@agentvault/agentvault 0.13.4 → 0.13.5

package/dist/index.js

@@ -44880,6 +44880,7 @@ var DoubleRatchet = class _DoubleRatchet {
   serialize() {
     const s2 = this.state;
     return JSON.stringify({
+      version: 1,
       rootKey: libsodium_wrappers_default.to_hex(s2.rootKey),
       sendingChain: s2.sendingChain ? {
         chainKey: libsodium_wrappers_default.to_hex(s2.sendingChain.chainKey),
@@ -44907,33 +44908,59 @@ var DoubleRatchet = class _DoubleRatchet {
     });
   }
   static deserialize(json) {
-    const d2 = JSON.parse(json);
-    return new _DoubleRatchet({
-      rootKey: libsodium_wrappers_default.from_hex(d2.rootKey),
-      sendingChain: d2.sendingChain ? {
-        chainKey: libsodium_wrappers_default.from_hex(d2.sendingChain.chainKey),
-        messageNumber: d2.sendingChain.messageNumber
-      } : null,
-      receivingChain: d2.receivingChain ? {
-        chainKey: libsodium_wrappers_default.from_hex(d2.receivingChain.chainKey),
-        messageNumber: d2.receivingChain.messageNumber
-      } : null,
-      dhSendingKeypair: {
-        publicKey: libsodium_wrappers_default.from_hex(d2.dhSendingKeypair.publicKey),
-        privateKey: libsodium_wrappers_default.from_hex(d2.dhSendingKeypair.privateKey)
-      },
-      dhReceivingPublicKey: d2.dhReceivingPublicKey ? libsodium_wrappers_default.from_hex(d2.dhReceivingPublicKey) : null,
-      identityKeypair: {
-        publicKey: libsodium_wrappers_default.from_hex(d2.identityKeypair.publicKey),
-        privateKey: libsodium_wrappers_default.from_hex(d2.identityKeypair.privateKey)
-      },
-      previousSendingChainLength: d2.previousSendingChainLength,
-      skippedKeys: d2.skippedKeys.map((sk) => ({
-        dhPub: sk.dhPub,
-        n: sk.n,
-        messageKey: libsodium_wrappers_default.from_hex(sk.messageKey)
-      }))
-    });
+    let d2;
+    try {
+      d2 = JSON.parse(json);
+    } catch {
+      throw new Error("Ratchet state: corrupt JSON");
+    }
+    if (d2.version !== void 0 && d2.version !== 1) {
+      throw new Error(`Ratchet state version ${d2.version} not supported`);
+    }
+    if (typeof d2.rootKey !== "string") {
+      throw new Error("Ratchet state: missing required field rootKey");
+    }
+    const dhSend = d2.dhSendingKeypair;
+    if (!dhSend || typeof dhSend.publicKey !== "string" || typeof dhSend.privateKey !== "string") {
+      throw new Error("Ratchet state: missing required field dhSendingKeypair");
+    }
+    const idKp = d2.identityKeypair;
+    if (!idKp || typeof idKp.publicKey !== "string" || typeof idKp.privateKey !== "string") {
+      throw new Error("Ratchet state: missing required field identityKeypair");
+    }
+    try {
+      return new _DoubleRatchet({
+        rootKey: libsodium_wrappers_default.from_hex(d2.rootKey),
+        sendingChain: d2.sendingChain ? {
+          chainKey: libsodium_wrappers_default.from_hex(d2.sendingChain.chainKey),
+          messageNumber: d2.sendingChain.messageNumber
+        } : null,
+        receivingChain: d2.receivingChain ? {
+          chainKey: libsodium_wrappers_default.from_hex(d2.receivingChain.chainKey),
+          messageNumber: d2.receivingChain.messageNumber
+        } : null,
+        dhSendingKeypair: {
+          publicKey: libsodium_wrappers_default.from_hex(dhSend.publicKey),
+          privateKey: libsodium_wrappers_default.from_hex(dhSend.privateKey)
+        },
+        dhReceivingPublicKey: d2.dhReceivingPublicKey ? libsodium_wrappers_default.from_hex(d2.dhReceivingPublicKey) : null,
+        identityKeypair: {
+          publicKey: libsodium_wrappers_default.from_hex(idKp.publicKey),
+          privateKey: libsodium_wrappers_default.from_hex(idKp.privateKey)
+        },
+        previousSendingChainLength: d2.previousSendingChainLength,
+        skippedKeys: d2.skippedKeys.map((sk) => ({
+          dhPub: sk.dhPub,
+          n: sk.n,
+          messageKey: libsodium_wrappers_default.from_hex(sk.messageKey)
+        }))
+      });
+    } catch (err) {
+      if (err instanceof Error && err.message.startsWith("Ratchet state")) {
+        throw err;
+      }
+      throw new Error(`Ratchet state: corrupt hex data \u2014 ${err instanceof Error ? err.message : String(err)}`);
+    }
   }
 };
 
@@ -45243,6 +45270,69 @@ function buildErrorSpan(opts) {
     status: { code: 2, message: opts.errorMessage }
   };
 }
+function buildHttpSpan(opts) {
+  const now = Date.now();
+  const attributes = {
+    "ai.agent.http.method": opts.method,
+    "ai.agent.http.url": opts.url,
+    "ai.agent.http.status_code": opts.statusCode,
+    "ai.agent.http.latency_ms": opts.latencyMs
+  };
+  const isError = opts.status === "error" || opts.statusCode >= 400;
+  const status = isError ? { code: 2, ...opts.statusMessage ? { message: opts.statusMessage } : {} } : { code: 0 };
+  return {
+    traceId: opts.traceId ?? generateTraceId(),
+    spanId: opts.spanId ?? generateSpanId(),
+    parentSpanId: opts.parentSpanId,
+    name: "http.request",
+    kind: "client",
+    startTime: now - opts.latencyMs,
+    endTime: now,
+    attributes,
+    status
+  };
+}
+function buildActionSpan(opts) {
+  const now = Date.now();
+  const attributes = {
+    "ai.agent.action.type": opts.actionType,
+    "ai.agent.action.target": opts.target,
+    "ai.agent.action.latency_ms": opts.latencyMs,
+    "ai.agent.action.success": opts.success
+  };
+  const status = opts.success ? { code: 0 } : { code: 2, ...opts.statusMessage ? { message: opts.statusMessage } : {} };
+  return {
+    traceId: opts.traceId ?? generateTraceId(),
+    spanId: opts.spanId ?? generateSpanId(),
+    parentSpanId: opts.parentSpanId,
+    name: "action.execute",
+    kind: "internal",
+    startTime: now - opts.latencyMs,
+    endTime: now,
+    attributes,
+    status
+  };
+}
+function buildNavSpan(opts) {
+  const now = Date.now();
+  const attributes = {
+    "ai.agent.nav.to_url": opts.toUrl,
+    "ai.agent.nav.latency_ms": opts.latencyMs
+  };
+  const isError = opts.status === "error";
+  const status = isError ? { code: 2, ...opts.statusMessage ? { message: opts.statusMessage } : {} } : { code: 0 };
+  return {
+    traceId: opts.traceId ?? generateTraceId(),
+    spanId: opts.spanId ?? generateSpanId(),
+    parentSpanId: opts.parentSpanId,
+    name: "nav.navigate",
+    kind: "internal",
+    startTime: now - opts.latencyMs,
+    endTime: now,
+    attributes,
+    status
+  };
+}
 
 // ../crypto/dist/telemetry-reporter.js
 function toOtlpAttributes(attrs) {
@@ -45310,6 +45400,18 @@ var TelemetryReporter = class {
   reportError(opts) {
     this._buffer.push(buildErrorSpan(opts));
   }
+  /** Record an HTTP request call. */
+  reportHttpCall(opts) {
+    this._buffer.push(buildHttpSpan(opts));
+  }
+  /** Record an action execution. */
+  reportActionCall(opts) {
+    this._buffer.push(buildActionSpan(opts));
+  }
+  /** Record a navigation event. */
+  reportNavCall(opts) {
+    this._buffer.push(buildNavSpan(opts));
+  }
   /** Record an arbitrary pre-built span. */
   reportCustomSpan(span) {
     this._buffer.push(span);
@@ -47042,7 +47144,15 @@ var SecureChannel = class _SecureChannel extends EventEmitter {
                   nonce: hexToBytes(msgData.nonce)
                 };
                 const ratchet = DoubleRatchet.deserialize(channelEntry.session.ratchetState);
-                const plaintext = ratchet.decrypt(encryptedMessage);
+                const ratchetSnapshot = channelEntry.session.ratchetState;
+                let a2aPlaintext;
+                try {
+                  a2aPlaintext = ratchet.decrypt(encryptedMessage);
+                } catch (decryptErr) {
+                  console.error(`[SecureChannel] A2A decrypt failed \u2014 restoring ratchet state:`, decryptErr);
+                  channelEntry.session.ratchetState = ratchetSnapshot;
+                  return;
+                }
                 channelEntry.session.ratchetState = ratchet.serialize();
                 if (channelEntry.role === "responder" && !channelEntry.session.activated) {
                   channelEntry.session.activated = true;
@@ -47065,7 +47175,7 @@ var SecureChannel = class _SecureChannel extends EventEmitter {
                 }
                 await this._persistState();
                 const a2aMsg = {
-                  text: plaintext,
+                  text: a2aPlaintext,
                   fromHubAddress: msgData.from_hub_address || msgData.hub_address || "",
                   channelId,
                   conversationId: msgData.conversation_id || "",
@@ -47136,7 +47246,19 @@ var SecureChannel = class _SecureChannel extends EventEmitter {
       header_blob: msgData.header_blob,
       ciphertext: msgData.ciphertext
     });
-    const plaintext = session.ratchet.decrypt(encrypted);
+    const ratchetSnapshot = session.ratchet.serialize();
+    let plaintext;
+    try {
+      plaintext = session.ratchet.decrypt(encrypted);
+    } catch (decryptErr) {
+      console.error(`[SecureChannel] Decrypt failed for conv ${convId.slice(0, 8)}... \u2014 restoring ratchet:`, decryptErr);
+      try {
+        session.ratchet = DoubleRatchet.deserialize(ratchetSnapshot);
+      } catch (restoreErr) {
+        console.error("[SecureChannel] Ratchet restore failed:", restoreErr);
+      }
+      return;
+    }
     this._sendAck(msgData.message_id);
     if (!session.activated) {
       session.activated = true;
@@ -47524,9 +47646,14 @@ ${messageText}`;
       ciphertext: msgData.ciphertext
     });
     let plaintext;
+    const ratchetSnapshot = session.ratchet.serialize();
     try {
       plaintext = session.ratchet.decrypt(encrypted);
     } catch (decryptErr) {
+      try {
+        session.ratchet = DoubleRatchet.deserialize(ratchetSnapshot);
+      } catch {
+      }
       console.warn(
         `[SecureChannel] Room decrypt failed for conv ${convId.slice(0, 8)}...: ${String(decryptErr)}, re-initializing ratchet`
       );
@@ -47672,7 +47799,20 @@ ${messageText}`;
               header_blob: msg.header_blob,
               ciphertext: msg.ciphertext
             });
-            const plaintext = session.ratchet.decrypt(encrypted);
+            const ratchetSnapshot = session.ratchet.serialize();
+            let plaintext;
+            try {
+              plaintext = session.ratchet.decrypt(encrypted);
+            } catch (decryptErr) {
+              console.error(`[SecureChannel] Sync decrypt failed for ${msg.conversation_id.slice(0, 8)}... \u2014 restoring ratchet:`, decryptErr);
+              try {
+                session.ratchet = DoubleRatchet.deserialize(ratchetSnapshot);
+              } catch {
+              }
+              this._persisted.lastMessageTimestamp = msg.created_at;
+              since = msg.created_at;
+              continue;
+            }
             this._sendAck(msg.id);
             if (!session.activated) {
               session.activated = true;
@@ -47707,7 +47847,7 @@ ${messageText}`;
             totalProcessed++;
           } catch (err) {
             console.warn(
-              `[SecureChannel] Sync decrypt failed for msg ${msg.id.slice(0, 8)}... in conv ${msg.conversation_id.slice(0, 8)}...: ${String(err)}`
+              `[SecureChannel] Sync failed for msg ${msg.id.slice(0, 8)}... in conv ${msg.conversation_id.slice(0, 8)}...: ${String(err)}`
             );
             this._persisted.lastMessageTimestamp = msg.created_at;
             since = msg.created_at;
@@ -47903,7 +48043,18 @@ ${messageText}`;
               header_blob: msg.header_blob,
               ciphertext: msg.ciphertext
             });
-            const plaintext = session.ratchet.decrypt(encrypted);
+            const ratchetSnapshot = session.ratchet.serialize();
+            let plaintext;
+            try {
+              plaintext = session.ratchet.decrypt(encrypted);
+            } catch (decryptErr) {
+              console.error(`[SecureChannel] Room sync decrypt failed for ${msg.conversation_id.slice(0, 8)}... \u2014 restoring ratchet:`, decryptErr);
+              try {
+                session.ratchet = DoubleRatchet.deserialize(ratchetSnapshot);
+              } catch {
+              }
+              continue;
+            }
             if (!session.activated) {
               session.activated = true;
             }