@antseed/node 0.2.91 → 0.2.93

package/dist/verification/codec.js

@@ -0,0 +1,38 @@
+import { parseJsonObject, requireFiniteNumberField, requireStringField, } from '../utils/json-codec.js';
+const encoder = new TextEncoder();
+const MAX_PAYLOAD_SIZE = 64 * 1024;
+function parseVerificationJson(data) {
+    return parseJsonObject(data, {
+        maxBytes: MAX_PAYLOAD_SIZE,
+        payloadName: 'Verification payload',
+    });
+}
+export function encodeResponseAuth(payload) {
+    return encoder.encode(JSON.stringify(payload));
+}
+export function decodeResponseAuth(data) {
+    const obj = parseVerificationJson(data);
+    const version = obj.version;
+    if (version !== 1) {
+        throw new Error(`Unsupported response auth version: ${String(version)}`);
+    }
+    const result = {
+        version,
+        requestId: requireStringField(obj, 'requestId'),
+        buyerPeerId: requireStringField(obj, 'buyerPeerId'),
+        sellerPeerId: requireStringField(obj, 'sellerPeerId'),
+        advertisedService: requireStringField(obj, 'advertisedService'),
+        provider: requireStringField(obj, 'provider'),
+        statusCode: requireFiniteNumberField(obj, 'statusCode'),
+        requestHash: requireStringField(obj, 'requestHash'),
+        responseHash: requireStringField(obj, 'responseHash'),
+        responseStartedAt: requireFiniteNumberField(obj, 'responseStartedAt'),
+        responseCompletedAt: requireFiniteNumberField(obj, 'responseCompletedAt'),
+        signature: requireStringField(obj, 'signature'),
+    };
+    if (typeof obj.channelId === 'string' && obj.channelId.length > 0) {
+        result.channelId = obj.channelId;
+    }
+    return result;
+}
+//# sourceMappingURL=codec.js.map

package/dist/verification/codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.js","sourceRoot":"","sources":["../../src/verification/codec.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,SAAS,qBAAqB,CAAC,IAAgB;IAC7C,OAAO,eAAe,CAAC,IAAI,EAAE;QAC3B,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,sBAAsB;KACpC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAwB;QAClC,OAAO;QACP,SAAS,EAAE,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC;QAC/C,WAAW,EAAE,kBAAkB,CAAC,GAAG,EAAE,aAAa,CAAC;QACnD,YAAY,EAAE,kBAAkB,CAAC,GAAG,EAAE,cAAc,CAAC;QACrD,iBAAiB,EAAE,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,CAAC;QAC/D,QAAQ,EAAE,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC;QAC7C,UAAU,EAAE,wBAAwB,CAAC,GAAG,EAAE,YAAY,CAAC;QACvD,WAAW,EAAE,kBAAkB,CAAC,GAAG,EAAE,aAAa,CAAC;QACnD,YAAY,EAAE,kBAAkB,CAAC,GAAG,EAAE,cAAc,CAAC;QACrD,iBAAiB,EAAE,wBAAwB,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACrE,mBAAmB,EAAE,wBAAwB,CAAC,GAAG,EAAE,qBAAqB,CAAC;QACzE,SAAS,EAAE,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC;KAChD,CAAC;IACF,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/verification/index.d.ts

@@ -0,0 +1,6 @@
+export { decodeResponseAuth, encodeResponseAuth } from './codec.js';
+export { VerificationMux } from './verification-mux.js';
+export { createResponseAuthPayload, hashRequest, hashResponse, verifyResponseAuth, type ResponseAuthInput, type ResponseAuthVerificationExpected, type ResponseAuthVerificationResult, } from './response-auth.js';
+export { VerificationSampler, type ResponseAuthSampleInput, type StoredVerificationSample, type VerificationSampleConfig, } from './samples.js';
+export { VerificationStorage, type StoredResponseAuth } from './storage.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/verification/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/verification/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,yBAAyB,EACzB,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,GACpC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/verification/index.js

@@ -0,0 +1,6 @@
+export { decodeResponseAuth, encodeResponseAuth } from './codec.js';
+export { VerificationMux } from './verification-mux.js';
+export { createResponseAuthPayload, hashRequest, hashResponse, verifyResponseAuth, } from './response-auth.js';
+export { VerificationSampler, } from './samples.js';
+export { VerificationStorage } from './storage.js';
+//# sourceMappingURL=index.js.map

package/dist/verification/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/verification/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,yBAAyB,EACzB,WAAW,EACX,YAAY,EACZ,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,GAIpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAA2B,MAAM,cAAc,CAAC"}

package/dist/verification/response-auth.d.ts

@@ -0,0 +1,31 @@
+import type { Wallet } from 'ethers';
+import type { ResponseAuthPayload } from '../types/protocol.js';
+import type { SerializedHttpRequest, SerializedHttpResponse } from '../types/http.js';
+export interface ResponseAuthInput {
+    request: SerializedHttpRequest;
+    response: SerializedHttpResponse;
+    buyerPeerId: string;
+    sellerPeerId: string;
+    advertisedService: string;
+    provider: string;
+    responseStartedAt: number;
+    responseCompletedAt: number;
+    channelId?: string | null;
+}
+export interface ResponseAuthVerificationExpected {
+    request: SerializedHttpRequest;
+    response: SerializedHttpResponse;
+    buyerPeerId: string;
+    sellerPeerId: string;
+    advertisedService: string;
+    channelId?: string | null;
+}
+export interface ResponseAuthVerificationResult {
+    valid: boolean;
+    reason?: string;
+}
+export declare function createResponseAuthPayload(input: ResponseAuthInput, signer: Wallet): ResponseAuthPayload;
+export declare function verifyResponseAuth(payload: ResponseAuthPayload, expected: ResponseAuthVerificationExpected): ResponseAuthVerificationResult;
+export declare function hashRequest(request: SerializedHttpRequest): string;
+export declare function hashResponse(response: SerializedHttpResponse): string;
+//# sourceMappingURL=response-auth.d.ts.map

package/dist/verification/response-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-auth.d.ts","sourceRoot":"","sources":["../../src/verification/response-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAOtF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAiBvG;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,gCAAgC,GACzC,8BAA8B,CA+ChC;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAElE;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,CAErE"}

package/dist/verification/response-auth.js

@@ -0,0 +1,111 @@
+import { keccak256 } from 'ethers';
+import { ANTSEED_STREAMING_RESPONSE_HEADER } from '../types/http.js';
+import { bytesToHex, hexToBytes, signData, verifySignature } from '../p2p/identity.js';
+import { encodeHttpRequest, encodeHttpResponse } from '../proxy/request-codec.js';
+const RESPONSE_AUTH_DOMAIN = 'antseed-response-auth-v1';
+export function createResponseAuthPayload(input, signer) {
+    const payload = {
+        version: 1,
+        requestId: input.request.requestId,
+        ...(input.channelId ? { channelId: input.channelId } : {}),
+        buyerPeerId: normalizePeerId(input.buyerPeerId),
+        sellerPeerId: normalizePeerId(input.sellerPeerId),
+        advertisedService: input.advertisedService,
+        provider: input.provider,
+        statusCode: input.response.statusCode,
+        requestHash: hashRequest(input.request),
+        responseHash: hashResponse(input.response),
+        responseStartedAt: input.responseStartedAt,
+        responseCompletedAt: input.responseCompletedAt,
+    };
+    const signature = bytesToHex(signData(signer, buildResponseAuthSigningBytes(payload)));
+    return { ...payload, signature };
+}
+export function verifyResponseAuth(payload, expected) {
+    const expectedRequestHash = hashRequest(expected.request);
+    if (payload.requestHash !== expectedRequestHash) {
+        return { valid: false, reason: 'request_hash_mismatch' };
+    }
+    const expectedResponseHash = hashResponse(expected.response);
+    if (payload.responseHash !== expectedResponseHash) {
+        return { valid: false, reason: 'response_hash_mismatch' };
+    }
+    if (payload.requestId !== expected.request.requestId) {
+        return { valid: false, reason: 'request_id_mismatch' };
+    }
+    if (payload.statusCode !== expected.response.statusCode) {
+        return { valid: false, reason: 'status_code_mismatch' };
+    }
+    if (normalizePeerId(payload.buyerPeerId) !== normalizePeerId(expected.buyerPeerId)) {
+        return { valid: false, reason: 'buyer_peer_mismatch' };
+    }
+    if (normalizePeerId(payload.sellerPeerId) !== normalizePeerId(expected.sellerPeerId)) {
+        return { valid: false, reason: 'seller_peer_mismatch' };
+    }
+    if (payload.advertisedService !== expected.advertisedService) {
+        return { valid: false, reason: 'advertised_service_mismatch' };
+    }
+    if (expected.channelId && payload.channelId !== expected.channelId) {
+        return { valid: false, reason: 'channel_id_mismatch' };
+    }
+    const { signature: _signature, ...unsigned } = payload;
+    let validSignature = false;
+    try {
+        const signature = hexToBytes(payload.signature);
+        validSignature = verifySignature(normalizePeerId(expected.sellerPeerId), signature, buildResponseAuthSigningBytes(unsigned));
+    }
+    catch {
+        validSignature = false;
+    }
+    if (!validSignature) {
+        return { valid: false, reason: 'invalid_signature' };
+    }
+    return { valid: true };
+}
+export function hashRequest(request) {
+    return keccak256(encodeHttpRequest(request));
+}
+export function hashResponse(response) {
+    return keccak256(encodeHttpResponse(stripStreamingHeader(response)));
+}
+function buildResponseAuthSigningBytes(payload) {
+    const encoder = new TextEncoder();
+    const fields = [
+        RESPONSE_AUTH_DOMAIN,
+        String(payload.version),
+        payload.requestId,
+        payload.channelId ?? '',
+        normalizePeerId(payload.buyerPeerId),
+        normalizePeerId(payload.sellerPeerId),
+        payload.advertisedService,
+        payload.provider,
+        String(payload.statusCode),
+        payload.requestHash,
+        payload.responseHash,
+        String(payload.responseStartedAt),
+        String(payload.responseCompletedAt),
+    ].map((field) => encoder.encode(field));
+    const totalLength = fields.reduce((sum, field) => sum + 4 + field.length, 0);
+    const out = new Uint8Array(totalLength);
+    const view = new DataView(out.buffer);
+    let offset = 0;
+    for (const field of fields) {
+        view.setUint32(offset, field.length);
+        offset += 4;
+        out.set(field, offset);
+        offset += field.length;
+    }
+    return out;
+}
+function stripStreamingHeader(response) {
+    if (response.headers[ANTSEED_STREAMING_RESPONSE_HEADER] !== '1') {
+        return response;
+    }
+    const headers = { ...response.headers };
+    delete headers[ANTSEED_STREAMING_RESPONSE_HEADER];
+    return { ...response, headers };
+}
+function normalizePeerId(peerId) {
+    return peerId.startsWith('0x') ? peerId.slice(2).toLowerCase() : peerId.toLowerCase();
+}
+//# sourceMappingURL=response-auth.js.map

package/dist/verification/response-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-auth.js","sourceRoot":"","sources":["../../src/verification/response-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAInC,OAAO,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAElF,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AA4BxD,MAAM,UAAU,yBAAyB,CAAC,KAAwB,EAAE,MAAc;IAChF,MAAM,OAAO,GAA2C;QACtD,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;QACjD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACrC,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC;QACvC,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC;IACF,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvF,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAA4B,EAC5B,QAA0C;IAE1C,MAAM,mBAAmB,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,oBAAoB,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;IACvD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChD,cAAc,GAAG,eAAe,CAC9B,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,EACtC,SAAS,EACT,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAA8B;IACxD,OAAO,SAAS,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgC;IAC3D,OAAO,SAAS,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,6BAA6B,CAAC,OAA+C;IACpF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG;QACb,oBAAoB;QACpB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QACvB,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,SAAS,IAAI,EAAE;QACvB,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC;QACpC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACrC,OAAO,CAAC,iBAAiB;QACzB,OAAO,CAAC,QAAQ;QAChB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,YAAY;QACpB,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACjC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;KACpC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAExC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgC;IAC5D,IAAI,QAAQ,CAAC,OAAO,CAAC,iCAAiC,CAAC,KAAK,GAAG,EAAE,CAAC;QAChE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;IACxC,OAAO,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAClD,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;AACxF,CAAC"}

package/dist/verification/samples.d.ts

@@ -0,0 +1,29 @@
+import type { SerializedHttpRequest, SerializedHttpResponse } from '../types/http.js';
+import type { ResponseAuthPayload } from '../types/protocol.js';
+export interface VerificationSampleConfig {
+    sampleRate?: number;
+    maxSampleBytes?: number;
+    random?: () => number;
+}
+export interface ResponseAuthSampleInput {
+    request: SerializedHttpRequest;
+    response: SerializedHttpResponse;
+    responseAuth: ResponseAuthPayload;
+    verified: boolean;
+    verificationError: string | null;
+}
+export interface StoredVerificationSample {
+    sampleId: string;
+    directory: string;
+    savedAt: number;
+}
+export declare class VerificationSampler {
+    private readonly _samplesDir;
+    private readonly _sampleRate;
+    private readonly _maxSampleBytes;
+    private readonly _random;
+    constructor(samplesDir: string, config?: VerificationSampleConfig);
+    shouldSample(): boolean;
+    maybeStoreResponseAuthSample(input: ResponseAuthSampleInput): Promise<StoredVerificationSample | null>;
+}
+//# sourceMappingURL=samples.d.ts.map

package/dist/verification/samples.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"samples.d.ts","sourceRoot":"","sources":["../../src/verification/samples.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAOhE,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,YAAY,EAAE,mBAAmB,CAAC;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;gBAE3B,UAAU,EAAE,MAAM,EAAE,MAAM,GAAE,wBAA6B;IAOrE,YAAY,IAAI,OAAO;IAMjB,4BAA4B,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;CAmD7G"}

package/dist/verification/samples.js

@@ -0,0 +1,96 @@
+import { randomBytes, randomInt } from 'node:crypto';
+import { mkdir, rename, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { encodeHttpRequest, encodeHttpResponse } from '../proxy/request-codec.js';
+const SAMPLE_RANDOM_SCALE = 1_000_000;
+const DEFAULT_SAMPLE_RATE = 0.01;
+const DEFAULT_MAX_SAMPLE_BYTES = 16 * 1024 * 1024;
+export class VerificationSampler {
+    _samplesDir;
+    _sampleRate;
+    _maxSampleBytes;
+    _random;
+    constructor(samplesDir, config = {}) {
+        this._samplesDir = samplesDir;
+        this._sampleRate = normalizeSampleRate(config.sampleRate ?? DEFAULT_SAMPLE_RATE);
+        this._maxSampleBytes = Math.max(1, config.maxSampleBytes ?? DEFAULT_MAX_SAMPLE_BYTES);
+        this._random = config.random ?? cryptoRandomFloat;
+    }
+    shouldSample() {
+        if (this._sampleRate <= 0)
+            return false;
+        if (this._sampleRate >= 1)
+            return true;
+        return this._random() < this._sampleRate;
+    }
+    async maybeStoreResponseAuthSample(input) {
+        if (!input.verified)
+            return null;
+        if (!this.shouldSample())
+            return null;
+        const requestBytes = encodeHttpRequest(input.request);
+        const responseBytes = encodeHttpResponse(input.response);
+        const combinedBytes = requestBytes.byteLength + responseBytes.byteLength;
+        if (combinedBytes > this._maxSampleBytes) {
+            return null;
+        }
+        const savedAt = Date.now();
+        const sampleId = sampleIdFor(input.responseAuth);
+        const directory = join(this._samplesDir, input.responseAuth.sellerPeerId, sampleId);
+        await mkdir(directory, { recursive: true });
+        const manifest = {
+            version: 1,
+            savedAt,
+            requestId: input.responseAuth.requestId,
+            buyerPeerId: input.responseAuth.buyerPeerId,
+            sellerPeerId: input.responseAuth.sellerPeerId,
+            advertisedService: input.responseAuth.advertisedService,
+            provider: input.responseAuth.provider,
+            statusCode: input.responseAuth.statusCode,
+            requestHash: input.responseAuth.requestHash,
+            responseHash: input.responseAuth.responseHash,
+            responseStartedAt: input.responseAuth.responseStartedAt,
+            responseCompletedAt: input.responseAuth.responseCompletedAt,
+            verified: input.verified,
+            verificationError: input.verificationError,
+            responseAuth: input.responseAuth,
+            files: {
+                request: 'request.bin',
+                response: 'response.bin',
+                encoding: 'antseed-http-codec-v1',
+            },
+        };
+        await writeFileAtomic(join(directory, 'request.bin'), requestBytes);
+        await writeFileAtomic(join(directory, 'response.bin'), responseBytes);
+        // The manifest is the completion marker. Readers should ignore sample
+        // directories without manifest.json because the process may have stopped
+        // between evidence writes.
+        await writeFileAtomic(join(directory, 'manifest.json'), new TextEncoder().encode(JSON.stringify(manifest, null, 2)));
+        return { sampleId, directory, savedAt };
+    }
+}
+function sampleIdFor(payload) {
+    return `${sanitizePathSegment(payload.requestId)}-${payload.requestHash.slice(2, 18)}`;
+}
+function sanitizePathSegment(value) {
+    const sanitized = value.replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 96);
+    return sanitized.length > 0 ? sanitized : 'sample';
+}
+function normalizeSampleRate(value) {
+    if (!Number.isFinite(value))
+        return DEFAULT_SAMPLE_RATE;
+    if (value <= 0)
+        return 0;
+    if (value >= 1)
+        return 1;
+    return value;
+}
+function cryptoRandomFloat() {
+    return randomInt(0, SAMPLE_RANDOM_SCALE) / SAMPLE_RANDOM_SCALE;
+}
+async function writeFileAtomic(path, data) {
+    const tmp = `${path}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+    await writeFile(tmp, data);
+    await rename(tmp, path);
+}
+//# sourceMappingURL=samples.js.map

package/dist/verification/samples.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"samples.js","sourceRoot":"","sources":["../../src/verification/samples.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAElF,MAAM,mBAAmB,GAAG,SAAS,CAAC;AACtC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAsBlD,MAAM,OAAO,mBAAmB;IACb,WAAW,CAAS;IACpB,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,OAAO,CAAe;IAEvC,YAAY,UAAkB,EAAE,SAAmC,EAAE;QACnE,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAC;QACjF,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,IAAI,wBAAwB,CAAC,CAAC;QACtF,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC;IACpD,CAAC;IAED,YAAY;QACV,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,KAA8B;QAC/D,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC;QACzE,IAAI,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpF,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAA+B;YAC3C,OAAO,EAAE,CAAC;YACV,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;YACvC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;YAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,YAAY;YAC7C,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,iBAAiB;YACvD,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ;YACrC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,UAAU;YACzC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;YAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,YAAY;YAC7C,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,iBAAiB;YACvD,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAC,mBAAmB;YAC3D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa;gBACtB,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,uBAAuB;aAClC;SACF,CAAC;QAEF,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;QACpE,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,2BAA2B;QAC3B,MAAM,eAAe,CACnB,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAC5D,CAAC;QAEF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;CACF;AAyBD,SAAS,WAAW,CAAC,OAA4B;IAC/C,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACxD,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACzB,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,SAAS,CAAC,CAAC,EAAE,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAgB;IAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3E,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/verification/storage.d.ts

@@ -0,0 +1,20 @@
+import type { ResponseAuthPayload } from '../types/protocol.js';
+export interface StoredResponseAuth extends ResponseAuthPayload {
+    receivedAt: number;
+    verified: boolean;
+    verificationError: string | null;
+}
+export declare class VerificationStorage {
+    private readonly _db;
+    private readonly _insertResponseAuth;
+    private readonly _getResponseAuth;
+    private readonly _listResponseAuthsBySeller;
+    constructor(dbPath: string);
+    private _prepareStatements;
+    private _prepareInsertResponseAuthStatement;
+    insertResponseAuth(record: StoredResponseAuth): void;
+    getResponseAuth(requestId: string): StoredResponseAuth | null;
+    listResponseAuthsBySeller(sellerPeerId: string, limit?: number): StoredResponseAuth[];
+    close(): void;
+}
+//# sourceMappingURL=storage.d.ts.map

package/dist/verification/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/verification/storage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAIhE,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAqB;gBAEpD,MAAM,EAAE,MAAM;IAW1B,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,mCAAmC;IAgC3C,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAqBpD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IAK7D,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,SAAM,GAAG,kBAAkB,EAAE;IAKlF,KAAK,IAAI,IAAI;CAGd"}

package/dist/verification/storage.js

@@ -0,0 +1,108 @@
+import Database from 'better-sqlite3';
+import { runMigrations } from '../storage/migrate.js';
+import { verificationMigrations } from '../storage/migrations/verification/index.js';
+export class VerificationStorage {
+    _db;
+    _insertResponseAuth;
+    _getResponseAuth;
+    _listResponseAuthsBySeller;
+    constructor(dbPath) {
+        this._db = new Database(dbPath);
+        this._db.pragma('journal_mode = WAL');
+        runMigrations(this._db, verificationMigrations);
+        const statements = this._prepareStatements();
+        this._insertResponseAuth = statements.insertResponseAuth;
+        this._getResponseAuth = statements.getResponseAuth;
+        this._listResponseAuthsBySeller = statements.listResponseAuthsBySeller;
+    }
+    _prepareStatements() {
+        return {
+            insertResponseAuth: this._prepareInsertResponseAuthStatement(),
+            getResponseAuth: this._db.prepare('SELECT * FROM response_auths WHERE request_id = ?'),
+            listResponseAuthsBySeller: this._db.prepare('SELECT * FROM response_auths WHERE seller_peer_id = ? ORDER BY received_at DESC LIMIT ?'),
+        };
+    }
+    _prepareInsertResponseAuthStatement() {
+        return this._db.prepare(`
+      INSERT INTO response_auths (
+        request_id, version, channel_id, buyer_peer_id, seller_peer_id,
+        advertised_service, provider, status_code, request_hash, response_hash,
+        response_started_at, response_completed_at, signature,
+        received_at, verified, verification_error
+      ) VALUES (
+        @requestId, @version, @channelId, @buyerPeerId, @sellerPeerId,
+        @advertisedService, @provider, @statusCode, @requestHash, @responseHash,
+        @responseStartedAt, @responseCompletedAt, @signature,
+        @receivedAt, @verified, @verificationError
+      )
+      ON CONFLICT(request_id) DO UPDATE SET
+        version = excluded.version,
+        channel_id = excluded.channel_id,
+        buyer_peer_id = excluded.buyer_peer_id,
+        seller_peer_id = excluded.seller_peer_id,
+        advertised_service = excluded.advertised_service,
+        provider = excluded.provider,
+        status_code = excluded.status_code,
+        request_hash = excluded.request_hash,
+        response_hash = excluded.response_hash,
+        response_started_at = excluded.response_started_at,
+        response_completed_at = excluded.response_completed_at,
+        signature = excluded.signature,
+        received_at = excluded.received_at,
+        verified = excluded.verified,
+        verification_error = excluded.verification_error
+    `);
+    }
+    insertResponseAuth(record) {
+        this._insertResponseAuth.run({
+            requestId: record.requestId,
+            version: record.version,
+            channelId: record.channelId ?? null,
+            buyerPeerId: record.buyerPeerId,
+            sellerPeerId: record.sellerPeerId,
+            advertisedService: record.advertisedService,
+            provider: record.provider,
+            statusCode: record.statusCode,
+            requestHash: record.requestHash,
+            responseHash: record.responseHash,
+            responseStartedAt: record.responseStartedAt,
+            responseCompletedAt: record.responseCompletedAt,
+            signature: record.signature,
+            receivedAt: record.receivedAt,
+            verified: record.verified ? 1 : 0,
+            verificationError: record.verificationError,
+        });
+    }
+    getResponseAuth(requestId) {
+        const row = this._getResponseAuth.get(requestId);
+        return row ? rowToResponseAuth(row) : null;
+    }
+    listResponseAuthsBySeller(sellerPeerId, limit = 100) {
+        const rows = this._listResponseAuthsBySeller.all(sellerPeerId, Math.max(1, limit));
+        return rows.map(rowToResponseAuth);
+    }
+    close() {
+        this._db.close();
+    }
+}
+function rowToResponseAuth(row) {
+    return {
+        version: row.version,
+        requestId: row.request_id,
+        ...(row.channel_id ? { channelId: row.channel_id } : {}),
+        buyerPeerId: row.buyer_peer_id,
+        sellerPeerId: row.seller_peer_id,
+        advertisedService: row.advertised_service,
+        provider: row.provider,
+        statusCode: row.status_code,
+        requestHash: row.request_hash,
+        responseHash: row.response_hash,
+        responseStartedAt: row.response_started_at,
+        responseCompletedAt: row.response_completed_at,
+        signature: row.signature,
+        receivedAt: row.received_at,
+        verified: row.verified === 1,
+        verificationError: row.verification_error,
+    };
+}
+//# sourceMappingURL=storage.js.map

package/dist/verification/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/verification/storage.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAQrF,MAAM,OAAO,mBAAmB;IACb,GAAG,CAAoB;IACvB,mBAAmB,CAAqB;IACxC,gBAAgB,CAAqB;IACrC,0BAA0B,CAAqB;IAEhE,YAAY,MAAc;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACtC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAEhD,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC7C,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACzD,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,eAAe,CAAC;QACnD,IAAI,CAAC,0BAA0B,GAAG,UAAU,CAAC,yBAAyB,CAAC;IACzE,CAAC;IAEO,kBAAkB;QACxB,OAAO;YACL,kBAAkB,EAAE,IAAI,CAAC,mCAAmC,EAAE;YAC9D,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,CAAC;YACtF,yBAAyB,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CACzC,yFAAyF,CAC1F;SACF,CAAC;IACJ,CAAC;IAEO,mCAAmC;QACzC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BvB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB,CAAC,MAA0B;QAC3C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAgC,CAAC;QAChF,OAAO,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAED,yBAAyB,CAAC,YAAoB,EAAE,KAAK,GAAG,GAAG;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAsB,CAAC;QACxG,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;CACF;AA2BD,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAY;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,WAAW,EAAE,GAAG,CAAC,aAAa;QAC9B,YAAY,EAAE,GAAG,CAAC,cAAc;QAChC,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;QACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;QAC1C,mBAAmB,EAAE,GAAG,CAAC,qBAAqB;QAC9C,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ,KAAK,CAAC;QAC5B,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;KAC1C,CAAC;AACJ,CAAC"}

package/dist/verification/verification-mux.d.ts

@@ -0,0 +1,20 @@
+import { type FramedMessage, type ResponseAuthPayload } from '../types/protocol.js';
+import type { PeerConnection } from '../p2p/connection-manager.js';
+export type VerificationMessageHandler<T> = (payload: T) => void | Promise<void>;
+export declare class VerificationMux {
+    private readonly _connection;
+    private _messageIdCounter;
+    private _onResponseAuth?;
+    private readonly _pendingResponseAuths;
+    private readonly _bufferedResponseAuths;
+    constructor(connection: PeerConnection);
+    onResponseAuth(handler: VerificationMessageHandler<ResponseAuthPayload>): void;
+    sendResponseAuth(payload: ResponseAuthPayload): void;
+    waitForResponseAuth(requestId: string, timeoutMs?: number): Promise<ResponseAuthPayload>;
+    close(): void;
+    handleFrame(frame: FramedMessage): Promise<boolean>;
+    static isVerificationMessage(type: number): boolean;
+    private _bufferResponseAuth;
+    private _send;
+}
+//# sourceMappingURL=verification-mux.d.ts.map

package/dist/verification/verification-mux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-mux.d.ts","sourceRoot":"","sources":["../../src/verification/verification-mux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAYnE,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEjF,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,eAAe,CAAC,CAAkD;IAC1E,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA0C;IAChF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA0C;gBAErE,UAAU,EAAE,cAAc;IAItC,cAAc,CAAC,OAAO,EAAE,0BAA0B,CAAC,mBAAmB,CAAC,GAAG,IAAI;IAI9E,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAIpD,mBAAmB,CACjB,SAAS,EAAE,MAAM,EACjB,SAAS,SAAmC,GAC3C,OAAO,CAAC,mBAAmB,CAAC;IAyB/B,KAAK,IAAI,IAAI;IASP,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBzD,MAAM,CAAC,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAInD,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,KAAK;CASd"}

package/dist/verification/verification-mux.js

@@ -0,0 +1,100 @@
+import { MessageType } from '../types/protocol.js';
+import { encodeFrame } from '../p2p/message-protocol.js';
+import { debugLog } from '../utils/debug.js';
+import { decodeResponseAuth, encodeResponseAuth } from './codec.js';
+const MESSAGE_TYPE_NAME = {
+    [MessageType.VerificationResponseAuth]: 'VerificationResponseAuth',
+};
+const MAX_BUFFERED_AUTHS = 256;
+const DEFAULT_RESPONSE_AUTH_TIMEOUT_MS = 30_000;
+export class VerificationMux {
+    _connection;
+    _messageIdCounter = 0;
+    _onResponseAuth;
+    _pendingResponseAuths = new Map();
+    _bufferedResponseAuths = new Map();
+    constructor(connection) {
+        this._connection = connection;
+    }
+    onResponseAuth(handler) {
+        this._onResponseAuth = handler;
+    }
+    sendResponseAuth(payload) {
+        this._send(MessageType.VerificationResponseAuth, encodeResponseAuth(payload));
+    }
+    waitForResponseAuth(requestId, timeoutMs = DEFAULT_RESPONSE_AUTH_TIMEOUT_MS) {
+        const buffered = this._bufferedResponseAuths.get(requestId);
+        if (buffered) {
+            this._bufferedResponseAuths.delete(requestId);
+            return Promise.resolve(buffered);
+        }
+        const existing = this._pendingResponseAuths.get(requestId);
+        if (existing)
+            return existing.promise;
+        let resolve;
+        let reject;
+        const timer = setTimeout(() => {
+            this._pendingResponseAuths.delete(requestId);
+            reject(new Error(`ResponseAuth timed out for request ${requestId}`));
+        }, Math.max(1, timeoutMs));
+        const promise = new Promise((res, rej) => {
+            resolve = res;
+            reject = rej;
+        });
+        this._pendingResponseAuths.set(requestId, { promise, resolve, reject, timer });
+        return promise;
+    }
+    close() {
+        for (const pending of this._pendingResponseAuths.values()) {
+            clearTimeout(pending.timer);
+            pending.reject(new Error('VerificationMux closed'));
+        }
+        this._pendingResponseAuths.clear();
+        this._bufferedResponseAuths.clear();
+    }
+    async handleFrame(frame) {
+        const name = MESSAGE_TYPE_NAME[frame.type];
+        if (!name)
+            return false;
+        debugLog(`[VerificationMux] ← recv ${name} (${frame.payload.length}b)`);
+        switch (frame.type) {
+            case MessageType.VerificationResponseAuth: {
+                const payload = decodeResponseAuth(frame.payload);
+                const pending = this._pendingResponseAuths.get(payload.requestId);
+                if (pending) {
+                    clearTimeout(pending.timer);
+                    this._pendingResponseAuths.delete(payload.requestId);
+                    pending.resolve(payload);
+                }
+                else {
+                    this._bufferResponseAuth(payload);
+                }
+                await this._onResponseAuth?.(payload);
+                return true;
+            }
+            default:
+                return false;
+        }
+    }
+    static isVerificationMessage(type) {
+        return type >= 0x80 && type <= 0x8f;
+    }
+    _bufferResponseAuth(payload) {
+        if (this._bufferedResponseAuths.size >= MAX_BUFFERED_AUTHS) {
+            const oldest = this._bufferedResponseAuths.keys().next().value;
+            if (oldest)
+                this._bufferedResponseAuths.delete(oldest);
+        }
+        this._bufferedResponseAuths.set(payload.requestId, payload);
+    }
+    _send(type, payload) {
+        debugLog(`[VerificationMux] → send ${MESSAGE_TYPE_NAME[type] ?? `0x${type.toString(16)}`} (${payload.length}b)`);
+        const frame = encodeFrame({
+            type,
+            messageId: this._messageIdCounter++ & 0xffffffff,
+            payload,
+        });
+        this._connection.send(frame);
+    }
+}
+//# sourceMappingURL=verification-mux.js.map

package/dist/verification/verification-mux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-mux.js","sourceRoot":"","sources":["../../src/verification/verification-mux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAgD,MAAM,sBAAsB,CAAC;AAEjG,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,iBAAiB,GAA2B;IAChD,CAAC,WAAW,CAAC,wBAAwB,CAAC,EAAE,0BAA0B;CACnE,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAIhD,MAAM,OAAO,eAAe;IACT,WAAW,CAAiB;IACrC,iBAAiB,GAAG,CAAC,CAAC;IACtB,eAAe,CAAmD;IACzD,qBAAqB,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC/D,sBAAsB,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEjF,YAAY,UAA0B;QACpC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;IAChC,CAAC;IAED,cAAc,CAAC,OAAwD;QACrE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,gBAAgB,CAAC,OAA4B;QAC3C,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,mBAAmB,CACjB,SAAiB,EACjB,SAAS,GAAG,gCAAgC;QAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QAEtC,IAAI,OAAgD,CAAC;QACrD,IAAI,MAA+B,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAE3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5D,OAAO,GAAG,GAAG,CAAC;YACd,MAAM,GAAG,GAAG,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1D,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QACnC,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAoB;QACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,QAAQ,CAAC,4BAA4B,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAExE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,WAAW,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAClD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAClE,IAAI,OAAO,EAAE,CAAC;oBACZ,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC5B,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBACrD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBACpC,CAAC;gBACD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YACD;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,qBAAqB,CAAC,IAAY;QACvC,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;IACtC,CAAC;IAEO,mBAAmB,CAAC,OAA4B;QACtD,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,IAAI,kBAAkB,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;YACrF,IAAI,MAAM;gBAAE,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,IAAiB,EAAE,OAAmB;QAClD,QAAQ,CAAC,4BAA4B,iBAAiB,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACjH,MAAM,KAAK,GAAG,WAAW,CAAC;YACxB,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,GAAG,UAAU;YAChD,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;CACF"}