@7h3/protocol 0.5.2 → 0.5.4

package/keyRegistry.d.ts

@@ -1,6 +1,6 @@
 export interface KeyRegistry {
     getPublicKey(senderId: string): Promise<string | null>;
-    getSharedSecret?(keyId: string): Promise<string | null>;
+    getSharedSecret?(keyId: string, sender: string): Promise<string | null>;
 }
 export declare function createStaticKeyRegistry(keys: Record<string, string>): KeyRegistry;
 export declare function createCompositeKeyRegistry(...registries: KeyRegistry[]): KeyRegistry;

package/package.json

@@ -1,24 +1,106 @@
 {
   "name": "@7h3/protocol",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "7h3 Protocol: deterministic, signed, replay-safe AI-to-AI message envelopes (wire 7h3/0.1).",
   "type": "module",
   "main": "./index.js",
   "types": "./index.d.ts",
   "exports": {
     ".": {
-      "import": "./index.js",
-      "types": "./index.d.ts"
+      "types": "./index.d.ts",
+      "import": "./index.js"
+    },
+    "./protocol": {
+      "types": "./index.d.ts",
+      "import": "./index.js"
+    },
+    "./http": {
+      "types": "./httpBinding.d.ts",
+      "import": "./index.js"
+    },
+    "./webhook": {
+      "types": "./webhookBinding.d.ts",
+      "import": "./index.js"
+    },
+    "./queue": {
+      "types": "./queueBinding.d.ts",
+      "import": "./index.js"
+    },
+    "./ws": {
+      "types": "./wsBinding.d.ts",
+      "import": "./index.js"
+    },
+    "./grpc": {
+      "types": "./grpcBinding.d.ts",
+      "import": "./index.js"
+    },
+    "./keys": {
+      "types": "./keyInfra.d.ts",
+      "import": "./index.js"
+    },
+    "./key-registry": {
+      "types": "./keyRegistry.d.ts",
+      "import": "./index.js"
+    },
+    "./gateway": {
+      "types": "./gateway.d.ts",
+      "import": "./index.js"
+    },
+    "./audit-log": {
+      "types": "./auditLog.d.ts",
+      "import": "./index.js"
+    },
+    "./signed-response": {
+      "types": "./signedResponse.d.ts",
+      "import": "./index.js"
+    },
+    "./rate-limiter": {
+      "types": "./rateLimiter.d.ts",
+      "import": "./index.js"
+    },
+    "./route-policy": {
+      "types": "./routePolicy.d.ts",
+      "import": "./index.js"
+    },
+    "./encryption": {
+      "types": "./encryption.d.ts",
+      "import": "./index.js"
+    },
+    "./capability": {
+      "types": "./capability.d.ts",
+      "import": "./index.js"
+    },
+    "./stream": {
+      "types": "./stream.d.ts",
+      "import": "./index.js"
+    },
+    "./telemetry": {
+      "types": "./telemetry.d.ts",
+      "import": "./index.js"
+    },
+    "./cbor": {
+      "types": "./envelopeCbor.d.ts",
+      "import": "./index.js"
+    },
+    "./replay": {
+      "types": "./replayStores.d.ts",
+      "import": "./index.js"
     }
   },
+  "bin": {
+    "7h3": "./bin/7h3.js"
+  },
   "files": [
     "index.js",
     "*.d.ts",
-    "README.md"
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "bin/7h3.js"
   ],
-  "license": "MIT",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "https://github.com/IceMasterT/7h3-protocol-aip.git"
+    "url": "https://github.com/IceMasterT/7h3-protocol.git"
   }
 }

package/protocol.d.ts

@@ -56,6 +56,7 @@ export declare function signEnvelopeEd25519(envelope: Omit<ProtocolEnvelope, 'si
 export declare function verifyEnvelopeEd25519(envelope: ProtocolEnvelope, publicKeySpkiBase64Url: string): Promise<boolean>;
 export declare function verifyEnvelopeSignature(envelope: ProtocolEnvelope, material: SignatureVerificationMaterial): Promise<boolean>;
 export declare function verifyCanonicalPayloadSignature(payload: string, signature: ProtocolSignature | undefined, material: SignatureVerificationMaterial): Promise<boolean>;
+export declare const MAX_TTL_MS = 86400000;
 export declare function validateEnvelope(envelope: ProtocolEnvelope, nowMs?: number): ProtocolDiagnostic[];
 export declare function createEnvelope(input: {
     sender: string;

package/queueBinding.d.ts

@@ -1,4 +1,5 @@
 import { type ProtocolEnvelope } from './protocol';
+import type { ReplayCache } from './protocolReplay';
 export interface QueueSignOptions {
     privateKey: string;
     sender: string;
@@ -8,6 +9,17 @@ export interface QueueSignOptions {
 }
 export interface QueueVerifyOptions {
     publicKey: string;
+    /** Reject expired or malformed envelopes (missing nonce, bad TTL, etc). Default true. */
+    strictTtl?: boolean;
+    /**
+     * Optional replay/dedup cache (e.g. `new InMemoryReplayCache()` from
+     * `./protocolReplay`). Construct ONE instance per consumer process and pass
+     * the same instance to every verifyQueueMessage/verifyQueueBatch call — a
+     * fresh cache per call provides no protection at all, since a replayed
+     * message would never be recognized as already-seen.
+     */
+    replayCache?: ReplayCache;
+    nowMs?: number;
 }
 export type SignedEnvelope = ProtocolEnvelope;
 export interface QueueMessage<T> {

package/rateLimiter.d.ts

@@ -7,6 +7,17 @@ export type RateLimitResult = {
     remaining: number;
     resetMs: number;
 };
+/**
+ * Persistent rate-limit store — required for correct rate limiting in any
+ * environment where the gateway/limiter instance doesn't live for the
+ * lifetime of the traffic it's limiting (e.g. a serverless function that
+ * rebuilds its gateway on every invocation). Without one, SlidingWindowRateLimiter's
+ * in-memory Map resets whenever the process/instance does, silently
+ * defeating the limit.
+ */
+export interface RateLimitStore {
+    consume(key: string, policy: RateLimitPolicy, nowMs?: number): Promise<RateLimitResult>;
+}
 declare class SlidingWindowRateLimiter {
     private windows;
     check(key: string, policy: RateLimitPolicy, nowMs?: number): RateLimitResult;

package/replayStores.d.ts

@@ -14,8 +14,8 @@ export interface RedisClientLike {
         px?: number;
     }): Promise<string | null>;
     get(key: string): Promise<string | null>;
-    del(key: string): Promise<number | any>;
-    quit(): Promise<any>;
+    del(key: string): Promise<number | unknown>;
+    quit(): Promise<unknown>;
 }
 /**
  * Gateway-facing replay store interface.

package/wsBinding.d.ts

@@ -3,13 +3,15 @@ import type { KeyRegistry } from './keyRegistry';
 import { SignedStreamWriter, type StreamSignerOpts, type StreamVerifierOpts, type StreamVerifyResult, type StreamChunk } from './stream';
 export { type KeyRegistry, generateEd25519KeypairBase64Url };
 export type { StreamSignerOpts, StreamVerifierOpts, StreamVerifyResult, StreamChunk };
+export type WsMessageHandler = (e: {
+    data: string | Buffer;
+}) => void;
+export type WsCloseHandler = () => void;
 export interface WebSocketLike {
     send(data: string): void;
-    addEventListener(event: 'message', handler: (e: {
-        data: string | Buffer;
-    }) => void): void;
-    addEventListener(event: 'close', handler: () => void): void;
-    removeEventListener(event: string, handler: (...args: unknown[]) => void): void;
+    addEventListener(event: 'message', handler: WsMessageHandler): void;
+    addEventListener(event: 'close', handler: WsCloseHandler): void;
+    removeEventListener(event: 'message' | 'close', handler: WsMessageHandler | WsCloseHandler): void;
     readyState?: number;
 }
 export interface WsBindingOptions {