@7h3/protocol 0.5.3 → 0.5.6

package/keyRegistry.d.ts

@@ -1,6 +1,6 @@
 export interface KeyRegistry {
     getPublicKey(senderId: string): Promise<string | null>;
-    getSharedSecret?(keyId: string): Promise<string | null>;
+    getSharedSecret?(keyId: string, sender: string): Promise<string | null>;
 }
 export declare function createStaticKeyRegistry(keys: Record<string, string>): KeyRegistry;
 export declare function createCompositeKeyRegistry(...registries: KeyRegistry[]): KeyRegistry;

package/package.json

@@ -1,24 +1,106 @@
 {
   "name": "@7h3/protocol",
-  "version": "0.5.3",
+  "version": "0.5.6",
   "description": "7h3 Protocol: deterministic, signed, replay-safe AI-to-AI message envelopes (wire 7h3/0.1).",
   "type": "module",
   "main": "./index.js",
   "types": "./index.d.ts",
   "exports": {
     ".": {
-      "import": "./index.js",
-      "types": "./index.d.ts"
+      "types": "./index.d.ts",
+      "import": "./index.js"
+    },
+    "./protocol": {
+      "types": "./index.d.ts",
+      "import": "./index.js"
+    },
+    "./http": {
+      "types": "./httpBinding.d.ts",
+      "import": "./index.js"
+    },
+    "./webhook": {
+      "types": "./webhookBinding.d.ts",
+      "import": "./index.js"
+    },
+    "./queue": {
+      "types": "./queueBinding.d.ts",
+      "import": "./index.js"
+    },
+    "./ws": {
+      "types": "./wsBinding.d.ts",
+      "import": "./index.js"
+    },
+    "./grpc": {
+      "types": "./grpcBinding.d.ts",
+      "import": "./index.js"
+    },
+    "./keys": {
+      "types": "./keyInfra.d.ts",
+      "import": "./index.js"
+    },
+    "./key-registry": {
+      "types": "./keyRegistry.d.ts",
+      "import": "./index.js"
+    },
+    "./gateway": {
+      "types": "./gateway.d.ts",
+      "import": "./index.js"
+    },
+    "./audit-log": {
+      "types": "./auditLog.d.ts",
+      "import": "./index.js"
+    },
+    "./signed-response": {
+      "types": "./signedResponse.d.ts",
+      "import": "./index.js"
+    },
+    "./rate-limiter": {
+      "types": "./rateLimiter.d.ts",
+      "import": "./index.js"
+    },
+    "./route-policy": {
+      "types": "./routePolicy.d.ts",
+      "import": "./index.js"
+    },
+    "./encryption": {
+      "types": "./encryption.d.ts",
+      "import": "./index.js"
+    },
+    "./capability": {
+      "types": "./capability.d.ts",
+      "import": "./index.js"
+    },
+    "./stream": {
+      "types": "./stream.d.ts",
+      "import": "./index.js"
+    },
+    "./telemetry": {
+      "types": "./telemetry.d.ts",
+      "import": "./index.js"
+    },
+    "./cbor": {
+      "types": "./envelopeCbor.d.ts",
+      "import": "./index.js"
+    },
+    "./replay": {
+      "types": "./replayStores.d.ts",
+      "import": "./index.js"
     }
   },
+  "bin": {
+    "7h3": "./bin/7h3.js"
+  },
   "files": [
     "index.js",
     "*.d.ts",
-    "README.md"
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "bin/7h3.js"
   ],
-  "license": "MIT",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "https://github.com/IceMasterT/7h3-protocol-aip.git"
+    "url": "https://github.com/IceMasterT/7h3-protocol.git"
   }
 }

package/protocol.d.ts

@@ -56,6 +56,7 @@ export declare function signEnvelopeEd25519(envelope: Omit<ProtocolEnvelope, 'si
 export declare function verifyEnvelopeEd25519(envelope: ProtocolEnvelope, publicKeySpkiBase64Url: string): Promise<boolean>;
 export declare function verifyEnvelopeSignature(envelope: ProtocolEnvelope, material: SignatureVerificationMaterial): Promise<boolean>;
 export declare function verifyCanonicalPayloadSignature(payload: string, signature: ProtocolSignature | undefined, material: SignatureVerificationMaterial): Promise<boolean>;
+export declare const MAX_TTL_MS = 86400000;
 export declare function validateEnvelope(envelope: ProtocolEnvelope, nowMs?: number): ProtocolDiagnostic[];
 export declare function createEnvelope(input: {
     sender: string;

package/queueBinding.d.ts

@@ -1,4 +1,5 @@
 import { type ProtocolEnvelope } from './protocol';
+import type { ReplayCache } from './protocolReplay';
 export interface QueueSignOptions {
     privateKey: string;
     sender: string;
@@ -8,6 +9,17 @@ export interface QueueSignOptions {
 }
 export interface QueueVerifyOptions {
     publicKey: string;
+    /** Reject expired or malformed envelopes (missing nonce, bad TTL, etc). Default true. */
+    strictTtl?: boolean;
+    /**
+     * Optional replay/dedup cache (e.g. `new InMemoryReplayCache()` from
+     * `./protocolReplay`). Construct ONE instance per consumer process and pass
+     * the same instance to every verifyQueueMessage/verifyQueueBatch call — a
+     * fresh cache per call provides no protection at all, since a replayed
+     * message would never be recognized as already-seen.
+     */
+    replayCache?: ReplayCache;
+    nowMs?: number;
 }
 export type SignedEnvelope = ProtocolEnvelope;
 export interface QueueMessage<T> {

package/rateLimiter.d.ts

@@ -7,8 +7,23 @@ export type RateLimitResult = {
     remaining: number;
     resetMs: number;
 };
+/**
+ * Persistent rate-limit store — required for correct rate limiting in any
+ * environment where the gateway/limiter instance doesn't live for the
+ * lifetime of the traffic it's limiting (e.g. a serverless function that
+ * rebuilds its gateway on every invocation). Without one, SlidingWindowRateLimiter's
+ * in-memory Map resets whenever the process/instance does, silently
+ * defeating the limit.
+ */
+export interface RateLimitStore {
+    consume(key: string, policy: RateLimitPolicy, nowMs?: number): Promise<RateLimitResult>;
+}
 declare class SlidingWindowRateLimiter {
     private windows;
+    private readonly maxKeys;
+    constructor(opts?: {
+        maxKeys?: number;
+    });
     check(key: string, policy: RateLimitPolicy, nowMs?: number): RateLimitResult;
     consume(key: string, policy: RateLimitPolicy, nowMs?: number): RateLimitResult;
     reset(key: string): void;

package/webhookBinding.d.ts

@@ -2,6 +2,26 @@ import { generateEd25519KeypairBase64Url } from './protocol';
 export declare const WEBHOOK_SIG_HEADER = "x-7h3-sig";
 export declare const WEBHOOK_TS_HEADER = "x-7h3-ts";
 export declare const WEBHOOK_DEFAULT_TTL_MS = 300000;
+/**
+ * A verified webhook signature is otherwise valid to replay any number of
+ * times until it ages out of maxAgeMs — the signature+timestamp cover
+ * authenticity and freshness, but nothing dedupes delivery. A replayCache
+ * closes that gap. The Ed25519/HMAC signature is deterministic per
+ * (timestampMs, body, key), so it doubles as a stable dedup key — no wire
+ * format change needed.
+ */
+export interface WebhookReplayCache {
+    /** Returns true if this key was successfully reserved (first use), false if already seen. */
+    consume(key: string, expiresAtMs: number, nowMs: number): boolean | Promise<boolean>;
+}
+/** Bounded in-memory WebhookReplayCache — single process only, does not survive a restart. */
+export declare class InMemoryWebhookReplayCache implements WebhookReplayCache {
+    private readonly seen;
+    private readonly maxEntries;
+    constructor(maxEntries?: number);
+    private prune;
+    consume(key: string, expiresAtMs: number, nowMs: number): boolean;
+}
 export interface WebhookSignOptions {
     privateKey: string;
     ttlMs?: number;
@@ -13,10 +33,14 @@ export interface WebhookSignHmacOptions {
 export interface WebhookVerifyOptions {
     publicKey: string;
     maxAgeMs?: number;
+    /** Optional — rejects a signature that's already been consumed within its TTL window. */
+    replayCache?: WebhookReplayCache;
 }
 export interface WebhookVerifyHmacOptions {
     secret: string;
     maxAgeMs?: number;
+    /** Optional — rejects a signature that's already been consumed within its TTL window. */
+    replayCache?: WebhookReplayCache;
 }
 export interface WebhookHeaders {
     [WEBHOOK_SIG_HEADER]: string;

package/wsBinding.d.ts

@@ -1,5 +1,6 @@
 import { generateEd25519KeypairBase64Url, type ProtocolEnvelope } from './protocol';
 import type { KeyRegistry } from './keyRegistry';
+import type { ReplayCache } from './protocolReplay';
 import { SignedStreamWriter, type StreamSignerOpts, type StreamVerifierOpts, type StreamVerifyResult, type StreamChunk } from './stream';
 export { type KeyRegistry, generateEd25519KeypairBase64Url };
 export type { StreamSignerOpts, StreamVerifierOpts, StreamVerifyResult, StreamChunk };
@@ -21,6 +22,13 @@ export interface WsBindingOptions {
     keyRegistry: KeyRegistry;
     ttlMs?: number;
     onVerifyFail?: (err: Error, rawData: string) => void;
+    /**
+     * Optional — signature+TTL alone don't stop a captured frame from being
+     * replayed verbatim any number of times within its TTL window. Pass an
+     * InMemoryReplayCache (or a distributed one) to dedupe incoming frames by
+     * sender/messageId/nonce, same as the HTTP gateway does.
+     */
+    replayCache?: ReplayCache;
 }
 export interface ProtectedWebSocket {
     send(payload: unknown): Promise<void>;