@openvtc/trust-tasks 0.27.1 → 0.27.3

package/src/_runtime/consume.ts

@@ -304,7 +304,8 @@ export interface ConsumeOptions<P, R> {
    *
    * Return a success response, an {@link ErrorResponse} to refuse, or nothing
    * at all for a specification that defines no success response (§4.4.1) —
-   * which yields the `accepted` outcome.
+   * which yields the `accepted` outcome. A throw aborts the pipeline, releases
+   * the item-11 claim so the document can be resent, and is rethrown.
    */
   handler: (
     doc: TrustTaskDocument<P>,
@@ -514,10 +515,33 @@ export async function consumeInbound<P, R>(
       case "fresh":
         claim = { guard, digest };
         break;
+      default:
+        // A guard answering with a verdict this runtime does not know has
+        // not said the document is fresh. Executing anyway would skip item
+        // 11, so fail closed, as for a guard that cannot answer at all.
+        return route({
+          code: "unavailable",
+          message: REPLAY_RECORD_UNAVAILABLE,
+          retryable: true,
+        });
     }
   }
 
-  const result = await handler(doc, resolved.parties);
+  let result: Awaited<ReturnType<typeof handler>>;
+  try {
+    result = await handler(doc, resolved.parties);
+  } catch (e) {
+    // The handler did not finish, so nothing says the effect happened.
+    // Holding the claim would answer every resend with an in-flight duplicate
+    // until the record expired: the document could not be retried, and the
+    // producer would never learn why.
+    try {
+      await claim?.guard.release?.(doc.id, claim.digest);
+    } catch {
+      /* best-effort */
+    }
+    throw e;
+  }
 
   if (result === undefined || result === null) {
     // Fire-and-forget: nothing to cache, but the claim stands — the effect

package/src/_runtime/document.ts

@@ -237,13 +237,29 @@ export const TRUST_TASK_ERROR_TYPE_URI = "https://trusttasks.org/spec/trust-task
  *
  * @param now Milliseconds since the epoch, as from `Date.now()`.
  */
+/**
+ * Parse an RFC 3339 `date-time` (SPEC §4.2) to epoch milliseconds, or `NaN`.
+ *
+ * Stricter than `Date.parse`, which reads a timestamp with no zone designator
+ * as *local* time and accepts forms RFC 3339 does not (a bare date, `Jan 1
+ * 2026`). The Rust and Go runtimes refuse both, and an instant that depends on
+ * the consumer's time zone is not one instant at all.
+ */
+export function parseRfc3339(value: string): number {
+  if (!RFC3339.test(value)) return NaN;
+  return Date.parse(value.toUpperCase());
+}
+
+const RFC3339 =
+  /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
+
 export function validateBasic<P>(
   doc: TrustTaskDocument<P>,
   now: number,
   myVid: string,
 ): RejectReason | null {
   if (doc.expiresAt !== undefined) {
-    const expiresAt = Date.parse(doc.expiresAt);
+    const expiresAt = parseRfc3339(doc.expiresAt);
     if (Number.isNaN(expiresAt)) {
       return {
         code: "malformedRequest",

package/src/_runtime/freshness.ts

@@ -20,7 +20,7 @@
  * be kept forever.
  */
 
-import type { RejectReason, TrustTaskDocument } from "./document.js";
+import { parseRfc3339, type RejectReason, type TrustTaskDocument } from "./document.js";
 
 /** The clock-skew tolerance SPEC §4.2 sanctions ("typically ≤ 60s"), in ms. */
 export const DEFAULT_SKEW_MS = 60_000;
@@ -125,14 +125,14 @@ export function validateFreshness<P>(
   });
 
   if (doc.issuedAt !== undefined) {
-    const issuedAt = Date.parse(doc.issuedAt);
+    const issuedAt = parseRfc3339(doc.issuedAt);
     if (Number.isNaN(issuedAt)) {
       return malformed("issuedAt is not a valid RFC 3339 timestamp");
     }
     if (issuedAt > now + policy.skewMs) return malformed(FUTURE_ISSUED_AT);
 
     if (doc.expiresAt !== undefined) {
-      const expiresAt = Date.parse(doc.expiresAt);
+      const expiresAt = parseRfc3339(doc.expiresAt);
       // A malformed `expiresAt` is `validateBasic`'s to report; skip it here
       // rather than raise a second, differently-worded rejection for it.
       if (!Number.isNaN(expiresAt) && expiresAt <= issuedAt) {
@@ -160,7 +160,9 @@ export function validateFreshness<P>(
  * this consumer's willingness to execute it, which SPEC §7.2 makes the same
  * instant as the end of the record's required retention.
  *
- * `expiresAt` fixes it where present; otherwise `issuedAt + maxAgeMs`.
+ * `expiresAt` fixes it where present; otherwise `issuedAt + maxAgeMs + skewMs`
+ * — the same bound {@link validateFreshness} accepts up to, so a replay arriving
+ * inside the skew allowance still finds the record.
  * `undefined` means this policy places no bound on the document, in which case
  * a consumer **MUST NOT** execute a consequential task on it — there is no
  * window in which to keep the record.
@@ -171,13 +173,13 @@ export function recordExpiry<P>(
   now: number,
 ): number | undefined {
   if (doc.expiresAt !== undefined) {
-    const expiresAt = Date.parse(doc.expiresAt);
+    const expiresAt = parseRfc3339(doc.expiresAt);
     if (!Number.isNaN(expiresAt)) return expiresAt;
   }
   if (policy.maxAgeMs === undefined) return undefined;
-  const issuedAt = doc.issuedAt === undefined ? NaN : Date.parse(doc.issuedAt);
+  const issuedAt = doc.issuedAt === undefined ? NaN : parseRfc3339(doc.issuedAt);
   // Fall back to `now` when the producer stamped no usable `issuedAt`: the
   // record then lives a full window from first sight, which is the longest the
   // document could still be arriving from a queue.
-  return (Number.isNaN(issuedAt) ? now : issuedAt) + policy.maxAgeMs;
+  return (Number.isNaN(issuedAt) ? now : issuedAt) + policy.maxAgeMs + policy.skewMs;
 }