@nelsonlongxiang/dsh-open-a2a-net 0.6.37 → 0.6.38

package/lib/types/faces/admin.d.ts

@@ -70,6 +70,10 @@ export interface AdminFaceDeps extends Pick<CanvasNotifyDeps, 'verifyOriginClaim
     }>;
     readonly layoutStore: LayoutStore;
     readonly taskLedger: TaskLedger;
+    readonly enforceRefused?: {
+        reason: string;
+        blockers: readonly string[];
+    };
     /** #114 S6: observe (lazily) and return the /state `authorization` block. */
     readonly authorizationView: () => unknown;
     readonly idempotencyStore: IdempotencyStore;
@@ -140,6 +144,12 @@ export interface AdminFaceDeps extends Pick<CanvasNotifyDeps, 'verifyOriginClaim
     readonly legacyInboundCount: number;
     readonly unboundInboundCount: number;
     readonly boundMissInboundCount: number;
+    readonly boundMissRecent: ReadonlyArray<{
+        caller: string;
+        audience: string;
+        count: number;
+        lastAt: number;
+    }>;
     readonly ownCardUrl: string;
     ownerSeatNames: Record<string, string>;
     ownerAllowlist: string[];

package/lib/types/faces/wire.d.ts

@@ -131,6 +131,7 @@ export interface WireDeps {
         readonly rawBody?: Uint8Array;
     }) => Promise<OriginClaimResult>;
     readonly forwardDirect: (request: ForwardRequest) => Promise<A2aRouteResult>;
+    readonly diagnoseCanvas: (team: string, reason: string, caller?: string) => Promise<string>;
     readonly remoteCliProof: (handle: string, claim: Extract<OriginClaimResult, {
         ok: true;
     }>) => Promise<RemoteCliProof | undefined>;
@@ -169,6 +170,7 @@ export interface WireDeps {
     /** gh#224: refuses a new delivery once the target already owes `targetQueueCap` receipts. */
     readonly refuseIfQueueFull: (caller: string, message: string, team: string, taskId: string, mailbox: boolean, res: ServerResponse) => boolean;
     /** Settles a receipt; returns the enforce refusal of the row its header names (#139), if any. */
+    readonly waitForForwardBirth: (message: string) => Promise<void>;
     readonly settleAndAnnounce: (message: string, settler?: Settler) => SettlementRefusal | undefined;
     readonly touchWakeDemand: () => void;
     readonly session: string;
@@ -199,7 +201,7 @@ export interface WireDeps {
     readonly nativeTeamsRound: (prepared: Extract<NativePrepared, {
         ok: true;
     }>, team: string, caller: string, message: string, taskId: string | undefined, proofClause: string, external?: AbortSignal, proofHeader?: (team: string, taskId: string, from: string, proofClause: string) => string) => Promise<NativeRoundOutcome>;
-    readonly routeIntoAgent: (team: string, message: string, caller: string, taskId?: string, proofClause?: string, directHeader?: (from: string) => string) => Promise<RouteOutcome>;
+    readonly routeIntoAgent: (team: string, message: string, caller: string, taskId?: string, proofClause?: string, directHeader?: (from: string) => string, localFrom?: string, onSteered?: (target: Agent, floor: number) => void) => Promise<RouteOutcome>;
 }
 /**
  * #187: what a verified claim may vouch for at settlement. The signing key always (the card was

package/lib/types/index.d.ts

@@ -91,7 +91,7 @@ export interface Config {
      * (which is left untouched). Inbound faces keep answering. Default false.
      */
     readonly isolated: boolean;
-    /** Forward online local CLI deliveries one hop after a local miss. Default off. */
+    /** Forward online local CLI deliveries one hop after a local miss. Default on from 0.6.38; explicit false opts out. */
     readonly forwardDirect: boolean;
     /** Human-facing name published on the agent card. */
     readonly agentName: string;

package/lib/types/origin-claim.d.ts

@@ -117,7 +117,10 @@ export declare function verifyOriginClaim(req: IncomingMessage, d: {
     /** Count one accepted unbound envelope (the drain gauge). */
     readonly onUnbound: () => void;
     /** Count one bound form that missed and fell back to the unbound one. */
-    readonly onBoundMiss?: () => void;
+    readonly onBoundMiss?: (miss: {
+        readonly caller: string;
+        readonly audience: string;
+    }) => void;
     /** A loopback arrival is an audience of its own (default); off when originClaimUrl declares a tunnel or proxy. */
     readonly loopbackArrival?: boolean;
     readonly now: number;

package/lib/types/task-auth.d.ts

@@ -232,6 +232,8 @@ export interface SettlementRow {
     readonly peerHost?: string;
     /** #139: the member that actually received the task (canvas and bare-zone deliveries). */
     readonly deliveredTo?: string;
+    readonly forwarded?: true;
+    readonly receiverMembers?: readonly string[];
 }
 /** Facts from outside the row. */
 export interface SettlementFacts {

package/lib/types/task-ledger-rows.d.ts

@@ -96,31 +96,36 @@ export declare function withAuth(raw: unknown, entry: {
     direction?: unknown;
     team?: unknown;
     peer?: unknown;
+    forwarded?: unknown;
+    sender?: unknown;
 }, now: number): {
     auth?: TaskAuthorization;
 };
 /** Routing and answer facts copied unchanged between a row and its archive entry. */
-export declare function routingOf(row: Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt'>): Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt'>;
+export declare function routingOf(row: Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt' | 'receiverMembers'>): Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt' | 'receiverMembers'>;
 /** #139: what an outbound row is born with besides its sender. */
 export interface OutboundBirth {
     readonly forwarded?: true;
-    /** The local-candidate admission (ingress local); kept only on a row whose peer is 'local'. */
+    /** Local-candidate admission, or a forwarded online CLI's verified wire admission. */
     readonly auth?: TaskAuthorization;
     readonly peerKey?: string;
     readonly peerHost?: string;
     readonly deliveredTo?: string;
+    /** Verified selected peer canvas membership at dispatch; actual deliveredTo remains stricter when available. */
+    readonly receiverMembers?: readonly string[];
 }
 /** The facts of one outbound birth that fit the row (see {@link withRouting} for the same shape on restore). */
-export declare function birthFacts(peer: string, birth: OutboundBirth | undefined): Pick<TaskRecord, 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded'>;
+export declare function birthFacts(peer: string, birth: OutboundBirth | undefined, team?: string, sender?: Sender, now?: number, warn?: (message: string) => void): Pick<TaskRecord, 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'receiverMembers'>;
 /** Bound on a persisted routing fact; anything longer (or empty, or not a string) is dropped on restore. */
 export declare const ROUTING_FACT_CAP = 256;
+export declare function parseReceiverMembers(value: unknown, warn?: (message: string) => void): readonly string[] | undefined;
 /**
  * #139: restore-side allowlist for the routing facts. Each is kept only in
  * its shape — a non-empty string within the cap — and the peer facts only on
  * a remote outbound row; anything else is dropped (the row survives as one
  * born before the fields, judged by current membership and origin).
  */
-export declare function withRouting(entry: Record<string, unknown>): Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt'>;
+export declare function withRouting(entry: Record<string, unknown>, warn?: (message: string) => void): Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt' | 'receiverMembers'>;
 /** One tracked outbound task still in the owed book (unsettled). */
 export interface TaskRecord {
     readonly taskId: string;
@@ -164,6 +169,8 @@ export interface TaskRecord {
     readonly peerHost?: string;
     /** #139: the member that actually received the task (canvas / bare-zone deliveries). */
     readonly deliveredTo?: string;
+    /** Verified selected peer canvas membership at dispatch; actual deliveredTo remains stricter when available. */
+    readonly receiverMembers?: readonly string[];
     /** Local target has produced an answer; still owed until receipt delivery/settlement, but no longer queued. */
     answeredAt?: number;
     status: TaskStatus;
@@ -221,6 +228,8 @@ export interface ArchivedRecord {
     readonly peerKey?: string;
     readonly peerHost?: string;
     readonly deliveredTo?: string;
+    /** Verified selected peer canvas membership at dispatch; actual deliveredTo remains stricter when available. */
+    readonly receiverMembers?: readonly string[];
     /** Local answer time retained as audit metadata, independent of resolution time. */
     readonly answeredAt?: number;
     /** #114 S4: who settled the row (receipt and echo ends), and their chain role. */
@@ -252,6 +261,8 @@ export interface CancelledResult extends AbandonResult {
 }
 /** Per-instance knobs; defaults come from the exported constants. */
 export interface TaskLedgerOptions {
+    /** Invalid persisted member entries are dropped individually and reported without their content. */
+    warn?: (message: string) => void;
     /** Stale-TTL override (tests inject short windows); defaults to {@link TASK_STALE_TTL_MS}. */
     staleTtlMs?: number;
     /** Archive capacity override; defaults to {@link ARCHIVE_CAP}. */
@@ -331,7 +342,7 @@ export declare const SETTLEMENT_REFUSAL_CAP = 64;
 export interface SettlementJudge {
     readonly enforce: boolean;
     readonly settler: SettlementRefusalRecord['settler'];
-    check(row: Pick<TaskRecord, 'team' | 'peer' | 'direction' | 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo'>, echo: boolean): SettlementVerdict;
+    check(row: Pick<TaskRecord, 'team' | 'peer' | 'direction' | 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'receiverMembers'>, echo: boolean): SettlementVerdict;
 }
 /** Restore-side allowlist for settledBy: whole or nothing. */
 export declare function withSettledBy(raw: unknown): {

package/lib/types/task-ledger.d.ts

@@ -44,6 +44,7 @@ export declare class TaskLedger {
     private readonly archiveCap;
     /** Injectable clock (option `now`). */
     private readonly now;
+    private readonly warn;
     /**
      * @param path - persistence file (`<dsh-home>/a2a/tasks.json`); empty = no persistence.
      * @param options - TTL/capacity overrides; defaults come from the exported constants.
@@ -55,6 +56,8 @@ export declare class TaskLedger {
      * @returns the owed-book records.
      */
     list(): readonly TaskRecord[];
+    /** #275: old forwarded canvas debts cannot be safely upgraded by inventing receiver authority. */
+    settlementEnforceBlockers(): string[];
     /**
      * The settled archive, most recently resolved first. Rows land here the
      * moment their receipt correlates and stay until the archive cap evicts

package/lib/types/tools/info.d.ts

@@ -18,6 +18,9 @@ export type DirectoryTeamRow = {
     session: string;
     name: string;
     seatName?: string;
+    kind?: 'canvas';
+    owner?: string;
+    memberCount?: number;
     description: string;
     local?: boolean;
     origin?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nelsonlongxiang/dsh-open-a2a-net",
-  "version": "0.6.37",
+  "version": "0.6.38",
   "description": "Open A2A network plugin for DeepSeek Harness: signed agent cards, decentralized peer/zone discovery, direct routing model tools, and joinable session nodes with a sidebar control",
   "type": "module",
   "main": "lib/index.js",