@wlfi-agent/cli 1.4.13 → 1.4.15

package/packages/cache/dist/service/index.js

@@ -0,0 +1,15 @@
+import {
+  RelayCacheService,
+  createRelayCacheService,
+  relayApprovalStatuses,
+  relayUpdateStatuses
+} from "../chunk-FGJEEF5N.js";
+import "../chunk-VXVMPG3W.js";
+import "../chunk-4U63TZTQ.js";
+export {
+  RelayCacheService,
+  createRelayCacheService,
+  relayApprovalStatuses,
+  relayUpdateStatuses
+};
+//# sourceMappingURL=index.js.map

package/packages/cache/dist/service/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/packages/cache/node_modules/.bin/jiti

@@ -0,0 +1,17 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*) basedir=`cygpath -w "$basedir"`;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/jiti@1.21.7/node_modules/jiti/bin/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/jiti@1.21.7/node_modules/jiti/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/jiti@1.21.7/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/jiti@1.21.7/node_modules/jiti/bin/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/jiti@1.21.7/node_modules/jiti/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/jiti@1.21.7/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../../../../node_modules/.pnpm/jiti@1.21.7/node_modules/jiti/bin/jiti.js" "$@"
+else
+  exec node  "$basedir/../../../../node_modules/.pnpm/jiti@1.21.7/node_modules/jiti/bin/jiti.js" "$@"
+fi

package/packages/cache/node_modules/.bin/tsc

@@ -0,0 +1,17 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*) basedir=`cygpath -w "$basedir"`;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/bin/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/bin/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/bin/tsc" "$@"
+else
+  exec node  "$basedir/../../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/bin/tsc" "$@"
+fi

package/packages/cache/node_modules/.bin/tsserver

@@ -0,0 +1,17 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*) basedir=`cygpath -w "$basedir"`;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/bin/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/bin/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/typescript@5.9.3/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/bin/tsserver" "$@"
+else
+  exec node  "$basedir/../../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/bin/tsserver" "$@"
+fi

package/packages/cache/node_modules/.bin/tsup

@@ -0,0 +1,17 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*) basedir=`cygpath -w "$basedir"`;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/dist/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/dist/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../../../../node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/dist/cli-default.js" "$@"
+else
+  exec node  "$basedir/../../../../node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/dist/cli-default.js" "$@"
+fi

package/packages/cache/node_modules/.bin/tsup-node

@@ -0,0 +1,17 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*) basedir=`cygpath -w "$basedir"`;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/dist/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/dist/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../../../../node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/dist/cli-node.js" "$@"
+else
+  exec node  "$basedir/../../../../node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/dist/cli-node.js" "$@"
+fi

package/packages/cache/node_modules/.bin/tsx

@@ -0,0 +1,17 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*) basedir=`cygpath -w "$basedir"`;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsx@4.21.0/node_modules/tsx/dist/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsx@4.21.0/node_modules/tsx/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsx@4.21.0/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsx@4.21.0/node_modules/tsx/dist/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsx@4.21.0/node_modules/tsx/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/tsx@4.21.0/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../../../../node_modules/.pnpm/tsx@4.21.0/node_modules/tsx/dist/cli.mjs" "$@"
+else
+  exec node  "$basedir/../../../../node_modules/.pnpm/tsx@4.21.0/node_modules/tsx/dist/cli.mjs" "$@"
+fi

package/packages/cache/node_modules/.bin/vitest

@@ -0,0 +1,17 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*) basedir=`cygpath -w "$basedir"`;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/vitest@3.2.4_@types+node@24.12.0_jiti@1.21.7_tsx@4.21.0/node_modules/vitest/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/vitest@3.2.4_@types+node@24.12.0_jiti@1.21.7_tsx@4.21.0/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/vitest@3.2.4_@types+node@24.12.0_jiti@1.21.7_tsx@4.21.0/node_modules/vitest/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/vitest@3.2.4_@types+node@24.12.0_jiti@1.21.7_tsx@4.21.0/node_modules:/Users/hanzhi/Documents/WLFI/wlfi-agent-sdk/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../../../../node_modules/.pnpm/vitest@3.2.4_@types+node@24.12.0_jiti@1.21.7_tsx@4.21.0/node_modules/vitest/vitest.mjs" "$@"
+else
+  exec node  "$basedir/../../../../node_modules/.pnpm/vitest@3.2.4_@types+node@24.12.0_jiti@1.21.7_tsx@4.21.0/node_modules/vitest/vitest.mjs" "$@"
+fi

package/packages/cache/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@wlfi-agent/cache",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./client": {
+      "types": "./src/client/index.ts",
+      "import": "./dist/client/index.js",
+      "require": "./dist/client/index.cjs"
+    },
+    "./errors": {
+      "types": "./src/errors/index.ts",
+      "import": "./dist/errors/index.js",
+      "require": "./dist/errors/index.cjs"
+    },
+    "./service": {
+      "types": "./src/service/index.ts",
+      "import": "./dist/service/index.js",
+      "require": "./dist/service/index.cjs"
+    }
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf .turbo node_modules dist coverage junit",
+    "dev": "tsup --watch",
+    "lint": "biome check .",
+    "lint:fix": "biome check --write .",
+    "test:unit": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "check": "pnpm run typecheck"
+  },
+  "types": "./src/index.ts",
+  "dependencies": {
+    "ioredis": "^5.7.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.0",
+    "vitest": "^3.2.4"
+  }
+}

package/packages/cache/src/client/index.ts

@@ -0,0 +1,56 @@
+/** biome-ignore-all lint/style/noProcessEnv: relay cache config is environment driven */
+import Redis from 'ioredis';
+
+export interface CacheClientOptions {
+  connectTimeoutMs?: number;
+  enableOfflineQueue?: boolean;
+  keyPrefix?: string;
+  lazyConnect?: boolean;
+  maxRetriesPerRequest?: number | null;
+  url?: string;
+}
+
+let singletonClient: Redis | null = null;
+
+const getDefaultCacheUrl = (): string => {
+  const explicitUrl = process.env.CACHE_URL?.trim();
+  if (explicitUrl) {
+    return explicitUrl;
+  }
+
+  const host = process.env.CACHE_HOST?.trim() || '127.0.0.1';
+  const port = Number(process.env.CACHE_PORT?.trim() || '6379');
+
+  return `redis://${host}:${port}`;
+};
+
+export const createCacheClient = (options: CacheClientOptions = {}): Redis => {
+  return new Redis(options.url ?? getDefaultCacheUrl(), {
+    connectTimeout: options.connectTimeoutMs ?? 5_000,
+    enableOfflineQueue: options.enableOfflineQueue ?? true,
+    keyPrefix: options.keyPrefix,
+    lazyConnect: options.lazyConnect ?? false,
+    maxRetriesPerRequest: options.maxRetriesPerRequest ?? 2,
+    reconnectOnError(error) {
+      return error.message.includes('READONLY') || error.message.includes('ETIMEDOUT');
+    },
+  });
+};
+
+export const getCacheClient = (options: CacheClientOptions = {}): Redis => {
+  if (!singletonClient) {
+    singletonClient = createCacheClient(options);
+  }
+
+  return singletonClient;
+};
+
+export const closeCacheClient = async (): Promise<void> => {
+  if (!singletonClient) {
+    return;
+  }
+
+  const client = singletonClient;
+  singletonClient = null;
+  await client.quit();
+};

package/packages/cache/src/errors/index.ts

@@ -0,0 +1,53 @@
+export const cacheErrorCodes = {
+  connectionFailed: 'CACHE_CONNECTION_FAILED',
+  invalidPayload: 'CACHE_INVALID_PAYLOAD',
+  notFound: 'CACHE_NOT_FOUND',
+  unknown: 'CACHE_UNKNOWN',
+} as const;
+
+export type CacheErrorCode = (typeof cacheErrorCodes)[keyof typeof cacheErrorCodes];
+
+export class CacheError extends Error {
+  readonly code: CacheErrorCode;
+  readonly key?: string;
+  readonly operation?: string;
+  override readonly cause?: unknown;
+
+  constructor(options: {
+    cause?: unknown;
+    code: CacheErrorCode;
+    key?: string;
+    message: string;
+    operation?: string;
+  }) {
+    super(options.message);
+    this.name = 'CacheError';
+    this.code = options.code;
+    this.key = options.key;
+    this.operation = options.operation;
+    this.cause = options.cause;
+  }
+}
+
+export const toCacheError = (
+  error: unknown,
+  context: { key?: string; operation?: string } = {},
+): CacheError => {
+  if (error instanceof CacheError) {
+    return error;
+  }
+
+  const message = error instanceof Error ? error.message : 'Unknown cache error';
+  const normalizedMessage = message.toLowerCase();
+  const code = normalizedMessage.includes('connect')
+    ? cacheErrorCodes.connectionFailed
+    : cacheErrorCodes.unknown;
+
+  return new CacheError({
+    cause: error,
+    code,
+    key: context.key,
+    message,
+    operation: context.operation,
+  });
+};

package/packages/cache/src/index.ts

@@ -0,0 +1,3 @@
+export * from './client/index.js';
+export * from './errors/index.js';
+export * from './service/index.js';

package/packages/cache/src/service/index.test.ts

@@ -0,0 +1,263 @@
+import { createHash } from 'node:crypto';
+import { describe, expect, it } from 'vitest';
+import { RelayCacheService } from './index.js';
+
+class InMemoryCacheClient {
+  private readonly store = new Map<string, string>();
+  private readonly sets = new Map<string, Set<string>>();
+  private readonly zsets = new Map<string, Array<{ member: string; score: number }>>();
+
+  async del(key: string): Promise<number> {
+    const existed = this.store.delete(key);
+    this.sets.delete(key);
+    this.zsets.delete(key);
+    return existed ? 1 : 0;
+  }
+
+  async get(key: string): Promise<string | null> {
+    return this.store.get(key) ?? null;
+  }
+
+  async ping(): Promise<string> {
+    return 'PONG';
+  }
+
+  async quit(): Promise<string> {
+    return 'OK';
+  }
+
+  async sadd(key: string, ...members: string[]): Promise<number> {
+    const bucket = this.sets.get(key) ?? new Set<string>();
+    let added = 0;
+    for (const member of members) {
+      if (!bucket.has(member)) {
+        bucket.add(member);
+        added += 1;
+      }
+    }
+    this.sets.set(key, bucket);
+    return added;
+  }
+
+  async set(key: string, value: string, mode?: 'NX' | 'XX'): Promise<'OK' | null> {
+    if (mode === 'NX' && this.store.has(key)) {
+      return null;
+    }
+    if (mode === 'XX' && !this.store.has(key)) {
+      return null;
+    }
+    this.store.set(key, value);
+    return 'OK';
+  }
+
+  async smembers(key: string): Promise<string[]> {
+    return [...(this.sets.get(key) ?? new Set<string>())];
+  }
+
+  async zadd(key: string, ...args: (string | number)[]): Promise<number> {
+    const bucket = this.zsets.get(key) ?? [];
+    for (let index = 0; index < args.length; index += 2) {
+      bucket.push({ score: Number(args[index]), member: String(args[index + 1]) });
+    }
+    this.zsets.set(key, bucket);
+    return args.length / 2;
+  }
+
+  async zrange(key: string, start: number, stop: number, ...args: string[]): Promise<string[]> {
+    const bucket = [...(this.zsets.get(key) ?? [])].sort((left, right) => left.score - right.score);
+    const ordered = args.includes('REV') ? bucket.reverse() : bucket;
+    const normalizedStop = stop < 0 ? ordered.length + stop : stop;
+    return ordered.slice(start, normalizedStop + 1).map((entry) => entry.member);
+  }
+
+  async zrem(key: string, ...members: string[]): Promise<number> {
+    const bucket = this.zsets.get(key) ?? [];
+    const filtered = bucket.filter((entry) => !members.includes(entry.member));
+    this.zsets.set(key, filtered);
+    return bucket.length - filtered.length;
+  }
+}
+
+describe('RelayCacheService approval capability guards', () => {
+  it('consumes an approval capability only once', async () => {
+    const service = new RelayCacheService({
+      client: new InMemoryCacheClient() as never,
+      namespace: 'test:relay',
+    });
+
+    await expect(service.consumeApprovalCapability('approval-1', 'hash-1')).resolves.toBe(true);
+    await expect(service.consumeApprovalCapability('approval-1', 'hash-1')).resolves.toBe(false);
+  });
+
+  it('rate limits repeated invalid approval capability attempts', async () => {
+    const service = new RelayCacheService({
+      client: new InMemoryCacheClient() as never,
+      namespace: 'test:relay',
+    });
+
+    for (let attempt = 1; attempt < 5; attempt += 1) {
+      await expect(service.recordApprovalCapabilityFailure('approval-2')).resolves.toMatchObject({
+        attempts: attempt,
+        blocked: false,
+        blockedUntil: null,
+      });
+    }
+
+    await expect(service.recordApprovalCapabilityFailure('approval-2')).resolves.toMatchObject({
+      attempts: 5,
+      blocked: true,
+    });
+  });
+
+  it('rotates approval capabilities for pending approvals and clears prior failure state', async () => {
+    const service = new RelayCacheService({
+      client: new InMemoryCacheClient() as never,
+      namespace: 'test:relay',
+    });
+
+    const daemonId = '11'.repeat(32);
+    const originalToken = 'aa'.repeat(32);
+    const originalHash = createHash('sha256').update(originalToken).digest('hex');
+
+    await service.syncDaemonRegistration({
+      daemon: {
+        daemonId,
+        daemonPublicKey: '22'.repeat(32),
+        ethereumAddress: '0x3333333333333333333333333333333333333333',
+        lastSeenAt: new Date().toISOString(),
+        registeredAt: new Date().toISOString(),
+        status: 'active',
+        updatedAt: new Date().toISOString(),
+      },
+      approvalRequests: [
+        {
+          approvalRequestId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+          daemonId,
+          destination: '0x4444444444444444444444444444444444444444',
+          metadata: {
+            approvalCapabilityHash: originalHash,
+            approvalCapabilityToken: originalToken,
+            source: 'daemon',
+          },
+          requestedAt: new Date().toISOString(),
+          status: 'pending',
+          transactionType: 'transfer_native',
+          updatedAt: new Date().toISOString(),
+        },
+      ],
+    });
+
+    for (let attempt = 1; attempt <= 2; attempt += 1) {
+      await expect(
+        service.recordApprovalCapabilityFailure('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'),
+      ).resolves.toMatchObject({
+        attempts: attempt,
+        blocked: false,
+      });
+    }
+
+    const rotated = await service.rotateApprovalCapability('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+
+    expect(rotated.metadata?.source).toBe('daemon');
+    expect(rotated.metadata?.approvalCapabilityToken).toMatch(/^[a-f0-9]{64}$/u);
+    expect(rotated.metadata?.approvalCapabilityToken).not.toBe(originalToken);
+    expect(rotated.metadata?.approvalCapabilityHash).toMatch(/^[a-f0-9]{64}$/u);
+    expect(rotated.metadata?.approvalCapabilityHash).not.toBe(originalHash);
+    expect(rotated.metadata?.approvalCapabilityHash).toBe(
+      createHash('sha256')
+        .update(rotated.metadata?.approvalCapabilityToken ?? '')
+        .digest('hex'),
+    );
+
+    await expect(
+      service.recordApprovalCapabilityFailure('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'),
+    ).resolves.toMatchObject({
+      attempts: 1,
+      blocked: false,
+      blockedUntil: null,
+    });
+  });
+
+  it('issues a secure approval capability for pending approvals that were synced without one', async () => {
+    const service = new RelayCacheService({
+      client: new InMemoryCacheClient() as never,
+      namespace: 'test:relay',
+    });
+
+    const daemonId = '55'.repeat(32);
+
+    await service.syncDaemonRegistration({
+      daemon: {
+        daemonId,
+        daemonPublicKey: '66'.repeat(32),
+        ethereumAddress: '0x7777777777777777777777777777777777777777',
+        lastSeenAt: new Date().toISOString(),
+        registeredAt: new Date().toISOString(),
+        status: 'active',
+        updatedAt: new Date().toISOString(),
+      },
+      approvalRequests: [
+        {
+          approvalRequestId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+          daemonId,
+          destination: '0x8888888888888888888888888888888888888888',
+          metadata: {
+            source: 'legacy-daemon',
+          },
+          requestedAt: new Date().toISOString(),
+          status: 'pending',
+          transactionType: 'transfer_native',
+          updatedAt: new Date().toISOString(),
+        },
+      ],
+    });
+
+    const rotated = await service.rotateApprovalCapability('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
+
+    expect(rotated.metadata).toMatchObject({
+      source: 'legacy-daemon',
+    });
+    expect(rotated.metadata?.approvalCapabilityToken).toMatch(/^[a-f0-9]{64}$/u);
+    expect(rotated.metadata?.approvalCapabilityHash).toBe(
+      createHash('sha256')
+        .update(rotated.metadata?.approvalCapabilityToken ?? '')
+        .digest('hex'),
+    );
+  });
+
+  it('rejects secure approval capability rotation for non-pending approvals', async () => {
+    const service = new RelayCacheService({
+      client: new InMemoryCacheClient() as never,
+      namespace: 'test:relay',
+    });
+
+    const daemonId = '99'.repeat(32);
+
+    await service.syncDaemonRegistration({
+      daemon: {
+        daemonId,
+        daemonPublicKey: 'aa'.repeat(32),
+        ethereumAddress: '0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+        lastSeenAt: new Date().toISOString(),
+        registeredAt: new Date().toISOString(),
+        status: 'active',
+        updatedAt: new Date().toISOString(),
+      },
+      approvalRequests: [
+        {
+          approvalRequestId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc',
+          daemonId,
+          destination: '0xdddddddddddddddddddddddddddddddddddddddd',
+          requestedAt: new Date().toISOString(),
+          status: 'completed',
+          transactionType: 'transfer_native',
+          updatedAt: new Date().toISOString(),
+        },
+      ],
+    });
+
+    await expect(
+      service.rotateApprovalCapability('cccccccc-cccc-4ccc-8ccc-cccccccccccc'),
+    ).rejects.toThrow(/cannot accept a new secure approval link/);
+  });
+});