@nelsonlongxiang/dsh-open-a2a-net 0.6.35 → 0.6.37

package/lib/types/index.d.ts

@@ -228,6 +228,8 @@ export interface Config {
      * nobody created. Empty list denies every join (default).
      */
     readonly teamJoinAllowlist: string[];
+    /** Human-owned stable display labels keyed by full local session id; never a routing identity. */
+    readonly seatNames: Record<string, unknown>;
     /**
      * S3 (phase-2 default-ON, owner ruling 2026-09-01): route dispatch checks
      * caller↔target shared team membership before addressing; set false to

package/lib/types/origin-claim.d.ts

@@ -4,7 +4,7 @@
  * face (card, /a2a/direct, /a2a/log, /a2a/canvas-op, /a2a/canvas-changed)
  * runs.
  *
- * Two canonical forms ride the same four base headers
+ * Three canonical forms share the base caller headers
  * (X-A2A-Caller / -Url / -Ts):
  *   · bound (v2, §2.1): JSON.stringify([tag, caller, callerUrl, ts,
  *     audience, METHOD, path]) in X-A2A-Caller-Sig2, the audience origin in
@@ -14,7 +14,8 @@
  *   · unbound (v1, legacy): JSON.stringify([caller, callerUrl, ts]) in
  *     X-A2A-Caller-Sig. Emitted and accepted only while the unbound window
  *     is open (originClaimUnboundWindow); accepted ones are counted.
- * Once the window closes a present Sig2 is the only thing verified. While
+ * A present Sig3 requires the exact raw body and v3 signature, with no downgrade.
+ * Without Sig3, once the window closes a present Sig2 is the only thing verified. While
  * it is open, a Sig2 that misses (audience or signature) falls back to the
  * Sig the envelope also carries — no more than stripping Sig2 would give —
  * and the miss is counted, so a peer dialled by an unlisted name keeps
@@ -29,12 +30,16 @@ import type { A2aPeerCard } from './types.ts';
 export declare const ORIGIN_CLAIM_SKEW_MS: number;
 /** Domain tag of the bound form: a v1 signature can never verify as v2. */
 export declare const ORIGIN_CLAIM_BOUND_TAG = "a2a-origin-claim/2";
+export declare const ORIGIN_CLAIM_BODY_TAG = "a2a-origin-claim/3";
+/** Digest the exact UTF-8 string/bytes passed to transport, never reserialized JSON. */
+export declare const originBodySha256: (body: string | Uint8Array) => string;
 /** Where an outbound request goes: the bound form signs both. */
 export interface OriginClaimTarget {
     readonly url: string;
     readonly method: string;
+    readonly body?: string | Uint8Array;
 }
-export type OriginClaimRefusal = 'absent' | 'bad-caller-shape' | 'bad-ts' | 'no-card' | 'bad-sig' | 'not-derivable' | 'wrong-audience' | 'unbound-closed';
+export type OriginClaimRefusal = 'absent' | 'bad-caller-shape' | 'bad-ts' | 'no-card' | 'bad-sig' | 'not-derivable' | 'wrong-audience' | 'unbound-closed' | 'body-mismatch';
 /** Only the canonical origin root can claim that origin's identity. */
 export declare function isRootOriginUrl(value: string): boolean;
 /**
@@ -59,6 +64,8 @@ export type OriginClaimVerdict = {
 export declare function unboundCanonical(caller: string, callerUrl: string, ts: number): string;
 /** The bound (v2) canonical form; method upper-cased, path without query. */
 export declare function boundCanonical(caller: string, callerUrl: string, ts: number, audience: string, method: string, path: string): string;
+/** The body-bound v3 form is domain-separated from v1/v2, with the digest appended. */
+export declare function bodyBoundCanonical(caller: string, callerUrl: string, ts: number, audience: string, method: string, path: string, bodySha256: string): string;
 /** An origin in URL's normal form, or '' when the text is not an http(s) URL. */
 export declare function originOf(url: string): string;
 /** The path a request names, without its query (the bound form signs this). */
@@ -114,6 +121,8 @@ export declare function verifyOriginClaim(req: IncomingMessage, d: {
     /** A loopback arrival is an audience of its own (default); off when originClaimUrl declares a tunnel or proxy. */
     readonly loopbackArrival?: boolean;
     readonly now: number;
+    /** Exact received bytes, supplied by the bounded body reader. Missing bytes cannot verify Sig3. */
+    readonly rawBody?: Uint8Array;
     /** On the faces that admit CLI identities: the deposit a claim URL names. */
     readonly cliDeposit?: (callerUrl: string) => CliDepositCard | undefined;
 }): Promise<OriginClaimVerdict>;

package/lib/types/owner-settings.d.ts

@@ -12,7 +12,12 @@ export interface OwnerSettings {
     teamJoinAllowlist?: string[];
     teamScopeInfo?: boolean;
     announce?: boolean;
+    seatNames?: Record<string, string>;
 }
+/** Shared validation for boot config and owner POST; labels are plain text, never handles or authority. */
+export declare function parseSeatNames(value: unknown): Record<string, string> | undefined;
+/** Boot config degrades entry-by-entry; owner POST remains all-or-nothing. Never echo label contents in warnings. */
+export declare function loadSeatNames(value: unknown, warn: (reason: string) => void): Record<string, string>;
 export declare function applyOwnerSettings(patchYaml: string, changes: OwnerSettings): {
     yaml: string;
     restartNeeded: boolean;

package/lib/types/peer-link-display.d.ts

@@ -0,0 +1,13 @@
+/** Host-specific badge projection only. Never use this to admit callers or choose CLI homes. */
+import type { A2aPeerCard } from './types.ts';
+export declare function peerLinkDisplay(peerUrl: string, d: {
+    readonly card: A2aPeerCard | undefined;
+    readonly ownUrl: string;
+    readonly seeds: readonly string[];
+    readonly refs: readonly string[];
+    readonly ownHandles: ReadonlySet<string>;
+    readonly cards: readonly A2aPeerCard[];
+}): {
+    link: 'linked' | 'stranger';
+    verified: boolean;
+};

package/lib/types/queue-guard.d.ts

@@ -3,7 +3,7 @@
  * busy session. This counts what the target already owes and refuses a NEW delivery once the
  * count reaches the cap, visibly and before anything is steered or booked.
  *
- * Counted ("queued for T"): rows this host's ledger still holds pending for T that expect a
+ * Counted ("queued for T"): unanswered rows this host's ledger still holds pending for T that expect a
  * receipt — inbound rows born at /a2a/direct (addressed to T, or delivered to T), and same-host
  * routes (peer 'local') to T. Never refused: a receipt for a task this host's ledger holds
  * (terminal; refusing one strands that row — a genuine receipt always returns to the host that
@@ -22,9 +22,10 @@ export interface QueueRow {
     readonly status: string;
     readonly direction?: string;
     readonly receiptExpected?: boolean;
+    readonly answeredAt?: number;
     readonly deliveredTo?: string;
 }
-/** How many receipt-owing tasks this host holds pending for `team`. */
+/** How many receipt-owing tasks this host holds pending and unanswered for `team`. */
 export declare function queuedFor(rows: readonly QueueRow[], team: string): number;
 /** The refusal text when `team`'s queue is full, else undefined. `cap <= 0` disables the guard. */
 export declare function queueFullRefusal(rows: readonly QueueRow[], team: string, message: string, cap: number, mailbox: boolean, ownTask: (taskId: string) => boolean): string | undefined;

package/lib/types/task-ledger-rows.d.ts

@@ -0,0 +1,341 @@
+/** Stateless ledger row types, classifiers and restore projections; moved verbatim for #258. */
+import { type AuthProof, type ChainRole, type SettlementReason, type SettlementVerdict, type TaskAuthorization } from './task-auth.ts';
+import type { ReceiptOutcomeV2 } from './receipt.ts';
+import type { ConservationSnapshot } from './ledger-conservation.ts';
+/**
+ * Caller-ended summaries (abandon / cancel) share one isolation law: late
+ * receipts never rewrite the verdict — they only stamp lateReceiptAt, and
+ * the projected outcome collapses to 'abandoned'.
+ */
+export declare const CALLER_ENDED_PREFIX: RegExp;
+/** Hard cap on the owed book (pending + dead-lettered rows, most recent first). */
+export declare const TASK_CAP = 64;
+/** Hard cap on the settled archive (most recent kept). */
+export declare const ARCHIVE_CAP = 64;
+/** Longest receipt summary kept on a record (multi-line outcomes collapse). */
+export declare const SUMMARY_CAP = 200;
+/**
+ * Longest dispatch brief kept per row. A ledger row without its payload is
+ * unreadable to supervision — "direct-8f3a1c2b → dsh/ec4ce7f8, 3h old" says
+ * nothing about whether to nudge, abandon, or read the receipt. The brief is
+ * the first non-empty line of the message, capped; the full body never enters
+ * the ledger (it can be arbitrarily large and may quote another session's log).
+ */
+export declare const BRIEF_CAP = 120;
+/** Reduce a dispatch body to one readable line: first non-empty line, collapsed, capped. */
+export declare function briefOf(message: string | undefined): string | undefined;
+/**
+ * Age at which an unsettled task auto-dead-letters. A dead row exits the
+ * owed view, disarms its async-nudge retry (a cold session cannot consume a
+ * re-steer anyway), and still accepts a late receipt from a revived target.
+ * Injectable per instance so tests can use short windows; sweeping stays
+ * lazy — every read/write entry point sweeps first.
+ */
+export declare const TASK_STALE_TTL_MS: number;
+/**
+ * The receipt correlation template now lives in `receipt.ts` (shared codec
+ * for header + v2 envelope line). This ledger consumes `parseReceipt` so
+ * human summaries and machine projections can never drift apart again.
+ */
+/** Lifecycle of a tracked outbound task inside the owed book. */
+export type TaskStatus = 'pending' | 'dead';
+/** F5 layer-3: why a dead row aged out (stamped by the sweep at flip time). */
+export type DeadReason = 'fire-forget' | 'unconsumed';
+/** gh#31: which archive path ended a row — a receipt, a content echo, or the caller. */
+export type ArchiveEnd = 'receipt' | 'echo' | 'abandoned' | 'cancelled' | 'evicted';
+export declare const ARCHIVE_ENDS: readonly string[];
+/** Summary marker {@link TaskLedger.resolveEcho} writes on echo-settled rows. */
+export declare const ECHO_SUMMARY = "(settled by content echo)";
+/**
+ * #114 S3: who really sent one outbound task — the routing session, the
+ * agent-less host face, or a native-teams bridge submitter. Before this
+ * field every outbound row was attributable only to the host ("home"), so
+ * same-host seats could not be told apart.
+ */
+export interface Sender {
+    readonly kind: 'session' | 'host' | 'bridge' | 'cli';
+    /**
+     * A session's `<zone>/<id8>` node team, the host process label, or the
+     * bridge submitter. Group senders by `kind:id`, never by `id` alone: a host
+     * label set by hand may look like a session handle.
+     */
+    readonly id: string;
+    /**
+     * Host senders only: the label the call borrowed on the wire when it
+     * differs from {@link id} (quick dispatch rides a live joined session's
+     * team). Display context, never a bucket key.
+     */
+    readonly face?: string;
+}
+/** Longest sender id kept; anything longer is malformed, not truncated. */
+export declare const SENDER_ID_CAP = 256;
+/**
+ * Restore-side allowlist for one persisted sender: a well-formed value comes
+ * back as a fresh object holding only kind, id and (when present) face; anything else is dropped whole (the row
+ * itself survives — a bad sender never costs the debt record).
+ * @param raw - the persisted value.
+ * @returns the sender, or undefined when absent or malformed.
+ */
+export declare function parseSender(raw: unknown): Sender | undefined;
+/**
+ * Spread helper for restore: `{ sender }` when the persisted value parses and
+ * the row is not inbound (an inbound row's originator is its caller, never a
+ * sender this host recorded), else nothing.
+ */
+export declare function withSender(raw: unknown, direction: unknown): {
+    sender?: Sender;
+};
+/**
+ * #114 S2: `{ auth }` when a persisted INBOUND row carries a record that
+ * parses whole (parseAuthorization) and belongs to THIS row — its target is
+ * the row's team and its receipt target the row's peer — else nothing: the
+ * row survives as a pre-S2 row, never with a partially adopted or borrowed
+ * record.
+ */
+export declare function withAuth(raw: unknown, entry: {
+    direction?: unknown;
+    team?: unknown;
+    peer?: unknown;
+}, now: number): {
+    auth?: TaskAuthorization;
+};
+/** Routing and answer facts copied unchanged between a row and its archive entry. */
+export declare function routingOf(row: Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt'>): Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt'>;
+/** #139: what an outbound row is born with besides its sender. */
+export interface OutboundBirth {
+    readonly forwarded?: true;
+    /** The local-candidate admission (ingress local); kept only on a row whose peer is 'local'. */
+    readonly auth?: TaskAuthorization;
+    readonly peerKey?: string;
+    readonly peerHost?: string;
+    readonly deliveredTo?: string;
+}
+/** The facts of one outbound birth that fit the row (see {@link withRouting} for the same shape on restore). */
+export declare function birthFacts(peer: string, birth: OutboundBirth | undefined): Pick<TaskRecord, 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded'>;
+/** Bound on a persisted routing fact; anything longer (or empty, or not a string) is dropped on restore. */
+export declare const ROUTING_FACT_CAP = 256;
+/**
+ * #139: restore-side allowlist for the routing facts. Each is kept only in
+ * its shape — a non-empty string within the cap — and the peer facts only on
+ * a remote outbound row; anything else is dropped (the row survives as one
+ * born before the fields, judged by current membership and origin).
+ */
+export declare function withRouting(entry: Record<string, unknown>): Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt'>;
+/** One tracked outbound task still in the owed book (unsettled). */
+export interface TaskRecord {
+    readonly taskId: string;
+    readonly team: string;
+    readonly peer: string;
+    readonly startedAt: number;
+    /**
+     * Which side of the wire this row serves: 'outbound' (this node sent and
+     * awaits a receipt) or 'inbound' (this node received and owes one).
+     * Absent on rows persisted before F2' — those are outbound by birth.
+     */
+    readonly direction?: 'inbound' | 'outbound';
+    /**
+     * F5: whether a receipt is actually owed. Absent ⇒ true (back-compat).
+     * `false` marks fire-and-forget deliveries — the caller's label could not
+     * receive a receipt at dispatch (process-form label), so no debt was born
+     * and supervision must not chase this row.
+     */
+    readonly receiptExpected?: boolean;
+    /** The conversation the delivery steered, for follow-up routes. */
+    readonly contextId?: string;
+    /**
+     * Head of the dispatched message (first non-empty line, {@link BRIEF_CAP}).
+     * What the row is ABOUT — the fact that makes the ledger readable without
+     * replaying the conversation. Absent on rows persisted before this field.
+     */
+    readonly brief?: string;
+    /** #114 S3: the real sender of an outbound row (absent on inbound rows and rows persisted before the field). */
+    readonly sender?: Sender;
+    /** Home host forwarded an online CLI request to a peer. */
+    readonly forwarded?: true;
+    /**
+     * #114 S2: the immutable authorization the row was born with — an inbound
+     * row's wire admission, or (#139) an outbound row's local-candidate
+     * admission (`ingress: 'local'`). Absent on remote outbound and older rows.
+     */
+    readonly auth?: TaskAuthorization;
+    /** #139: the public key of the peer card a remote outbound row was dispatched to. */
+    readonly peerKey?: string;
+    /** #139: that card's session label (the peer host's process label). */
+    readonly peerHost?: string;
+    /** #139: the member that actually received the task (canvas / bare-zone deliveries). */
+    readonly deliveredTo?: string;
+    /** Local target has produced an answer; still owed until receipt delivery/settlement, but no longer queued. */
+    answeredAt?: number;
+    status: TaskStatus;
+    /** When the row was swept to dead-letter (absent while pending). */
+    deadAt?: number;
+    /**
+     * F5 layer-3: why the row aged out. 'fire-forget' — a receiptExpected:false
+     * row expiring is expected bookkeeping, not a failure; 'unconsumed' — a
+     * receipt-owed row never settled, the actionable stale shape. Absent on
+     * dead rows persisted before this field (rendered as 'unspecified').
+     */
+    reason?: DeadReason;
+}
+/** One settled task kept for audit, with its receipt-correlated outcome. */
+export interface ArchivedRecord {
+    readonly taskId: string;
+    readonly team: string;
+    readonly peer: string;
+    readonly startedAt: number;
+    readonly contextId?: string;
+    readonly resolvedAt: number;
+    readonly summary?: string;
+    /** Head of the dispatched message that this row settled (see {@link TaskRecord.brief}). */
+    readonly brief?: string;
+    /** Controlled vocabulary verdict when the settling receipt carried a v2 envelope; forced 'abandoned' for caller-abandoned rows. */
+    readonly outcome?: ReceiptOutcomeV2 | 'abandoned';
+    /** Remote-turn wall-clock cost, when the settling envelope carried it. */
+    readonly elapsedMs?: number;
+    /**
+     * When a receipt arrived for an explicitly abandoned row ({@link TaskLedger.abandon}).
+     * Orphan isolation: the abandonment outcome stays verbatim; the late answer is
+     * recorded as metadata only, never promoted to resolution.
+     */
+    readonly lateReceiptAt?: number;
+    /**
+     * gh#31: which archive path ended the row, recorded at archive time. Absent
+     * on rows archived before the field — {@link archivedEndedBy} derives it.
+     */
+    readonly endedBy?: ArchiveEnd;
+    /** gh#31: which side of the wire the row served, copied from the owed row (absent on rows archived before the field). */
+    readonly direction?: 'inbound' | 'outbound';
+    /**
+     * gh#68: copied from the owed row when it awaited no receipt, so a tidied
+     * fire-forget expiry is not read as a send we gave up on. Only `false` is
+     * ever stored; absent means a receipt was owed (or the row predates the field).
+     */
+    readonly receiptExpected?: false;
+    /** #114 S3: copied from the owed row (absent on inbound rows and rows archived before the field). */
+    readonly sender?: Sender;
+    /** Home host forwarded an online CLI request to a peer. */
+    readonly forwarded?: true;
+    /** #114 S2: carried over from the live row unchanged. */
+    readonly auth?: TaskAuthorization;
+    /** #139: carried over from the live row unchanged (a late receipt is judged against them). */
+    readonly peerKey?: string;
+    readonly peerHost?: string;
+    readonly deliveredTo?: string;
+    /** Local answer time retained as audit metadata, independent of resolution time. */
+    readonly answeredAt?: number;
+    /** #114 S4: who settled the row (receipt and echo ends), and their chain role. */
+    readonly settledBy?: SettledBy;
+}
+/**
+ * How one archived row ended (gh#31). The recorded field wins; legacy rows
+ * fall back to the summary markers this ledger writes itself. The fallback
+ * reads a receipt-settled row's summary, which is the peer's text, so it is
+ * only as exact as the legacy data allows.
+ * @param row - the archived record.
+ * @returns the archive path that ended it.
+ */
+export declare function archivedEndedBy(row: ArchivedRecord): ArchiveEnd;
+/** Result of an explicit caller-side abandon. Total and never-thrown. */
+export type AbandonOutcome = 'cleared' | 'already-terminal' | 'unknown';
+/** Structured verdict for one {@link TaskLedger.abandon} call (consumer contract: idempotent). */
+export interface AbandonResult {
+    readonly outcome: AbandonOutcome;
+    readonly taskId: string;
+    /** Settle time: fresh abandonment's clock tick, or the already-settled row's original resolvedAt. */
+    readonly archivedAt?: number;
+}
+/** Result of a cooperative {@link TaskLedger.cancel}; adds routing facts for the notify half. */
+export interface CancelledResult extends AbandonResult {
+    /** Team the ended row addressed — the route layer reaches a live local target through it. */
+    readonly team?: string;
+    readonly contextId?: string;
+}
+/** Per-instance knobs; defaults come from the exported constants. */
+export interface TaskLedgerOptions {
+    /** Stale-TTL override (tests inject short windows); defaults to {@link TASK_STALE_TTL_MS}. */
+    staleTtlMs?: number;
+    /** Archive capacity override; defaults to {@link ARCHIVE_CAP}. */
+    archiveCap?: number;
+    /**
+     * Clock injection for tests: every sweep/TTL decision reads the time from
+     * here. Defaults to Date.now. Injecting a steppable clock makes the stale
+     * transition deterministic - no real sleeps to race under load.
+     */
+    now?: () => number;
+}
+/**
+ * What one correlated receipt settled — the payload of the
+ * `a2a/receipt-resolved` event, emitted for consumers that react to receipt
+ * arrivals (P2: native-teams settles its outstanding async submissions from
+ * this seam). `outcome` carries the v2 envelope's controlled-vocabulary
+ * verdict when the receipt rode one; `late` marks a receipt answering a
+ * dead-lettered row (revival) or an abandoned row (arrival recorded) — a
+ * healthy row's duplicate receipt refreshes the archive with NO marker.
+ */
+export interface ReceiptResolvedInfo {
+    readonly taskId: string;
+    /** The team the task was routed to (as the dispatcher recorded it). */
+    readonly team: string;
+    /** The peer (or `'local'`) the task was dispatched through. */
+    readonly peer: string;
+    /** v2 envelope outcome, when the receipt rode one. */
+    readonly outcome?: string;
+    /** One-line outcome summary, when the receipt carried one. */
+    readonly summary?: string;
+    /** True when the receipt answered a dead-lettered or abandoned row. */
+    readonly late?: boolean;
+}
+/** The persisted ledger document: the owed book plus its settled archive. */
+export interface TaskLedgerSnapshot {
+    readonly tasks: readonly TaskRecord[];
+    readonly archived?: readonly ArchivedRecord[];
+    /** #114 S4: the bounded ring of refused / would-be-refused settlements. */
+    readonly settlementRefusals?: readonly SettlementRefusalRecord[];
+    /** #114 S4: monotonic count of every refusal noted. */
+    readonly settlementRefusalsTotal?: number;
+    /** gh#154: lifetime conservation counters (persisted; absent = pre-#154 legacy) — the module contract, shared by classifier, counters, and this schema (review P3). */
+    readonly conservation?: ConservationSnapshot;
+}
+/** #114 S4: who settled an archived row, and how they stood on its authorization chain. */
+export interface SettledBy {
+    readonly caller: string;
+    readonly chain_role: ChainRole | 'off-chain';
+}
+/** #114 S4: one settlement the judgement refused (enforce) or would have refused (observe). */
+export interface SettlementRefusalRecord {
+    readonly taskId: string;
+    readonly at: number;
+    readonly settler: {
+        readonly caller: string;
+        readonly proof: AuthProof;
+        readonly ingress: 'wire' | 'local';
+    };
+    readonly reason: SettlementReason;
+    /** The receipt's first line, bounded. */
+    readonly head: string;
+    /** true: the settlement was refused (enforce); false: recorded only (observe). */
+    readonly enforced: boolean;
+    /** Repeats of the same (task, settler, reason) folded into this entry, so a flood cannot push older evidence out (review of PR #140 P2-4). */
+    readonly count: number;
+}
+/** Bound on ids and callers kept in settlement records; longer values are cut on write and refused on restore. */
+export declare const SETTLEMENT_ID_CAP = 256;
+/** Bound of the refusal ring (design §4.4). */
+export declare const SETTLEMENT_REFUSAL_CAP = 64;
+/**
+ * #114 S4: how the ledger asks whether a settler may settle a row. `check`
+ * is the pure judgement (task-auth.ts judgeSettlement) bound to this
+ * receipt's facts; `enforce` decides whether an off-chain verdict blocks
+ * the settlement or is only recorded.
+ */
+export interface SettlementJudge {
+    readonly enforce: boolean;
+    readonly settler: SettlementRefusalRecord['settler'];
+    check(row: Pick<TaskRecord, 'team' | 'peer' | 'direction' | 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo'>, echo: boolean): SettlementVerdict;
+}
+/** Restore-side allowlist for settledBy: whole or nothing. */
+export declare function withSettledBy(raw: unknown): {
+    settledBy?: SettledBy;
+};
+/** Restore-side allowlist for one refusal record: whole or nothing. */
+export declare function parseRefusal(raw: unknown): SettlementRefusalRecord | undefined;