@sentropic/h2a 0.2.4 → 0.2.6

package/dist/envelope.d.ts

@@ -1,8 +1,26 @@
+import { type SignOptions } from "./signature.js";
 import { type H2AEnvelope } from "./types.js";
 type CreateEnvelopeInput<TBody> = Omit<H2AEnvelope<TBody>, "protocol" | "version" | "createdAt"> & {
     createdAt?: string;
 };
 export declare function createEnvelope<TBody>(input: CreateEnvelopeInput<TBody>): H2AEnvelope<TBody>;
+/**
+ * Sign an envelope's provenance (DEC-073). Returns a new envelope with the
+ * ed25519 signature appended to `signatures[]`; the original is not mutated.
+ * This is the "signed bearer" primitive underpinning authenticated transport
+ * (DEC-032): a recipient can verify *who* emitted an envelope independently of
+ * the channel it arrived on.
+ */
+export declare function signEnvelope<TBody>(envelope: H2AEnvelope<TBody>, options: SignOptions): H2AEnvelope<TBody>;
+/**
+ * Verify an envelope's signature(s) against a public key (DEC-073). With
+ * `options.by`, only that signer's signature(s) are checked; otherwise any
+ * signature that verifies against the key counts. Returns false when the
+ * envelope carries no (matching) signature.
+ */
+export declare function verifyEnvelopeSignature<TBody>(envelope: H2AEnvelope<TBody>, publicKeyPem: string, options?: {
+    by?: string;
+}): boolean;
 export declare function isH2AEnvelope<TBody = unknown>(value: unknown): value is H2AEnvelope<TBody>;
 export {};
 //# sourceMappingURL=envelope.d.ts.map

package/dist/envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAEpB,KAAK,mBAAmB,CAAC,KAAK,IAAI,IAAI,CACpC,WAAW,CAAC,KAAK,CAAC,EAClB,UAAU,GAAG,SAAS,GAAG,WAAW,CACrC,GAAG;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAwBF,wBAAgB,cAAc,CAAC,KAAK,EAClC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,GAChC,WAAW,CAAC,KAAK,CAAC,CAOpB;AAED,wBAAgB,aAAa,CAAC,KAAK,GAAG,OAAO,EAC3C,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,CAc7B"}
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAEpB,KAAK,mBAAmB,CAAC,KAAK,IAAI,IAAI,CACpC,WAAW,CAAC,KAAK,CAAC,EAClB,UAAU,GAAG,SAAS,GAAG,WAAW,CACrC,GAAG;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAwBF,wBAAgB,cAAc,CAAC,KAAK,EAClC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,GAChC,WAAW,CAAC,KAAK,CAAC,CAOpB;AAeD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAChC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,EAC5B,OAAO,EAAE,WAAW,GACnB,WAAW,CAAC,KAAK,CAAC,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAC3C,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,EAC5B,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5B,OAAO,CAUT;AAED,wBAAgB,aAAa,CAAC,KAAK,GAAG,OAAO,EAC3C,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,CAc7B"}

package/dist/envelope.js

@@ -1,3 +1,4 @@
+import { signCanonical, verifyCanonical } from "./signature.js";
 import { H2A_ENVELOPE_TYPES, H2A_PROTOCOL, H2A_ROLES, H2A_VERSION } from "./types.js";
 function isRecord(value) {
     return typeof value === "object" && value !== null;
@@ -23,6 +24,47 @@ export function createEnvelope(input) {
         ...input
     };
 }
+/**
+ * The portion of an envelope that a signature covers: everything except the
+ * `signatures` array itself. Excluding `signatures` makes the signed content
+ * stable, so multiple signers each sign the same provenance (DEC-073) — the
+ * same model as artifact signing (DEC-035).
+ */
+function envelopeSigningView(envelope) {
+    const { signatures: _omit, ...rest } = envelope;
+    return rest;
+}
+/**
+ * Sign an envelope's provenance (DEC-073). Returns a new envelope with the
+ * ed25519 signature appended to `signatures[]`; the original is not mutated.
+ * This is the "signed bearer" primitive underpinning authenticated transport
+ * (DEC-032): a recipient can verify *who* emitted an envelope independently of
+ * the channel it arrived on.
+ */
+export function signEnvelope(envelope, options) {
+    const signature = signCanonical(envelopeSigningView(envelope), options);
+    return {
+        ...envelope,
+        signatures: [...(envelope.signatures ?? []), signature]
+    };
+}
+/**
+ * Verify an envelope's signature(s) against a public key (DEC-073). With
+ * `options.by`, only that signer's signature(s) are checked; otherwise any
+ * signature that verifies against the key counts. Returns false when the
+ * envelope carries no (matching) signature.
+ */
+export function verifyEnvelopeSignature(envelope, publicKeyPem, options = {}) {
+    const signatures = envelope.signatures ?? [];
+    const candidates = options.by
+        ? signatures.filter((s) => s.by === options.by)
+        : signatures;
+    if (candidates.length === 0) {
+        return false;
+    }
+    const view = envelopeSigningView(envelope);
+    return candidates.some((sig) => verifyCanonical(view, sig, publicKeyPem));
+}
 export function isH2AEnvelope(value) {
     if (!isRecord(value)) {
         return false;

package/dist/envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,WAAW,EAIZ,MAAM,YAAY,CAAC;AASpB,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,KAAwB,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAA2B,CAAC;QACrD,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAiC;IAEjC,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,WAAW;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtD,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,KAAK,CAAC,QAAQ,KAAK,YAAY;QAC/B,KAAK,CAAC,OAAO,KAAK,WAAW;QAC7B,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;QACvB,MAAM,IAAI,KAAK;QACf,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAoB,MAAM,gBAAgB,CAAC;AAClF,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,WAAW,EAIZ,MAAM,YAAY,CAAC;AASpB,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,KAAwB,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAA2B,CAAC;QACrD,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAiC;IAEjC,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,WAAW;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtD,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,QAA4B;IAE5B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,QAA4B,EAC5B,OAAoB;IAEpB,MAAM,SAAS,GAAG,aAAa,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,QAAQ;QACX,UAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAA4B,EAC5B,YAAoB,EACpB,UAA2B,EAAE;IAE7B,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE;QAC3B,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QAC/C,CAAC,CAAC,UAAU,CAAC;IACf,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,KAAK,CAAC,QAAQ,KAAK,YAAY;QAC/B,KAAK,CAAC,OAAO,KAAK,WAAW;QAC7B,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;QACvB,MAAM,IAAI,KAAK;QACf,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -14,7 +14,9 @@ export { H2A_OBLIGATION_CADENCES, H2A_RECURRING_OBLIGATION_CONFLICT_DISPOSITIONS
 export type { H2AObligationCadence, H2ARecurringObligationAuditResult, H2ARecurringObligationConflictDisposition, H2ARecurringObligationProfileDescriptor } from "./recurring-obligations.js";
 export { H2A_JURISDICTION_CONFLICT_DISPOSITIONS, H2A_JURISDICTION_KINDS, H2A_JURISDICTION_PROFILES, auditJurisdictionProfile, getJurisdictionProfile } from "./jurisdiction.js";
 export type { H2AJurisdictionAuditResult, H2AJurisdictionConflictDisposition, H2AJurisdictionKind, H2AJurisdictionProfileDescriptor } from "./jurisdiction.js";
-export { createEnvelope, isH2AEnvelope } from "./envelope.js";
+export { createEnvelope, isH2AEnvelope, signEnvelope, verifyEnvelopeSignature } from "./envelope.js";
+export { H2A_DEFAULT_MAX_AGE_MS, H2A_DEFAULT_MAX_SKEW_MS, checkEnvelopeFreshness, createReplayGuard } from "./replay.js";
+export type { H2AFreshnessOptions, H2AReplayCheck, H2AReplayGuard, H2AReplayRejection } from "./replay.js";
 export { H2A_SESSION_DEFAULT_EXPIRY_MS, H2A_SESSION_DEFAULT_HEARTBEAT_INTERVAL_MS, H2A_SESSION_NOTIFICATION_TOPICS, H2A_SESSION_STATES, isH2ASession, isSessionExpired, pickFreshSessions } from "./session.js";
 export type { H2ASession, H2ASessionExpiryOptions, H2ASessionInterests, H2ASessionNotificationTopic, H2ASessionState } from "./session.js";
 export { H2A_HOST_BRIDGE_CLAUSES, H2A_HOST_BRIDGE_PROFILES, auditHostBridge, getHostBridgeProfile, listHostBridgeProfiles } from "./h2a-bridge.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,qBAAqB,EACrB,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,aAAa,EACb,4BAA4B,EAC5B,cAAc,EACd,WAAW,EACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,iCAAiC,EACjC,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,gCAAgC,EAChC,0BAA0B,EAC1B,2BAA2B,EAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,mCAAmC,EACnC,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,2CAA2C,EAC3C,8BAA8B,EAC9B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC3B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,8BAA8B,EAC9B,sCAAsC,EACtC,oCAAoC,EACpC,uBAAuB,EACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oCAAoC,EACpC,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,wBAAwB,EACxB,gCAAgC,EAChC,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kCAAkC,EAClC,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,EACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,8CAA8C,EAC9C,iCAAiC,EACjC,+BAA+B,EAC/B,6BAA6B,EAC9B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,oBAAoB,EACpB,iCAAiC,EACjC,yCAAyC,EACzC,uCAAuC,EACxC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,0BAA0B,EAC1B,kCAAkC,EAClC,mBAAmB,EACnB,gCAAgC,EACjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,aAAa,EACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,6BAA6B,EAC7B,yCAAyC,EACzC,+BAA+B,EAC/B,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,UAAU,EACV,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,eAAe,EAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,mBAAmB,EACnB,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,sBAAsB,EACtB,iCAAiC,EAClC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,kBAAkB,EACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,WAAW,EACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,6BAA6B,EAC7B,uCAAuC,EACxC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACxB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,0BAA0B,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,YAAY,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,YAAY,EACZ,SAAS,EACT,WAAW,EACZ,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,WAAW,EACX,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,eAAe,EACf,UAAU,EACV,oBAAoB,EACpB,mBAAmB,EACnB,SAAS,EACT,qBAAqB,EACrB,OAAO,EACP,YAAY,EACb,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,qBAAqB,EACrB,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,aAAa,EACb,4BAA4B,EAC5B,cAAc,EACd,WAAW,EACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,iCAAiC,EACjC,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,gCAAgC,EAChC,0BAA0B,EAC1B,2BAA2B,EAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,mCAAmC,EACnC,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,2CAA2C,EAC3C,8BAA8B,EAC9B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC3B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,8BAA8B,EAC9B,sCAAsC,EACtC,oCAAoC,EACpC,uBAAuB,EACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oCAAoC,EACpC,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,wBAAwB,EACxB,gCAAgC,EAChC,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kCAAkC,EAClC,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,EACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,8CAA8C,EAC9C,iCAAiC,EACjC,+BAA+B,EAC/B,6BAA6B,EAC9B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,oBAAoB,EACpB,iCAAiC,EACjC,yCAAyC,EACzC,uCAAuC,EACxC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,0BAA0B,EAC1B,kCAAkC,EAClC,mBAAmB,EACnB,gCAAgC,EACjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,uBAAuB,EACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,kBAAkB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,6BAA6B,EAC7B,yCAAyC,EACzC,+BAA+B,EAC/B,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,UAAU,EACV,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,eAAe,EAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,mBAAmB,EACnB,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,sBAAsB,EACtB,iCAAiC,EAClC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,kBAAkB,EACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,WAAW,EACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,6BAA6B,EAC7B,uCAAuC,EACxC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACxB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,0BAA0B,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,YAAY,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,YAAY,EACZ,SAAS,EACT,WAAW,EACZ,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,WAAW,EACX,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,eAAe,EACf,UAAU,EACV,oBAAoB,EACpB,mBAAmB,EACnB,SAAS,EACT,qBAAqB,EACrB,OAAO,EACP,YAAY,EACb,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -6,7 +6,8 @@ export { H2A_DISCLOSURE_CONFLICT_DISPOSITIONS, H2A_DISCLOSURE_MODES, H2A_DISCLOS
 export { H2A_RECOURSE_CONFLICT_DISPOSITIONS, H2A_RECOURSE_PROFILES, H2A_RECOURSE_STATES, auditRecourseProfile, getRecourseProfile } from "./recourse.js";
 export { H2A_OBLIGATION_CADENCES, H2A_RECURRING_OBLIGATION_CONFLICT_DISPOSITIONS, H2A_RECURRING_OBLIGATION_PROFILES, auditRecurringObligationProfile, getRecurringObligationProfile } from "./recurring-obligations.js";
 export { H2A_JURISDICTION_CONFLICT_DISPOSITIONS, H2A_JURISDICTION_KINDS, H2A_JURISDICTION_PROFILES, auditJurisdictionProfile, getJurisdictionProfile } from "./jurisdiction.js";
-export { createEnvelope, isH2AEnvelope } from "./envelope.js";
+export { createEnvelope, isH2AEnvelope, signEnvelope, verifyEnvelopeSignature } from "./envelope.js";
+export { H2A_DEFAULT_MAX_AGE_MS, H2A_DEFAULT_MAX_SKEW_MS, checkEnvelopeFreshness, createReplayGuard } from "./replay.js";
 export { H2A_SESSION_DEFAULT_EXPIRY_MS, H2A_SESSION_DEFAULT_HEARTBEAT_INTERVAL_MS, H2A_SESSION_NOTIFICATION_TOPICS, H2A_SESSION_STATES, isH2ASession, isSessionExpired, pickFreshSessions } from "./session.js";
 export { H2A_HOST_BRIDGE_CLAUSES, H2A_HOST_BRIDGE_PROFILES, auditHostBridge, getHostBridgeProfile, listHostBridgeProfiles } from "./h2a-bridge.js";
 export { assertValidNegotiationState } from "./negotiation.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAWlB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,gCAAgC,EAChC,0BAA0B,EAC1B,2BAA2B,EAC5B,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,2CAA2C,EAC3C,8BAA8B,EAC9B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC3B,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,oCAAoC,EACpC,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EACL,kCAAkC,EAClC,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,eAAe,CAAC;AAOvB,OAAO,EACL,uBAAuB,EACvB,8CAA8C,EAC9C,iCAAiC,EACjC,+BAA+B,EAC/B,6BAA6B,EAC9B,MAAM,4BAA4B,CAAC;AAOpC,OAAO,EACL,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EACL,cAAc,EACd,aAAa,EACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,6BAA6B,EAC7B,yCAAyC,EACzC,+BAA+B,EAC/B,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAQtB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,iBAAiB,CAAC;AAYzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,WAAW,EACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACxB,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACxB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,YAAY,EACZ,SAAS,EACT,WAAW,EACZ,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAWlB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,gCAAgC,EAChC,0BAA0B,EAC1B,2BAA2B,EAC5B,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,2CAA2C,EAC3C,8BAA8B,EAC9B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC3B,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,oCAAoC,EACpC,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EACL,kCAAkC,EAClC,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,eAAe,CAAC;AAOvB,OAAO,EACL,uBAAuB,EACvB,8CAA8C,EAC9C,iCAAiC,EACjC,+BAA+B,EAC/B,6BAA6B,EAC9B,MAAM,4BAA4B,CAAC;AAOpC,OAAO,EACL,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,uBAAuB,EACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAOrB,OAAO,EACL,6BAA6B,EAC7B,yCAAyC,EACzC,+BAA+B,EAC/B,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAQtB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,iBAAiB,CAAC;AAYzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,WAAW,EACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACxB,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACxB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,YAAY,EACZ,SAAS,EACT,WAAW,EACZ,MAAM,YAAY,CAAC"}

package/dist/replay.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Anti-replay for signed envelopes (DEC-074), slice 2 of the signed-bearer
+ * transport-auth workstream (DEC-032 / DEC-073).
+ *
+ * A DEC-073 signature proves *who* emitted an envelope, but not that it is
+ * *fresh* — a validly signed envelope can be captured and re-sent. Replay
+ * protection adds two orthogonal checks:
+ *
+ * - **Freshness**: the envelope's `createdAt` must fall inside an accepted
+ *   window `[now - maxAgeMs, now + maxSkewMs]` (skew tolerates clock drift on
+ *   the emitter).
+ * - **Dedup**: the envelope's `id` must not have been accepted before. The
+ *   `id` is part of the signed view (DEC-073), so a replayed envelope carries
+ *   the same id and is rejected.
+ *
+ * Both are pure/in-memory — no I/O — so this lives in `@sentropic/h2a`. The
+ * channel that moves bytes is irrelevant; verification is end-to-end.
+ */
+import type { H2AEnvelope } from "./types.js";
+export declare const H2A_DEFAULT_MAX_AGE_MS = 300000;
+export declare const H2A_DEFAULT_MAX_SKEW_MS = 60000;
+export interface H2AFreshnessOptions {
+    /** Reference time (ms epoch). Defaults to `Date.now()`. */
+    now?: number;
+    /** How old an envelope may be before it is stale. Default 5 min. */
+    maxAgeMs?: number;
+    /** How far in the future `createdAt` may be (clock skew). Default 1 min. */
+    maxSkewMs?: number;
+}
+export type H2AReplayRejection = "invalid-timestamp" | "expired" | "future" | "replayed";
+export interface H2AReplayCheck {
+    ok: boolean;
+    reason?: H2AReplayRejection;
+}
+/**
+ * Pure freshness check: is the envelope's `createdAt` within the accepted
+ * window? Does not consider dedup (that needs state — see {@link createReplayGuard}).
+ */
+export declare function checkEnvelopeFreshness(envelope: H2AEnvelope, options?: H2AFreshnessOptions): H2AReplayCheck;
+export interface H2AReplayGuard {
+    /**
+     * Accept an envelope iff it is fresh AND its id has not been seen before.
+     * On success the id is remembered for the rest of its freshness window.
+     */
+    accept(envelope: H2AEnvelope, now?: number): H2AReplayCheck;
+    /** Number of remembered ids (after pruning). Mostly for tests/observability. */
+    size(): number;
+}
+/**
+ * Create an in-memory replay guard. It remembers accepted envelope ids until
+ * they fall out of the freshness window, so the set stays bounded: an id that
+ * could only be replayed *after* it has expired would be rejected by the
+ * freshness check anyway, so it is safe to forget.
+ */
+export declare function createReplayGuard(options?: Pick<H2AFreshnessOptions, "maxAgeMs" | "maxSkewMs">): H2AReplayGuard;
+//# sourceMappingURL=replay.d.ts.map

package/dist/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../src/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAC9C,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEzF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,WAAW,EACrB,OAAO,GAAE,mBAAwB,GAChC,cAAc,CAgBhB;AAED,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAC5D,gFAAgF;IAChF,IAAI,IAAI,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,GAAG,WAAW,CAAM,GAChE,cAAc,CAgChB"}

package/dist/replay.js

@@ -0,0 +1,79 @@
+/**
+ * Anti-replay for signed envelopes (DEC-074), slice 2 of the signed-bearer
+ * transport-auth workstream (DEC-032 / DEC-073).
+ *
+ * A DEC-073 signature proves *who* emitted an envelope, but not that it is
+ * *fresh* — a validly signed envelope can be captured and re-sent. Replay
+ * protection adds two orthogonal checks:
+ *
+ * - **Freshness**: the envelope's `createdAt` must fall inside an accepted
+ *   window `[now - maxAgeMs, now + maxSkewMs]` (skew tolerates clock drift on
+ *   the emitter).
+ * - **Dedup**: the envelope's `id` must not have been accepted before. The
+ *   `id` is part of the signed view (DEC-073), so a replayed envelope carries
+ *   the same id and is rejected.
+ *
+ * Both are pure/in-memory — no I/O — so this lives in `@sentropic/h2a`. The
+ * channel that moves bytes is irrelevant; verification is end-to-end.
+ */
+export const H2A_DEFAULT_MAX_AGE_MS = 300_000; // 5 minutes
+export const H2A_DEFAULT_MAX_SKEW_MS = 60_000; // 1 minute clock skew
+/**
+ * Pure freshness check: is the envelope's `createdAt` within the accepted
+ * window? Does not consider dedup (that needs state — see {@link createReplayGuard}).
+ */
+export function checkEnvelopeFreshness(envelope, options = {}) {
+    const now = options.now ?? Date.now();
+    const maxAgeMs = options.maxAgeMs ?? H2A_DEFAULT_MAX_AGE_MS;
+    const maxSkewMs = options.maxSkewMs ?? H2A_DEFAULT_MAX_SKEW_MS;
+    const created = Date.parse(envelope.createdAt);
+    if (Number.isNaN(created)) {
+        return { ok: false, reason: "invalid-timestamp" };
+    }
+    if (created > now + maxSkewMs) {
+        return { ok: false, reason: "future" };
+    }
+    if (created < now - maxAgeMs) {
+        return { ok: false, reason: "expired" };
+    }
+    return { ok: true };
+}
+/**
+ * Create an in-memory replay guard. It remembers accepted envelope ids until
+ * they fall out of the freshness window, so the set stays bounded: an id that
+ * could only be replayed *after* it has expired would be rejected by the
+ * freshness check anyway, so it is safe to forget.
+ */
+export function createReplayGuard(options = {}) {
+    const maxAgeMs = options.maxAgeMs ?? H2A_DEFAULT_MAX_AGE_MS;
+    const maxSkewMs = options.maxSkewMs ?? H2A_DEFAULT_MAX_SKEW_MS;
+    // id -> the createdAt (ms) we accepted it at, for window-based pruning.
+    const seen = new Map();
+    function prune(now) {
+        for (const [id, created] of seen) {
+            if (created < now - maxAgeMs)
+                seen.delete(id);
+        }
+    }
+    return {
+        accept(envelope, now = Date.now()) {
+            const freshness = checkEnvelopeFreshness(envelope, {
+                now,
+                maxAgeMs,
+                maxSkewMs
+            });
+            if (!freshness.ok)
+                return freshness;
+            prune(now);
+            if (seen.has(envelope.id)) {
+                return { ok: false, reason: "replayed" };
+            }
+            seen.set(envelope.id, Date.parse(envelope.createdAt));
+            return { ok: true };
+        },
+        size() {
+            return seen.size;
+        }
+    };
+}
+//# sourceMappingURL=replay.js.map

package/dist/replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../src/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,CAAC,YAAY;AAC3D,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,CAAC,sBAAsB;AAkBrE;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAqB,EACrB,UAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,GAAG,GAAG,GAAG,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,GAAG,GAAG,GAAG,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA+D,EAAE;IAEjE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC/D,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvC,SAAS,KAAK,CAAC,GAAW;QACxB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,OAAO,GAAG,GAAG,GAAG,QAAQ;gBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,CAAC,QAAqB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAC5C,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,EAAE;gBACjD,GAAG;gBACH,QAAQ;gBACR,SAAS;aACV,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YAEpC,KAAK,CAAC,GAAG,CAAC,CAAC;YACX,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAC3C,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,IAAI;YACF,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentropic/h2a",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Core contracts and runtime primitives for human-to-agent coordination.",
   "license": "MIT",
   "type": "module",