@twin3-ai/agent-id 0.2.0 → 0.3.0

package/package.json

@@ -1,9 +1,13 @@
 {
   "name": "@twin3-ai/agent-id",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Domain-bound Agent identity, AEO evidence, and website-Agent integration SDK.",
   "license": "UNLICENSED",
   "private": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cis2042/agent-id.git"
+  },
   "files": [
     "bin",
     "*.js"
@@ -16,7 +20,7 @@
     "npm": ">=10"
   },
   "scripts": {
-    "prepublishOnly": "node --check bin/agent-id.js && node --check installer.js && node --check enterprise-identity.js && node --check release-verifier.js && node --check production-preflight.js && node --check static-edge-adapter.js && node --check optimization-loop.js && node --check artifact-bundle.js"
+    "prepublishOnly": "node --check bin/agent-id.js && node --check bin/agent-id-cloudflare-a1.js && node --check bin/agent-id-b1-sync.js && node --check installer.js && node --check enterprise-identity.js && node --check domain-proof.js && node --check release-verifier.js && node --check production-preflight.js && node --check static-edge-adapter.js && node --check edge-html-injection.js && node --check optimization-loop.js && node --check artifact-bundle.js && node --check cloudflare-a1-sync.js && node --check b1-sync.js"
   },
   "main": "site-agent.js",
   "exports": {
@@ -31,10 +35,13 @@
     "./local-policy": "./local-policy.js",
     "./task-executor": "./task-executor.js",
     "./telemetry-collector": "./telemetry-collector.js",
+    "./cloudflare-a1-sync": "./cloudflare-a1-sync.js",
+    "./b1-sync": "./b1-sync.js",
     "./trust-verifier": "./trust-verifier.js",
     "./repository-connector": "./repository-connector.js",
     "./cloudflare-worker-adapter": "./cloudflare-worker-adapter.js",
     "./static-edge-adapter": "./static-edge-adapter.js",
+    "./edge-html-injection": "./edge-html-injection.js",
     "./optimization-loop": "./optimization-loop.js",
     "./artifact-bundle": "./artifact-bundle.js",
     "./release-verifier": "./release-verifier.js",
@@ -42,6 +49,8 @@
   },
   "bin": {
     "agent-id": "bin/agent-id.js",
-    "agent-id-sync": "bin/agent-id-sync.js"
+    "agent-id-sync": "bin/agent-id-sync.js",
+    "agent-id-cloudflare-a1": "bin/agent-id-cloudflare-a1.js",
+    "agent-id-b1-sync": "bin/agent-id-b1-sync.js"
   }
 }

package/production-preflight.js

@@ -1,7 +1,7 @@
 "use strict";
 
 const net = require("node:net");
-const { verifyReleaseManifest } = require("./release-verifier.js");
+const { verifyReleaseManifest, verifyProductionReleaseReceipt, sha256 } = require("./release-verifier.js");
 
 const PACKAGE_NAME = "@twin3-ai/agent-id";
 
@@ -50,12 +50,15 @@ async function runProductionPreflight({ endpoint, packageVersion, expectedIssuer
 
   const packageId = encodeURIComponent(PACKAGE_NAME);
   const version = String(packageVersion || "");
-  const [manifestResponse, issuerResponse, registryResponse, healthResponse, cardResponse] = await Promise.all([
+  const [manifestResponse, receiptResponse, issuerResponse, registryResponse, healthResponse, cardResponse, installResponse, openapiResponse] = await Promise.all([
     fetchJson(fetchImpl, `${origin}/.well-known/agent-id-release.json`),
+    fetchJson(fetchImpl, `${origin}/.well-known/agent-id-release-receipt.json`),
     fetchJson(fetchImpl, `${origin}/.well-known/agentx-issuer-key.json`),
     fetchJson(fetchImpl, `https://registry.npmjs.org/${packageId}/${encodeURIComponent(version)}`),
     fetchJson(fetchImpl, `${origin}/agent/health.json`),
     fetchJson(fetchImpl, `${origin}/.well-known/agent-card.json`),
+    fetchJson(fetchImpl, `${origin}/.well-known/xagent-install.json`),
+    fetchJson(fetchImpl, `${origin}/agent/openapi.json`),
   ]);
 
   const manifest = manifestResponse.body;
@@ -79,13 +82,32 @@ async function runProductionPreflight({ endpoint, packageVersion, expectedIssuer
     && registry.dist.integrity === manifest?.package?.integrity;
   const health = healthResponse.ok && healthResponse.body && healthResponse.body.ok !== false;
   const agentCard = cardResponse.ok && typeof cardResponse.body?.name === "string" && cardResponse.body.name.length > 0;
-  const apiReachable = [manifestResponse, issuerResponse, healthResponse, cardResponse]
+  const installManifest = installResponse.ok && installResponse.body?.schema === "xagent-install-manifest-v1";
+  const openapi = openapiResponse.ok && openapiResponse.body?.openapi === "3.1.0";
+  const productionReceipt = receiptResponse.ok && receiptResponse.body
+    ? verifyProductionReleaseReceipt({
+      receipt: receiptResponse.body,
+      issuerDescriptor: issuerResponse.body,
+      releaseManifest: manifest,
+      expectedOrigin: origin,
+      packageVersion: version,
+      expectedIssuerKeySha256,
+    })
+    : { ok: false, signature_verified: false, blockers: Array.isArray(receiptResponse.body?.blockers) ? receiptResponse.body.blockers : [] };
+  const artifactBindings = productionReceipt.ok
+    && receiptResponse.body?.artifacts?.agent_card?.sha256 === sha256(cardResponse.body)
+    && receiptResponse.body?.artifacts?.install_manifest?.sha256 === sha256(installResponse.body)
+    && receiptResponse.body?.artifacts?.openapi?.sha256 === sha256(openapiResponse.body);
+  const apiReachable = [manifestResponse, receiptResponse, issuerResponse, healthResponse, cardResponse, installResponse, openapiResponse]
     .some(response => Number(response.status) > 0);
   const checks = {
     stable_api_origin_format: true,
     api_https_reachable: apiReachable,
     stable_api_origin: apiReachable,
     release_manifest_http: manifestResponse.ok,
+    production_receipt_http: receiptResponse.ok,
+    production_receipt_signature: productionReceipt.signature_verified === true,
+    production_release_binding: productionReceipt.ok === true && artifactBindings,
     issuer_descriptor_http: issuerResponse.ok,
     release_signature: release.signature_verified === true,
     release_contract: release.ok === true,
@@ -93,15 +115,21 @@ async function runProductionPreflight({ endpoint, packageVersion, expectedIssuer
     registry_integrity: registryIntegrity,
     health_endpoint: health,
     agent_card: agentCard,
+    install_manifest: installManifest,
+    openapi,
   };
-  const blockers = [...release.blockers];
+  const blockers = [...release.blockers, ...productionReceipt.blockers];
   if (!apiReachable) blockers.push("stable_api_unreachable");
   if (apiReachable && !manifestResponse.ok) blockers.push("release_manifest_unavailable");
+  if (apiReachable && !receiptResponse.ok) blockers.push("production_release_receipt_unavailable");
   if (apiReachable && !issuerResponse.ok) blockers.push("issuer_descriptor_unavailable");
   if (!registryIdentity) blockers.push("npm_package_unpublished_or_version_mismatch");
   if (manifestResponse.ok && registryIdentity && !registryIntegrity) blockers.push("npm_integrity_mismatch");
   if (apiReachable && !health) blockers.push("health_endpoint_unavailable");
   if (apiReachable && !agentCard) blockers.push("agent_card_unavailable");
+  if (apiReachable && !installManifest) blockers.push("install_manifest_unavailable");
+  if (apiReachable && !openapi) blockers.push("openapi_unavailable");
+  if (productionReceipt.ok && !artifactBindings) blockers.push("production_artifact_hash_mismatch");
 
   return {
     ok: blockers.length === 0,
@@ -116,6 +144,9 @@ async function runProductionPreflight({ endpoint, packageVersion, expectedIssuer
       published_at: manifest?.published_at || "",
       integrity: manifest?.package?.integrity || "",
       signature_verified: release.signature_verified === true,
+      production_receipt_signature_verified: productionReceipt.signature_verified === true,
+      production_revision: receiptResponse.body?.deployment?.revision || "",
+      production_image_digest: receiptResponse.body?.deployment?.image_digest || "",
     },
   };
 }

package/release-verifier.js

@@ -3,6 +3,7 @@
 const crypto = require("node:crypto");
 
 const SCHEMA = "agentx-release-manifest-v1";
+const PRODUCTION_RECEIPT_SCHEMA = "agentx-production-release-receipt-v1";
 const PACKAGE_NAME = "@twin3-ai/agent-id";
 
 function stableValue(value) {
@@ -80,4 +81,48 @@ function verifyReleaseManifest({ manifest, issuerDescriptor, expectedOrigin, pac
   };
 }
 
-module.exports = { verifyReleaseManifest };
+function verifyProductionReleaseReceipt({ receipt, issuerDescriptor, releaseManifest, expectedOrigin, packageVersion, expectedIssuerKeySha256 }) {
+  const blockers = [];
+  const expected = normalizedOrigin(expectedOrigin);
+  if (!receipt || receipt.schema !== PRODUCTION_RECEIPT_SCHEMA) blockers.push("invalid_production_receipt_schema");
+  if (!receipt || receipt.ready !== true) blockers.push(...(Array.isArray(receipt?.blockers) ? receipt.blockers : ["production_receipt_not_ready"]));
+  if (!expected || normalizedOrigin(receipt?.api_origin) !== expected) blockers.push("production_receipt_origin_mismatch");
+  if (receipt?.package?.name !== PACKAGE_NAME || receipt?.package?.version !== String(packageVersion || "")) blockers.push("production_receipt_package_mismatch");
+  if (receipt?.package?.integrity !== releaseManifest?.package?.integrity) blockers.push("production_receipt_integrity_mismatch");
+  if (receipt?.source?.release_commit !== releaseManifest?.release_commit) blockers.push("production_receipt_commit_mismatch");
+  if (receipt?.source?.release_manifest_sha256 !== releaseManifest?.content_hash) blockers.push("production_receipt_manifest_hash_mismatch");
+  if (!/^sha256:[0-9a-f]{64}$/.test(String(receipt?.deployment?.image_digest || ""))) blockers.push("production_receipt_image_digest_missing");
+  if (!String(receipt?.deployment?.revision || "").startsWith(`${String(receipt?.deployment?.service || "")}-`)) blockers.push("production_receipt_revision_mismatch");
+  for (const name of ["agent_card", "install_manifest", "openapi"]) {
+    if (!/^sha256:[0-9a-f]{64}$/.test(String(receipt?.artifacts?.[name]?.sha256 || ""))) blockers.push(`production_receipt_${name}_hash_missing`);
+  }
+
+  const proof = receipt && typeof receipt.proof === "object" ? receipt.proof : {};
+  const unsigned = receipt && typeof receipt === "object"
+    ? Object.fromEntries(Object.entries(receipt).filter(([key]) => !["proof", "content_hash"].includes(key)))
+    : {};
+  if (receipt?.content_hash !== sha256(unsigned)) blockers.push("production_receipt_content_hash_mismatch");
+  if (proof.verification_method !== `${expected}/.well-known/agentx-issuer-key.json#ed25519-2026`) blockers.push("production_receipt_verification_method_mismatch");
+
+  let signatureVerified = false;
+  const publicKey = String(issuerDescriptor?.public_key_pem || "");
+  if (!publicKey) {
+    blockers.push("issuer_public_key_missing");
+  } else {
+    const issuerKeySha256 = `sha256:${crypto.createHash("sha256").update(publicKey).digest("hex")}`;
+    if (!expectedIssuerKeySha256 || issuerKeySha256 !== expectedIssuerKeySha256) blockers.push("issuer_key_pin_mismatch");
+    try {
+      signatureVerified = crypto.verify(null, Buffer.from(canonical(unsigned)), crypto.createPublicKey(publicKey), decodeProof(proof.proof_value));
+    } catch (_error) {
+      signatureVerified = false;
+    }
+    if (!signatureVerified) blockers.push("production_receipt_signature_invalid");
+  }
+  return {
+    ok: blockers.length === 0,
+    signature_verified: signatureVerified,
+    blockers: [...new Set(blockers)],
+  };
+}
+
+module.exports = { verifyReleaseManifest, verifyProductionReleaseReceipt, canonical, sha256 };

package/repository-connector.js

@@ -11,8 +11,22 @@ const AUTO_MANAGED_PATHS = new Set([
   ".well-known/aeo-agent.json",
   ".well-known/agent-knowledge.json"
 ]);
+// A missing sitemap may be created, but an existing customer sitemap is never
+// replaced by the generic connector. Replacing one could silently remove product,
+// locale, image, or news URLs that this service has not observed.
+const CREATE_ONLY_PATHS = new Set(["sitemap.xml"]);
+// A full robots.txt rewrite stays owner-gated: a bad directive can delist an entire
+// site. `buildRobotsAdditivePatch` below is the only supported automated path, and it
+// can append AI crawler directives without ever touching an existing line.
 const REVIEW_ONLY_PATHS = new Set(["robots.txt"]);
-const ALLOWED_PATHS = AUTO_MANAGED_PATHS;
+const ALLOWED_PATHS = new Set([...AUTO_MANAGED_PATHS, ...CREATE_ONLY_PATHS]);
+
+const AI_CRAWLER_BLOCK_MARKER = "# agent-id: AI crawler directives (additive, generated)";
+const KNOWN_AI_AGENTS = new Set([
+  "GPTBot", "OAI-SearchBot", "ChatGPT-User", "ClaudeBot", "Claude-Web",
+  "PerplexityBot", "Google-Extended", "Applebot-Extended", "CCBot",
+  "Bytespider", "meta-externalagent", "Amazonbot", "cohere-ai"
+]);
 const SECRET_PATTERNS = [
   /\bak_aeo_[A-Za-z0-9_-]{6,}\b/,
   /\bav_[A-Za-z0-9_-]{8,}\b/,
@@ -94,6 +108,9 @@ async function buildRepositoryPatch({ repositoryRoot = process.cwd(), changes =
     const absolute = await safeAbsolute(root, relative);
     const before = await readText(absolute);
     const after = change.content;
+    if (CREATE_ONLY_PATHS.has(relative) && before != null && before !== after) {
+      throw connectorError("CONNECTOR_CREATE_ONLY_PATH_EXISTS", `Existing customer file cannot be replaced automatically: ${relative}`);
+    }
     const beforeHash = before == null ? "" : hashText(before);
     const afterHash = hashText(after);
     normalized.push({
@@ -153,10 +170,27 @@ function deploymentChanges({ implementationBundle, knowledgePack } = {}) {
 }
 
 async function buildImplementationPatch({ repositoryRoot = process.cwd(), implementationBundle, knowledgePack } = {}) {
-  return buildRepositoryPatch({
-    repositoryRoot,
-    changes: deploymentChanges({ implementationBundle, knowledgePack })
-  });
+  const root = rootPath(repositoryRoot);
+  const changes = deploymentChanges({ implementationBundle, knowledgePack });
+  const safeChanges = [];
+  const skippedChanges = [];
+  for (const change of changes) {
+    if (CREATE_ONLY_PATHS.has(change.path)) {
+      const current = await readText(await safeAbsolute(root, change.path));
+      if (current != null && current !== change.content) {
+        skippedChanges.push({
+          path: change.path,
+          status: "requires_customer_review",
+          reason: "existing_customer_file_preserved",
+          current_sha256: hashText(current)
+        });
+        continue;
+      }
+    }
+    safeChanges.push(change);
+  }
+  const plan = await buildRepositoryPatch({ repositoryRoot: root, changes: safeChanges });
+  return { ...plan, skipped_changes: skippedChanges };
 }
 
 async function buildVerifiedArtifactPatch({ repositoryRoot = process.cwd(), artifactBundle, issuerPublicKey, expectedSubject, now } = {}) {
@@ -276,10 +310,94 @@ async function rollbackRepositoryPatch(receiptOrRoot, { approved = false } = {})
   return { schema: "agentx-repository-rollback-receipt-v1", connector: "repository_patch", plan_id: receipt.plan_id || "", artifact_bundle_hash: String(receipt.artifact_bundle_hash || ""), rolled_back: true, files: restored };
 }
 
+/**
+ * Append AI crawler directives to robots.txt without ever removing or rewriting an
+ * existing line.
+ *
+ * A full robots.txt rewrite remains review-only because a single bad `Disallow: /`
+ * can delist an entire site. This additive-only mode is narrow enough to automate:
+ * it appends a clearly marked block, refuses any removal, refuses a global disallow,
+ * and is idempotent so repeated runs converge on the same file.
+ */
+function buildRobotsAdditivePatch({ current = "", allowAgents = [], removeLines = [], disallowAll = false } = {}) {
+  if (Array.isArray(removeLines) && removeLines.length) {
+    throw connectorError("ROBOTS_REMOVAL_FORBIDDEN", "Additive robots mode cannot remove or rewrite existing directives.");
+  }
+  if (disallowAll === true) {
+    throw connectorError("ROBOTS_GLOBAL_DISALLOW_FORBIDDEN", "Additive robots mode refuses a global disallow directive.");
+  }
+  const before = typeof current === "string" ? current : "";
+  assertSafeContent(before);
+
+  const agents = [];
+  const seen = new Set();
+  for (const value of Array.isArray(allowAgents) ? allowAgents : [allowAgents]) {
+    const agent = String(value || "").trim();
+    if (!agent || seen.has(agent)) continue;
+    if (agent === "*") {
+      throw connectorError("ROBOTS_GLOBAL_DISALLOW_FORBIDDEN", "Additive robots mode refuses wildcard agent directives.");
+    }
+    if (!KNOWN_AI_AGENTS.has(agent)) {
+      throw connectorError("ROBOTS_AGENT_NOT_RECOGNIZED", `Agent is not a recognized AI crawler: ${agent}`);
+    }
+    seen.add(agent);
+    agents.push(agent);
+  }
+  if (!agents.length) throw connectorError("ROBOTS_AGENTS_REQUIRED", "At least one recognized AI crawler is required.");
+
+  const existingAgents = new Set(
+    (before.match(/^\s*User-agent:\s*(.+)$/gim) || []).map((line) => line.split(":").slice(1).join(":").trim())
+  );
+  const pending = agents.filter((agent) => !existingAgents.has(agent));
+
+  let after = before;
+  const appendedLines = [];
+  if (pending.length) {
+    const block = [before.endsWith("\n") || before === "" ? "" : "\n", "\n", `${AI_CRAWLER_BLOCK_MARKER}\n`];
+    for (const agent of pending) {
+      block.push(`User-agent: ${agent}\n`, "Allow: /\n");
+      appendedLines.push(`User-agent: ${agent}`, "Allow: /");
+    }
+    after = before + block.join("");
+    assertSafeContent(after);
+  }
+
+  const beforeLines = before.split("\n");
+  const afterLines = after.split("\n");
+  const removed = beforeLines.filter((line) => line.trim() && !afterLines.includes(line));
+  if (removed.length) {
+    throw connectorError("ROBOTS_REMOVAL_FORBIDDEN", "Additive robots mode must preserve every existing line.");
+  }
+
+  return {
+    schema: "agentx-robots-additive-patch-v1",
+    path: "robots.txt",
+    mode: "additive_only",
+    approval_required: true,
+    before,
+    after,
+    before_sha256: before === "" ? "" : hashText(before),
+    after_sha256: hashText(after),
+    appended_lines: appendedLines,
+    removed_lines: [],
+    agents: pending,
+    closes_checks: ["aeo_ai_crawler_policy", "seo_robots"],
+    non_claims: [
+      "never_removes_or_rewrites_existing_directives",
+      "never_emits_a_global_disallow",
+      "does_not_guarantee_ai_crawler_compliance"
+    ]
+  };
+}
+
 module.exports = {
   ALLOWED_PATHS,
   AUTO_MANAGED_PATHS,
+  CREATE_ONLY_PATHS,
   REVIEW_ONLY_PATHS,
+  AI_CRAWLER_BLOCK_MARKER,
+  KNOWN_AI_AGENTS,
+  buildRobotsAdditivePatch,
   buildRepositoryPatch,
   buildImplementationPatch,
   buildVerifiedArtifactPatch,

package/site-agent.js

@@ -330,6 +330,40 @@ function createSiteAgentClient(options = {}) {
     return data;
   }
 
+  async function permissionsRequest(method, payload = {}) {
+    const key = payload.agent_key || payload.agentKey || agentKey;
+    const target = payload.url || payload.website || payload.host || "";
+    if (!key) {
+      throw siteAgentError(
+        "SITE_AGENT_KEY_REQUIRED",
+        "A Site Agent Key is required to manage this website agent's permissions."
+      );
+    }
+    const body = { ...payload };
+    delete body.agent_key;
+    delete body.agentKey;
+    const suffix = method === "GET" ? `?url=${encodeURIComponent(target)}` : "";
+    const request = {
+      method,
+      headers: {
+        "authorization": `Bearer ${key}`,
+        ...(method === "POST" ? { "content-type": "application/json" } : {})
+      },
+      ...(method === "POST" ? { body: JSON.stringify(body) } : {})
+    };
+    const res = await fetchWithRetry(endpoint + "/api/site_agents/permissions" + suffix, request);
+    const data = await readJsonResponse(res);
+    if (!res.ok || data.ok === false) {
+      const error = siteAgentError(
+        data.error || "SITE_AGENT_PERMISSION_FAILED",
+        data.message || data.error || `Site Agent permission request failed with HTTP ${res.status}`
+      );
+      error.status = res.status;
+      throw error;
+    }
+    return data;
+  }
+
   return Object.freeze({
     endpoint,
     policy: SITE_AGENT_KEY_POLICY,
@@ -349,6 +383,12 @@ function createSiteAgentClient(options = {}) {
       delete body.agentKey;
       return publicPost("/api/site_agents/verify", body);
     },
+    permissions(payload = {}) {
+      return permissionsRequest("GET", payload);
+    },
+    updatePermissions(payload = {}) {
+      return permissionsRequest("POST", payload);
+    },
     insightsFeed(payload = {}) {
       return call("insights_feed", payload);
     },
@@ -362,7 +402,7 @@ function createSiteAgentClient(options = {}) {
           ts: payload.ts == null ? Math.floor(Date.now() / 1000) : payload.ts,
           data: {
             runtime: payload.runtime || "server_side_site_agent",
-            sdk_version: payload.sdk_version || payload.sdkVersion || "0.2.0"
+            sdk_version: payload.sdk_version || payload.sdkVersion || "0.3.0"
           }
         }]
       });
@@ -379,7 +419,7 @@ function createSiteAgentClient(options = {}) {
               ts: payload.ts == null ? Math.floor(Date.now() / 1000) : payload.ts,
               data: {
                 runtime: payload.runtime || "server_side_site_agent",
-                sdk_version: payload.sdk_version || payload.sdkVersion || "0.2.0"
+                sdk_version: payload.sdk_version || payload.sdkVersion || "0.3.0"
               }
             }]
           });
@@ -792,6 +832,15 @@ function createSiteAgentClient(options = {}) {
     monthlyDashboard(payload = {}) {
       return call("monthly_dashboard", payload);
     },
+    measurementSnapshot(payload = {}) {
+      return call("measurement_snapshot", payload);
+    },
+    measurementHistory(payload = {}) {
+      return call("measurement_history", payload);
+    },
+    measurementComparison(payload = {}) {
+      return call("measurement_comparison", payload);
+    },
     async monthlyEvidenceLoop(payload = {}) {
       const contentPackRes = await call("content_pack", payload);
       const reviewRes = await publicPost("/api/agent/content_workflow_review", {
@@ -1006,5 +1055,8 @@ function createSiteAgentClient(options = {}) {
 module.exports = {
   SITE_AGENT_KEY_POLICY,
   createSiteAgentClient,
-  createTelemetryCollector: (options) => require("./telemetry-collector.js").createTelemetryCollector(options)
+  createTelemetryCollector: (options) => require("./telemetry-collector.js").createTelemetryCollector(options),
+  createCloudflareA1Sync: (options) => require("./cloudflare-a1-sync.js").createCloudflareA1Sync(options),
+  createGa4B1Sync: (options) => require("./b1-sync.js").createGa4B1Sync(options),
+  createOrderB1Sync: (options) => require("./b1-sync.js").createOrderB1Sync(options)
 };

package/sync-service.js

@@ -125,7 +125,7 @@ function createSiteAgentSyncService(options = {}) {
   const intervalMs = Math.max(1000, Number(options.intervalMs || process.env.AGENT_ID_SYNC_INTERVAL_MS || 900000));
   const heartbeatIntervalMs = Math.max(300000, Number(options.heartbeatIntervalMs || process.env.AGENT_ID_HEARTBEAT_INTERVAL_MS || options.intervalMs || 900000));
   const collector = options.collector || null;
-  const runtimeVersion = String(options.runtimeVersion || process.env.AGENT_ID_RUNTIME_VERSION || "0.2.0");
+  const runtimeVersion = String(options.runtimeVersion || process.env.AGENT_ID_RUNTIME_VERSION || "0.3.0");
   const capabilities = Array.from(new Set((Array.isArray(options.capabilities) ? options.capabilities : ["heartbeat", "insights_feed"]).map((item) => String(item).trim()).filter(Boolean))).sort();
   const now = options.now || Date.now;
   const sleep = options.sleep || ((ms, signal) => new Promise((resolve) => {