session, identity) {
+    // Encrypt the body using X25519 session keys
+    const encryptedBody = encryptBody(body, session.contactPublicKey, session.exchangeKeyPair.privateKey);
+    // Build header JSON without signature for signing
+    const headerForSigning = JSON.stringify(header);
+    // Sign header + encrypted body with RSA identity key
+    const signature = signMessage(headerForSigning, encryptedBody, identity.identityKeyPair.privateKey);
+    // Add signature to header
+    const fullHeader = { ...header, signature };
+    const fullHeaderJson = JSON.stringify(fullHeader);
+    // Assemble: header + delimiter + encrypted body → Base64
+    const raw = fullHeaderJson + PAMP_BODY_DELIMITER + encryptedBody;
+    return Buffer.from(raw).toString('base64');
+}
+/**
+ * Parse a Base64 envelope into header + encrypted body.
+ * Does NOT decrypt or verify — call decryptEnvelope() for that.
+ */
+export function parseEnvelope(base64Envelope) {
+    const raw = Buffer.from(base64Envelope, 'base64').toString('utf8');
+    const delimiterIndex = raw.indexOf(PAMP_BODY_DELIMITER);
+    if (delimiterIndex === -1) {
+        throw new Error('Invalid PAMP envelope: missing body delimiter');
+    }
+    const headerJson = raw.substring(0, delimiterIndex);
+    const encryptedBody = raw.substring(delimiterIndex + PAMP_BODY_DELIMITER.length);
+    const header = JSON.parse(headerJson);
+    return { header, encryptedBody };
+}
+/**
+ * Verify signature and decrypt the body of a parsed envelope.
+ */
+export function decryptEnvelope(header, encryptedBody, session, senderIdentityPublicKey) {
+    // Rebuild the header without signature for verification
+    const { signature, ...headerWithoutSig } = header;
+    const headerForVerification = JSON.stringify(headerWithoutSig);
+    // Verify RSA signature
+    const valid = verifySignature(headerForVerification, encryptedBody, signature, senderIdentityPublicKey);
+    if (!valid) {
+        throw new Error(`PAMP signature verification failed for message ${header.message_id}`);
+    }
+    // Decrypt body using X25519 session keys
+    const body = decryptBody(encryptedBody, session.exchangeKeyPair.privateKey, session.contactPublicKey);
+    return {
+        header,
+        body,
+        fetchedAt: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=envelope.js.map

package/dist/pamp/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/pamp/envelope.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAChF,EAAE;AACF,sDAAsD;AACtD,wDAAwD;AACxD,gFAAgF;AAGhF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAErF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CACzB,IAAY,EACZ,MAA6C,EAC7C,OAAoB,EACpB,QAAsB;IAEtB,6CAA6C;IAC7C,MAAM,aAAa,GAAG,WAAW,CAC7B,IAAI,EACJ,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,eAAe,CAAC,UAAU,CACrC,CAAC;IAEF,kDAAkD;IAClD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEhD,qDAAqD;IACrD,MAAM,SAAS,GAAG,WAAW,CACzB,gBAAgB,EAChB,aAAa,EACb,QAAQ,CAAC,eAAe,CAAC,UAAU,CACtC,CAAC;IAEF,0BAA0B;IAC1B,MAAM,UAAU,GAAuB,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC;IAChE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAElD,yDAAyD;IACzD,MAAM,GAAG,GAAG,cAAc,GAAG,mBAAmB,GAAG,aAAa,CAAC;IACjE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,cAAsB;IAIhD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxD,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,GAAG,CAAC,SAAS,CAAC,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAEjF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAuB,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC3B,MAA0B,EAC1B,aAAqB,EACrB,OAAoB,EACpB,uBAA+B;IAE/B,wDAAwD;IACxD,MAAM,EAAE,SAAS,EAAE,GAAG,gBAAgB,EAAE,GAAG,MAAM,CAAC;IAClD,MAAM,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAE/D,uBAAuB;IACvB,MAAM,KAAK,GAAG,eAAe,CACzB,qBAAqB,EACrB,aAAa,EACb,SAAS,EACT,uBAAuB,CAC1B,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,yCAAyC;IACzC,MAAM,IAAI,GAAG,WAAW,CACpB,aAAa,EACb,OAAO,CAAC,eAAe,CAAC,UAAU,EAClC,OAAO,CAAC,gBAAgB,CAC3B,CAAC;IAEF,OAAO;QACH,MAAM;QACN,IAAI;QACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACN,CAAC"}

package/dist/pamp/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './crypto.js';
+export * from './envelope.js';
+export * from './storage.js';
+export { PampClient } from './client.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/pamp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pamp/index.ts"],"names":[],"mappings":"AAIA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}

package/dist/pamp/index.js

@@ -0,0 +1,9 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// PAMP — Barrel Exports
+// ─────────────────────────────────────────────────────────────────────────────
+export * from './types.js';
+export * from './crypto.js';
+export * from './envelope.js';
+export * from './storage.js';
+export { PampClient } from './client.js';
+//# sourceMappingURL=index.js.map

package/dist/pamp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pamp/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}