@loopingai/core 0.6.0 → 0.7.1

package/dist/testing/index.js

@@ -24,7 +24,11 @@
 export { setupRecording, cassetteNameFor } from "./vcr-spec.js";
 export { VCR_CONTROL_ORIGIN, VCR_MARKER_HEADER, CASSETTE_NAME_RE } from "./vcr-shared.js";
 export { FakeSession } from "./fake-session.js";
-export { mockModel, finalReply } from "./mock-model.js";
+// `throwingModel`, `countingModel` and `rateLimitedModel` were reachable only
+// through a deep `dist/` path until now, which meant a consumer could not assert
+// the one thing they exist for: that a rate limit is waited out on the *same*
+// model rather than falling through to the fallback slot.
+export { mockModel, finalReply, throwingModel, countingModel, rateLimitedModel } from "./mock-model.js";
 export { makeGatewayToken } from "./auth.js";
 export { AGENT_ORIGIN, GATEWAY_ORIGIN, TEST_AGENT_PRIVATE_JWK, TEST_GATEWAY_PRIVATE_JWK, TEST_MODELS, gatewayPublicJwks, testAgentMessage, testStatus, testTask } from "./fixtures.js";
 export { doStorage, makeDoHelpers } from "./do.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loopingai/core",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Shared, mandatory foundation for Looping agents on Cloudflare Workers: zero-trust A2A, durable task lifecycle, delegation and subagent runtime, test harness.",
   "keywords": [
     "a2a",
@@ -57,6 +57,10 @@
       "types": "./dist/host/index.d.ts",
       "import": "./dist/host/index.js"
     },
+    "./alarm": {
+      "types": "./dist/alarm/index.d.ts",
+      "import": "./dist/alarm/index.js"
+    },
     "./round": {
       "types": "./dist/round/index.d.ts",
       "import": "./dist/round/index.js"

package/scripts/generate-keys.mjs

@@ -7,7 +7,7 @@
  * registration (Trust-On-First-Use). No secret is shared in either direction —
  * see `src/a2a/verify.ts` for the other half of the contract.
  *
- *   node scripts/generate-keys.mjs              # print both halves
+ *   node scripts/generate-keys.mjs              # print the private JWK
  *   node scripts/generate-keys.mjs --kid my-key # choose the key id
  *
  * The `kid` is required, not decorative: it goes in the JWS protected header and
@@ -24,30 +24,25 @@ const kid =
     ? args[kidFlag + 1]
     : `a2a-${new Date().toISOString().slice(0, 10)}`;
 
-// `extractable` is required to export the private half at all.
-const { privateKey, publicKey } = await generateKeyPair("EdDSA", {
+// `extractable` is required to export the private half at all. Only the
+// private half is printed: the public one is derived from it at runtime and
+// served at the JWKS route, so there is nothing to copy anywhere.
+const { privateKey } = await generateKeyPair("EdDSA", {
   crv: "Ed25519",
   extractable: true
 });
 
 const priv = { ...(await exportJWK(privateKey)), kid };
-const pub = { ...(await exportJWK(publicKey)), kid, use: "sig", alg: "EdDSA" };
 
-console.log("A2A_SIGNING_KEY (private — set as a secret, never commit):\n");
-console.log(JSON.stringify(priv));
+console.log(`\nGenerated Ed25519 keypair (kid: ${kid})\n`);
 console.log(
-  "\nPublic JWKS (served at the card's `jku`, derived at runtime):\n"
+  "Add this line to .env — it is the private half, never commit it:\n"
+);
+console.log(`A2A_SIGNING_KEY=${JSON.stringify(priv)}\n`);
+console.log(
+  "To deploy it, push the whole file or just this one secret:\n\n" +
+    "  npx wrangler deploy --secrets-file .env\n" +
+    "  npx wrangler secret put A2A_SIGNING_KEY\n\n" +
+    "The public half is not configured anywhere — the Worker derives it from\n" +
+    "the private key and serves it at the JWKS route.\n"
 );
-console.log(JSON.stringify({ keys: [pub] }, null, 2));
-console.log(`
-Next:
-
-  # local
-  echo 'A2A_SIGNING_KEY=<the private JSON above>' >> .dev.vars
-
-  # deployed
-  npx wrangler secret put A2A_SIGNING_KEY
-
-The public half is not configured anywhere — the Worker derives it from the
-private key and serves it at the JWKS route.
-`);