@7h3/protocol 0.6.0 → 0.6.2

package/index.js

@@ -2432,6 +2432,7 @@ async function Gn(e, t) {
 		let e = await t.replayCache.consume(n.envelope, r);
 		if (!e.ok) throw Error(e.reason ?? "Queue message replay detected");
 	}
+	if ((typeof n.payload == "string" ? n.payload : JSON.stringify(n.payload)) !== n.envelope.body.content) throw Error("Queue message payload does not match the signed content — the payload field was modified in transit");
 	return {
 		payload: n.payload,
 		envelope: n.envelope
@@ -2987,6 +2988,10 @@ var Cr = class {
 			reason: t
 		});
 	}
+	isEnvelopeRevoked(e) {
+		let t = e?.header?.sender, n = e?.signature?.keyId;
+		return t !== void 0 && this.isRevoked(t) || n !== void 0 && this.isRevoked(n);
+	}
 	isRevoked(e) {
 		return this.revoked.has(e);
 	}
@@ -3022,12 +3027,24 @@ var Cr = class {
 	}
 	consume(e, t, n = Date.now()) {
 		let r = n - t.windowMs, i = (this.windows.get(e) ?? []).filter((e) => e > r), a = i.length < t.requests;
-		if (a && i.push(n), i.length > 0) for (this.windows.delete(e), this.windows.set(e, i); this.windows.size > this.maxKeys;) {
-			let e = this.windows.keys().next().value;
-			if (e === void 0) break;
-			this.windows.delete(e);
-		}
-		else this.windows.delete(e);
+		if (a && i.push(n), i.length > 0) {
+			if (this.windows.delete(e), this.windows.set(e, i), this.windows.size > this.maxKeys) {
+				let r = n - t.windowMs;
+				for (let [t, n] of this.windows) {
+					if (this.windows.size <= this.maxKeys) break;
+					t !== e && (n.length === 0 || n[n.length - 1] <= r) && this.windows.delete(t);
+				}
+				for (let [n, r] of this.windows) {
+					if (this.windows.size <= this.maxKeys) break;
+					n !== e && r.length < t.requests && this.windows.delete(n);
+				}
+				for (; this.windows.size > this.maxKeys;) {
+					let e = this.windows.keys().next().value;
+					if (e === void 0) break;
+					this.windows.delete(e);
+				}
+			}
+		} else this.windows.delete(e);
 		return {
 			allowed: a,
 			remaining: Math.max(0, t.requests - i.length),

package/keyInfra.d.ts

@@ -56,7 +56,37 @@ export interface RevocationList {
 }
 export declare class RevocationRegistry {
     private revoked;
-    revoke(keyId: string, reason?: string): void;
+    /**
+     * Revoke an identifier — either a sender identity or a keyId.
+     *
+     * Which one you pass matters, and the difference used to be silent. A
+     * registry lookup is keyed by *sender*, so `wrapRegistry().getPublicKey()`
+     * can only ever compare against a sender id. Revoking a bare keyId therefore
+     * blocked the HMAC path (which receives both identifiers) while leaving the
+     * Ed25519 path fully open — a revoked, compromised key kept authenticating.
+     *
+     * Use {@link isEnvelopeRevoked} on the verification path to enforce a keyId
+     * revocation for Ed25519, or revoke the sender identity as well. For
+     * fleet-wide `(sender, keyId)` revocation, use `RevocationStore` from
+     * `./revocation` instead.
+     */
+    revoke(senderOrKeyId: string, reason?: string): void;
+    /**
+     * True if either the envelope's sender or the keyId it was signed under has
+     * been revoked.
+     *
+     * This is the check that actually enforces a keyId revocation for Ed25519,
+     * because unlike a registry lookup it can see `signature.keyId`. Call it on
+     * the verification path alongside signature checking.
+     */
+    isEnvelopeRevoked(envelope: {
+        header?: {
+            sender?: string;
+        };
+        signature?: {
+            keyId?: string;
+        };
+    }): boolean;
     isRevoked(keyId: string): boolean;
     getList(): RevocationList;
     importList(list: RevocationList): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@7h3/protocol",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "7h3 Protocol: deterministic, signed, replay-safe AI-to-AI message envelopes (wire 7h3/0.1).",
   "type": "module",
   "main": "./index.js",