@labacacia/nps-sdk 1.0.0-alpha.6 → 1.0.0-alpha.7

package/nip-ca-server/package.json

@@ -1,23 +0,0 @@
-{
-  "name": "@labacacia/nip-ca-server",
-  "version": "0.1.0",
-  "description": "NIP CA Server — TypeScript/Node.js",
-  "license": "Apache-2.0",
-  "type": "module",
-  "main": "dist/index.js",
-  "scripts": {
-    "build": "tsc",
-    "start": "node dist/index.js",
-    "dev": "tsx src/index.ts"
-  },
-  "dependencies": {
-    "better-sqlite3": "^11.7.0",
-    "fastify": "^5.2.1"
-  },
-  "devDependencies": {
-    "@types/better-sqlite3": "^7.6.12",
-    "@types/node": "^22.10.5",
-    "tsx": "^4.19.2",
-    "typescript": "^5.7.3"
-  }
-}

package/nip-ca-server/src/ca.ts

@@ -1,155 +0,0 @@
-// Copyright 2026 INNO LOTUS PTY LTD
-// SPDX-License-Identifier: Apache-2.0
-import * as crypto from "node:crypto";
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-const PBKDF2_ITERS = 600_000;
-const SALT_LEN = 16;
-const NONCE_LEN = 12;
-const KEY_LEN = 32;
-
-export interface KeyEnvelope {
-  version: number;
-  algorithm: string;
-  pub_key: string;
-  salt: string;
-  nonce: string;
-  ciphertext: string;
-}
-
-function deriveKey(passphrase: string, salt: Buffer): Buffer {
-  return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERS, KEY_LEN, "sha256");
-}
-
-export function pubKeyString(pubKey: crypto.KeyObject): string {
-  const raw = pubKey.export({ type: "pkcs8", format: "der" });
-  // Ed25519 PKCS8 DER = 44 bytes; raw public key is last 32 bytes
-  const rawPub = raw.subarray(raw.length - 32);
-  return "ed25519:" + rawPub.toString("hex");
-}
-
-function rawPrivateBytes(privKey: crypto.KeyObject): Buffer {
-  // Ed25519 private key in JWK → d field is base64url-encoded 32-byte seed
-  const jwk = privKey.export({ format: "jwk" }) as { d: string };
-  return Buffer.from(jwk.d, "base64url");
-}
-
-export function generateKey(): crypto.KeyObject {
-  const { privateKey } = crypto.generateKeyPairSync("ed25519");
-  return privateKey;
-}
-
-export function saveKey(privKey: crypto.KeyObject, filePath: string, passphrase: string): void {
-  const salt = crypto.randomBytes(SALT_LEN);
-  const nonce = crypto.randomBytes(NONCE_LEN);
-  const dk = deriveKey(passphrase, salt);
-  const seed = rawPrivateBytes(privKey);
-  const cipher = crypto.createCipheriv("aes-256-gcm", dk, nonce);
-  const encrypted = Buffer.concat([cipher.update(seed), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  const ciphertext = Buffer.concat([encrypted, tag]);
-  const { privateKey: tmpPriv, publicKey: tmpPub } = crypto.generateKeyPairSync("ed25519", {
-    privateKeyEncoding: { type: "pkcs8", format: "der" },
-    publicKeyEncoding: { type: "spki", format: "der" },
-  });
-  // Re-derive public key from the same private key
-  const pubStr = pubKeyString(crypto.createPublicKey(privKey));
-  const envelope: KeyEnvelope = {
-    version: 1,
-    algorithm: "ed25519",
-    pub_key: pubStr,
-    salt: salt.toString("hex"),
-    nonce: nonce.toString("hex"),
-    ciphertext: ciphertext.toString("hex"),
-  };
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, JSON.stringify(envelope), { mode: 0o600 });
-}
-
-export function loadKey(filePath: string, passphrase: string): crypto.KeyObject {
-  const env: KeyEnvelope = JSON.parse(fs.readFileSync(filePath, "utf8"));
-  const salt = Buffer.from(env.salt, "hex");
-  const nonce = Buffer.from(env.nonce, "hex");
-  const ctBuf = Buffer.from(env.ciphertext, "hex");
-  const tag = ctBuf.subarray(ctBuf.length - 16);
-  const ciphertext = ctBuf.subarray(0, ctBuf.length - 16);
-  const dk = deriveKey(passphrase, salt);
-  const decipher = crypto.createDecipheriv("aes-256-gcm", dk, nonce);
-  decipher.setAuthTag(tag);
-  let seed: Buffer;
-  try {
-    seed = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-  } catch {
-    throw new Error("Key decryption failed — wrong passphrase?");
-  }
-  return crypto.createPrivateKey({ key: seed, format: "der", type: "pkcs8" } as any) ||
-    (() => {
-      // Construct PKCS8 DER for Ed25519 seed manually
-      // PKCS8 for Ed25519 = 0x302e020100300506032b657004220420 + 32-byte seed
-      const pkcs8Header = Buffer.from("302e020100300506032b657004220420", "hex");
-      const der = Buffer.concat([pkcs8Header, seed]);
-      return crypto.createPrivateKey({ key: der, format: "der", type: "pkcs8" });
-    })();
-}
-
-function canonicalJson(obj: Record<string, unknown>): Buffer {
-  const sorted = Object.keys(obj).sort().reduce((acc, k) => {
-    (acc as any)[k] = (obj as any)[k];
-    return acc;
-  }, {} as Record<string, unknown>);
-  return Buffer.from(JSON.stringify(sorted), "utf8");
-}
-
-export function signDict(privKey: crypto.KeyObject, obj: Record<string, unknown>): string {
-  const sig = crypto.sign(null, canonicalJson(obj), privKey);
-  return "ed25519:" + sig.toString("base64");
-}
-
-export interface IssuedCert {
-  nid: string;
-  pub_key: string;
-  capabilities: string[];
-  scope: Record<string, unknown>;
-  issued_by: string;
-  issued_at: string;
-  expires_at: string;
-  serial: string;
-  signature: string;
-  metadata?: Record<string, unknown>;
-}
-
-export function issueCert(
-  privKey: crypto.KeyObject,
-  caNid: string,
-  subjectNid: string,
-  subjectPubKey: string,
-  capabilities: string[],
-  scope: Record<string, unknown>,
-  validityDays: number,
-  serial: string,
-  metadata?: Record<string, unknown> | null,
-): IssuedCert {
-  const now = new Date();
-  const expires = new Date(now.getTime() + validityDays * 86400_000);
-  const fmt = (d: Date) => d.toISOString().replace(/\.\d{3}Z$/, "Z");
-  const unsigned: Record<string, unknown> = {
-    capabilities,
-    expires_at: fmt(expires),
-    issued_at: fmt(now),
-    issued_by: caNid,
-    nid: subjectNid,
-    pub_key: subjectPubKey,
-    scope,
-    serial,
-  };
-  const signature = signDict(privKey, unsigned);
-  const cert: IssuedCert = { ...unsigned as any, signature };
-  if (metadata) cert.metadata = metadata;
-  return cert;
-}
-
-export function generateNid(domain: string, entityType: string): string {
-  const uid = crypto.randomBytes(8).toString("hex");
-  return `urn:nps:${entityType}:${domain}:${uid}`;
-}

package/nip-ca-server/src/db.ts

@@ -1,104 +0,0 @@
-// Copyright 2026 INNO LOTUS PTY LTD
-// SPDX-License-Identifier: Apache-2.0
-import Database from "better-sqlite3";
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-const SCHEMA_PATH = path.join(__dirname, "..", "db", "001_init.sql");
-
-export interface CertRecord {
-  id: number;
-  nid: string;
-  entity_type: string;
-  serial: string;
-  pub_key: string;
-  capabilities: string[];
-  scope: Record<string, unknown>;
-  issued_by: string;
-  issued_at: string;
-  expires_at: string;
-  revoked_at: string | null;
-  revoke_reason: string | null;
-  metadata: Record<string, unknown> | null;
-}
-
-export class CaDb {
-  private db: Database.Database;
-
-  constructor(dbPath: string) {
-    fs.mkdirSync(path.dirname(dbPath), { recursive: true });
-    this.db = new Database(dbPath);
-    this.db.pragma("journal_mode = WAL");
-    this.db.pragma("foreign_keys = ON");
-    this.db.exec(fs.readFileSync(SCHEMA_PATH, "utf8"));
-  }
-
-  nextSerial(): string {
-    const row = this.db
-      .prepare(
-        "SELECT COALESCE(MAX(CAST(REPLACE(serial,'0x','') AS INTEGER)),0)+1 AS n FROM nip_certificates",
-      )
-      .get() as { n: number };
-    return `0x${row.n.toString(16).toUpperCase().padStart(6, "0")}`;
-  }
-
-  insert(rec: {
-    nid: string; entity_type: string; serial: string; pub_key: string;
-    capabilities: string[]; scope: Record<string, unknown>; issued_by: string;
-    issued_at: string; expires_at: string; metadata?: Record<string, unknown> | null;
-  }): number {
-    const result = this.db.prepare(
-      `INSERT INTO nip_certificates
-       (nid, entity_type, serial, pub_key, capabilities, scope_json,
-        issued_by, issued_at, expires_at, metadata_json)
-       VALUES (?,?,?,?,?,?,?,?,?,?)`,
-    ).run(
-      rec.nid, rec.entity_type, rec.serial, rec.pub_key,
-      JSON.stringify(rec.capabilities), JSON.stringify(rec.scope),
-      rec.issued_by, rec.issued_at, rec.expires_at,
-      rec.metadata ? JSON.stringify(rec.metadata) : null,
-    );
-    return Number(result.lastInsertRowid);
-  }
-
-  getActive(nid: string): CertRecord | null {
-    const row = this.db.prepare(
-      `SELECT * FROM nip_certificates
-       WHERE nid=? AND revoked_at IS NULL
-       ORDER BY issued_at DESC LIMIT 1`,
-    ).get(nid);
-    return row ? this._toRecord(row as any) : null;
-  }
-
-  revoke(nid: string, reason: string): boolean {
-    const now = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-    const r = this.db.prepare(
-      "UPDATE nip_certificates SET revoked_at=?, revoke_reason=? WHERE nid=? AND revoked_at IS NULL",
-    ).run(now, reason, nid);
-    return r.changes > 0;
-  }
-
-  crl(): Array<{ serial: string; nid: string; revoked_at: string; revoke_reason: string | null }> {
-    return this.db.prepare(
-      "SELECT serial, nid, revoked_at, revoke_reason FROM nip_certificates WHERE revoked_at IS NOT NULL ORDER BY revoked_at DESC",
-    ).all() as any;
-  }
-
-  private _toRecord(row: any): CertRecord {
-    return {
-      id: row.id,
-      nid: row.nid,
-      entity_type: row.entity_type,
-      serial: row.serial,
-      pub_key: row.pub_key,
-      capabilities: JSON.parse(row.capabilities),
-      scope: JSON.parse(row.scope_json),
-      issued_by: row.issued_by,
-      issued_at: row.issued_at,
-      expires_at: row.expires_at,
-      revoked_at: row.revoked_at ?? null,
-      revoke_reason: row.revoke_reason ?? null,
-      metadata: row.metadata_json ? JSON.parse(row.metadata_json) : null,
-    };
-  }
-}

package/nip-ca-server/src/index.ts

@@ -1,157 +0,0 @@
-// Copyright 2026 INNO LOTUS PTY LTD
-// SPDX-License-Identifier: Apache-2.0
-import * as crypto from "node:crypto";
-import * as fs from "node:fs";
-import Fastify from "fastify";
-import { CaDb } from "./db.js";
-import * as ca from "./ca.js";
-
-// ── Config ────────────────────────────────────────────────────────────────────
-const CA_NID        = process.env["NIP_CA_NID"]!;
-const CA_PASSPHRASE = process.env["NIP_CA_PASSPHRASE"]!;
-const CA_BASE_URL   = (process.env["NIP_CA_BASE_URL"] ?? "").replace(/\/$/, "");
-const KEY_FILE      = process.env["NIP_CA_KEY_FILE"]     ?? "/data/ca.key.enc";
-const DB_PATH       = process.env["NIP_CA_DB_PATH"]      ?? "/data/ca.db";
-const DISPLAY_NAME  = process.env["NIP_CA_DISPLAY_NAME"] ?? "NPS CA";
-const AGENT_DAYS    = parseInt(process.env["NIP_CA_AGENT_VALIDITY_DAYS"] ?? "30");
-const NODE_DAYS     = parseInt(process.env["NIP_CA_NODE_VALIDITY_DAYS"]  ?? "90");
-const RENEWAL_DAYS  = parseInt(process.env["NIP_CA_RENEWAL_WINDOW_DAYS"] ?? "7");
-const PORT          = parseInt(process.env["PORT"] ?? "17440");
-
-for (const k of ["NIP_CA_NID", "NIP_CA_PASSPHRASE", "NIP_CA_BASE_URL"]) {
-  if (!process.env[k]) throw new Error(`${k} is required`);
-}
-
-const CA_DOMAIN = CA_NID.split(":").slice(-2)[0] ?? "ca.local";
-
-// ── Bootstrap ─────────────────────────────────────────────────────────────────
-let caPriv: crypto.KeyObject;
-let caPubStr: string;
-
-if (!fs.existsSync(KEY_FILE)) {
-  caPriv = ca.generateKey();
-  ca.saveKey(caPriv, KEY_FILE, CA_PASSPHRASE);
-} else {
-  caPriv = ca.loadKey(KEY_FILE, CA_PASSPHRASE);
-}
-caPubStr = ca.pubKeyString(crypto.createPublicKey(caPriv));
-
-const db = new CaDb(DB_PATH);
-
-// ── Server ─────────────────────────────────────────────────────────────────────
-const app = Fastify({ logger: true });
-
-// ── Helpers ────────────────────────────────────────────────────────────────────
-function register(
-  body: { nid?: string; pub_key: string; capabilities?: string[]; scope?: object; metadata?: object },
-  entityType: string,
-  validityDays: number,
-  reply: any,
-): void {
-  const nid = body.nid ?? ca.generateNid(CA_DOMAIN, entityType);
-  if (db.getActive(nid)) {
-    reply.code(409).send({ error_code: "NIP-CA-NID-ALREADY-EXISTS",
-      message: `${nid} already has an active certificate` });
-    return;
-  }
-  const serial = db.nextSerial();
-  const cert = ca.issueCert(caPriv, CA_NID, nid, body.pub_key,
-    body.capabilities ?? [], body.scope as any ?? {}, validityDays, serial,
-    (body as any).metadata ?? null);
-  db.insert({ nid, entity_type: entityType, serial, pub_key: body.pub_key,
-    capabilities: body.capabilities ?? [], scope: body.scope as any ?? {},
-    issued_by: CA_NID, issued_at: cert.issued_at, expires_at: cert.expires_at,
-    metadata: (body as any).metadata ?? null });
-  reply.code(201).send({ nid, serial, issued_at: cert.issued_at,
-    expires_at: cert.expires_at, ident_frame: cert });
-}
-
-// ── Routes ─────────────────────────────────────────────────────────────────────
-app.post("/v1/agents/register", async (req, reply) => {
-  register(req.body as any, "agent", AGENT_DAYS, reply);
-});
-
-app.post("/v1/nodes/register", async (req, reply) => {
-  register(req.body as any, "node", NODE_DAYS, reply);
-});
-
-app.post<{ Params: { "*": string } }>("/v1/agents/*", async (req, reply) => {
-  const parts = (req.params["*"] as string).split("/");
-  const action = parts.pop();
-  const nid = parts.join("/");
-
-  if (action === "renew") {
-    const rec = db.getActive(nid);
-    if (!rec) return reply.code(404).send({ error_code: "NIP-CA-NID-NOT-FOUND", message: `${nid} not found` });
-    const expMs = new Date(rec.expires_at).getTime();
-    const daysLeft = Math.floor((expMs - Date.now()) / 86400_000);
-    if (daysLeft > RENEWAL_DAYS)
-      return reply.code(400).send({ error_code: "NIP-CA-RENEWAL-TOO-EARLY",
-        message: `Renewal window opens in ${daysLeft - RENEWAL_DAYS} days` });
-    const serial = db.nextSerial();
-    const days = rec.entity_type === "agent" ? AGENT_DAYS : NODE_DAYS;
-    const cert = ca.issueCert(caPriv, CA_NID, nid, rec.pub_key,
-      rec.capabilities, rec.scope, days, serial, rec.metadata);
-    db.insert({ nid, entity_type: rec.entity_type, serial, pub_key: rec.pub_key,
-      capabilities: rec.capabilities, scope: rec.scope,
-      issued_by: CA_NID, issued_at: cert.issued_at, expires_at: cert.expires_at,
-      metadata: rec.metadata });
-    return reply.send({ nid, serial, issued_at: cert.issued_at,
-      expires_at: cert.expires_at, ident_frame: cert });
-  }
-
-  if (action === "revoke") {
-    const body = req.body as any;
-    if (!db.revoke(nid, body?.reason ?? "cessation_of_operation"))
-      return reply.code(404).send({ error_code: "NIP-CA-NID-NOT-FOUND",
-        message: `${nid} not found or already revoked` });
-    return reply.send({ nid, revoked_at: new Date().toISOString().replace(/\.\d{3}Z$/, "Z"),
-      reason: body?.reason ?? "cessation_of_operation" });
-  }
-
-  reply.code(404).send({ message: "Not found" });
-});
-
-app.get<{ Params: { "*": string } }>("/v1/agents/*", async (req, reply) => {
-  const parts = (req.params["*"] as string).split("/");
-  const action = parts.pop();
-  const nid = parts.join("/");
-
-  if (action === "verify") {
-    const rec = db.getActive(nid);
-    if (!rec) return reply.code(404).send({ error_code: "NIP-CA-NID-NOT-FOUND", message: `${nid} not found` });
-    const valid = new Date(rec.expires_at).getTime() > Date.now();
-    return reply.send({ valid, nid, entity_type: rec.entity_type, pub_key: rec.pub_key,
-      capabilities: rec.capabilities, issued_by: rec.issued_by,
-      issued_at: rec.issued_at, expires_at: rec.expires_at, serial: rec.serial,
-      error_code: valid ? null : "NIP-CERT-EXPIRED" });
-  }
-  reply.code(404).send({ message: "Not found" });
-});
-
-app.get("/v1/ca/cert", async (_req, reply) =>
-  reply.send({ nid: CA_NID, display_name: DISPLAY_NAME, pub_key: caPubStr, algorithm: "ed25519" }));
-
-app.get("/v1/crl", async (_req, reply) =>
-  reply.send({ revoked: db.crl() }));
-
-app.get("/.well-known/nps-ca", async (_req, reply) =>
-  reply.send({
-    nps_ca: "0.1", issuer: CA_NID, display_name: DISPLAY_NAME, public_key: caPubStr,
-    algorithms: ["ed25519"],
-    endpoints: {
-      register: `${CA_BASE_URL}/v1/agents/register`,
-      verify:   `${CA_BASE_URL}/v1/agents/{nid}/verify`,
-      ocsp:     `${CA_BASE_URL}/v1/agents/{nid}/verify`,
-      crl:      `${CA_BASE_URL}/v1/crl`,
-    },
-    capabilities: ["agent", "node"],
-    max_cert_validity_days: Math.max(AGENT_DAYS, NODE_DAYS),
-  }));
-
-app.get("/health", async (_req, reply) => reply.send({ status: "ok" }));
-
-app.listen({ port: PORT, host: "0.0.0.0" }, (err) => {
-  if (err) { console.error(err); process.exit(1); }
-  console.log(`NIP CA Server listening on :${PORT}`);
-});

package/nip-ca-server/tsconfig.json

@@ -1,13 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "outDir": "dist",
-    "rootDir": "src",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true
-  },
-  "include": ["src"]
-}

package/src/core/anchor-cache.ts

@@ -1,129 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Copyright (c) 2026 LabAcacia / INNO LOTUS PTY LTD
-//
-// AnchorCache — Schema cache with TTL, LRU eviction, poison detection
-// NPS-1 §5.3, §7.2, §9
-
-import { NcpError } from "./frame-header.js";
-import type { AnchorFrame } from "../ncp/frames/anchor-frame.js";
-
-interface CacheEntry {
-  frame: AnchorFrame;
-  expiresAt: number; // epoch ms
-  lastAccessed: number; // epoch ms
-}
-
-/**
- * AnchorFrame cache with:
- * - TTL-based expiry (NPS-1 §5.3)
- * - LRU eviction at maxSize (NPS-1 §9, default 1000)
- * - Anchor poisoning detection (NPS-1 §7.2)
- */
-export class AnchorCache {
-  private readonly cache = new Map<string, CacheEntry>();
-  private readonly maxSize: number;
-  private readonly getNow: () => number;
-
-  constructor(options?: { maxSize?: number; getNow?: () => number }) {
-    this.maxSize = options?.maxSize ?? 1000;
-    this.getNow = options?.getNow ?? (() => Date.now());
-  }
-
-  /**
-   * Cache an AnchorFrame.
-   *
-   * - ttl=0: frame is valid but not cached (NPS-1 §4.1)
-   * - Same anchor_id + same schema: idempotent (no-op)
-   * - Same anchor_id + different schema: NCP-ANCHOR-ID-MISMATCH (poison detection)
-   *
-   * @throws {NcpError} NCP-ANCHOR-ID-MISMATCH on anchor poisoning.
-   */
-  set(frame: AnchorFrame): void {
-    // ttl=0 means use once, don't cache
-    if (frame.ttl === 0) return;
-
-    const existing = this.cache.get(frame.anchor_id);
-    if (existing) {
-      // Poison detection: same ID, different schema
-      const existingJson = JSON.stringify(existing.frame.schema);
-      const newJson = JSON.stringify(frame.schema);
-      if (existingJson !== newJson) {
-        throw new NcpError(
-          "NCP-ANCHOR-ID-MISMATCH",
-          `Anchor poisoning detected: anchor_id ${frame.anchor_id} received with different schema`,
-        );
-      }
-      // Same schema — idempotent, update access time
-      existing.lastAccessed = this.getNow();
-      return;
-    }
-
-    // LRU eviction if at capacity
-    if (this.cache.size >= this.maxSize) {
-      this.evictLru();
-    }
-
-    const ttlMs = (frame.ttl ?? 3600) * 1000;
-    this.cache.set(frame.anchor_id, {
-      frame,
-      expiresAt: this.getNow() + ttlMs,
-      lastAccessed: this.getNow(),
-    });
-  }
-
-  /**
-   * Get a cached AnchorFrame by anchor_id.
-   *
-   * @returns The cached frame, or null if not found or expired.
-   */
-  get(anchorId: string): AnchorFrame | null {
-    const entry = this.cache.get(anchorId);
-    if (!entry) return null;
-
-    // Check TTL expiry
-    if (this.getNow() >= entry.expiresAt) {
-      this.cache.delete(anchorId);
-      return null;
-    }
-
-    entry.lastAccessed = this.getNow();
-    return entry.frame;
-  }
-
-  /**
-   * Get a cached AnchorFrame, throwing if not found.
-   * @throws {NcpError} NCP-ANCHOR-NOT-FOUND if not in cache or expired.
-   */
-  getRequired(anchorId: string): AnchorFrame {
-    const frame = this.get(anchorId);
-    if (!frame) {
-      throw new NcpError(
-        "NCP-ANCHOR-NOT-FOUND",
-        `Schema anchor ${anchorId} not found in cache`,
-      );
-    }
-    return frame;
-  }
-
-  /** Current cache size. */
-  get size(): number {
-    return this.cache.size;
-  }
-
-  /** Evict the least recently accessed entry. */
-  private evictLru(): void {
-    let oldestKey: string | undefined;
-    let oldestTime = Infinity;
-
-    for (const [key, entry] of this.cache) {
-      if (entry.lastAccessed < oldestTime) {
-        oldestTime = entry.lastAccessed;
-        oldestKey = key;
-      }
-    }
-
-    if (oldestKey) {
-      this.cache.delete(oldestKey);
-    }
-  }
-}

package/src/core/cache.ts

@@ -1,93 +0,0 @@
-// Copyright 2026 INNO LOTUS PTY LTD
-// SPDX-License-Identifier: Apache-2.0
-
-/**
- * AnchorFrameCache — in-process cache for AnchorFrame instances (NPS-1 §4.1).
- */
-
-import { createHash } from "node:crypto";
-import { NpsAnchorNotFoundError, NpsAnchorPoisonError } from "./exceptions.js";
-import type { AnchorFrame, FrameSchema } from "../ncp/frames.js";
-
-export class AnchorFrameCache {
-  private readonly _store = new Map<string, { frame: AnchorFrame; expiresAt: number }>();
-
-  // Allow clock injection for testing
-  clock: () => number = () => Date.now();
-
-  // ── Public API ────────────────────────────────────────────────────────────
-
-  set(frame: AnchorFrame): string {
-    const anchorId = frame.anchorId.startsWith("sha256:")
-      ? frame.anchorId
-      : AnchorFrameCache.computeAnchorId(frame.schema);
-
-    const existing = this._store.get(anchorId);
-    if (existing !== undefined && this.clock() < existing.expiresAt) {
-      if (!AnchorFrameCache._schemasEqual(existing.frame.schema, frame.schema)) {
-        throw new NpsAnchorPoisonError(anchorId);
-      }
-      // Same schema — idempotent; refresh TTL below
-    }
-
-    const ttlMs   = (frame.ttl ?? 3600) * 1000;
-    const expiresAt = this.clock() + ttlMs;
-    this._store.set(anchorId, { frame, expiresAt });
-    return anchorId;
-  }
-
-  get(anchorId: string): AnchorFrame | undefined {
-    const entry = this._store.get(anchorId);
-    if (entry === undefined) return undefined;
-    if (this.clock() > entry.expiresAt) {
-      this._store.delete(anchorId);
-      return undefined;
-    }
-    return entry.frame;
-  }
-
-  getRequired(anchorId: string): AnchorFrame {
-    const frame = this.get(anchorId);
-    if (frame === undefined) throw new NpsAnchorNotFoundError(anchorId);
-    return frame;
-  }
-
-  invalidate(anchorId: string): void {
-    this._store.delete(anchorId);
-  }
-
-  get size(): number {
-    this._evictExpired();
-    return this._store.size;
-  }
-
-  // ── Static helpers ────────────────────────────────────────────────────────
-
-  static computeAnchorId(schema: FrameSchema): string {
-    const sorted = [...schema.fields]
-      .map((f) => {
-        const obj: Record<string, unknown> = { name: f.name, type: f.type };
-        if (f.semantic !== undefined) obj["semantic"] = f.semantic;
-        if (f.nullable !== undefined) obj["nullable"] = f.nullable;
-        return obj;
-      })
-      .sort((a, b) => String(a["name"]).localeCompare(String(b["name"])));
-
-    const canonical = JSON.stringify(sorted);
-    const digest    = createHash("sha256").update(canonical, "utf8").digest("hex");
-    return `sha256:${digest}`;
-  }
-
-  // ── Private ───────────────────────────────────────────────────────────────
-
-  private _evictExpired(): void {
-    const now = this.clock();
-    for (const [k, entry] of this._store) {
-      if (now > entry.expiresAt) this._store.delete(k);
-    }
-  }
-
-  private static _schemasEqual(a: FrameSchema, b: FrameSchema): boolean {
-    return AnchorFrameCache.computeAnchorId(a) === AnchorFrameCache.computeAnchorId(b);
-  }
-}