sealbridge 0.0.1 → 0.2.0

package/dist/packages/core/dist/crypto.js

@@ -0,0 +1,329 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
+// Adapted from newtro/delegateos src/core/crypto.ts (MIT), Scott Smith.
+// ACP uses Node Ed25519, SHA-256 and did:key; it is not DelegateOS SJT wire format.
+import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, sign, verify, } from 'node:crypto';
+import canonicalizeJson from 'canonicalize';
+const alphabet = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+function base58(bytes) {
+    let n = BigInt('0x' + Buffer.from(bytes).toString('hex'));
+    let s = '';
+    while (n) {
+        s = alphabet[Number(n % 58n)] + s;
+        n /= 58n;
+    }
+    for (const b of bytes) {
+        if (b !== 0)
+            break;
+        s = '1' + s;
+    }
+    return s;
+}
+function unbase58(s) {
+    if (!s || s.length > 128)
+        throw new Error('INVALID_DID');
+    let n = 0n;
+    for (const c of s) {
+        const i = alphabet.indexOf(c);
+        if (i < 0)
+            throw new Error('INVALID_DID');
+        n = n * 58n + BigInt(i);
+    }
+    let hex = n.toString(16);
+    if (hex.length % 2)
+        hex = '0' + hex;
+    return Buffer.concat([
+        Buffer.alloc(s.match(/^1*/)?.[0].length ?? 0),
+        n ? Buffer.from(hex, 'hex') : Buffer.alloc(0),
+    ]);
+}
+function assertJson(v, seen = new Set()) {
+    if (v === null || typeof v === 'boolean')
+        return;
+    if (typeof v === 'string') {
+        if (/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u.test(v))
+            throw new Error('INVALID_UNICODE');
+        return;
+    }
+    if (typeof v === 'number' && Number.isFinite(v))
+        return;
+    if (typeof v !== 'object' || seen.has(v))
+        throw new Error('INVALID_JSON');
+    if (!Array.isArray(v) &&
+        Object.getPrototypeOf(v) !== Object.prototype &&
+        Object.getPrototypeOf(v) !== null)
+        throw new Error('INVALID_JSON');
+    seen.add(v);
+    if (Array.isArray(v)) {
+        for (let i = 0; i < v.length; i++)
+            assertJson(v[i], seen);
+    }
+    else
+        for (const [k, x] of Object.entries(v)) {
+            assertJson(k);
+            assertJson(x, seen);
+        }
+    seen.delete(v);
+}
+export function canonicalize(v) {
+    assertJson(v);
+    const s = canonicalizeJson(v);
+    if (s === undefined)
+        throw new Error('INVALID_JSON');
+    return s;
+}
+export function digestBytes(v) {
+    return 'sha256:' + createHash('sha256').update(v).digest('hex');
+}
+export function digest(v) {
+    return digestBytes(canonicalize(v));
+}
+export function generateKeyPair() {
+    const kp = generateKeyPairSync('ed25519');
+    const raw = kp.publicKey.export({ format: 'der', type: 'spki' }).subarray(-32);
+    return {
+        did: 'did:key:z' + base58(Buffer.concat([Buffer.from([0xed, 0x01]), raw])),
+        privateKey: kp.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+    };
+}
+export function resolveDid(did) {
+    if (!did.startsWith('did:key:z'))
+        throw new Error('INVALID_DID');
+    const raw = unbase58(did.slice(9));
+    if (raw.length !== 34 || raw[0] !== 0xed || raw[1] !== 1 || base58(raw) !== did.slice(9))
+        throw new Error('INVALID_DID');
+    return createPublicKey({
+        format: 'der',
+        type: 'spki',
+        key: Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), raw.subarray(2)]),
+    });
+}
+export function signPayload(payload, key, signedAt = new Date().toISOString()) {
+    const payloadDigest = digest(payload);
+    const metadata = {
+        signerDid: key.did,
+        canonicalization: 'RFC8785-JCS',
+        payloadDigest,
+        signedAt,
+    };
+    // Metadata is covered as well as the payload, preventing signer/time substitution.
+    const signature = 'ed25519:' +
+        sign(null, Buffer.from(canonicalize({ payload, ...metadata })), createPrivateKey(key.privateKey)).toString('base64url');
+    const result = { payload: structuredClone(payload), signature: { ...metadata, signature } };
+    if (!verifySigned(result, key.did))
+        throw new Error('KEY_DID_MISMATCH');
+    return result;
+}
+export function verifySigned(value, expectedDid) {
+    try {
+        const { signature, ...metadata } = value.signature;
+        if (!/^ed25519:[A-Za-z0-9_-]{86}$/.test(signature))
+            return false;
+        const encoded = signature.slice(8);
+        const decoded = Buffer.from(encoded, 'base64url');
+        const canonical = decoded.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+        if (decoded.length !== 64 || canonical !== encoded)
+            return false;
+        return ((!expectedDid || metadata.signerDid === expectedDid) &&
+            metadata.canonicalization === 'RFC8785-JCS' &&
+            Number.isFinite(Date.parse(metadata.signedAt)) &&
+            metadata.payloadDigest === digest(value.payload) &&
+            verify(null, Buffer.from(canonicalize({ payload: value.payload, ...metadata })), resolveDid(metadata.signerDid), decoded));
+    }
+    catch {
+        return false;
+    }
+}
+export function verifySignature(payload, signature, expectedDid) {
+    return verifySigned({ payload, signature }, expectedDid);
+}
+const X25519_P = (1n << 255n) - 19n;
+const X25519_SPKI_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
+const X25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b656e04220420', 'hex');
+function mod(n, p) {
+    const r = n % p;
+    return r >= 0n ? r : r + p;
+}
+function modInverse(a, p) {
+    let result = 1n;
+    let base = mod(a, p);
+    let exp = p - 2n;
+    while (exp > 0n) {
+        if (exp & 1n)
+            result = (result * base) % p;
+        base = (base * base) % p;
+        exp >>= 1n;
+    }
+    return result;
+}
+function readLe(bytes) {
+    let n = 0n;
+    for (let i = bytes.length - 1; i >= 0; i--)
+        n = (n << 8n) + BigInt(bytes[i]);
+    return n;
+}
+function writeLe(value, length = 32) {
+    const out = Buffer.alloc(length);
+    let n = value;
+    for (let i = 0; i < length; i++) {
+        out[i] = Number(n & 0xffn);
+        n >>= 8n;
+    }
+    return out;
+}
+/**
+ * Montgomery u from an Ed25519 public key. RFC 8032 encodes y little-endian
+ * with the x sign in bit 255; RFC 7748 uses u = (1 + y) / (1 - y).
+ */
+function x25519PublicFromDid(did) {
+    const y = readLe(resolveDid(did).export({ format: 'der', type: 'spki' }).subarray(-32)) &
+        ((1n << 255n) - 1n);
+    const yMod = y % X25519_P;
+    const denom = mod(1n - yMod, X25519_P);
+    if (denom === 0n)
+        throw new Error('INVALID_DID');
+    const u = mod((1n + yMod) * modInverse(denom, X25519_P), X25519_P);
+    return createPublicKey({
+        key: Buffer.concat([X25519_SPKI_PREFIX, writeLe(u)]),
+        format: 'der',
+        type: 'spki',
+    });
+}
+/** Ed25519 seed to the clamped X25519 scalar from the SHA-512 prefix. */
+function x25519PrivateFromKey(key) {
+    const seed = createPrivateKey(key.privateKey)
+        .export({ format: 'der', type: 'pkcs8' })
+        .subarray(-32);
+    const scalar = Buffer.from(createHash('sha512').update(seed).digest().subarray(0, 32));
+    scalar[0] &= 248;
+    scalar[31] &= 127;
+    scalar[31] |= 64;
+    return createPrivateKey({
+        key: Buffer.concat([X25519_PKCS8_PREFIX, scalar]),
+        format: 'der',
+        type: 'pkcs8',
+    });
+}
+function envelopeAad(context) {
+    return Buffer.from(canonicalize({
+        taskId: context.taskId,
+        seq: context.seq,
+        eventType: context.eventType,
+        senderDid: context.senderDid,
+        recipientDid: context.recipientDid,
+    }));
+}
+function rawX25519PublicKey(key) {
+    const raw = key.export({ format: 'der', type: 'spki' }).subarray(-32);
+    if (raw.length !== 32)
+        throw new Error('INVALID_PUBLIC_KEY');
+    return Buffer.from(raw);
+}
+/**
+ * HKDF-SHA256 info for envelope payload encryption.
+ * Binds the canonical header to the ephemeral X25519 public key and the
+ * recipient static X25519 public key so the AES key is tied to this
+ * Diffie-Hellman transcript as well as the header. Both keys are the raw
+ * 32-byte values, encoded base64url. AES-GCM additional data stays the
+ * header alone, and the 12-byte nonce stays the HKDF salt.
+ */
+export function envelopeHkdfInfo(context, ephemeralPublicKey, recipientPublicKey) {
+    if (ephemeralPublicKey.length !== 32 || recipientPublicKey.length !== 32)
+        throw new Error('INVALID_PUBLIC_KEY');
+    return Buffer.from(canonicalize({
+        taskId: context.taskId,
+        seq: context.seq,
+        eventType: context.eventType,
+        senderDid: context.senderDid,
+        recipientDid: context.recipientDid,
+        ephemeralPublicKey: Buffer.from(ephemeralPublicKey).toString('base64url'),
+        recipientPublicKey: Buffer.from(recipientPublicKey).toString('base64url'),
+    }), 'utf8');
+}
+function importEphemeralPublic(encoded) {
+    const raw = Buffer.from(encoded, 'base64url');
+    const der = raw.length === 32 ? Buffer.concat([X25519_SPKI_PREFIX, raw]) : raw;
+    return createPublicKey({ key: der, format: 'der', type: 'spki' });
+}
+export function isEncryptedEnvelopePayload(payload) {
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload))
+        return false;
+    const value = payload;
+    return (value.__acpEncrypted === 'X25519-HKDF-AES256GCM' &&
+        typeof value.ephemeralPublicKey === 'string' &&
+        typeof value.iv === 'string' &&
+        typeof value.ciphertext === 'string' &&
+        typeof value.tag === 'string');
+}
+export function encryptEnvelopePayload(payload, context) {
+    const ephemeral = generateKeyPairSync('x25519');
+    const recipientPublic = x25519PublicFromDid(context.recipientDid);
+    const shared = diffieHellman({
+        privateKey: ephemeral.privateKey,
+        publicKey: recipientPublic,
+    });
+    const iv = randomBytes(12);
+    const aad = envelopeAad(context);
+    const info = envelopeHkdfInfo(context, rawX25519PublicKey(ephemeral.publicKey), rawX25519PublicKey(recipientPublic));
+    // The nonce remains the HKDF salt. Info binds the header and both X25519 public keys.
+    const key = Buffer.from(hkdfSync('sha256', shared, iv, info, 32));
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    cipher.setAAD(aad);
+    const ciphertext = Buffer.concat([
+        cipher.update(Buffer.from(JSON.stringify(payload), 'utf8')),
+        cipher.final(),
+    ]);
+    return {
+        __acpEncrypted: 'X25519-HKDF-AES256GCM',
+        ephemeralPublicKey: ephemeral.publicKey
+            .export({ format: 'der', type: 'spki' })
+            .toString('base64url'),
+        iv: iv.toString('base64url'),
+        ciphertext: ciphertext.toString('base64url'),
+        tag: cipher.getAuthTag().toString('base64url'),
+    };
+}
+export function decryptEnvelopePayload(payload, recipient, context, options = {}) {
+    // Session peers must opt in to cleartext. A missing flag rejects it.
+    const requireEncrypted = options.requireEncrypted ?? true;
+    if (!isEncryptedEnvelopePayload(payload)) {
+        if (requireEncrypted)
+            throw new Error('UNENCRYPTED_ENVELOPE_REJECTED');
+        return payload;
+    }
+    try {
+        const iv = Buffer.from(payload.iv, 'base64url');
+        const aad = envelopeAad(context);
+        const ephemeralPublic = importEphemeralPublic(payload.ephemeralPublicKey);
+        const recipientPublic = x25519PublicFromDid(context.recipientDid);
+        const shared = diffieHellman({
+            privateKey: x25519PrivateFromKey(recipient),
+            publicKey: ephemeralPublic,
+        });
+        const info = envelopeHkdfInfo(context, rawX25519PublicKey(ephemeralPublic), rawX25519PublicKey(recipientPublic));
+        // The nonce remains the HKDF salt. Info binds the header and both X25519 public keys.
+        const key = Buffer.from(hkdfSync('sha256', shared, iv, info, 32));
+        const decipher = createDecipheriv('aes-256-gcm', key, iv);
+        decipher.setAAD(aad);
+        decipher.setAuthTag(Buffer.from(payload.tag, 'base64url'));
+        const plain = Buffer.concat([
+            decipher.update(Buffer.from(payload.ciphertext, 'base64url')),
+            decipher.final(),
+        ]);
+        return JSON.parse(plain.toString('utf8'));
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === 'ENVELOPE_DECRYPTION_FAILED')
+            throw error;
+        throw new Error('ENVELOPE_DECRYPTION_FAILED');
+    }
+}
+export function openEnvelope(envelope, recipient, options = {}) {
+    return decryptEnvelopePayload(envelope.payload.payload, recipient, {
+        taskId: envelope.payload.taskId,
+        seq: envelope.payload.seq,
+        eventType: envelope.payload.eventType,
+        senderDid: envelope.payload.senderDid,
+        recipientDid: envelope.payload.recipientDid,
+    }, { requireEncrypted: options.requireEncrypted ?? true });
+}
+//# sourceMappingURL=crypto.js.map

package/dist/packages/core/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,wEAAwE;AACxE,oFAAoF;AACpF,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,WAAW,EACX,IAAI,EACJ,MAAM,GACP,MAAM,aAAa,CAAC;AAErB,OAAO,gBAAgB,MAAM,cAAc,CAAC;AAS5C,MAAM,QAAQ,GAAG,4DAA4D,CAAC;AAC9E,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,OAAO,CAAC,EAAE,CAAC;QACT,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,IAAI,GAAG,CAAC;IACX,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM;QACnB,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IACd,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QAC1C,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC;AACD,SAAS,UAAU,CAAC,CAAU,EAAE,OAAO,IAAI,GAAG,EAAU;IACtD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO;IACjD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,yEAAyE,CAAC,IAAI,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO;IACxD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1E,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACjB,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS;QAC7C,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,IAAI;QAEjC,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;;QACC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,UAAU,CAAC,CAAC,CAAC,CAAC;YACd,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,UAAU,CAAC,CAAC,CAAC,CAAC;IACd,MAAM,CAAC,GAAI,gBAAkE,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,CAAsB;IAChD,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,CAAU;IAC/B,OAAO,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AACD,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO;QACL,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1E,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC9E,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,OAAO,eAAe,CAAC;QACrB,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;KACtF,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,WAAW,CACzB,OAAU,EACV,GAAY,EACZ,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAEnC,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG;QACf,SAAS,EAAE,GAAG,CAAC,GAAG;QAClB,gBAAgB,EAAE,aAAsB;QACxC,aAAa;QACb,QAAQ;KACT,CAAC;IACF,mFAAmF;IACnF,MAAM,SAAS,GACb,UAAU;QACV,IAAI,CACF,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,EACnD,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CACjC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC;IAC5F,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,YAAY,CAAI,KAAgB,EAAE,WAAoB;IACpE,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;QACnD,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACjE,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxG,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACjE,OAAO,CACL,CAAC,CAAC,WAAW,IAAI,QAAQ,CAAC,SAAS,KAAK,WAAW,CAAC;YACpD,QAAQ,CAAC,gBAAgB,KAAK,aAAa;YAC3C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9C,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YAChD,MAAM,CACJ,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,EAClE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAC9B,OAAO,CACR,CACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,MAAM,UAAU,eAAe,CAC7B,OAAgB,EAChB,SAAoB,EACpB,WAAoB;IAEpB,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,WAAW,CAAC,CAAC;AAC3D,CAAC;AACD,MAAM,QAAQ,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC;AACpC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAC1E,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AAQnF,SAAS,GAAG,CAAC,CAAS,EAAE,CAAS;IAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AACD,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrB,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IACjB,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC;QAChB,IAAI,GAAG,GAAG,EAAE;YAAE,MAAM,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,KAAK,EAAE,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,OAAO,CAAC,KAAa,EAAE,MAAM,GAAG,EAAE;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD;;;GAGG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,CAAC,GACL,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnE,OAAO,eAAe,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;AACL,CAAC;AACD,yEAAyE;AACzE,SAAS,oBAAoB,CAAC,GAAY;IACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC;SAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SACxC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACjB,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACjB,OAAO,gBAAgB,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;AACL,CAAC;AACD,SAAS,WAAW,CAAC,OAA8B;IACjD,OAAO,MAAM,CAAC,IAAI,CAChB,YAAY,CAAC;QACX,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CACH,CAAC;AACJ,CAAC;AACD,SAAS,kBAAkB,CAAC,GAAc;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AACD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA8B,EAC9B,kBAA8B,EAC9B,kBAA8B;IAE9B,IAAI,kBAAkB,CAAC,MAAM,KAAK,EAAE,IAAI,kBAAkB,CAAC,MAAM,KAAK,EAAE;QACtE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,IAAI,CAChB,YAAY,CAAC;QACX,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzE,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC1E,CAAC,EACF,MAAM,CACP,CAAC;AACJ,CAAC;AACD,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/E,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AACD,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,MAAM,KAAK,GAAG,OAAkC,CAAC;IACjD,OAAO,CACL,KAAK,CAAC,cAAc,KAAK,uBAAuB;QAChD,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ;QAC5C,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAC9B,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,sBAAsB,CACpC,OAAa,EACb,OAA8B;IAE9B,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,SAAS,EAAE,eAAe;KAC3B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,gBAAgB,CAC3B,OAAO,EACP,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,EACvC,kBAAkB,CAAC,eAAe,CAAC,CACpC,CAAC;IACF,sFAAsF;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,OAAO;QACL,cAAc,EAAE,uBAAuB;QACvC,kBAAkB,EAAE,SAAS,CAAC,SAAS;aACpC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;aACvC,QAAQ,CAAC,WAAW,CAAC;QACxB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5C,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC/C,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,sBAAsB,CACpC,OAAa,EACb,SAAkB,EAClB,OAA8B,EAC9B,UAA0C,EAAE;IAE5C,qEAAqE;IACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC;IAC1D,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvE,OAAO,OAAY,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC1E,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,UAAU,EAAE,oBAAoB,CAAC,SAAS,CAAC;YAC3C,SAAS,EAAE,eAAe;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,gBAAgB,CAC3B,OAAO,EACP,kBAAkB,CAAC,eAAe,CAAC,EACnC,kBAAkB,CAAC,eAAe,CAAC,CACpC,CAAC;QACF,sFAAsF;QACtF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC1B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAC7D,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,4BAA4B;YAAE,MAAM,KAAK,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AACD,MAAM,UAAU,YAAY,CAC1B,QAAwB,EACxB,SAAkB,EAClB,UAA0C,EAAE;IAE5C,OAAO,sBAAsB,CAC3B,QAAQ,CAAC,OAAO,CAAC,OAAO,EACxB,SAAS,EACT;QACE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;QAC/B,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG;QACzB,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;QACrC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;QACrC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY;KAC5C,EACD,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI,EAAE,CACvD,CAAC;AACJ,CAAC"}

package/dist/packages/core/dist/discovery.d.ts

@@ -0,0 +1,129 @@
+import type { BudgetSpec, Json, KeyPair, Signature, Signed } from './types.js';
+export interface AgentSkill {
+    id: string;
+    name: string;
+    description?: string;
+    taskTypes?: string[];
+    inputSchema?: Json;
+    outputSchema?: Json;
+}
+/** Lifetime applied when createSignedAgentCard is not given an explicit expiresAt. */
+export declare const DEFAULT_AGENT_CARD_EXPIRY_MS: number;
+/** Longest allowed expiresAt - signedAt window. Matches the invite TTL cap of 30 days. */
+export declare const MAX_AGENT_CARD_EXPIRY_MS: number;
+/** Allowed future clock skew for newly minted invites, capability tokens, and task manifests. */
+export declare const DEFAULT_CLOCK_SKEW_MS = 60000;
+/**
+ * Statement signed by agentDid's key when the card owner is a different DID.
+ * Binds ownerDid, agentDid, relayEndpoint, and expiresAt. A signature for one tuple
+ * does not authorize a different owner, agent, relay, or expiry.
+ */
+export interface AgentCardDelegation {
+    type: 'AgentCardDelegation';
+    ownerDid: string;
+    agentDid: string;
+    relayEndpoint: string;
+    expiresAt: string;
+}
+export declare function agentCardDelegationStatement(fields: {
+    ownerDid: string;
+    agentDid: string;
+    relayEndpoint: string;
+    expiresAt: string;
+}): AgentCardDelegation;
+export type OpenPolicy = Partial<Pick<BudgetSpec, 'maxInputTokens' | 'maxOutputTokens' | 'maxToolInvocations' | 'maxWallClockSeconds'>>;
+export declare const OPEN_POLICY_FIELDS: readonly ["maxInputTokens", "maxOutputTokens", "maxToolInvocations", "maxWallClockSeconds"];
+export interface DiscoveryAgentCard {
+    type: 'AgentCard';
+    accessMode?: 'invite-only' | 'open';
+    openPolicy?: OpenPolicy;
+    name: string;
+    description: string;
+    ownerDid: string;
+    agentDid: string;
+    relayEndpoint: string;
+    skills: AgentSkill[];
+    costModes: BudgetSpec['costBearer'][];
+    version: string;
+    /** ISO-8601 timestamp after which the card must be rejected. */
+    expiresAt: string;
+    /**
+     * Signature by agentDid over agentCardDelegationStatement.
+     * Required when agentDid differs from ownerDid, and absent when they are the same key.
+     */
+    agentDelegation?: Signature;
+}
+export type CreateAgentCardOptions = Omit<DiscoveryAgentCard, 'type' | 'ownerDid' | 'version' | 'description' | 'costModes' | 'expiresAt' | 'agentDelegation'> & Partial<Pick<DiscoveryAgentCard, 'version' | 'description' | 'costModes' | 'expiresAt'>> & {
+    /** Key that controls agentDid. Required when agentDid is not owner.did. */
+    agentKey?: KeyPair;
+};
+export type SignedAgentCard = Signed<DiscoveryAgentCard>;
+export interface RelayEndpointPolicy {
+    /** Private and loopback relays are blocked unless this is exactly true. */
+    allowPrivateRelay?: boolean;
+}
+/** Reject an IP address that must not be used as a relay destination. */
+export declare function validateIpAddress(ip: string, options?: RelayEndpointPolicy): void;
+/** Validate literal endpoints before using an untrusted invite as a network destination. */
+export declare function validateRelayEndpointUrl(value: string, options?: RelayEndpointPolicy): void;
+export declare function createSignedAgentCard(options: CreateAgentCardOptions, owner: KeyPair, agentKey?: KeyPair): SignedAgentCard;
+export declare function verifySignedAgentCard(card: SignedAgentCard, now?: number): boolean;
+/** Select a verified card independently of directory order. Exact agent DIDs win. */
+export declare function findDiscoveredAgentCard(rawCards: unknown, targetDid: string, now?: number): SignedAgentCard | undefined;
+export declare function toA2AAgentCard(card: SignedAgentCard): {
+    name: string;
+    description: string;
+    url: string;
+    version: string;
+    protocolVersion: string;
+    capabilities: {
+        streaming: boolean;
+    };
+    defaultInputModes: string[];
+    defaultOutputModes: string[];
+    skills: {
+        description: string;
+        tags: string[];
+        id: string;
+        name: string;
+        taskTypes?: string[];
+        inputSchema?: Json;
+        outputSchema?: Json;
+    }[];
+    ownerDid: string;
+    agentDid: string;
+    relayEndpoint: string;
+    expiresAt: string;
+    costModes: ("worker_byok" | "bilateral_quota" | "external_settlement_plugin")[];
+    signedAgentCard: SignedAgentCard;
+};
+export interface Invite {
+    type: 'AgentInvite';
+    ownerDid: string;
+    agentDid: string;
+    relayUrl: string;
+    agentCard: SignedAgentCard;
+    issuedAt: string;
+    expiresAt: string;
+}
+export declare function createInviteToken(options: {
+    agentCard: SignedAgentCard;
+    expiresInSeconds?: number;
+    issuedAt?: string;
+    format?: 'acp-invite' | 'acp';
+}, owner: KeyPair): string;
+/** Extract invitation material locally; HTTPS links are never fetched. */
+export declare function inviteTokenFromUri(uri: string): string;
+export declare function isInviteTarget(value: string): boolean;
+export declare function parseAndVerifyInviteToken(uri: string, now?: number, options?: {
+    allowPrivateRelay?: boolean;
+    /** Verify historical invites for revocation lookup without requiring current validity. */
+    allowExpired?: boolean;
+}): Invite;
+/** Resolve current signed cards before filtering, so stale advertisements cannot reopen access. */
+export declare function discoverAgentCards(rawCards: unknown, query?: {
+    did?: string;
+    skillId?: string;
+    taskType?: string;
+    accessMode?: 'invite-only' | 'open';
+}, now?: number): SignedAgentCard[];