End-to-end device relay envelopes and workspace content keys. A browser, phone
or device seals a payload to the target device with HPKE and signs it with
Ed25519; the relay stores and forwards envelopes it cannot read. Pure WebCrypto,
@hpke and Zod, so the same modules run in pi-host, the browser, the phone and
the relay worker — no transport, no credentials, no secrets.
Install
bun add @adea-ai/runtime-gateway-protocol
Subpath exports
Path
Contents
./device-relay
Authenticated relay envelopes, signed sender keyrings and replay checks
./content-key
Workspace content keys: derivation, sealing and signed key wraps
.
Both of the above
Usage
import { sealAuthenticatedRelayCommand } from '@adea-ai/runtime-gateway-protocol/device-relay'
import { sealContent } from '@adea-ai/runtime-gateway-protocol/content-key'