@iflow-mcp/jkheadley-instar 0.26.2

package/dist/threadline/relay/ConnectionManager.d.ts

@@ -0,0 +1,86 @@
+/**
+ * ConnectionManager — Manages WebSocket connections from agents.
+ *
+ * Handles authentication, heartbeat, and connection lifecycle.
+ * Part of Threadline Relay Phase 1.
+ */
+import type { WebSocket } from 'ws';
+import type { AgentFingerprint, AuthFrame } from './types.js';
+import type { PresenceRegistry } from './PresenceRegistry.js';
+import type { RelayRateLimiter } from './RelayRateLimiter.js';
+import type { RegistryStore } from './RegistryStore.js';
+import type { RegistryAuth } from './RegistryAuth.js';
+export interface ConnectionManagerConfig {
+    heartbeatIntervalMs: number;
+    heartbeatJitterMs: number;
+    authTimeoutMs: number;
+    missedPongsBeforeDisconnect: number;
+}
+export declare class ConnectionManager {
+    private readonly config;
+    private readonly presence;
+    private readonly rateLimiter;
+    private readonly pending;
+    private readonly connections;
+    private readonly socketToAgent;
+    /** Optional registry store for persistent agent profiles */
+    registryStore?: RegistryStore;
+    /** Optional registry auth for JWT token issuance */
+    registryAuth?: RegistryAuth;
+    /** Callback when a fully authenticated agent connection is established */
+    onAuthenticated?: (agentId: AgentFingerprint, socket: WebSocket) => void;
+    /** Callback when an agent disconnects */
+    onDisconnected?: (agentId: AgentFingerprint) => void;
+    /** Callback when an existing agent is displaced by a new connection */
+    onDisplaced?: (agentId: AgentFingerprint, oldSocket: WebSocket) => void;
+    constructor(config: ConnectionManagerConfig, presence: PresenceRegistry, rateLimiter: RelayRateLimiter);
+    /**
+     * Get the base64-encoded public key for an agent.
+     */
+    getPublicKey(agentId: AgentFingerprint): string | undefined;
+    /**
+     * Handle a new WebSocket connection.
+     * Sends a challenge and waits for auth response.
+     */
+    handleConnection(socket: WebSocket, ip: string): void;
+    /**
+     * Handle an auth response from an agent.
+     */
+    handleAuth(socket: WebSocket, frame: AuthFrame): boolean;
+    /**
+     * Handle a pong response from an agent.
+     */
+    handlePong(socket: WebSocket): void;
+    /**
+     * Handle socket close/error.
+     */
+    handleDisconnect(socket: WebSocket): void;
+    /**
+     * Get socket for an agent.
+     */
+    getSocket(agentId: AgentFingerprint): WebSocket | undefined;
+    /**
+     * Get agent ID for a socket.
+     */
+    getAgentId(socket: WebSocket): AgentFingerprint | undefined;
+    /**
+     * Get IP address for an agent.
+     */
+    getIP(agentId: AgentFingerprint): string;
+    /**
+     * Check if a socket is authenticated.
+     */
+    isAuthenticated(socket: WebSocket): boolean;
+    /**
+     * Get total number of active connections.
+     */
+    get size(): number;
+    /**
+     * Destroy all connections and timers.
+     */
+    destroy(): void;
+    private startHeartbeat;
+    private removeConnection;
+    private sendFrame;
+}
+//# sourceMappingURL=ConnectionManager.d.ts.map

package/dist/threadline/relay/ConnectionManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConnectionManager.d.ts","sourceRoot":"","sources":["../../../src/threadline/relay/ConnectionManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EACV,gBAAgB,EAEhB,SAAS,EASV,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAmBtD,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,EAAE,MAAM,CAAC;CACrC;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgD;IAC5E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IAExE,4DAA4D;IAC5D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,oDAAoD;IACpD,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B,0EAA0E;IAC1E,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC;IACzE,yCAAyC;IACzC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACrD,uEAAuE;IACvE,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,KAAK,IAAI,CAAC;gBAGtE,MAAM,EAAE,uBAAuB,EAC/B,QAAQ,EAAE,gBAAgB,EAC1B,WAAW,EAAE,gBAAgB;IAO/B;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS;IAI3D;;;OAGG;IACH,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAiCrD;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO;IAsLxD;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI;IASnC;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI;IAgBzC;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS;IAI3D;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,gBAAgB,GAAG,SAAS;IAI3D;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM;IAIxC;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO;IAI3C;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,OAAO,IAAI,IAAI;IAcf,OAAO,CAAC,cAAc;IA0BtB,OAAO,CAAC,gBAAgB;IAgBxB,OAAO,CAAC,SAAS;CAKlB"}

package/dist/threadline/relay/ConnectionManager.js

@@ -0,0 +1,356 @@
+/**
+ * ConnectionManager — Manages WebSocket connections from agents.
+ *
+ * Handles authentication, heartbeat, and connection lifecycle.
+ * Part of Threadline Relay Phase 1.
+ */
+import crypto from 'node:crypto';
+import { RELAY_ERROR_CODES } from './types.js';
+import { verify } from '../ThreadlineCrypto.js';
+export class ConnectionManager {
+    config;
+    presence;
+    rateLimiter;
+    pending = new Map();
+    connections = new Map();
+    socketToAgent = new Map();
+    /** Optional registry store for persistent agent profiles */
+    registryStore;
+    /** Optional registry auth for JWT token issuance */
+    registryAuth;
+    /** Callback when a fully authenticated agent connection is established */
+    onAuthenticated;
+    /** Callback when an agent disconnects */
+    onDisconnected;
+    /** Callback when an existing agent is displaced by a new connection */
+    onDisplaced;
+    constructor(config, presence, rateLimiter) {
+        this.config = config;
+        this.presence = presence;
+        this.rateLimiter = rateLimiter;
+    }
+    /**
+     * Get the base64-encoded public key for an agent.
+     */
+    getPublicKey(agentId) {
+        return this.connections.get(agentId)?.publicKeyBase64;
+    }
+    /**
+     * Handle a new WebSocket connection.
+     * Sends a challenge and waits for auth response.
+     */
+    handleConnection(socket, ip) {
+        // Rate limit auth attempts by IP
+        const authCheck = this.rateLimiter.checkAuth(ip);
+        if (!authCheck.allowed) {
+            this.sendFrame(socket, {
+                type: 'auth_error',
+                code: RELAY_ERROR_CODES.RATE_LIMITED,
+                message: 'Too many auth attempts',
+            });
+            socket.close(4029, 'Rate limited');
+            return;
+        }
+        this.rateLimiter.recordAuth(ip);
+        // Generate challenge nonce
+        const nonce = crypto.randomBytes(32).toString('base64');
+        const challenge = { type: 'challenge', nonce };
+        // Set auth timeout
+        const timer = setTimeout(() => {
+            this.pending.delete(socket);
+            this.sendFrame(socket, {
+                type: 'auth_error',
+                code: RELAY_ERROR_CODES.AUTH_TIMEOUT,
+                message: 'Authentication timeout',
+            });
+            socket.close(4008, 'Auth timeout');
+        }, this.config.authTimeoutMs);
+        this.pending.set(socket, { nonce, timer, ip });
+        this.sendFrame(socket, challenge);
+    }
+    /**
+     * Handle an auth response from an agent.
+     */
+    handleAuth(socket, frame) {
+        const pending = this.pending.get(socket);
+        if (!pending) {
+            this.sendFrame(socket, {
+                type: 'auth_error',
+                code: RELAY_ERROR_CODES.AUTH_FAILED,
+                message: 'No pending challenge',
+            });
+            return false;
+        }
+        clearTimeout(pending.timer);
+        this.pending.delete(socket);
+        // Decode public key
+        let publicKey;
+        try {
+            publicKey = Buffer.from(frame.publicKey, 'base64');
+            if (publicKey.length !== 32)
+                throw new Error('Invalid key length');
+        }
+        catch {
+            this.sendFrame(socket, {
+                type: 'auth_error',
+                code: RELAY_ERROR_CODES.AUTH_FAILED,
+                message: 'Invalid public key',
+            });
+            return false;
+        }
+        // Verify fingerprint matches public key
+        const expectedFingerprint = publicKey.subarray(0, 16).toString('hex');
+        if (frame.agentId !== expectedFingerprint) {
+            this.sendFrame(socket, {
+                type: 'auth_error',
+                code: RELAY_ERROR_CODES.AUTH_FAILED,
+                message: 'Agent ID does not match public key',
+            });
+            return false;
+        }
+        // Verify signature
+        let signature;
+        try {
+            signature = Buffer.from(frame.signature, 'base64');
+        }
+        catch {
+            this.sendFrame(socket, {
+                type: 'auth_error',
+                code: RELAY_ERROR_CODES.AUTH_FAILED,
+                message: 'Invalid signature encoding',
+            });
+            return false;
+        }
+        const nonceBuffer = Buffer.from(pending.nonce, 'utf-8');
+        const valid = verify(publicKey, nonceBuffer, signature);
+        if (!valid) {
+            this.sendFrame(socket, {
+                type: 'auth_error',
+                code: RELAY_ERROR_CODES.AUTH_FAILED,
+                message: 'Signature verification failed',
+            });
+            return false;
+        }
+        // Handle displacement: if this agent is already connected, disconnect the old socket
+        const existingConn = this.connections.get(frame.agentId);
+        if (existingConn) {
+            const displacedFrame = {
+                type: 'displaced',
+                reason: 'Another device connected with the same identity key',
+            };
+            this.sendFrame(existingConn.socket, displacedFrame);
+            this.removeConnection(existingConn.socket, frame.agentId);
+            existingConn.socket.close(4001, 'Displaced by new connection');
+            this.onDisplaced?.(frame.agentId, existingConn.socket);
+        }
+        // Register with presence
+        const sessionId = `relay-${crypto.randomBytes(8).toString('hex')}`;
+        const visibility = frame.visibility ?? 'unlisted';
+        try {
+            this.presence.register(frame.agentId, frame.publicKey, frame.metadata, visibility, sessionId);
+        }
+        catch (err) {
+            this.sendFrame(socket, {
+                type: 'auth_error',
+                code: RELAY_ERROR_CODES.INTERNAL_ERROR,
+                message: err instanceof Error ? err.message : 'Registration failed',
+            });
+            return false;
+        }
+        // Store connection
+        const connection = {
+            socket,
+            agentId: frame.agentId,
+            publicKey,
+            publicKeyBase64: frame.publicKey,
+            sessionId,
+            ip: pending.ip,
+            missedPongs: 0,
+            heartbeatTimer: null,
+        };
+        this.connections.set(frame.agentId, connection);
+        this.socketToAgent.set(socket, frame.agentId);
+        // Start heartbeat
+        this.startHeartbeat(connection);
+        // Handle registry
+        const authOk = {
+            type: 'auth_ok',
+            sessionId,
+            heartbeatInterval: this.config.heartbeatIntervalMs,
+        };
+        if (this.registryStore && this.registryAuth) {
+            // Issue JWT token for REST API access
+            const tokenInfo = this.registryAuth.issueToken(frame.publicKey);
+            authOk.registry_token = tokenInfo.token;
+            authOk.registry_token_expires = tokenInfo.expiresAt;
+            // Auto-register public agents in persistent registry (survives deploys)
+            // Agents with explicit registry config get priority fields; all public agents get listed
+            const registryFrameworkVisible = frame.registry?.frameworkVisible ?? true;
+            const registryHomepage = frame.registry?.homepage ?? '';
+            if (visibility === 'public' || frame.registry?.listed) {
+                this.registryStore.upsert({
+                    publicKey: frame.publicKey,
+                    agentId: frame.agentId,
+                    name: frame.metadata.name ?? '',
+                    bio: frame.metadata.bio ?? '',
+                    interests: frame.metadata.interests ?? [],
+                    capabilities: frame.metadata.capabilities ?? [],
+                    framework: frame.metadata.framework ?? 'unknown',
+                    frameworkVisible: registryFrameworkVisible,
+                    homepage: registryHomepage,
+                    visibility: visibility === 'private' ? 'unlisted' : visibility,
+                    consentMethod: 'auth_handshake',
+                });
+                authOk.registry_status = 'listed';
+                if (frame.registry?.listed) {
+                    authOk.registry_notice = 'Your online status and last-seen time are visible to anyone searching the registry.';
+                }
+            }
+            else {
+                // Unlisted/private — update last_seen if entry exists, don't auto-create
+                const existing = this.registryStore.getByPublicKey(frame.publicKey);
+                if (existing) {
+                    // Update visibility in case it changed (e.g., was public, now unlisted)
+                    this.registryStore.upsert({
+                        publicKey: frame.publicKey,
+                        agentId: frame.agentId,
+                        name: frame.metadata.name ?? '',
+                        bio: frame.metadata.bio ?? '',
+                        interests: frame.metadata.interests ?? [],
+                        capabilities: frame.metadata.capabilities ?? [],
+                        framework: frame.metadata.framework ?? 'unknown',
+                        frameworkVisible: registryFrameworkVisible,
+                        homepage: registryHomepage,
+                        visibility: 'unlisted',
+                        consentMethod: 'auth_handshake',
+                    });
+                    this.registryStore.setOnline(frame.publicKey);
+                    authOk.registry_status = 'updated';
+                }
+                else {
+                    authOk.registry_status = 'not_listed';
+                }
+            }
+        }
+        this.sendFrame(socket, authOk);
+        this.onAuthenticated?.(frame.agentId, socket);
+        return true;
+    }
+    /**
+     * Handle a pong response from an agent.
+     */
+    handlePong(socket) {
+        const agentId = this.socketToAgent.get(socket);
+        if (!agentId)
+            return;
+        const conn = this.connections.get(agentId);
+        if (!conn)
+            return;
+        conn.missedPongs = 0;
+        this.presence.touch(agentId);
+    }
+    /**
+     * Handle socket close/error.
+     */
+    handleDisconnect(socket) {
+        // Clean up pending auth
+        const pending = this.pending.get(socket);
+        if (pending) {
+            clearTimeout(pending.timer);
+            this.pending.delete(socket);
+        }
+        // Clean up authenticated connection
+        const agentId = this.socketToAgent.get(socket);
+        if (agentId) {
+            this.removeConnection(socket, agentId);
+            this.onDisconnected?.(agentId);
+        }
+    }
+    /**
+     * Get socket for an agent.
+     */
+    getSocket(agentId) {
+        return this.connections.get(agentId)?.socket;
+    }
+    /**
+     * Get agent ID for a socket.
+     */
+    getAgentId(socket) {
+        return this.socketToAgent.get(socket);
+    }
+    /**
+     * Get IP address for an agent.
+     */
+    getIP(agentId) {
+        return this.connections.get(agentId)?.ip ?? 'unknown';
+    }
+    /**
+     * Check if a socket is authenticated.
+     */
+    isAuthenticated(socket) {
+        return this.socketToAgent.has(socket);
+    }
+    /**
+     * Get total number of active connections.
+     */
+    get size() {
+        return this.connections.size;
+    }
+    /**
+     * Destroy all connections and timers.
+     */
+    destroy() {
+        for (const [, conn] of this.connections) {
+            if (conn.heartbeatTimer)
+                clearTimeout(conn.heartbeatTimer);
+        }
+        for (const [, pending] of this.pending) {
+            clearTimeout(pending.timer);
+        }
+        this.connections.clear();
+        this.socketToAgent.clear();
+        this.pending.clear();
+    }
+    // ── Private ─────────────────────────────────────────────────────
+    startHeartbeat(conn) {
+        const scheduleNext = () => {
+            const jitter = (Math.random() * 2 - 1) * this.config.heartbeatJitterMs;
+            const interval = this.config.heartbeatIntervalMs + jitter;
+            conn.heartbeatTimer = setTimeout(() => {
+                if (conn.missedPongs >= this.config.missedPongsBeforeDisconnect) {
+                    // Too many missed pongs — disconnect
+                    this.handleDisconnect(conn.socket);
+                    conn.socket.close(4000, 'Heartbeat timeout');
+                    return;
+                }
+                conn.missedPongs++;
+                const ping = {
+                    type: 'ping',
+                    timestamp: new Date().toISOString(),
+                };
+                this.sendFrame(conn.socket, ping);
+                scheduleNext();
+            }, Math.max(1000, interval));
+        };
+        scheduleNext();
+    }
+    removeConnection(socket, agentId) {
+        const conn = this.connections.get(agentId);
+        if (conn?.heartbeatTimer) {
+            clearTimeout(conn.heartbeatTimer);
+        }
+        // Set offline in registry
+        if (conn && this.registryStore) {
+            this.registryStore.setOffline(conn.publicKeyBase64);
+        }
+        this.connections.delete(agentId);
+        this.socketToAgent.delete(socket);
+        this.presence.unregister(agentId);
+    }
+    sendFrame(socket, frame) {
+        if (socket.readyState === 1 /* OPEN */) {
+            socket.send(JSON.stringify(frame));
+        }
+    }
+}
+//# sourceMappingURL=ConnectionManager.js.map

package/dist/threadline/relay/ConnectionManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConnectionManager.js","sourceRoot":"","sources":["../../../src/threadline/relay/ConnectionManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAejC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA8BhD,MAAM,OAAO,iBAAiB;IACX,MAAM,CAA0B;IAChC,QAAQ,CAAmB;IAC3B,WAAW,CAAmB;IAC9B,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,WAAW,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC3D,aAAa,GAAG,IAAI,GAAG,EAA+B,CAAC;IAExE,4DAA4D;IAC5D,aAAa,CAAiB;IAC9B,oDAAoD;IACpD,YAAY,CAAgB;IAE5B,0EAA0E;IAC1E,eAAe,CAA0D;IACzE,yCAAyC;IACzC,cAAc,CAAuC;IACrD,uEAAuE;IACvE,WAAW,CAA6D;IAExE,YACE,MAA+B,EAC/B,QAA0B,EAC1B,WAA6B;QAE7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAyB;QACpC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACxD,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,MAAiB,EAAE,EAAU;QAC5C,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;gBACrB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB,CAAC,YAAY;gBACpC,OAAO,EAAE,wBAAwB;aAClC,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEhC,2BAA2B;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAE/D,mBAAmB;QACnB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;gBACrB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB,CAAC,YAAY;gBACpC,OAAO,EAAE,wBAAwB;aAClC,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACrC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAiB,EAAE,KAAgB;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;gBACrB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB,CAAC,WAAW;gBACnC,OAAO,EAAE,sBAAsB;aAChC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE5B,oBAAoB;QACpB,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACnD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;gBACrB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB,CAAC,WAAW;gBACnC,OAAO,EAAE,oBAAoB;aAC9B,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wCAAwC;QACxC,MAAM,mBAAmB,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;YAC1C,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;gBACrB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB,CAAC,WAAW;gBACnC,OAAO,EAAE,oCAAoC;aAC9C,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mBAAmB;QACnB,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;gBACrB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB,CAAC,WAAW;gBACnC,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;gBACrB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB,CAAC,WAAW;gBACnC,OAAO,EAAE,+BAA+B;aACzC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qFAAqF;QACrF,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,cAAc,GAAmB;gBACrC,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,qDAAqD;aAC9D,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACpD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1D,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;YAC/D,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QAED,yBAAyB;QACzB,MAAM,SAAS,GAAG,SAAS,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,UAAU,GAAoB,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC;QAEnE,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,CACpB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,QAAQ,EACd,UAAU,EACV,SAAS,CACV,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;gBACrB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB,CAAC,cAAc;gBACtC,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;aACpE,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mBAAmB;QACnB,MAAM,UAAU,GAAoB;YAClC,MAAM;YACN,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS;YACT,eAAe,EAAE,KAAK,CAAC,SAAS;YAChC,SAAS;YACT,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,WAAW,EAAE,CAAC;YACd,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAE9C,kBAAkB;QAClB,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAEhC,kBAAkB;QAClB,MAAM,MAAM,GAAgB;YAC1B,IAAI,EAAE,SAAS;YACf,SAAS;YACT,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SACnD,CAAC;QAEF,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,sCAAsC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAChE,MAAM,CAAC,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC;YACxC,MAAM,CAAC,sBAAsB,GAAG,SAAS,CAAC,SAAS,CAAC;YAEpD,wEAAwE;YACxE,yFAAyF;YACzF,MAAM,wBAAwB,GAAG,KAAK,CAAC,QAAQ,EAAE,gBAAgB,IAAI,IAAI,CAAC;YAC1E,MAAM,gBAAgB,GAAG,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;YAExD,IAAI,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBACtD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;oBAC/B,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE;oBAC7B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE;oBACzC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE;oBAC/C,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,SAAS;oBAChD,gBAAgB,EAAE,wBAAwB;oBAC1C,QAAQ,EAAE,gBAAgB;oBAC1B,UAAU,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;oBAC9D,aAAa,EAAE,gBAAgB;iBAChC,CAAC,CAAC;gBACH,MAAM,CAAC,eAAe,GAAG,QAAQ,CAAC;gBAClC,IAAI,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;oBAC3B,MAAM,CAAC,eAAe,GAAG,qFAAqF,CAAC;gBACjH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACpE,IAAI,QAAQ,EAAE,CAAC;oBACb,wEAAwE;oBACxE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;wBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;wBAC/B,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE;wBAC7B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE;wBACzC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE;wBAC/C,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,SAAS;wBAChD,gBAAgB,EAAE,wBAAwB;wBAC1C,QAAQ,EAAE,gBAAgB;wBAC1B,UAAU,EAAE,UAAU;wBACtB,aAAa,EAAE,gBAAgB;qBAChC,CAAC,CAAC;oBACH,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC9C,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,eAAe,GAAG,YAAY,CAAC;gBACxC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE/B,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAiB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAiB;QAChC,wBAAwB;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAED,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACvC,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,OAAyB;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAiB;QAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAyB;QAC7B,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,SAAS,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAAiB;QAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,OAAO;QACL,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,cAAc;gBAAE,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,mEAAmE;IAE3D,cAAc,CAAC,IAAqB;QAC1C,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,GAAG,MAAM,CAAC;YAE1D,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;gBACpC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;oBAChE,qCAAqC;oBACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;oBAC7C,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAc;oBACtB,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;gBACF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAClC,YAAY,EAAE,CAAC;YACjB,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,YAAY,EAAE,CAAC;IACjB,CAAC;IAEO,gBAAgB,CAAC,MAAiB,EAAE,OAAyB;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,IAAI,EAAE,cAAc,EAAE,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAEO,SAAS,CAAC,MAAiB,EAAE,KAAiB;QACpD,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;CACF"}

package/dist/threadline/relay/MessageRouter.d.ts

@@ -0,0 +1,46 @@
+/**
+ * MessageRouter — Routes encrypted message envelopes between agents.
+ *
+ * Part of Threadline Relay Phase 1. Routes by recipient fingerprint.
+ * Does NOT read message content (E2E encrypted).
+ */
+import type { WebSocket } from 'ws';
+import type { AgentFingerprint, MessageEnvelope } from './types.js';
+import type { PresenceRegistry } from './PresenceRegistry.js';
+import type { RelayRateLimiter } from './RelayRateLimiter.js';
+export interface RouterDeps {
+    presence: PresenceRegistry;
+    rateLimiter: RelayRateLimiter;
+    getSocket: (agentId: AgentFingerprint) => WebSocket | undefined;
+    getIP: (agentId: AgentFingerprint) => string;
+    maxEnvelopeSize: number;
+}
+export interface RouteResult {
+    delivered: boolean;
+    status: 'delivered' | 'queued' | 'rejected';
+    reason?: string;
+    errorCode?: string;
+}
+export declare class MessageRouter {
+    private readonly deps;
+    private readonly recentMessages;
+    private cleanupTimer;
+    constructor(deps: RouterDeps);
+    /**
+     * Route a message envelope from sender to recipient.
+     */
+    route(envelope: MessageEnvelope, senderAgentId: AgentFingerprint): RouteResult;
+    /**
+     * Clean up expired entries in the replay detection cache.
+     */
+    private cleanupReplayCache;
+    /**
+     * Destroy the router (clean up timers).
+     */
+    destroy(): void;
+    /**
+     * Get replay cache size (for monitoring).
+     */
+    get replayCacheSize(): number;
+}
+//# sourceMappingURL=MessageRouter.d.ts.map

package/dist/threadline/relay/MessageRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MessageRouter.d.ts","sourceRoot":"","sources":["../../../src/threadline/relay/MessageRouter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EAGhB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,SAAS,GAAG,SAAS,CAAC;IAChE,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAAC;IAC7C,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAKD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAC5D,OAAO,CAAC,YAAY,CAA+C;gBAEvD,IAAI,EAAE,UAAU;IAM5B;;OAEG;IACH,KAAK,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,GAAG,WAAW;IAmG9E;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,IAAI,IAAI;IAQf;;OAEG;IACH,IAAI,eAAe,IAAI,MAAM,CAE5B;CACF"}

package/dist/threadline/relay/MessageRouter.js

@@ -0,0 +1,138 @@
+/**
+ * MessageRouter — Routes encrypted message envelopes between agents.
+ *
+ * Part of Threadline Relay Phase 1. Routes by recipient fingerprint.
+ * Does NOT read message content (E2E encrypted).
+ */
+import { RELAY_ERROR_CODES } from './types.js';
+/** Set of recently seen message IDs for replay detection */
+const REPLAY_WINDOW_MS = 5 * 60 * 1000; // 5 minutes
+export class MessageRouter {
+    deps;
+    recentMessages = new Map(); // messageId → timestamp
+    cleanupTimer = null;
+    constructor(deps) {
+        this.deps = deps;
+        // Periodic cleanup of replay detection cache
+        this.cleanupTimer = setInterval(() => this.cleanupReplayCache(), 60_000);
+    }
+    /**
+     * Route a message envelope from sender to recipient.
+     */
+    route(envelope, senderAgentId) {
+        // 1. Validate sender matches envelope
+        if (envelope.from !== senderAgentId) {
+            return {
+                delivered: false,
+                status: 'rejected',
+                reason: 'Sender fingerprint mismatch',
+                errorCode: RELAY_ERROR_CODES.INVALID_SIGNATURE,
+            };
+        }
+        // 2. Check envelope size
+        const envelopeSize = JSON.stringify(envelope).length;
+        if (envelopeSize > this.deps.maxEnvelopeSize) {
+            return {
+                delivered: false,
+                status: 'rejected',
+                reason: `Envelope too large (${envelopeSize} > ${this.deps.maxEnvelopeSize})`,
+                errorCode: RELAY_ERROR_CODES.ENVELOPE_TOO_LARGE,
+            };
+        }
+        // 3. Replay detection
+        if (this.recentMessages.has(envelope.messageId)) {
+            return {
+                delivered: false,
+                status: 'rejected',
+                reason: 'Duplicate message ID (replay detected)',
+                errorCode: RELAY_ERROR_CODES.REPLAY_DETECTED,
+            };
+        }
+        // 4. Rate limiting
+        const ip = this.deps.getIP(senderAgentId);
+        const rateCheck = this.deps.rateLimiter.checkMessage(senderAgentId, ip);
+        if (!rateCheck.allowed) {
+            return {
+                delivered: false,
+                status: 'rejected',
+                reason: `Rate limited (${rateCheck.limitType})`,
+                errorCode: RELAY_ERROR_CODES.RATE_LIMITED,
+            };
+        }
+        // 5. Check recipient exists
+        const recipientPresence = this.deps.presence.get(envelope.to);
+        if (!recipientPresence) {
+            return {
+                delivered: false,
+                status: 'rejected',
+                reason: 'Recipient not connected',
+                errorCode: RELAY_ERROR_CODES.RECIPIENT_OFFLINE,
+            };
+        }
+        // 6. Check recipient's private visibility
+        if (recipientPresence.visibility === 'private') {
+            // Private agents only accept messages from agents they have prior trust with.
+            // For Phase 1, we'll allow all messages to private agents if they know the fingerprint.
+            // Trust filtering is handled by the agent itself.
+        }
+        // 7. Get recipient socket
+        const recipientSocket = this.deps.getSocket(envelope.to);
+        if (!recipientSocket || recipientSocket.readyState !== 1 /* OPEN */) {
+            return {
+                delivered: false,
+                status: 'rejected',
+                reason: 'Recipient socket not available',
+                errorCode: RELAY_ERROR_CODES.RECIPIENT_OFFLINE,
+            };
+        }
+        // 8. Record event for rate limiting
+        this.deps.rateLimiter.recordMessage(senderAgentId, ip);
+        // 9. Record for replay detection
+        this.recentMessages.set(envelope.messageId, Date.now());
+        // 10. Forward to recipient
+        const messageFrame = JSON.stringify({
+            type: 'message',
+            envelope,
+        });
+        try {
+            recipientSocket.send(messageFrame);
+        }
+        catch {
+            return {
+                delivered: false,
+                status: 'rejected',
+                reason: 'Failed to send to recipient',
+                errorCode: RELAY_ERROR_CODES.INTERNAL_ERROR,
+            };
+        }
+        return { delivered: true, status: 'delivered' };
+    }
+    /**
+     * Clean up expired entries in the replay detection cache.
+     */
+    cleanupReplayCache() {
+        const cutoff = Date.now() - REPLAY_WINDOW_MS;
+        for (const [id, ts] of this.recentMessages) {
+            if (ts < cutoff) {
+                this.recentMessages.delete(id);
+            }
+        }
+    }
+    /**
+     * Destroy the router (clean up timers).
+     */
+    destroy() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+        this.recentMessages.clear();
+    }
+    /**
+     * Get replay cache size (for monitoring).
+     */
+    get replayCacheSize() {
+        return this.recentMessages.size;
+    }
+}
+//# sourceMappingURL=MessageRouter.js.map

package/dist/threadline/relay/MessageRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MessageRouter.js","sourceRoot":"","sources":["../../../src/threadline/relay/MessageRouter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAmB/C,4DAA4D;AAC5D,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEpD,MAAM,OAAO,aAAa;IACP,IAAI,CAAa;IACjB,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,wBAAwB;IAC7E,YAAY,GAA0C,IAAI,CAAC;IAEnE,YAAY,IAAgB;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,6CAA6C;QAC7C,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAyB,EAAE,aAA+B;QAC9D,sCAAsC;QACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,6BAA6B;gBACrC,SAAS,EAAE,iBAAiB,CAAC,iBAAiB;aAC/C,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QACrD,IAAI,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC7C,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,uBAAuB,YAAY,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG;gBAC7E,SAAS,EAAE,iBAAiB,CAAC,kBAAkB;aAChD,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,wCAAwC;gBAChD,SAAS,EAAE,iBAAiB,CAAC,eAAe;aAC7C,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,iBAAiB,SAAS,CAAC,SAAS,GAAG;gBAC/C,SAAS,EAAE,iBAAiB,CAAC,YAAY;aAC1C,CAAC;QACJ,CAAC;QAED,4BAA4B;QAC5B,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,yBAAyB;gBACjC,SAAS,EAAE,iBAAiB,CAAC,iBAAiB;aAC/C,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,iBAAiB,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/C,8EAA8E;YAC9E,wFAAwF;YACxF,kDAAkD;QACpD,CAAC;QAED,0BAA0B;QAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;YACpE,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,gCAAgC;gBACxC,SAAS,EAAE,iBAAiB,CAAC,iBAAiB;aAC/C,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAEvD,iCAAiC;QACjC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAExD,2BAA2B;QAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;YAClC,IAAI,EAAE,SAAS;YACf,QAAQ;SACT,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,6BAA6B;gBACrC,SAAS,EAAE,iBAAiB,CAAC,cAAc;aAC5C,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClD,CAAC;IAED;;OAEG;IACK,kBAAkB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;QAC7C,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;IAClC,CAAC;CACF"}