@7h3/protocol 0.5.0 → 0.5.1

package/src/protocol.ts

@@ -1,414 +0,0 @@
-export type ProtocolVersion = '7h3/0.1'
-
-export type IntentKind =
-  | 'PING'
-  | 'PONG'
-  | 'CAPS'
-  | 'TASK'
-  | 'RESULT'
-  | 'ERROR'
-  | 'ENCRYPTED'
-
-export interface ProtocolHeader {
-  version: ProtocolVersion
-  messageId: string
-  timestampMs: number
-  ttlMs: number
-  sender: string
-  recipient?: string
-  nonce: string
-}
-
-export interface ProtocolBody {
-  intent: IntentKind
-  content: string
-  capability?: string
-  correlationId?: string
-}
-
-export interface ProtocolSignature {
-  alg: 'HS256' | 'ED25519'
-  keyId: string
-  value: string
-}
-
-export interface ProtocolEnvelope {
-  header: ProtocolHeader
-  body: ProtocolBody
-  signature?: ProtocolSignature
-}
-
-export interface ProtocolDiagnostic {
-  level: 'error' | 'warning'
-  message: string
-}
-
-const textEncoder = new TextEncoder()
-const HMAC_KEY_CACHE_LIMIT = 256
-const hmacKeyCache = new Map<string, Promise<CryptoKey>>()
-const ED25519_KEY_CACHE_LIMIT = 256
-const ed25519PrivateKeyCache = new Map<string, Promise<CryptoKey>>()
-const ed25519PublicKeyCache = new Map<string, Promise<CryptoKey>>()
-
-export type SignatureVerificationMaterial =
-  | { alg: 'HS256'; secret: string }
-  | { alg: 'ED25519'; publicKey: string }
-
-type BufferLike = {
-  from: (input: string | Uint8Array, encoding?: string) => Uint8Array & { toString: (encoding?: string) => string }
-}
-
-function getBufferLike(): BufferLike | null {
-  const candidate = globalThis as unknown as { Buffer?: BufferLike }
-  return candidate.Buffer ?? null
-}
-
-function serializeHeaderCanonical(header: ProtocolHeader): string {
-  const parts: string[] = [
-    `"messageId":${JSON.stringify(header.messageId)}`,
-    `"nonce":${JSON.stringify(header.nonce)}`,
-  ]
-  if (header.recipient !== undefined) {
-    parts.push(`"recipient":${JSON.stringify(header.recipient)}`)
-  }
-  parts.push(`"sender":${JSON.stringify(header.sender)}`)
-  parts.push(`"timestampMs":${header.timestampMs}`)
-  parts.push(`"ttlMs":${header.ttlMs}`)
-  parts.push(`"version":${JSON.stringify(header.version)}`)
-  return `{${parts.join(',')}}`
-}
-
-function serializeBodyCanonical(body: ProtocolBody): string {
-  const parts: string[] = []
-  if (body.capability !== undefined) {
-    parts.push(`"capability":${JSON.stringify(body.capability)}`)
-  }
-  parts.push(`"content":${JSON.stringify(body.content)}`)
-  if (body.correlationId !== undefined) {
-    parts.push(`"correlationId":${JSON.stringify(body.correlationId)}`)
-  }
-  parts.push(`"intent":${JSON.stringify(body.intent)}`)
-  return `{${parts.join(',')}}`
-}
-
-function getCachedHmacKey(secret: string): Promise<CryptoKey> {
-  const cacheKey = `hs256:${secret}`
-  const cached = hmacKeyCache.get(cacheKey)
-  if (cached) return cached
-
-  if (hmacKeyCache.size >= HMAC_KEY_CACHE_LIMIT) {
-    hmacKeyCache.clear()
-  }
-
-  const subtle = requireCryptoSubtle()
-  const imported = subtle
-    .importKey(
-      'raw',
-      textEncoder.encode(secret),
-      { name: 'HMAC', hash: 'SHA-256' },
-      false,
-      ['sign', 'verify'],
-    )
-    .catch((error: unknown) => {
-      hmacKeyCache.delete(cacheKey)
-      throw error
-    })
-
-  hmacKeyCache.set(cacheKey, imported)
-  return imported
-}
-
-function getCachedEd25519PrivateKey(privateKeyPkcs8Base64Url: string): Promise<CryptoKey> {
-  const cacheKey = `ed25519:pkcs8:${privateKeyPkcs8Base64Url}`
-  const cached = ed25519PrivateKeyCache.get(cacheKey)
-  if (cached) return cached
-
-  if (ed25519PrivateKeyCache.size >= ED25519_KEY_CACHE_LIMIT) {
-    ed25519PrivateKeyCache.clear()
-  }
-
-  const subtle = requireCryptoSubtle()
-  const imported = subtle
-    .importKey('pkcs8', toArrayBuffer(fromBase64Url(privateKeyPkcs8Base64Url)), { name: 'Ed25519' }, false, ['sign'])
-    .catch((error: unknown) => {
-      ed25519PrivateKeyCache.delete(cacheKey)
-      throw error
-    })
-  ed25519PrivateKeyCache.set(cacheKey, imported)
-  return imported
-}
-
-function getCachedEd25519PublicKey(publicKeySpkiBase64Url: string): Promise<CryptoKey> {
-  const cacheKey = `ed25519:spki:${publicKeySpkiBase64Url}`
-  const cached = ed25519PublicKeyCache.get(cacheKey)
-  if (cached) return cached
-
-  if (ed25519PublicKeyCache.size >= ED25519_KEY_CACHE_LIMIT) {
-    ed25519PublicKeyCache.clear()
-  }
-
-  const subtle = requireCryptoSubtle()
-  const imported = subtle
-    .importKey('spki', toArrayBuffer(fromBase64Url(publicKeySpkiBase64Url)), { name: 'Ed25519' }, false, ['verify'])
-    .catch((error: unknown) => {
-      ed25519PublicKeyCache.delete(cacheKey)
-      throw error
-    })
-  ed25519PublicKeyCache.set(cacheKey, imported)
-  return imported
-}
-
-function toBase64Url(bytes: Uint8Array): string {
-  const bufferLike = getBufferLike()
-  const base64 = bufferLike ? bufferLike.from(bytes).toString('base64') : btoa(String.fromCharCode(...bytes))
-  return base64
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(/=+$/g, '')
-}
-
-function fromBase64Url(value: string): Uint8Array {
-  const padded = value
-    .replace(/-/g, '+')
-    .replace(/_/g, '/')
-    .padEnd(Math.ceil(value.length / 4) * 4, '=')
-
-  const bufferLike = getBufferLike()
-  if (bufferLike) {
-    return new Uint8Array(bufferLike.from(padded, 'base64'))
-  }
-
-  const binary = atob(padded)
-  const bytes = new Uint8Array(binary.length)
-  for (let i = 0; i < binary.length; i += 1) {
-    bytes[i] = binary.charCodeAt(i)
-  }
-  return bytes
-}
-
-function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
-  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer
-}
-
-export function canonicalizeEnvelope(envelope: Omit<ProtocolEnvelope, 'signature'>): string {
-  return `{"body":${serializeBodyCanonical(envelope.body)},"header":${serializeHeaderCanonical(envelope.header)}}`
-}
-
-function requireCryptoSubtle(): SubtleCrypto {
-  if (typeof crypto === 'undefined' || !crypto.subtle) {
-    throw new Error('Web Crypto API is not available in this runtime')
-  }
-  return crypto.subtle
-}
-
-async function hmacSign(payload: string, secret: string): Promise<string> {
-  const subtle = requireCryptoSubtle()
-  const key = await getCachedHmacKey(secret)
-  const signature = await subtle.sign('HMAC', key, textEncoder.encode(payload))
-  return toBase64Url(new Uint8Array(signature))
-}
-
-async function hmacVerify(payload: string, signature: string, secret: string): Promise<boolean> {
-  const subtle = requireCryptoSubtle()
-  const key = await getCachedHmacKey(secret)
-  const signatureBytes = fromBase64Url(signature)
-  return subtle.verify('HMAC', key, signatureBytes.buffer as ArrayBuffer, textEncoder.encode(payload))
-}
-
-async function ed25519Sign(payload: string, privateKeyPkcs8Base64Url: string): Promise<string> {
-  const subtle = requireCryptoSubtle()
-  const key = await getCachedEd25519PrivateKey(privateKeyPkcs8Base64Url)
-  const signature = await subtle.sign('Ed25519', key, textEncoder.encode(payload))
-  return toBase64Url(new Uint8Array(signature))
-}
-
-async function ed25519Verify(payload: string, signature: string, publicKeySpkiBase64Url: string): Promise<boolean> {
-  const subtle = requireCryptoSubtle()
-  const key = await getCachedEd25519PublicKey(publicKeySpkiBase64Url)
-  const signatureBytes = fromBase64Url(signature)
-  return subtle.verify('Ed25519', key, signatureBytes.buffer as ArrayBuffer, textEncoder.encode(payload))
-}
-
-export async function signCanonicalPayloadHmac(payload: string, secret: string): Promise<string> {
-  return hmacSign(payload, secret)
-}
-
-export async function verifyCanonicalPayloadHmac(payload: string, signature: string, secret: string): Promise<boolean> {
-  return hmacVerify(payload, signature, secret)
-}
-
-export async function generateEd25519KeypairBase64Url(): Promise<{ publicKey: string; privateKey: string }> {
-  const subtle = requireCryptoSubtle()
-  const pair = await subtle.generateKey({ name: 'Ed25519' }, true, ['sign', 'verify'])
-  const privateKeyRaw = await subtle.exportKey('pkcs8', pair.privateKey)
-  const publicKeyRaw = await subtle.exportKey('spki', pair.publicKey)
-  return {
-    privateKey: toBase64Url(new Uint8Array(privateKeyRaw)),
-    publicKey: toBase64Url(new Uint8Array(publicKeyRaw)),
-  }
-}
-
-export async function signCanonicalPayloadEd25519(payload: string, privateKeyPkcs8Base64Url: string): Promise<string> {
-  return ed25519Sign(payload, privateKeyPkcs8Base64Url)
-}
-
-export async function verifyCanonicalPayloadEd25519(
-  payload: string,
-  signature: string,
-  publicKeySpkiBase64Url: string,
-): Promise<boolean> {
-  return ed25519Verify(payload, signature, publicKeySpkiBase64Url)
-}
-
-export async function signEnvelopeHmac(
-  envelope: Omit<ProtocolEnvelope, 'signature'>,
-  secret: string,
-  keyId = 'local-dev-key',
-): Promise<ProtocolEnvelope> {
-  const payload = canonicalizeEnvelope(envelope)
-  const signature = await hmacSign(payload, secret)
-  return {
-    ...envelope,
-    signature: {
-      alg: 'HS256',
-      keyId,
-      value: signature,
-    },
-  }
-}
-
-export async function verifyEnvelopeHmac(envelope: ProtocolEnvelope, secret: string): Promise<boolean> {
-  if (!envelope.signature) return false
-  if (envelope.signature.alg !== 'HS256') return false
-
-  const unsigned: Omit<ProtocolEnvelope, 'signature'> = {
-    header: envelope.header,
-    body: envelope.body,
-  }
-  const payload = canonicalizeEnvelope(unsigned)
-  return hmacVerify(payload, envelope.signature.value, secret)
-}
-
-export async function signEnvelopeEd25519(
-  envelope: Omit<ProtocolEnvelope, 'signature'>,
-  privateKeyPkcs8Base64Url: string,
-  keyId = 'local-ed25519-key',
-): Promise<ProtocolEnvelope> {
-  const payload = canonicalizeEnvelope(envelope)
-  const signature = await ed25519Sign(payload, privateKeyPkcs8Base64Url)
-  return {
-    ...envelope,
-    signature: {
-      alg: 'ED25519',
-      keyId,
-      value: signature,
-    },
-  }
-}
-
-export async function verifyEnvelopeEd25519(envelope: ProtocolEnvelope, publicKeySpkiBase64Url: string): Promise<boolean> {
-  if (!envelope.signature) return false
-  if (envelope.signature.alg !== 'ED25519') return false
-
-  const unsigned: Omit<ProtocolEnvelope, 'signature'> = {
-    header: envelope.header,
-    body: envelope.body,
-  }
-  const payload = canonicalizeEnvelope(unsigned)
-  return ed25519Verify(payload, envelope.signature.value, publicKeySpkiBase64Url)
-}
-
-export async function verifyEnvelopeSignature(
-  envelope: ProtocolEnvelope,
-  material: SignatureVerificationMaterial,
-): Promise<boolean> {
-  if (!envelope.signature) return false
-  if (envelope.signature.alg !== material.alg) return false
-  if (material.alg === 'HS256') {
-    return verifyEnvelopeHmac(envelope, material.secret)
-  }
-  return verifyEnvelopeEd25519(envelope, material.publicKey)
-}
-
-export async function verifyCanonicalPayloadSignature(
-  payload: string,
-  signature: ProtocolSignature | undefined,
-  material: SignatureVerificationMaterial,
-): Promise<boolean> {
-  if (!signature) return false
-  if (signature.alg !== material.alg) return false
-  if (material.alg === 'HS256') {
-    return verifyCanonicalPayloadHmac(payload, signature.value, material.secret)
-  }
-  return verifyCanonicalPayloadEd25519(payload, signature.value, material.publicKey)
-}
-
-export function validateEnvelope(envelope: ProtocolEnvelope, nowMs = Date.now()): ProtocolDiagnostic[] {
-  const diagnostics: ProtocolDiagnostic[] = []
-  const header = (envelope as Partial<ProtocolEnvelope>).header ?? ({} as Partial<ProtocolHeader>)
-  const body = (envelope as Partial<ProtocolEnvelope>).body ?? ({} as Partial<ProtocolBody>)
-
-  const version = typeof header.version === 'string' ? header.version : ''
-  const messageId = typeof header.messageId === 'string' ? header.messageId : ''
-  const sender = typeof header.sender === 'string' ? header.sender : ''
-  const nonce = typeof header.nonce === 'string' ? header.nonce : ''
-  const timestampMs = typeof header.timestampMs === 'number' ? header.timestampMs : 0
-  const ttlMs = typeof header.ttlMs === 'number' ? header.ttlMs : 0
-  const content = typeof body.content === 'string' ? body.content : ''
-
-  if (version !== '7h3/0.1') {
-    diagnostics.push({ level: 'error', message: `Unsupported protocol version '${version}'` })
-  }
-  if (!messageId.trim()) {
-    diagnostics.push({ level: 'error', message: 'Missing messageId' })
-  }
-  if (!sender.trim()) {
-    diagnostics.push({ level: 'error', message: 'Missing sender identity' })
-  }
-  if (!nonce.trim()) {
-    diagnostics.push({ level: 'error', message: 'Missing nonce — replay protection requires a unique nonce per message' })
-  }
-  if (ttlMs <= 0) {
-    diagnostics.push({ level: 'error', message: 'ttlMs must be greater than zero' })
-  }
-  if (timestampMs + ttlMs < nowMs) {
-    diagnostics.push({ level: 'error', message: 'Message TTL expired' })
-  }
-  if (!content.trim()) {
-    diagnostics.push({ level: 'warning', message: 'Empty content payload' })
-  }
-
-  return diagnostics
-}
-
-export function createEnvelope(input: {
-  sender: string
-  recipient?: string
-  intent: IntentKind
-  content: string
-  capability?: string
-  correlationId?: string
-  ttlMs?: number
-  messageId?: string
-  nonce?: string
-  nowMs?: number
-}): Omit<ProtocolEnvelope, 'signature'> {
-  const nowMs = input.nowMs ?? Date.now()
-  return {
-    header: {
-      version: '7h3/0.1',
-      messageId: input.messageId ?? `msg-${nowMs}-${Math.random().toString(36).slice(2, 10)}`,
-      timestampMs: nowMs,
-      ttlMs: input.ttlMs ?? 60_000,
-      sender: input.sender,
-      recipient: input.recipient,
-      nonce: input.nonce ?? Math.random().toString(36).slice(2, 12),
-    },
-    body: {
-      intent: input.intent,
-      content: input.content,
-      capability: input.capability,
-      correlationId: input.correlationId,
-    },
-  }
-}

package/src/protocolAgent.test.ts

@@ -1,105 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { AgentSession } from './protocolAgent'
-import { negotiateAipCapabilities, parseAipCapabilities } from './protocolCapabilities'
-import { encodeEnvelope, receiveEnvelope } from './protocolTransport'
-
-describe('AgentSession protocol loop', () => {
-  const alpha = new AgentSession({
-    agentId: 'agent.alpha',
-    outboundSecret: 'alpha-secret',
-    sharedSecrets: {
-      'agent.beta': 'beta-secret',
-    },
-  })
-
-  const beta = new AgentSession({
-    agentId: 'agent.beta',
-    outboundSecret: 'beta-secret',
-    capabilities: ['math.mul2', 'task.plan'],
-    sharedSecrets: {
-      'agent.alpha': 'alpha-secret',
-    },
-    onTask: async (envelope) => ({
-      intent: 'RESULT',
-      content: `task accepted:${envelope.body.content}`,
-      capability: envelope.body.capability,
-    }),
-  })
-
-  it('responds to PING with signed PONG', async () => {
-    const ping = await alpha.createSignedIntent({
-      recipient: 'agent.beta',
-      intent: 'PING',
-      content: 'hello',
-      messageId: 'p-1',
-      nonce: 'n-1',
-      nowMs: 1000,
-    })
-
-    const receivedByBeta = await beta.receiveAndRespond(encodeEnvelope(ping), 1000)
-    expect(receivedByBeta.ok).toBe(true)
-    expect(receivedByBeta.response?.body.intent).toBe('PONG')
-
-    const receivedByAlpha = await receiveEnvelope(receivedByBeta.response!, {
-      nowMs: 1001,
-      secretResolver: async () => 'beta-secret',
-      requireSignature: true,
-    })
-    expect(receivedByAlpha.ok).toBe(true)
-    expect(receivedByAlpha.envelope?.body.correlationId).toBe('p-1')
-  })
-
-  it('responds to CAPS with capability payload', async () => {
-    const capsReq = await alpha.createSignedIntent({
-      recipient: 'agent.beta',
-      intent: 'CAPS',
-      content: 'what can you do?',
-      messageId: 'c-1',
-      nonce: 'n-2',
-      nowMs: 1100,
-    })
-
-    const receivedByBeta = await beta.receiveAndRespond(capsReq, 1100)
-    expect(receivedByBeta.ok).toBe(true)
-    expect(receivedByBeta.response?.body.intent).toBe('RESULT')
-
-    const parsed = JSON.parse(receivedByBeta.response?.body.content ?? '{}') as {
-      agent?: string
-      capabilities?: string[]
-      wireFormats?: string[]
-      batchMax?: number
-    }
-    expect(parsed.agent).toBe('agent.beta')
-    expect(parsed.capabilities).toContain('math.mul2')
-    expect(parsed.wireFormats).toContain('compact')
-    expect(parsed.batchMax).toBe(1)
-  })
-
-  it('negotiates shared wire capabilities from CAPS payloads', () => {
-    const local = parseAipCapabilities('{"agent":"local","capabilities":[],"wireFormats":["binary","compact"],"batchMax":16,"ackModes":["fast","receipt"]}')
-    const remote = parseAipCapabilities('{"agent":"remote","capabilities":[],"wireFormats":["compact","json"],"batchMax":8,"ackModes":["receipt"]}')
-    expect(local).not.toBeNull()
-    expect(remote).not.toBeNull()
-
-    const negotiated = negotiateAipCapabilities(local!, remote!)
-    expect(negotiated).toEqual({ wireFormat: 'compact', batchMax: 8, ackMode: 'receipt' })
-  })
-
-  it('handles TASK with custom task handler', async () => {
-    const task = await alpha.createSignedIntent({
-      recipient: 'agent.beta',
-      intent: 'TASK',
-      content: 'plan route',
-      capability: 'task.plan',
-      messageId: 't-1',
-      nonce: 'n-3',
-      nowMs: 1200,
-    })
-
-    const receivedByBeta = await beta.receiveAndRespond(task, 1200)
-    expect(receivedByBeta.ok).toBe(true)
-    expect(receivedByBeta.response?.body.intent).toBe('RESULT')
-    expect(receivedByBeta.response?.body.content).toContain('task accepted:plan route')
-    expect(receivedByBeta.response?.body.correlationId).toBe('t-1')
-  })
-})

package/src/protocolAgent.ts

@@ -1,169 +0,0 @@
-import { createEnvelope, signEnvelopeHmac, type IntentKind, type ProtocolDiagnostic, type ProtocolEnvelope } from './protocol'
-import { createAipCapabilities, encodeAipCapabilities, type AckMode } from './protocolCapabilities'
-import { InMemoryReplayCache } from './protocolReplay'
-import { receiveEnvelope, type WireEnvelope, type WireFormat } from './protocolTransport'
-
-export interface TaskHandlerResult {
-  intent?: 'RESULT' | 'ERROR'
-  content: string
-  capability?: string
-}
-
-export interface AgentSessionConfig {
-  agentId: string
-  outboundSecret: string
-  keyId?: string
-  capabilities?: string[]
-  supportedWireFormats?: WireFormat[]
-  maxBatchSize?: number
-  ackModes?: AckMode[]
-  requireSignature?: boolean
-  replayCache?: InMemoryReplayCache
-  sharedSecrets?: Record<string, string>
-  resolveInboundSecret?: (keyId: string, sender: string) => string | undefined | Promise<string | undefined>
-  onTask?: (envelope: ProtocolEnvelope) => TaskHandlerResult | Promise<TaskHandlerResult>
-}
-
-export interface AgentReceiveResult {
-  ok: boolean
-  diagnostics: ProtocolDiagnostic[]
-  received: ProtocolEnvelope | null
-  response: ProtocolEnvelope | null
-}
-
-export class AgentSession {
-  private readonly agentId: string
-  private readonly outboundSecret: string
-  private readonly keyId: string
-  private readonly capabilities: string[]
-  private readonly supportedWireFormats: WireFormat[]
-  private readonly maxBatchSize: number
-  private readonly ackModes: AckMode[]
-  private readonly requireSignature: boolean
-  private readonly replayCache: InMemoryReplayCache
-  private readonly sharedSecrets: Record<string, string>
-  private readonly resolveInboundSecret?: (keyId: string, sender: string) => string | undefined | Promise<string | undefined>
-  private readonly onTask?: (envelope: ProtocolEnvelope) => TaskHandlerResult | Promise<TaskHandlerResult>
-
-  constructor(config: AgentSessionConfig) {
-    this.agentId = config.agentId
-    this.outboundSecret = config.outboundSecret
-    this.keyId = config.keyId ?? `${config.agentId}-k1`
-    this.capabilities = config.capabilities ?? []
-    this.supportedWireFormats = config.supportedWireFormats ?? ['compact', 'json']
-    this.maxBatchSize = config.maxBatchSize ?? 1
-    this.ackModes = config.ackModes ?? ['receipt']
-    this.requireSignature = config.requireSignature ?? true
-    this.replayCache = config.replayCache ?? new InMemoryReplayCache()
-    this.sharedSecrets = config.sharedSecrets ?? {}
-    this.resolveInboundSecret = config.resolveInboundSecret
-    this.onTask = config.onTask
-  }
-
-  private async inboundSecretResolver(keyId: string, sender: string): Promise<string | undefined> {
-    if (this.resolveInboundSecret) {
-      return this.resolveInboundSecret(keyId, sender)
-    }
-    return this.sharedSecrets[sender]
-  }
-
-  async createSignedIntent(input: {
-    recipient?: string
-    intent: IntentKind
-    content: string
-    capability?: string
-    correlationId?: string
-    ttlMs?: number
-    messageId?: string
-    nonce?: string
-    nowMs?: number
-  }): Promise<ProtocolEnvelope> {
-    const unsigned = createEnvelope({
-      sender: this.agentId,
-      recipient: input.recipient,
-      intent: input.intent,
-      content: input.content,
-      capability: input.capability,
-      correlationId: input.correlationId,
-      ttlMs: input.ttlMs,
-      messageId: input.messageId,
-      nonce: input.nonce,
-      nowMs: input.nowMs,
-    })
-    return signEnvelopeHmac(unsigned, this.outboundSecret, this.keyId)
-  }
-
-  async receiveAndRespond(input: WireEnvelope | ProtocolEnvelope, nowMs = Date.now()): Promise<AgentReceiveResult> {
-    const received = await receiveEnvelope(input, {
-      nowMs,
-      requireSignature: this.requireSignature,
-      replayCache: this.replayCache,
-      secretResolver: (keyId, sender) => this.inboundSecretResolver(keyId, sender),
-    })
-
-    if (!received.ok || !received.envelope) {
-      return {
-        ok: false,
-        diagnostics: received.diagnostics,
-        received: received.envelope,
-        response: null,
-      }
-    }
-
-    const envelope = received.envelope
-    const response = await this.buildAutoResponse(envelope, nowMs)
-    return {
-      ok: true,
-      diagnostics: received.diagnostics,
-      received: envelope,
-      response,
-    }
-  }
-
-  private async buildAutoResponse(envelope: ProtocolEnvelope, nowMs: number): Promise<ProtocolEnvelope | null> {
-    if (envelope.body.intent === 'PING') {
-      return this.createSignedIntent({
-        recipient: envelope.header.sender,
-        intent: 'PONG',
-        content: 'pong',
-        correlationId: envelope.header.messageId,
-        nowMs,
-      })
-    }
-
-    if (envelope.body.intent === 'CAPS') {
-      return this.createSignedIntent({
-        recipient: envelope.header.sender,
-        intent: 'RESULT',
-        content: encodeAipCapabilities(
-          createAipCapabilities({
-            agent: this.agentId,
-            capabilities: this.capabilities,
-            wireFormats: this.supportedWireFormats,
-            batchMax: this.maxBatchSize,
-            ackModes: this.ackModes,
-          }),
-        ),
-        capability: 'caps',
-        correlationId: envelope.header.messageId,
-        nowMs,
-      })
-    }
-
-    if (envelope.body.intent === 'TASK') {
-      const taskResult = this.onTask
-        ? await this.onTask(envelope)
-        : { intent: 'RESULT' as const, content: 'ACK', capability: envelope.body.capability }
-      return this.createSignedIntent({
-        recipient: envelope.header.sender,
-        intent: taskResult.intent ?? 'RESULT',
-        content: taskResult.content,
-        capability: taskResult.capability,
-        correlationId: envelope.header.messageId,
-        nowMs,
-      })
-    }
-
-    return null
-  }
-}