@7h3/protocol 0.1.2 → 0.4.0

package/revocation.d.ts

@@ -1,71 +0,0 @@
-import type { ProtocolEnvelope, SignatureVerificationMaterial } from './protocol';
-import type { RedisLikeClient } from './redisClient';
-/**
- * A shared key-revocation list consulted on the verification hot path.
- *
- * `RollingKeyring` enforces revocation in-process; a `RevocationStore` makes a
- * revocation effective fleet-wide: revoke a `(sender, keyId)` on one node and
- * every node that consults the same store rejects it.
- */
-export interface RevocationStore {
-    isRevoked(sender: string, keyId: string, nowMs?: number): boolean | Promise<boolean>;
-    revoke(sender: string, keyId: string, options?: {
-        untilMs?: number;
-    }): void | Promise<void>;
-}
-/** Single-process revocation list (tests, local dev, single-node deployments). */
-export declare class InMemoryRevocationStore implements RevocationStore {
-    /** keyId map value: revoked-until timestamp, or `Infinity` for permanent. */
-    private readonly revoked;
-    private readonly now;
-    constructor(options?: {
-        now?: () => number;
-    });
-    private makeKey;
-    isRevoked(sender: string, keyId: string, nowMs?: number): boolean;
-    revoke(sender: string, keyId: string, options?: {
-        untilMs?: number;
-    }): void;
-}
-/** Behavior when the Redis client throws while checking revocation. */
-export type RevocationErrorBehavior = 'reject' | 'allow';
-export interface RedisRevocationStoreOptions {
-    /** Key namespace in Redis. Default `aip:revoked:`. */
-    keyPrefix?: string;
-    /**
-     * Behavior when the Redis client throws.
-     * - `reject` (default): fail closed — treat the key as revoked. A revoked key
-     *   is a compromised key; never accept on uncertainty.
-     * - `allow`: treat the key as not revoked (favor availability).
-     */
-    errorBehavior?: RevocationErrorBehavior;
-    /** Local cache freshness window in ms for `isRevoked` reads. Default 5000. */
-    cacheTtlMs?: number;
-    /** Observability hook fired whenever a Redis error forces degraded handling. */
-    onDegraded?: (error: unknown, context: {
-        sender: string;
-        keyId: string;
-    }) => void;
-    /** Clock override (testing). */
-    now?: () => number;
-}
-/**
- * Creates a Redis-backed {@link RevocationStore}.
- *
- * Reads are served from a short-lived local cache so the verification hot path
- * does not hit Redis on every message; known revocations therefore keep
- * enforcing even through a brief Redis outage.
- */
-export declare function createRedisRevocationStore(client: Pick<RedisLikeClient, 'set' | 'get' | 'del'>, options?: RedisRevocationStoreOptions): RevocationStore;
-type SignatureResolver = (signature: NonNullable<ProtocolEnvelope['signature']>, sender: string) => SignatureVerificationMaterial | undefined | Promise<SignatureVerificationMaterial | undefined>;
-/**
- * Wraps a signature resolver so that a revoked `(sender, keyId)` resolves to no
- * material — which makes signature verification fail and the envelope is rejected.
- *
- * Compose over `createKeyringSignatureResolver` (or any resolver) and pass the
- * result as the transport `signatureResolver`.
- */
-export declare function withRevocationCheck(resolver: SignatureResolver, store: RevocationStore, options?: {
-    nowMsProvider?: () => number;
-}): SignatureResolver;
-export {};

package/runtimePolicy.d.ts

@@ -1,24 +0,0 @@
-export interface RuntimePolicy {
-    version: string;
-    name: string;
-    status: string;
-    owner?: string;
-    updated_at?: string;
-    hard_invariants?: Record<string, unknown>;
-    slo_defaults?: Record<string, unknown>;
-    mode_selection?: Record<string, unknown>;
-    guardrails?: Record<string, unknown>;
-    tuning?: Record<string, unknown>;
-    adaptive_flow?: Record<string, unknown>;
-    benchmark_policy?: Record<string, unknown>;
-    runtime_decision_tree?: unknown[];
-    operator_handoff_required_fields?: string[];
-    [key: string]: unknown;
-}
-export interface LoadRuntimePolicyOptions {
-    path?: string;
-    readTextFile?: (filePath: string) => Promise<string>;
-}
-export declare function validateRuntimePolicy(value: unknown): RuntimePolicy;
-export declare function parseRuntimePolicyJson(jsonText: string): RuntimePolicy;
-export declare function loadRuntimePolicy(options?: LoadRuntimePolicyOptions): Promise<RuntimePolicy>;

package/runtimePolicyManager.d.ts

@@ -1,15 +0,0 @@
-import { type BootstrapRuntimePolicyEnforcerOptions, type PolicyEnforcer } from './policyEnforcer';
-import type { RuntimePolicy } from './runtimePolicy';
-export interface RuntimePolicySnapshot {
-    policy: RuntimePolicy;
-    enforcer: PolicyEnforcer;
-    loadedAtMs: number;
-}
-export declare class RuntimePolicyManager {
-    private snapshot;
-    private readonly options;
-    constructor(options?: BootstrapRuntimePolicyEnforcerOptions);
-    loadInitial(): Promise<RuntimePolicySnapshot>;
-    current(): RuntimePolicySnapshot;
-    refresh(): Promise<RuntimePolicySnapshot>;
-}

package/runtimePolicyPresets.d.ts

@@ -1,11 +0,0 @@
-import type { RuntimeMode } from './policyEnforcer';
-export type RuntimeEnvironment = 'dev' | 'staging' | 'prod';
-export interface RuntimeTuningPreset {
-    environment: RuntimeEnvironment;
-    mode: RuntimeMode;
-    poolSize: number;
-    batchSize: number;
-    inflightCap: number;
-    retryMaxAttempts: number;
-}
-export declare function getRuntimeTuningPreset(environment: RuntimeEnvironment): RuntimeTuningPreset;