@agentvault/muse-bridge 0.1.24 → 0.1.25

package/dist/index.js

@@ -11787,11 +11787,11 @@ async function joinWithFirstMatchingKp(welcomeBytes, candidates) {
   return null;
 }
 function ownIdentity() {
-  const v2 = true ? "0.23.49" : FALLBACK;
+  const v2 = true ? "0.23.50" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "c98737d" : "";
+  const raw = true ? "c8f1371" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -70301,6 +70301,34 @@ var init_dist = __esm({
             }
             return null;
           }
+          /**
+           * Every occupied leaf of the ratchet tree, with its basic-credential
+           * identity — READ-ONLY (#470 phase 1).
+           *
+           * Stale-leaf detection compares the tree with the server's eligible set, so
+           * it must see EVERY leaf. `memberLeafIndex` cannot: it stops at the first
+           * match, so a device holding two leaves (the duplicate-add shape observed
+           * live 2026-06-18) would show one. Blank leaves (removed members) are
+           * skipped; duplicates are returned once per leaf. Leaves whose credential is
+           * not `basic` carry no comparable identity and are skipped too — the web
+           * client only ever mints basic credentials.
+           *
+           * Identities are COPIES: a caller mutating one cannot reach the tree.
+           */
+          leafIdentities() {
+            const tree = this._requireState().ratchetTree;
+            const out = [];
+            for (let nodeIndex = 0; nodeIndex < tree.length; nodeIndex += 2) {
+              const node2 = tree[nodeIndex];
+              if (node2 && node2.nodeType === "leaf") {
+                const cred = node2.leaf.credential;
+                if (cred.credentialType === "basic") {
+                  out.push({ leafIndex: nodeIndex / 2, identity: new Uint8Array(cred.identity) });
+                }
+              }
+            }
+            return out;
+          }
           // -------------------------------------------------------------------------
           // Encrypt / Decrypt
           // -------------------------------------------------------------------------
@@ -71307,6 +71335,7 @@ var init_dist = __esm({
           _trustTier = null;
           _trustTokenExpiresAt = null;
           _trustTokenInterval = null;
+          _trustTokenUnavailableUntil = 0;
           _pendingPollTimer = null;
           _syncMessageIds = null;
           _deliveryHeartbeat = null;
@@ -71522,6 +71551,7 @@ ${text}`;
           static SILENCE_TIMEOUT_MS = 9e4;
           static POLL_FALLBACK_INTERVAL_MS = 3e4;
           // 30s when messages found
+          static TRUST_TOKEN_UNAVAILABLE_BACKOFF_MS = 6 * 60 * 60 * 1e3;
           static POLL_FALLBACK_IDLE_MS = 6e4;
           // 60s when idle
           /**
@@ -72919,7 +72949,7 @@ ${text}`;
            */
           sendActivitySpan(spanData) {
             if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-            const pluginVersion = true ? "0.23.49" : "0.0.0-dev";
+            const pluginVersion = true ? "0.23.50" : "0.0.0-dev";
             const agentName = this.config.agentName ?? "Agent";
             const resource = {
               "service.name": "agentvault-agent",
@@ -73952,6 +73982,7 @@ ${text}`;
             return this._trustTokenExpiresAt;
           }
           async refreshTrustToken() {
+            if (Date.now() < this._trustTokenUnavailableUntil) return;
             try {
               const res = await fetch(`${this.config.apiUrl}/api/v1/gate/token`, {
                 method: "POST",
@@ -73965,12 +73996,15 @@ ${text}`;
                 this._trustToken = data.token;
                 this._trustTier = data.tier;
                 this._trustTokenExpiresAt = data.expires_at;
+              } else if (res.status === 503 || res.status === 404 || res.status === 403) {
+                this._trustTokenUnavailableUntil = Date.now() + _SecureChannel.TRUST_TOKEN_UNAVAILABLE_BACKOFF_MS;
               }
             } catch (err) {
               console.warn("[AgentVault] Trust token refresh failed:", err);
             }
           }
           startTrustTokenRefresh() {
+            this.stopTrustTokenRefresh();
             this.refreshTrustToken();
             this._trustTokenInterval = setInterval(
               () => this.refreshTrustToken(),
@@ -74915,7 +74949,7 @@ ${text}`;
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.49" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.50" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -75243,7 +75277,7 @@ ${text}`;
                         agentVersion: this.config.agentVersion ?? "0.0.0",
                         // __AV_VERSION__ is injected by esbuild from package.json at build time.
                         // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                        pluginVersion: true ? "0.23.49" : "0.0.0-dev"
+                        pluginVersion: true ? "0.23.50" : "0.0.0-dev"
                       });
                       this._telemetryReporter.startAutoFlush(3e4);
                     }
@@ -101399,7 +101433,7 @@ data:
         await init_skill_telemetry();
         await init_policy_enforcer();
         init_room_protocol();
-        VERSION = true ? "0.23.49" : "0.0.0-dev";
+        VERSION = true ? "0.23.50" : "0.0.0-dev";
       }
     });
     await init_index();
@@ -103344,7 +103378,7 @@ function mkdir700(path2) {
   chmodSync5(path2, 448);
 }
 function packageVersion() {
-  return true ? "0.1.24" : void 0;
+  return true ? "0.1.25" : void 0;
 }
 function helpText(version2) {
   return [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/muse-bridge",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "type": "module",
   "description": "AgentVault Muse Bridge — daemon bridging a Muse agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",