@7h3/protocol 0.5.6 → 0.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@7h3/protocol",
-  "version": "0.5.6",
+  "version": "0.6.0",
   "description": "7h3 Protocol: deterministic, signed, replay-safe AI-to-AI message envelopes (wire 7h3/0.1).",
   "type": "module",
   "main": "./index.js",

package/protocol.d.ts

@@ -57,6 +57,16 @@ export declare function verifyEnvelopeEd25519(envelope: ProtocolEnvelope, public
 export declare function verifyEnvelopeSignature(envelope: ProtocolEnvelope, material: SignatureVerificationMaterial): Promise<boolean>;
 export declare function verifyCanonicalPayloadSignature(payload: string, signature: ProtocolSignature | undefined, material: SignatureVerificationMaterial): Promise<boolean>;
 export declare const MAX_TTL_MS = 86400000;
+/**
+ * How far into the future a timestamp may sit before it is rejected.
+ *
+ * Matches the transport binding's default so every entry point agrees. Without
+ * this ceiling, MAX_TTL_MS bounds nothing: a sender can post-date `timestampMs`
+ * by a year and still pass a 24h `ttlMs`, producing an envelope that validates
+ * for a year and stays replayable long after any replay store has forgotten its
+ * nonce.
+ */
+export declare const MAX_CLOCK_SKEW_MS = 30000;
 export declare function validateEnvelope(envelope: ProtocolEnvelope, nowMs?: number): ProtocolDiagnostic[];
 export declare function createEnvelope(input: {
     sender: string;