@agentcontextdistributionprotocol/acdp 0.14.5 → 0.15.0

package/README.md

@@ -2,11 +2,14 @@
 
 Thin NAPI-rs binding over the [`acdp`](https://crates.io/crates/acdp)
 Rust library. Implements the producer- and consumer-side crypto for the
-Agent Context Distribution Protocol — v0.1.0 core plus the v0.2.0 Trust &
-Hardening surface (RFC-ACDP-0001 through 0015). HTTP is intentionally left
-to the caller — pair this with `fetch` / `undici` for transport.
+Agent Context Distribution Protocol — the 0.1.0–0.4.0 Final lines plus
+RFC-ACDP-0016 external anchors; see the spec's
+[version matrix](https://github.com/agentcontextdistributionprotocol/agentcontextdistributionprotocol/blob/main/docs/version-matrix.md) for exactly
+which protocol lines each release implements. HTTP is intentionally left to
+the caller — pair this with `fetch` / `undici` for transport.
 
-Package version tracks the binding release line (currently **0.8.0**).
+The package is released at the same version as the
+[`acdp`](https://crates.io/crates/acdp) crate.
 
 ## Install
 
@@ -19,12 +22,12 @@ Prebuilt native binaries are published for macOS (x64/arm64) and Linux
 
 ## Install (development)
 
-`package-lock.json` is committed, so `npm install` here resolves the pinned
-dependency graph (including an exact `@napi-rs/cli` version) rather than
-re-resolving fresh.
+`package-lock.json` is committed; use `npm ci` (as CI does) to install exactly
+that pinned graph, including the exact `@napi-rs/cli` version — it fails
+instead of silently re-resolving if `package.json` and the lockfile disagree.
 
 ```bash
-npm install                  # installs @napi-rs/cli
+npm ci                       # installs @napi-rs/cli from the lockfile
 npm run build:debug          # produces index.js + acdp.<platform>.node
 node --test tests/*.mjs      # in-process unit tests, no HTTP
 ```
@@ -51,7 +54,8 @@ const raw = producer.buildPublishRequest({
   summary: 'Quarter-end inventory',
 });
 
-// POST `raw` (the JSON string) to your registry. On retrieve:
+// POST `raw` (the JSON string) to your registry's /contexts endpoint.
+// On retrieve:
 const body = (await response.json()).body;
 AcdpVerifier.verifyContentHash(JSON.stringify(body), body.content_hash);
 AcdpVerifier.verifySignature(
@@ -109,7 +113,7 @@ fetched from) and recomputing (never trusting) the body hash you pass in.
 
 ## Verification surface
 
-`AcdpVerifier` covers the full 0.2.0 surface in addition to the basics
+`AcdpVerifier` covers the full verification surface in addition to the basics
 above: identity binding (`verifyCtxIdBinding`, see
 [Verifying a retrieved body](#verifying-a-retrieved-body) above),
 offline `did:key` verification (`verifyBodyOffline`,
@@ -129,8 +133,7 @@ are also exported.
 
 * **JSON across the FFI boundary.** Every method accepts and returns
   JSON strings — never a Rust type, never a JS class instance you'd
-  have to serialize before sending. The binary stays at ~500 lines of
-  glue.
+  have to serialize before sending.
 * **Crypto in Rust, HTTP in JS.** Key generation, JCS + SHA-256 hashing,
   Ed25519 signing, and signature verification happen in the underlying
   `acdp` crate. Transport, retries, and observability are yours.
@@ -142,22 +145,8 @@ are also exported.
   against the spec's `sig-001` fixture — the same constants the Rust
   suite asserts. A drift on either side is a protocol break.
 
-## Layout
+## Public surface
 
-```
-bindings/acdp-node/
-├── Cargo.toml         # standalone [workspace]; depends on `acdp` via path
-├── build.rs           # napi-build setup
-├── package.json
-├── README.md          # this file
-├── index.js           # generated by `napi build`
-├── index.d.ts         # generated by `napi build`
-├── acdp.<platform>.node  # native binary
-├── src/
-│   ├── lib.rs         # module entry — re-exports the napi classes
-│   ├── producer.rs    # AcdpProducer: build/sign publish requests
-│   ├── verifier.rs    # AcdpVerifier: content_hash + signature verify
-│   └── helpers.rs     # visibility / contextType parsers
-└── tests/
-    └── test.mjs
-```
+The canonical list of exported classes and methods (and their arity) is
+[`bindings/interop/expected_surface.json`](https://github.com/agentcontextdistributionprotocol/acdp-rs/blob/main/bindings/interop/expected_surface.json),
+enforced against this package by the interop parity tests.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentcontextdistributionprotocol/acdp",
-  "version": "0.14.5",
+  "version": "0.15.0",
   "description": "Agent Context Distribution Protocol — Node.js SDK",
   "license": "MIT OR Apache-2.0",
   "repository": {
@@ -47,9 +47,9 @@
     "registry": "https://registry.npmjs.org/"
   },
   "optionalDependencies": {
-    "@agentcontextdistributionprotocol/acdp-darwin-x64": "0.14.5",
-    "@agentcontextdistributionprotocol/acdp-darwin-arm64": "0.14.5",
-    "@agentcontextdistributionprotocol/acdp-linux-x64-gnu": "0.14.5",
-    "@agentcontextdistributionprotocol/acdp-linux-arm64-gnu": "0.14.5"
+    "@agentcontextdistributionprotocol/acdp-darwin-x64": "0.15.0",
+    "@agentcontextdistributionprotocol/acdp-darwin-arm64": "0.15.0",
+    "@agentcontextdistributionprotocol/acdp-linux-x64-gnu": "0.15.0",
+    "@agentcontextdistributionprotocol/acdp-linux-arm64-gnu": "0.15.0"
   }
 }