@aithos/sdk 0.1.0-alpha.35 → 0.1.0-alpha.36

package/dist/src/auth.js

@@ -1294,6 +1294,24 @@ export class AithosAuth {
                 }
                 const json = (await res.json());
                 if (json.error) {
+                    // Backward-compat shim for backends without the semantic-equality
+                    // fix on publish-identity (alpha.33+ regression): the server may
+                    // reject a republish with -32022 because the client regenerates
+                    // `aithos.created_at` (and `proof.created`) on every
+                    // `signedDidDocument()` call, breaking the strict byte-equal
+                    // idempotence the server enforces. For an honest signer (same
+                    // root key, same DID) the only way to hit this code path is the
+                    // timestamp-drift case — which is semantically a no-op. Treat as
+                    // success.
+                    //
+                    // Server-side fix (publish-identity.ts switched to semantic
+                    // equality on cryptographic fields only) makes this branch dead
+                    // code on upgraded backends. Kept here as defense-in-depth for
+                    // SDK consumers pointing at older deployments.
+                    if (json.error.code === -32022 &&
+                        /different did\.json already published/i.test(json.error.message)) {
+                        return; // already published with same crypto material — no-op
+                    }
                     // JSON-RPC error: don't retry — these are deterministic
                     // (validation, permission, identity-already-tombstoned, …).
                     throw new AithosSDKError("ethos_bootstrap_failed", `publish_identity rejected: ${json.error.message}`, {

package/dist/test/signup-bootstrap.test.js

@@ -218,5 +218,94 @@ describe("AithosAuth.signUp — Ethos bootstrap", () => {
         assert.equal(publishCalls, 3);
         assert.equal(auth.canSignAsOwner(), false);
     });
+    /* ------------------------------------------------------------------------ */
+    /*  alpha.36 — defense-in-depth for legacy backends without semantic-equal  */
+    /* ------------------------------------------------------------------------ */
+    it("treats -32022 'different did.json already published' as a no-op success", async () => {
+        // This is the regression introduced in alpha.33: republishing the same
+        // identity returns -32022 because `signedDidDocument()` regenerates
+        // `aithos.created_at` on every call. For an honest signer, this is
+        // semantically a no-op — the Ethos is published, crypto material matches.
+        // The SDK swallows this specific case so chatty publish_identity callers
+        // (signInCustodial, verifyEmail) don't break on every subsequent sign-in.
+        const { fetch: f, calls } = makeMockFetch([
+            { url: "/auth/register", method: "POST", respond: fakeRegisterOk },
+            {
+                url: "/mcp/primitives/write",
+                method: "POST",
+                respond: () => ({
+                    json: {
+                        jsonrpc: "2.0",
+                        id: "publish_identity",
+                        error: {
+                            code: -32022,
+                            message: "different did.json already published for this DID",
+                            data: { existing_doc_url: "https://cdn.aithos.be/did.json" },
+                        },
+                    },
+                }),
+            },
+        ]);
+        const auth = makeAuth(f);
+        // Must succeed, not throw — the republish-conflict is masked.
+        await auth.signUp(validInput);
+        // Hydrate worked: owner is loaded.
+        assert.equal(auth.canSignAsOwner(), true);
+        // No retry on -32022 (deterministic) — exactly 1 publish call.
+        assert.equal(calls.filter((c) => c.url.includes("/mcp/primitives/write")).length, 1, "publish_identity must not retry on -32022");
+    });
+    it("still throws ethos_bootstrap_failed on -32022 with a DIFFERENT message", async () => {
+        // The shim is narrow: it ONLY swallows the specific
+        // "different did.json already published" message. Other -32022 cases
+        // (server might use the same code for different semantics) must still
+        // bubble up as ethos_bootstrap_failed.
+        const { fetch: f } = makeMockFetch([
+            { url: "/auth/register", method: "POST", respond: fakeRegisterOk },
+            {
+                url: "/mcp/primitives/write",
+                method: "POST",
+                respond: () => ({
+                    json: {
+                        jsonrpc: "2.0",
+                        id: "publish_identity",
+                        error: {
+                            code: -32022,
+                            message: "subject identity is tombstoned",
+                        },
+                    },
+                }),
+            },
+        ]);
+        const auth = makeAuth(f);
+        await assert.rejects(() => auth.signUp(validInput), (e) => e instanceof AithosSDKError &&
+            e.code === "ethos_bootstrap_failed" &&
+            /tombstoned/i.test(e.message));
+        assert.equal(auth.canSignAsOwner(), false);
+    });
+    it("still throws ethos_bootstrap_failed on the conflict message under a different code", async () => {
+        // Conversely, an error matching the message but with a code OTHER than
+        // -32022 is not swallowed — we anchor on both (code, message) to keep
+        // the shim narrow.
+        const { fetch: f } = makeMockFetch([
+            { url: "/auth/register", method: "POST", respond: fakeRegisterOk },
+            {
+                url: "/mcp/primitives/write",
+                method: "POST",
+                respond: () => ({
+                    json: {
+                        jsonrpc: "2.0",
+                        id: "publish_identity",
+                        error: {
+                            code: -32000,
+                            message: "different did.json already published for this DID",
+                        },
+                    },
+                }),
+            },
+        ]);
+        const auth = makeAuth(f);
+        await assert.rejects(() => auth.signUp(validInput), (e) => e instanceof AithosSDKError && e.code === "ethos_bootstrap_failed");
+        assert.equal(auth.canSignAsOwner(), false);
+    });
 });
 //# sourceMappingURL=signup-bootstrap.test.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aithos/sdk",
-  "version": "0.1.0-alpha.35",
-  "description": "Aithos SDK \u2014 high-level TypeScript developer kit for building agentic apps on the Aithos protocol. Wraps @aithos/protocol-client and exposes the Aithos compute proxy and wallet (Stripe top-up) endpoints.",
+  "version": "0.1.0-alpha.36",
+  "description": "Aithos SDK — high-level TypeScript developer kit for building agentic apps on the Aithos protocol. Wraps @aithos/protocol-client and exposes the Aithos compute proxy and wallet (Stripe top-up) endpoints.",
   "keywords": [
     "aithos",
     "sdk",
@@ -39,15 +39,6 @@
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "tsc",
-    "build:test": "tsc -p tsconfig.test.json",
-    "check-types": "tsc --noEmit && tsc -p tsconfig.test.json --noEmit",
-    "test": "npm run clean && npm run build && npm run build:test && cd dist && node --test",
-    "test:watch": "cd dist && node --test --watch",
-    "clean": "rm -rf dist",
-    "prepublishOnly": "npm run clean && npm run build && npm test"
-  },
   "engines": {
     "node": ">=20"
   },
@@ -63,5 +54,13 @@
   "publishConfig": {
     "access": "public",
     "tag": "alpha"
+  },
+  "scripts": {
+    "build": "tsc",
+    "build:test": "tsc -p tsconfig.test.json",
+    "check-types": "tsc --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "test": "npm run clean && npm run build && npm run build:test && cd dist && node --test",
+    "test:watch": "cd dist && node --test --watch",
+    "clean": "rm -rf dist"
   }
-}
+}