@evomap/evolver-adapter-public 2.0.1 → 2.0.8

package/dist/hubCapability.d.ts

@@ -58,6 +58,9 @@ export interface AccountAssetListResult {
     hasMore: boolean;
     nextCursor?: string;
 }
+export declare class MalformedAccountAssetPageError extends Error {
+    constructor();
+}
 /** 完整 GEP-A2A 信封(实测 dev: publish/fetch/validate 等协议消息端点必须全信封, 非仅 protocol+message_type). */
 export declare function gepEnvelope(messageType: string, payload: unknown, options?: {
     messageId?: string;
@@ -149,7 +152,7 @@ export declare class PublicHubCapability implements hub.HubCapability {
     private heartbeatMeta;
     publish(bundle: hub.AssetRecord[], options?: hub.PublishOptions): Promise<hub.PublishReceipt>;
     fetch(query: hub.HubQuery): Promise<hub.AssetRecord[]>;
-    fetchAssetById(assetId: string): Promise<hub.AssetRecord | null>;
+    fetchAssetById(assetId: string, options?: hub.FetchAssetByIdOptions): Promise<hub.AssetRecord | null>;
     /**
      * #69: search != fetch. Free-text is the hub's vector endpoint (GET /a2a/assets/semantic-search?q=);
      * signal/id queries use the Hub's free search-only phase on /a2a/fetch. /a2a/fetch does NOT do semantic,

package/dist/hubCapability.js

@@ -1,12 +1,12 @@
 import { createHash } from 'node:crypto';
-import { bootstrap, hub as hubNs, signals } from '@evomap/evolver-core';
+import { bootstrap, hub as hubNs, signals, wire } from '@evomap/evolver-core';
 import { AuthError, HubFetch, HubClientError, isHubUnreachableError } from './hubFetch.js';
 import { isNodeSecret, parseNodeSecretVersion } from './auth/legacyShim.js';
 import { inboundToAgentEvent, agentEventToOutbound, publishRespToReceipt, searchQueryToFetchWire, searchQueryToSearchOnlyWire, } from './wireMap.js';
 import { antiAbuseTelemetryMode, buildHeartbeatAntiAbuseTelemetry, } from './antiAbuseTelemetry.js';
 import { getWorkspaceKeychainMode } from './auth/workspaceKeychain.js';
 import { agentDirectoryFailure, parsePublicAgentPage, parsePublicAgentProfile, paginatePublicAgentPage, mergePublicAgentPages, publicAgentSearchQuery, publicTaskDiscoveryQuery, PUBLIC_TASK_DISCOVERY_MAX_CANDIDATES, unsupportedPublicAvailability, unsupportedPublicSort, withDirectoryTimeout, } from './agentDirectory.js';
-import { assetMatchesId } from './hubReuse.js';
+import { assetMatchesId, stripHubDeliveryMetadataForIntegrity } from './hubReuse.js';
 export const INBOUND_LIMIT = 100;
 export const OUTBOUND_MAX_BATCH = 50;
 export const OUTBOUND_MAX_BODY_BYTES = 4 * 1024 * 1024;
@@ -22,6 +22,12 @@ export const USED_ASSET_IDS_MAX = 50;
 export const USED_ASSET_ID_MAX_LEN = 200;
 export const LEARNING_ASSET_IDS_MAX = 50;
 export const LEARNING_ASSET_ID_MAX_LEN = 128;
+export class MalformedAccountAssetPageError extends Error {
+    constructor() {
+        super('Hub account asset page is malformed');
+        this.name = 'MalformedAccountAssetPageError';
+    }
+}
 /** 完整 GEP-A2A 信封(实测 dev: publish/fetch/validate 等协议消息端点必须全信封, 非仅 protocol+message_type). */
 export function gepEnvelope(messageType, payload, options = {}) {
     return {
@@ -280,12 +286,41 @@ export class PublicHubCapability {
         const body = await this.http.call('POST', '/a2a/fetch', gepEnvelope('fetch', searchQueryToFetchWire(query)));
         return assetsFromBody(body);
     }
-    async fetchAssetById(assetId) {
+    async fetchAssetById(assetId, options) {
         const id = assetId.trim();
         if (!id)
             return null;
         const body = await this.http.call('POST', '/a2a/fetch', gepEnvelope('fetch', { asset_ids: [id] }));
-        return assetsFromBody(body).find((asset) => fetchResultMatchesId(asset, id)) ?? null;
+        const matches = [];
+        for (const row of assetCandidatesFromBody(body)) {
+            const asset = unwrapFetchDeliveryRow(row);
+            if (!fetchDeliveryIdentityConsistent(row, asset))
+                return null;
+            if (id.startsWith('sha256:')) {
+                if (!assetMatchesId(asset, id)) {
+                    // The unverified escape hatch is intentionally narrower than the legacy verified aliases accepted by
+                    // assetMatchesId: a rewritten delivery must bind the requested content id through its canonical
+                    // asset_id field before a caller-owned quarantine path may opt in.
+                    if (stringField(asset, 'asset_id') !== id || !isExactUnverifiedContentDelivery(asset, id))
+                        return null;
+                }
+                if (isRevokedFetchDelivery(row))
+                    return null;
+                matches.push(asset);
+                continue;
+            }
+            if (fetchResultMatchesId(asset, id)) {
+                if (isRevokedFetchDelivery(row))
+                    return null;
+                matches.push(asset);
+            }
+        }
+        const result = unambiguousFetchResult(matches);
+        // Logical-id lookups retain their historical matching semantics. Only a canonical sha256 lookup can opt in
+        // to a content-hash drift, and every non-opted-in caller remains strict.
+        if (!result || !/^sha256:[0-9a-f]{64}$/.test(id) || assetMatchesId(result, id))
+            return result;
+        return options?.allowUnverifiedExactIdentity === true ? result : null;
     }
     /**
      * #69: search != fetch. Free-text is the hub's vector endpoint (GET /a2a/assets/semantic-search?q=);
@@ -368,16 +403,18 @@ export class PublicHubCapability {
             ...(opts.scope === 'published' && opts.status && opts.status !== 'all' ? { status: opts.status } : {}),
         };
         const body = await this.http.call('GET', path, undefined, query);
-        const payload = asRecord(body['payload']) ?? body;
+        const payload = Object.prototype.hasOwnProperty.call(body, 'payload')
+            ? asRecord(body['payload'])
+            : body;
+        if (!payload)
+            throw new MalformedAccountAssetPageError();
         const assets = accountAssetsFromPayload(payload);
         const count = numberField(payload, 'count');
-        const nextCursor = stringField(payload, 'next_cursor') ?? stringField(payload, 'nextCursor');
-        const hasMore = booleanField(payload, 'has_more') ?? booleanField(payload, 'hasMore') ?? Boolean(nextCursor);
+        const pagination = accountPaginationFromPayload(payload);
         return {
             assets,
             ...(count !== undefined ? { count } : {}),
-            hasMore,
-            ...(nextCursor ? { nextCursor } : {}),
+            ...pagination,
         };
     }
     /**
@@ -850,7 +887,7 @@ function dryRunRecipeReceipt(action, recipeId, extra = {}) {
         },
     };
 }
-function assetsFromBody(body) {
+function assetCandidatesFromBody(body) {
     const payload = asRecord(body['payload']);
     const candidates = [
         body['asset'],
@@ -861,15 +898,25 @@ function assetsFromBody(body) {
         ...(Array.isArray(payload?.['results']) ? payload['results'] : []),
     ];
     return candidates
-        .filter((candidate) => Boolean(candidate && typeof candidate === 'object' && !Array.isArray(candidate)))
-        .map(unwrapFetchDeliveryRow);
+        .filter((candidate) => Boolean(candidate && typeof candidate === 'object' && !Array.isArray(candidate)));
+}
+function assetsFromBody(body) {
+    return assetCandidatesFromBody(body).map(unwrapFetchDeliveryRow);
 }
 // Delivery-row metadata carried over onto the unwrapped GEP record. Ranking fields are consumed by
 // hubReuse and stripped before canonical storage. `payload_backfill_reason` must also survive this
 // boundary so integrity consumers can report that the Hub synthesized the payload (#570). Do not
 // carry `confidence`: it is transport metadata on Gene rows but canonical content on Capsules, so
 // overloading it can either poison a Gene hash or overwrite Capsule content (#565).
-const FETCH_ROW_CARRYOVER_KEYS = ['gdi_score', 'success_rate', 'reuse_count', 'source_node_id', 'payload_backfill_reason'];
+const FETCH_ROW_CARRYOVER_KEYS = [
+    'gdi_score',
+    'success_rate',
+    'reuse_count',
+    'source_node_id',
+    'payload_backfill_reason',
+    'status',
+    'trust_state',
+];
 /**
  * The live hub's /a2a/fetch results are DELIVERY ROWS, not raw GEP records (#565, observed on
  * evomap.ai 2026-07-22): the record itself nests under `payload`, while the row's own keys are
@@ -893,20 +940,89 @@ function unwrapFetchDeliveryRow(row) {
     }
     return { ...inner, ...carryover };
 }
+function fetchDeliveryIdentityConsistent(row, asset) {
+    const outer = row;
+    if (typeof outer['type'] === 'string') {
+        const transportType = stringField(outer, 'asset_type');
+        if (transportType !== undefined && transportType !== outer['type'])
+            return false;
+        const transportLogicalId = stringField(outer, 'local_id');
+        if (transportLogicalId !== undefined && transportLogicalId !== stringField(outer, 'id'))
+            return false;
+        return true;
+    }
+    const inner = asRecord(outer['payload']);
+    if (!inner)
+        return false;
+    const outerAssetId = stringField(outer, 'asset_id');
+    const innerAssetId = stringField(inner, 'asset_id');
+    if (!outerAssetId || !innerAssetId || outerAssetId !== innerAssetId)
+        return false;
+    const outerType = stringField(outer, 'asset_type');
+    const innerType = stringField(inner, 'type');
+    if (outerType !== undefined && outerType !== innerType)
+        return false;
+    const innerLogicalId = stringField(inner, 'id');
+    for (const key of ['id', 'local_id']) {
+        const outerLogicalId = stringField(outer, key);
+        if (outerLogicalId !== undefined && outerLogicalId !== innerLogicalId)
+            return false;
+    }
+    for (const key of ['status', 'trust_state']) {
+        const outerMarker = stringField(outer, key);
+        const innerMarker = stringField(inner, key);
+        const outerRevoked = isRevokedMarker(outerMarker);
+        const innerRevoked = isRevokedMarker(innerMarker);
+        if (outerMarker !== undefined && innerMarker !== undefined && outerRevoked !== innerRevoked)
+            return false;
+    }
+    return asset === row || stringField(asset, 'asset_id') === innerAssetId;
+}
+function isRevokedFetchDelivery(row) {
+    const record = row;
+    const nested = asRecord(record['payload']);
+    return [record, ...(nested ? [nested] : [])].some((value) => (isRevokedMarker(value['status'])
+        || isRevokedMarker(value['trust_state'])));
+}
+function isRevokedMarker(raw) {
+    return typeof raw === 'string' && raw.trim().toLowerCase() === 'revoked';
+}
 function accountAssetsFromPayload(payload) {
-    const candidates = [
-        payload['assets'],
-        payload['results'],
-        payload['items'],
-    ];
-    for (const candidate of candidates) {
-        if (!Array.isArray(candidate))
-            continue;
-        return candidate
-            .filter((asset) => Boolean(asset && typeof asset === 'object' && !Array.isArray(asset)))
-            .map(unwrapFetchDeliveryRow);
+    const keys = ['assets', 'results', 'items']
+        .filter((key) => Object.prototype.hasOwnProperty.call(payload, key));
+    if (keys.length !== 1)
+        throw new MalformedAccountAssetPageError();
+    const candidate = payload[keys[0]];
+    if (!Array.isArray(candidate) || candidate.some((asset) => !asset || typeof asset !== 'object' || Array.isArray(asset))) {
+        throw new MalformedAccountAssetPageError();
     }
-    return [];
+    return candidate.map((row) => {
+        const asset = unwrapFetchDeliveryRow(row);
+        return fetchDeliveryIdentityConsistent(row, asset) ? asset : row;
+    });
+}
+function accountPaginationFromPayload(payload) {
+    const snakeHasMore = payload['has_more'];
+    const camelHasMore = payload['hasMore'];
+    if ((snakeHasMore !== undefined && typeof snakeHasMore !== 'boolean')
+        || (camelHasMore !== undefined && typeof camelHasMore !== 'boolean')
+        || (snakeHasMore === undefined && camelHasMore === undefined)
+        || (typeof snakeHasMore === 'boolean' && typeof camelHasMore === 'boolean' && snakeHasMore !== camelHasMore)) {
+        throw new MalformedAccountAssetPageError();
+    }
+    const hasMore = typeof snakeHasMore === 'boolean' ? snakeHasMore : camelHasMore;
+    const rawCursors = [payload['next_cursor'], payload['nextCursor']]
+        .filter((value) => value !== undefined && value !== null);
+    if (rawCursors.some((value) => typeof value !== 'string' || !value.trim())) {
+        throw new MalformedAccountAssetPageError();
+    }
+    if (rawCursors.length === 2 && rawCursors[0] !== rawCursors[1]) {
+        throw new MalformedAccountAssetPageError();
+    }
+    const nextCursor = rawCursors[0];
+    if (hasMore !== Boolean(nextCursor))
+        throw new MalformedAccountAssetPageError();
+    return { hasMore, ...(nextCursor ? { nextCursor } : {}) };
 }
 function learningAssetsFromPayload(payload) {
     const candidates = [
@@ -1010,7 +1126,48 @@ function failureReason(error) {
 function fetchResultMatchesId(asset, requestedId) {
     if (assetMatchesId(asset, requestedId))
         return true;
-    return !requestedId.startsWith('sha256:') && Boolean(asset && stringField(asset, 'id') === requestedId);
+    if (!asset)
+        return false;
+    if (!requestedId.startsWith('sha256:'))
+        return stringField(asset, 'id') === requestedId;
+    return false;
+}
+function unambiguousFetchResult(matches) {
+    if (matches.length === 0)
+        return null;
+    let canonical;
+    try {
+        canonical = wire.canonicalize(stripHubDeliveryMetadataForIntegrity(matches[0]));
+        for (const asset of matches.slice(1)) {
+            if (wire.canonicalize(stripHubDeliveryMetadataForIntegrity(asset)) !== canonical)
+                return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    return matches.find((asset) => stringField(asset, 'payload_backfill_reason') !== undefined) ?? matches[0];
+}
+function isExactUnverifiedContentDelivery(asset, requestedId) {
+    if (!/^sha256:[0-9a-f]{64}$/.test(requestedId))
+        return false;
+    if (stringField(asset, 'asset_id') !== requestedId)
+        return false;
+    const logicalId = stringField(asset, 'id');
+    if (!logicalId)
+        return false;
+    const wireAsset = stripHubDeliveryMetadataForIntegrity(asset);
+    try {
+        if (!wire.validateWireDeep(wireAsset).ok)
+            return false;
+        const deliveredContentId = wire.computeAssetId(wireAsset);
+        return typeof deliveredContentId === 'string'
+            && /^sha256:[0-9a-f]{64}$/.test(deliveredContentId)
+            && deliveredContentId !== requestedId;
+    }
+    catch {
+        return false;
+    }
 }
 function stringField(value, key) {
     return typeof value[key] === 'string' && value[key].length > 0 ? value[key] : undefined;

package/dist/hubReuse.d.ts

@@ -50,6 +50,7 @@ export declare class ReuseCache {
     setPayload(assetId: string, payload: hub.AssetRecord): void;
     clear(): void;
 }
+export declare function stripHubDeliveryMetadataForIntegrity(rec: hub.AssetRecord): hub.AssetRecord;
 /**
  * Map a hub search row (AssetRecord with arbitrary quality fields) → the core's price-free HubMetadata.
  * Accepts both camelCase and the hub's snake_case (gdi_score / success_rate / reuse_count / ...). Drops any

package/dist/hubReuse.js

@@ -36,6 +36,7 @@ const GENE_WIRE_KEYS = new Set([
 ]);
 const HUB_DELIVERY_METADATA_KEYS = new Set([
     'status',
+    'trust_state',
     'success_streak',
     'reputation_score',
     'gdi_score',
@@ -55,8 +56,15 @@ const HUB_DELIVERY_METADATA_KEYS = new Set([
     'semanticSimilarity',
     '_search_score',
     'search_score',
+    '_match_score',
+    'match_score',
+    '_retrieval_rank',
+    'retrieval_rank',
     'payload_backfill_reason',
+    'original_asset_id',
     'asset_type',
+    'local_id',
+    'source',
     'bundle_id',
     'callable',
     'payload_ready',
@@ -246,10 +254,15 @@ function stripHubPayloadMetadata(rec) {
     }
     return out;
 }
-function stripHubDeliveryMetadataForIntegrity(rec) {
+// Shared content projection for by-id verification and sync quarantine classification.
+export function stripHubDeliveryMetadataForIntegrity(rec) {
     const out = { ...rec };
-    for (const key of HUB_DELIVERY_METADATA_KEYS)
+    for (const key of HUB_DELIVERY_METADATA_KEYS) {
+        // Hub ranking streak is metadata for Genes, while Capsule.success_streak is canonical content.
+        if (key === 'success_streak' && out['type'] === 'Capsule')
+            continue;
         delete out[key];
+    }
     // Hub ranking confidence is metadata for Genes, while Capsule.confidence is canonical content.
     if (out['type'] === 'Gene')
         delete out['confidence'];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evomap/evolver-adapter-public",
-  "version": "2.0.1",
+  "version": "2.0.8",
   "private": false,
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "@evomap/atp-sdk": "^0.1.0",
-    "@evomap/evolver-core": "2.0.1",
+    "@evomap/evolver-core": "2.0.8",
     "undici": "^6.27.0"
   },
   "optionalDependencies": {