@highway1/core 0.1.47 → 0.1.51

package/src/messaging/rate-limiter.ts

@@ -0,0 +1,85 @@
+/**
+ * Token Bucket Rate Limiter
+ *
+ * Classic token bucket algorithm for per-sender rate limiting.
+ * Tokens refill at a constant rate up to capacity.
+ */
+
+export interface TokenBucketConfig {
+  capacity: number;    // Max tokens (burst size)
+  refillRate: number;  // Tokens per millisecond
+}
+
+export class TokenBucket {
+  private tokens: number;
+  private lastRefill: number;
+  private readonly capacity: number;
+  private readonly refillRate: number; // tokens per ms
+
+  constructor(config: TokenBucketConfig, initialTokens?: number, lastRefill?: number) {
+    this.capacity = config.capacity;
+    this.refillRate = config.refillRate;
+    this.tokens = initialTokens ?? config.capacity;
+    this.lastRefill = lastRefill ?? Date.now();
+  }
+
+  /** Attempt to consume one token. Returns true if allowed. */
+  consume(): boolean {
+    this.refill();
+    if (this.tokens >= 1) {
+      this.tokens -= 1;
+      return true;
+    }
+    return false;
+  }
+
+  getRemaining(): number {
+    this.refill();
+    return Math.floor(this.tokens);
+  }
+
+  /** Milliseconds until at least one token is available */
+  getResetTime(): number {
+    this.refill();
+    if (this.tokens >= 1) return 0;
+    const needed = 1 - this.tokens;
+    return Math.ceil(needed / this.refillRate);
+  }
+
+  /** Serialize state for persistence */
+  toState(): { tokens: number; lastRefill: number } {
+    return { tokens: this.tokens, lastRefill: this.lastRefill };
+  }
+
+  private refill(): void {
+    const now = Date.now();
+    const elapsed = now - this.lastRefill;
+    const newTokens = elapsed * this.refillRate;
+    this.tokens = Math.min(this.capacity, this.tokens + newTokens);
+    this.lastRefill = now;
+  }
+}
+
+/**
+ * Rate limiter tiers based on trust score
+ */
+export interface RateLimitTiers {
+  /** Trust < 0.3: new/unknown agents */
+  newAgent: TokenBucketConfig;
+  /** Trust 0.3–0.6: established agents */
+  established: TokenBucketConfig;
+  /** Trust > 0.6: trusted agents */
+  trusted: TokenBucketConfig;
+}
+
+export const DEFAULT_RATE_LIMIT_TIERS: RateLimitTiers = {
+  newAgent:    { capacity: 10,   refillRate: 10   / (60 * 1000) }, // 10/min, burst 10
+  established: { capacity: 100,  refillRate: 60   / (60 * 1000) }, // 60/min, burst 100
+  trusted:     { capacity: 1000, refillRate: 600  / (60 * 1000) }, // 600/min, burst 1000
+};
+
+export function getTierConfig(trustScore: number, tiers: RateLimitTiers): TokenBucketConfig {
+  if (trustScore >= 0.6) return tiers.trusted;
+  if (trustScore >= 0.3) return tiers.established;
+  return tiers.newAgent;
+}

package/src/messaging/router.ts

@@ -1,8 +1,5 @@
-import type { Libp2p } from 'libp2p';
-import { peerIdFromString } from '@libp2p/peer-id';
-import { multiaddr } from '@multiformats/multiaddr';
 import type { MessageEnvelope } from './envelope.js';
-import type { DHTOperations } from '../discovery/dht.js';
+import type { RelayClient } from '../transport/relay-client.js';
 import { encodeMessage, decodeMessage } from './codec.js';
 import { validateEnvelope, verifyEnvelope } from './envelope.js';
 import { createLogger } from '../utils/logger.js';
@@ -12,53 +9,34 @@ import { verify } from '../identity/keys.js';
 
 const logger = createLogger('router');
 
-/** Helper to efficiently concatenate Uint8Array chunks */
-function concatUint8Arrays(arrays: Uint8Array[]): Uint8Array {
-  if (arrays.length === 0) return new Uint8Array(0);
-  if (arrays.length === 1) return arrays[0];
-
-  const totalLength = arrays.reduce((acc, arr) => acc + arr.length, 0);
-  const result = new Uint8Array(totalLength);
-  let offset = 0;
-  for (const arr of arrays) {
-    result.set(arr, offset);
-    offset += arr.length;
-  }
-  return result;
-}
-
 export type MessageHandler = (
   envelope: MessageEnvelope
 ) => Promise<MessageEnvelope | void>;
 
-export interface PeerHint {
-  peerId: string;
-  multiaddrs: string[];
-}
-
 export interface MessageRouter {
   registerHandler: (protocol: string, handler: MessageHandler) => void;
   unregisterHandler: (protocol: string) => void;
   registerCatchAllHandler: (handler: MessageHandler) => void;
-  sendMessage: (envelope: MessageEnvelope, peerHint?: PeerHint) => Promise<MessageEnvelope | void>;
+  sendMessage: (envelope: MessageEnvelope) => Promise<MessageEnvelope | void>;
   start: () => Promise<void>;
   stop: () => Promise<void>;
 }
 
 /**
- * Create a message router for a libp2p node.
- * When dht is provided, sendMessage can resolve DIDs to peer addresses via DHT lookup.
- * When relayPeers is provided, sendMessage will attempt relay fallback if direct dial fails.
+ * Create a message router using relay client (CVP-0011)
  */
 export function createMessageRouter(
-  libp2p: Libp2p,
-  verifyFn: (signature: Uint8Array, data: Uint8Array) => Promise<boolean>,
-  dht?: DHTOperations,
-  relayPeers?: string[]
+  relayClient: RelayClient,
+  verifyFn: (signature: Uint8Array, data: Uint8Array) => Promise<boolean>
 ): MessageRouter {
   const handlers = new Map<string, MessageHandler>();
   let catchAllHandler: MessageHandler | undefined;
-  const PROTOCOL_PREFIX = '/clawiverse/msg/1.0.0';
+
+  // Map to track pending requests waiting for responses
+  const pendingRequests = new Map<string, {
+    resolve: (envelope: MessageEnvelope | undefined) => void;
+    timeout: NodeJS.Timeout;
+  }>();
 
   return {
     registerHandler: (protocol: string, handler: MessageHandler) => {
@@ -76,160 +54,16 @@ export function createMessageRouter(
       logger.info('Registered catch-all message handler');
     },
 
-    sendMessage: async (envelope: MessageEnvelope, peerHint?: PeerHint) => {
+    sendMessage: async (envelope: MessageEnvelope) => {
       try {
         if (!validateEnvelope(envelope)) {
           throw new MessagingError('Invalid message envelope');
         }
 
-        // Resolve peer: try peerHint first, then DHT
-        let targetPeerIdStr: string | undefined;
-        let targetMultiaddrs: string[] = [];
-
-        if (peerHint) {
-          targetPeerIdStr = peerHint.peerId;
-          targetMultiaddrs = peerHint.multiaddrs;
-          logger.info('Using peer hint for direct addressing', { peerId: targetPeerIdStr });
-        } else if (dht) {
-          const resolved = await dht.resolveDID(envelope.to);
-          if (resolved) {
-            targetPeerIdStr = resolved.peerId;
-            targetMultiaddrs = resolved.multiaddrs;
-          }
-        }
-
-        if (!targetPeerIdStr) {
-          throw new MessagingError(
-            `Cannot resolve recipient: ${envelope.to} — provide peerHint or ensure agent is in DHT`
-          );
-        }
-
-        const targetPeerId = peerIdFromString(targetPeerIdStr);
-
-        if (targetMultiaddrs.length > 0) {
-          const mas = targetMultiaddrs.map((a) => multiaddr(a));
-          await libp2p.peerStore.merge(targetPeerId, { multiaddrs: mas });
-        }
-
-        logger.info('Dialing peer for message delivery', {
-          peerId: targetPeerIdStr,
-          multiaddrs: targetMultiaddrs,
-        });
-
-        let stream: any;
-        const DIAL_TIMEOUT = 3000; // 3 seconds per attempt
-
-        // Separate relay addrs from direct addrs
-        const relayMultiaddrs = targetMultiaddrs.filter((a) => a.includes('/p2p-circuit/'));
-        const directMultiaddrs = targetMultiaddrs.filter((a) => !a.includes('/p2p-circuit/'));
-
-        // Try direct addresses in parallel
-        if (directMultiaddrs.length > 0) {
-          const directDialPromises = directMultiaddrs.map(async (addr) => {
-            try {
-              const conn = await libp2p.dial(multiaddr(addr), {
-                signal: AbortSignal.timeout(DIAL_TIMEOUT)
-              });
-              const s = await conn.newStream(PROTOCOL_PREFIX, { runOnLimitedConnection: true });
-              logger.info('Direct dial succeeded', { addr });
-              return { conn, stream: s };
-            } catch {
-              return null;
-            }
-          });
-
-          const winner = await Promise.race(
-            directDialPromises.map(p => p.then(r => r || Promise.reject()))
-          ).catch(() => undefined);
-
-          if (winner) {
-            stream = winner.stream;
-            // Close connections whose streams were not selected
-            Promise.allSettled(directDialPromises).then((results) => {
-              for (const result of results) {
-                if (result.status === 'fulfilled' && result.value && result.value.stream !== stream) {
-                  result.value.conn.close().catch(() => {});
-                }
-              }
-            });
-          }
-        }
-
-        let lastError: unknown;
-
-        // Fall back to relay: try all relay addresses in parallel
-        if (!stream) {
-          const allRelayAddrs = [
-            ...relayMultiaddrs,
-            ...(relayPeers ?? []).map((r) => buildCircuitRelayAddr(r, targetPeerIdStr!)),
-          ];
-          // Deduplicate
-          const uniqueRelayAddrs = [...new Set(allRelayAddrs)];
-
-          if (uniqueRelayAddrs.length > 0) {
-            const relayDialPromises = uniqueRelayAddrs.map(async (addr) => {
-              try {
-                const conn = await libp2p.dial(multiaddr(addr), {
-                  signal: AbortSignal.timeout(DIAL_TIMEOUT)
-                });
-                logger.info('Relay connection established', { addr });
-                const s = await conn.newStream(PROTOCOL_PREFIX, { runOnLimitedConnection: true });
-                logger.info('Relay stream opened', { addr });
-                return { conn, stream: s };
-              } catch (relayErr) {
-                logger.warn('Relay dial failed', { addr, error: (relayErr as Error).message });
-                lastError = relayErr;
-                return null;
-              }
-            });
-
-            const winner = await Promise.race(
-              relayDialPromises.map(p => p.then(r => r || Promise.reject()))
-            ).catch(() => undefined);
-
-            if (winner) {
-              stream = winner.stream;
-              // Close connections whose streams were not selected
-              Promise.allSettled(relayDialPromises).then((results) => {
-                for (const result of results) {
-                  if (result.status === 'fulfilled' && result.value && result.value.stream !== stream) {
-                    result.value.conn.close().catch(() => {});
-                  }
-                }
-              });
-            }
-          }
-        }
-
-        // Last resort: query DHT for relay-capable peers
-        if (!stream && dht && 'queryRelayPeers' in dht) {
-          const discoveredRelays = await (dht as any).queryRelayPeers();
-          for (const relayAddr of discoveredRelays) {
-            const circuitAddr = buildCircuitRelayAddr(relayAddr, targetPeerIdStr!);
-            try {
-              const conn = await libp2p.dial(multiaddr(circuitAddr));
-              stream = await conn.newStream(PROTOCOL_PREFIX, { runOnLimitedConnection: true });
-              logger.info('DHT-discovered relay succeeded', { relayAddr });
-              break;
-            } catch (e) {
-              logger.warn('DHT relay failed', { relayAddr, error: (e as Error).message });
-              lastError = e;
-            }
-          }
-        }
-
-        if (!stream) {
-          throw lastError ?? new MessagingError('All dial attempts failed (including DHT-discovered relays)');
-        }
-
         const encoded = encodeMessage(envelope);
-        await stream.sink(
-          (async function* () {
-            yield encoded;
-          })()
-        );
+        await relayClient.sendEnvelope(envelope.to, encoded);
 
-        logger.info('Message sent over libp2p stream', {
+        logger.info('Message sent via relay', {
           id: envelope.id,
           from: envelope.from,
           to: envelope.to,
@@ -240,44 +74,17 @@ export function createMessageRouter(
         if (envelope.type === 'request') {
           logger.debug('Waiting for response to request', { id: envelope.id });
 
-          try {
-            // Add timeout to prevent infinite blocking
-            const RESPONSE_TIMEOUT = 5000; // 5 seconds
+          const RESPONSE_TIMEOUT = 30000; // 30 seconds (CVP-0010 §4.2)
 
-            const responsePromise = (async () => {
-              const responseChunks: Uint8Array[] = [];
-              for await (const chunk of stream.source) {
-                responseChunks.push(chunk.subarray());
-              }
+          return new Promise<MessageEnvelope | undefined>((resolve) => {
+            const timeout = setTimeout(() => {
+              pendingRequests.delete(envelope.id);
+              logger.warn('Response timeout', { id: envelope.id, timeout: RESPONSE_TIMEOUT });
+              resolve(undefined);
+            }, RESPONSE_TIMEOUT);
 
-              if (responseChunks.length > 0) {
-                const responseData = concatUint8Arrays(responseChunks);
-                const responseEnvelope = decodeMessage(responseData);
-                logger.info('Received response', {
-                  id: responseEnvelope.id,
-                  replyTo: responseEnvelope.replyTo,
-                });
-
-                return responseEnvelope;
-              } else {
-                logger.warn('No response received for request', { id: envelope.id });
-                return undefined;
-              }
-            })();
-
-            const timeoutPromise = new Promise<undefined>((resolve) => {
-              setTimeout(() => {
-                logger.warn('Response timeout', { id: envelope.id, timeout: RESPONSE_TIMEOUT });
-                resolve(undefined);
-              }, RESPONSE_TIMEOUT);
-            });
-
-            const response = await Promise.race([responsePromise, timeoutPromise]);
-            return response;
-          } catch (error) {
-            logger.warn('Error reading response', { error });
-            return undefined;
-          }
+            pendingRequests.set(envelope.id, { resolve, timeout });
+          });
         }
 
         return undefined;
@@ -288,128 +95,115 @@ export function createMessageRouter(
     },
 
     start: async () => {
-      await libp2p.handle(PROTOCOL_PREFIX, async ({ stream }) => {
+      // Register handler for incoming DELIVER messages
+      relayClient.onDeliver(async (deliverMsg) => {
         try {
-          await handleIncomingStream(stream, handlers, catchAllHandler, verifyFn);
+          const envelope = decodeMessage(deliverMsg.envelope);
+
+          if (!validateEnvelope(envelope)) {
+            logger.warn('Received invalid message envelope');
+            return;
+          }
+
+          // Verify signature against sender DID embedded public key
+          const isValidSignature = await verifyEnvelope(envelope, async (signature, data) => {
+            const senderPublicKey = extractPublicKey(envelope.from);
+            return verify(signature, data, senderPublicKey);
+          });
+          if (!isValidSignature) {
+            logger.warn('Received message with invalid signature', {
+              id: envelope.id,
+              from: envelope.from,
+            });
+            return;
+          }
+
+          // Optional caller-supplied verification hook (e.g. policy checks)
+          try {
+            const { signature, ...envelopeWithoutSig } = envelope;
+            const dataBytes = new TextEncoder().encode(JSON.stringify(envelopeWithoutSig));
+            const signatureBytes = Buffer.from(signature, 'hex');
+            const hookValid = await verifyFn(signatureBytes, dataBytes);
+            if (!hookValid) {
+              logger.warn('Message rejected by custom verifier', {
+                id: envelope.id,
+                from: envelope.from,
+              });
+              return;
+            }
+          } catch (error) {
+            logger.warn('Custom verification hook failed', {
+              id: envelope.id,
+              from: envelope.from,
+              error: (error as Error).message,
+            });
+            return;
+          }
+
+          logger.info('Received message', {
+            id: envelope.id,
+            from: envelope.from,
+            to: envelope.to,
+            protocol: envelope.protocol,
+            type: envelope.type,
+          });
+
+          // Check if this is a response to a pending request
+          if (envelope.type === 'response' && envelope.replyTo) {
+            const pending = pendingRequests.get(envelope.replyTo);
+            if (pending) {
+              clearTimeout(pending.timeout);
+              pendingRequests.delete(envelope.replyTo);
+              pending.resolve(envelope);
+              logger.info('Matched response to pending request', {
+                requestId: envelope.replyTo,
+                responseId: envelope.id,
+              });
+              return;
+            }
+          }
+
+          // Dispatch to handler
+          const handler = handlers.get(envelope.protocol);
+          let response: MessageEnvelope | void = undefined;
+
+          if (handler) {
+            response = await handler(envelope);
+          } else if (catchAllHandler) {
+            logger.debug('Using catch-all handler for protocol', { protocol: envelope.protocol });
+            response = await catchAllHandler(envelope);
+          } else {
+            logger.warn('No handler for protocol', { protocol: envelope.protocol });
+          }
+
+          // Send response back if handler returned one
+          if (response) {
+            const encoded = encodeMessage(response);
+            await relayClient.sendEnvelope(response.to, encoded);
+            logger.info('Sent response back to sender', {
+              responseId: response.id,
+              replyTo: response.replyTo,
+            });
+          }
         } catch (error) {
-          logger.error('Error handling incoming stream', error);
+          logger.error('Error handling incoming message', error);
         }
-      }, { runOnLimitedConnection: true });
+      });
 
       logger.info('Message router started');
     },
 
     stop: async () => {
-      await libp2p.unhandle(PROTOCOL_PREFIX);
+      // Clear all pending requests
+      for (const [, pending] of pendingRequests.entries()) {
+        clearTimeout(pending.timeout);
+        pending.resolve(undefined);
+      }
+      pendingRequests.clear();
+
       handlers.clear();
       catchAllHandler = undefined;
       logger.info('Message router stopped');
     },
   };
 }
-
-function buildCircuitRelayAddr(relayAddr: string, targetPeerId: string): string {
-  return `${relayAddr}/p2p-circuit/p2p/${targetPeerId}`;
-}
-
-async function handleIncomingStream(
-  stream: any,
-  handlers: Map<string, MessageHandler>,
-  catchAllHandler: MessageHandler | undefined,
-  verifyFn: (signature: Uint8Array, data: Uint8Array) => Promise<boolean>
-): Promise<void> {
-  try {
-    const chunks: Uint8Array[] = [];
-    for await (const chunk of stream.source) {
-      chunks.push(chunk.subarray());
-    }
-
-    const data = concatUint8Arrays(chunks);
-
-    // Ignore empty streams (from unused parallel dial connections)
-    if (data.length === 0) {
-      logger.debug('Received empty stream, ignoring');
-      return;
-    }
-
-    const envelope = decodeMessage(data);
-
-    if (!validateEnvelope(envelope)) {
-      logger.warn('Received invalid message envelope');
-      return;
-    }
-
-    // Verify signature against sender DID embedded public key.
-    const isValidSignature = await verifyEnvelope(envelope, async (signature, data) => {
-      const senderPublicKey = extractPublicKey(envelope.from);
-      return verify(signature, data, senderPublicKey);
-    });
-    if (!isValidSignature) {
-      logger.warn('Received message with invalid signature', {
-        id: envelope.id,
-        from: envelope.from,
-      });
-      return;
-    }
-
-    // Optional caller-supplied verification hook (e.g. policy checks).
-    try {
-      const { signature, ...envelopeWithoutSig } = envelope;
-      const dataBytes = new TextEncoder().encode(JSON.stringify(envelopeWithoutSig));
-      const signatureBytes = Buffer.from(signature, 'hex');
-      const hookValid = await verifyFn(signatureBytes, dataBytes);
-      if (!hookValid) {
-        logger.warn('Message rejected by custom verifier', {
-          id: envelope.id,
-          from: envelope.from,
-        });
-        return;
-      }
-    } catch (error) {
-      logger.warn('Custom verification hook failed', {
-        id: envelope.id,
-        from: envelope.from,
-        error: (error as Error).message,
-      });
-      return;
-    }
-
-    logger.info('Received message', {
-      id: envelope.id,
-      from: envelope.from,
-      to: envelope.to,
-      protocol: envelope.protocol,
-      payload: envelope.payload,
-    });
-
-    const handler = handlers.get(envelope.protocol);
-    let response: MessageEnvelope | void = undefined;
-
-    if (handler) {
-      response = await handler(envelope);
-    } else if (catchAllHandler) {
-      logger.debug('Using catch-all handler for protocol', { protocol: envelope.protocol });
-      response = await catchAllHandler(envelope);
-    } else {
-      logger.warn('No handler for protocol', { protocol: envelope.protocol });
-    }
-
-    // Send response back if handler returned one
-    if (response) {
-      const encoded = encodeMessage(response);
-      logger.info('Sending response back to sender', {
-        responseId: response.id,
-        replyTo: response.replyTo,
-        size: encoded.length
-      });
-
-      await stream.sink(
-        (async function* () {
-          yield encoded;
-        })()
-      );
-    }
-  } catch (error) {
-    logger.error('Error handling incoming message', error);
-  }
-}