sealbridge 0.2.2 → 0.3.0

package/dist/packages/core/dist/receipts.d.ts

@@ -5,5 +5,6 @@ export declare function signUsage(payload: Usage, key: KeyPair): import("./types
 export declare function signAck(payload: Ack, key: KeyPair): import("./types.js").Signed<Ack>;
 export declare function signEnvelope(payload: Omit<Envelope, 'type' | 'envelopeId' | 'senderDid'>, key: KeyPair, options?: {
     encrypt?: boolean;
+    signedAt?: string;
 }): SignedEnvelope;
 export declare function verifyEnvelope(envelope: SignedEnvelope, recipientDid?: string): boolean;

package/dist/packages/core/dist/receipts.js

@@ -52,7 +52,7 @@ export function signEnvelope(payload, key, options) {
             senderDid: envelope.senderDid,
             recipientDid: envelope.recipientDid,
         });
-    return signPayload(envelope, key);
+    return signPayload(envelope, key, options?.signedAt);
 }
 export function verifyEnvelope(envelope, recipientDid) {
     try {

package/dist/packages/core/dist/receipts.js.map

@@ -1 +1 @@
-{"version":3,"file":"receipts.js","sourceRoot":"","sources":["../src/receipts.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAW7C,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,IAAU,EACV,MAAe,EACf,GAAY,EACZ,WAAiC,UAAU;IAE3C,OAAO,WAAW,CAChB;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,UAAU,EAAE;QACvB,MAAM;QACN,IAAI;QACJ,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5B,QAAQ;QACR,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,cAAc,CAC5B,OAAwB,EACxB,QAAgB,EAChB,MAAc,EACd,IAAU,EACV,MAAe;IAEf,IAAI,CAAC;QACH,cAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1B,OAAO,CACL,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC/B,CAAC,CAAC,MAAM,KAAK,MAAM;YACnB,CAAC,CAAC,IAAI,KAAK,IAAI;YACf,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAC1B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,MAAM,UAAU,SAAS,CAAC,OAAc,EAAE,GAAY;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpC,cAAc,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,UAAU,OAAO,CAAC,OAAY,EAAE,GAAY;IAChD,IAAI,OAAO,CAAC,WAAW,KAAK,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACrE,OAAO,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AACD,MAAM,UAAU,YAAY,CAC1B,OAA4D,EAC5D,GAAY,EACZ,OAA+B;IAE/B,MAAM,QAAQ,GAAa;QACzB,GAAG,OAAO;QACV,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,UAAU,EAAE;QACxB,SAAS,EAAE,GAAG,CAAC,GAAG;KACnB,CAAC;IACF,IAAI,OAAO,EAAE,OAAO;QAClB,QAAQ,CAAC,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,OAAO,EAAE;YAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;IACL,OAAO,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,QAAwB,EAAE,YAAqB;IAC5E,IAAI,CAAC;QACH,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,CACL,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YAClD,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,KAAK,YAAY,CAAC,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"receipts.js","sourceRoot":"","sources":["../src/receipts.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAW7C,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,IAAU,EACV,MAAe,EACf,GAAY,EACZ,WAAiC,UAAU;IAE3C,OAAO,WAAW,CAChB;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,UAAU,EAAE;QACvB,MAAM;QACN,IAAI;QACJ,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5B,QAAQ;QACR,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,cAAc,CAC5B,OAAwB,EACxB,QAAgB,EAChB,MAAc,EACd,IAAU,EACV,MAAe;IAEf,IAAI,CAAC;QACH,cAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1B,OAAO,CACL,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC/B,CAAC,CAAC,MAAM,KAAK,MAAM;YACnB,CAAC,CAAC,IAAI,KAAK,IAAI;YACf,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAC1B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,MAAM,UAAU,SAAS,CAAC,OAAc,EAAE,GAAY;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpC,cAAc,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,UAAU,OAAO,CAAC,OAAY,EAAE,GAAY;IAChD,IAAI,OAAO,CAAC,WAAW,KAAK,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACrE,OAAO,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AACD,MAAM,UAAU,YAAY,CAC1B,OAA4D,EAC5D,GAAY,EACZ,OAAkD;IAElD,MAAM,QAAQ,GAAa;QACzB,GAAG,OAAO;QACV,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,UAAU,EAAE;QACxB,SAAS,EAAE,GAAG,CAAC,GAAG;KACnB,CAAC;IACF,IAAI,OAAO,EAAE,OAAO;QAClB,QAAQ,CAAC,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,OAAO,EAAE;YAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;IACL,OAAO,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AACvD,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,QAAwB,EAAE,YAAqB;IAC5E,IAAI,CAAC;QACH,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,CACL,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YAClD,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,KAAK,YAAY,CAAC,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/packages/core/dist/schema.d.ts

@@ -2,6 +2,7 @@ import { Ajv2020 } from 'ajv/dist/2020.js';
 import type { TaskManifest, Schema } from './types.js';
 export declare function createAjv(): Ajv2020;
 export declare const specDirectory: URL;
+export declare const SCHEMA_NAMES: readonly ["task-manifest", "task-manifest.0.1.0", "task-manifest.0.2.0", "agent-card", "delivery-status", "envelope", "usage-receipt", "ack-receipt", "capability-token", "approval-receipt", "audit-entry"];
 export declare function loadSchema(name: string): Schema;
 /** Spec files are static. Rebuilding Ajv for every envelope check dominates a session. */
 export declare function schemaRegistry(): Ajv2020;

package/dist/packages/core/dist/schema.js

@@ -2,14 +2,19 @@
 import { readFileSync, readdirSync } from 'node:fs';
 import { Ajv2020 } from 'ajv/dist/2020.js';
 import formats from 'ajv-formats';
+import { isManifestProtocolVersion } from './protocol.js';
 export function createAjv() {
     const ajv = new Ajv2020({ allErrors: true, strict: false, validateFormats: true });
     formats(ajv);
     return ajv;
 }
 export const specDirectory = new URL('../../../spec/', import.meta.url);
+export const SCHEMA_NAMES = [
+    'task-manifest', 'task-manifest.0.1.0', 'task-manifest.0.2.0', 'agent-card',
+    'delivery-status', 'envelope', 'usage-receipt', 'ack-receipt', 'capability-token', 'approval-receipt', 'audit-entry',
+];
 export function loadSchema(name) {
-    if (!/^[a-z-]+$/.test(name))
+    if (!SCHEMA_NAMES.some(known => known === name))
         throw new Error('INVALID_SCHEMA_NAME');
     return JSON.parse(readFileSync(new URL(name + '.schema.json', specDirectory), 'utf8'));
 }
@@ -25,13 +30,19 @@ export function schemaRegistry() {
     return ajv;
 }
 export function validateSchema(name, value) {
+    if (!SCHEMA_NAMES.some(known => known === name))
+        throw new Error('INVALID_SCHEMA_NAME');
     const ajv = schemaRegistry();
     const validate = ajv.getSchema(name);
     if (!validate(value))
         throw new Error('SCHEMA_VIOLATION: ' + ajv.errorsText(validate.errors));
 }
 export function validateManifest(value) {
-    validateSchema('task-manifest', value);
+    const version = value && typeof value === 'object' && !Array.isArray(value)
+        ? value.protocolVersion : undefined;
+    if (version !== undefined && !isManifestProtocolVersion(version))
+        throw new Error('PROTOCOL_VERSION_UNSUPPORTED');
+    validateSchema(isManifestProtocolVersion(version) ? 'task-manifest.' + version : 'task-manifest', value);
 }
 export function assertSynchronousSchema(schema) {
     if (!schema || typeof schema !== 'object')

package/dist/packages/core/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,OAAO,MAAM,aAAa,CAAC;AAElC,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,OAA2C,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxE,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,cAAc,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAW,CAAC;AACnG,CAAC;AACD,IAAI,cAAwD,CAAC;AAC7D,0FAA0F;AAC1F,MAAM,UAAU,cAAc;IAC5B,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAClF,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,cAAc,GAAG,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAc;IACzD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAE,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAChG,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,cAAc,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,MAAe;IACrD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO;IAClD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,KAAc;IAC3D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACrD,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,OAAO,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,OAA2C,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,YAAY;IAC3E,iBAAiB,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,aAAa;CAC5G,CAAC;AACX,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,cAAc,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAW,CAAC;AACnG,CAAC;AACD,IAAI,cAAwD,CAAC;AAC7D,0FAA0F;AAC1F,MAAM,UAAU,cAAc;IAC5B,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAClF,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,cAAc,GAAG,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAc;IACzD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAE,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAChG,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,OAAO,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAuC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,cAAc,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AAC3G,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,MAAe;IACrD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO;IAClD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,KAAc;IAC3D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACrD,CAAC"}

package/dist/packages/ledger/dist/index.d.ts

@@ -1,4 +1,4 @@
-import type { Json, Signature, AckReceipt, KeyPair, Signed } from '@acp/core';
+import type { Json, Signature, AckReceipt, KeyPair, Signed } from '../../core/dist/index.js';
 export interface AuditBody {
     taskId: string;
     seq: number;

package/dist/packages/relay/dist/admission.d.ts

@@ -0,0 +1,14 @@
+/** Status-only send failures; response text is never included in diagnostics. */
+export declare class RelayAdmissionError extends Error {
+    readonly status: number;
+    readonly retryAfterMs?: number | undefined;
+    readonly code = "RELAY_RETRY_LATER";
+    constructor(status: number, retryAfterMs?: number | undefined);
+}
+export declare class RelayDuplicateEnvelopeError extends Error {
+    readonly status: number;
+    readonly code = "REPLAYED_ENVELOPE";
+    constructor(status?: number);
+}
+/** Decode at most 1 KiB and only the two documented admission responses. */
+export declare function decodeAdmissionError(response: Response): Promise<Error>;

package/dist/packages/relay/dist/admission.js

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: Apache-2.0
+/** Status-only send failures; response text is never included in diagnostics. */
+export class RelayAdmissionError extends Error {
+    status;
+    retryAfterMs;
+    code = 'RELAY_RETRY_LATER';
+    constructor(status, retryAfterMs) {
+        super('RELAY_REJECTED: ' + status);
+        this.status = status;
+        this.retryAfterMs = retryAfterMs;
+        this.name = 'RelayAdmissionError';
+    }
+}
+export class RelayDuplicateEnvelopeError extends Error {
+    status;
+    code = 'REPLAYED_ENVELOPE';
+    constructor(status = 400) {
+        super('RELAY_REJECTED: ' + status);
+        this.status = status;
+        this.name = 'RelayDuplicateEnvelopeError';
+    }
+}
+/** Decode at most 1 KiB and only the two documented admission responses. */
+export async function decodeAdmissionError(response) {
+    let value;
+    const reader = response.body?.getReader();
+    if (reader) {
+        try {
+            const chunks = [];
+            let size = 0;
+            for (;;) {
+                const part = await reader.read();
+                if (part.done)
+                    break;
+                size += part.value.byteLength;
+                if (size > 1024)
+                    break;
+                chunks.push(part.value);
+            }
+            if (size <= 1024) {
+                const bytes = new Uint8Array(size);
+                let offset = 0;
+                for (const chunk of chunks) {
+                    bytes.set(chunk, offset);
+                    offset += chunk.length;
+                }
+                const parsed = JSON.parse(new TextDecoder().decode(bytes));
+                if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                    value = parsed;
+            }
+        }
+        catch { /* Malformed responses retain status-only behavior. */ }
+        finally {
+            await reader.cancel().catch(() => { });
+            reader.releaseLock();
+        }
+    }
+    if (response.status === 400 && value?.error === 'REPLAYED_ENVELOPE' &&
+        Object.keys(value).join(',') === 'error')
+        return new RelayDuplicateEnvelopeError();
+    if (response.status === 429) {
+        const hint = value?.error === 'RELAY_RETRY_LATER' && value.retryable === true &&
+            Object.keys(value).sort().join(',') === 'error,retryAfterMs,retryable' &&
+            Number.isSafeInteger(value.retryAfterMs) && Number(value.retryAfterMs) > 0 && Number(value.retryAfterMs) <= 3_600_000
+            ? Number(value.retryAfterMs) : undefined;
+        return new RelayAdmissionError(429, hint);
+    }
+    return new Error('RELAY_REJECTED: ' + response.status);
+}
+//# sourceMappingURL=admission.js.map

package/dist/packages/relay/dist/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iFAAiF;AACjF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEvB;IAAyB;IADrC,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAAqB,MAAc,EAAW,YAAqB;QACjE,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAAC;QADhB,WAAM,GAAN,MAAM,CAAQ;QAAW,iBAAY,GAAZ,YAAY,CAAS;QAEjE,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AACD,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAE/B;IADZ,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAAqB,SAAS,GAAG;QAAI,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAAC;QAAnD,WAAM,GAAN,MAAM,CAAM;QAAwC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAAC,CAAC;CACtH;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAkB;IAC3D,IAAI,KAA0C,CAAC;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,GAAiB,EAAE,CAAC;YAChC,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACrB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC9B,IAAI,IAAI,GAAG,IAAI;oBAAE,MAAM;gBACvB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;YACD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,MAAM,GAAG,CAAC,CAAC;gBACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAC,CAAC;gBACjF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,KAAK,GAAG,MAAiC,CAAC;YAChH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;gBAC1D,CAAC;YAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,KAAK,KAAK,mBAAmB;QAC/D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,2BAA2B,EAAE,CAAC;IACvF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,EAAE,KAAK,KAAK,mBAAmB,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;YAC3E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,8BAA8B;YACtE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,SAAS;YACrH,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3C,OAAO,IAAI,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC"}

package/dist/packages/relay/dist/fetch.d.ts

@@ -1,4 +1,4 @@
-import type { SignedEnvelope, SignedAgentCard, RelayAuthAction, KeyPair } from '@acp/core/edge';
+import type { SignedEnvelope, SignedAgentCard, RelayAuthAction, KeyPair } from '../../core/dist/edge.js';
 import type { RelayWakeOptions, RelayWakeAttempt, RelayOperation, SignedRelayDeliveryStatus } from './notifications.js';
 export * from './notifications.js';
 export declare function verifyRelayEnvelope(e: SignedEnvelope, recipient?: string): boolean;
@@ -203,7 +203,7 @@ export declare function relayHttpHeaders(kind?: 'json' | 'empty' | 'sse'): Recor
  * Names that the live relay does not throw today stay listed so a later
  * constant code is not replaced by RELAY_INTERNAL_ERROR.
  */
-export declare const KNOWN_RELAY_ERROR_CODES: readonly ["INVALID_ENVELOPE", "INVALID_SIGNED_ENVELOPE", "ENVELOPE_EXPIRED", "REPLAYED_ENVELOPE", "DUPLICATE_ENVELOPE_ID", "ENVELOPE_TOO_LARGE", "RELAY_CAPACITY", "RELAY_QUEUE_FULL", "QUEUE_BYTES_EXCEEDED", "QUEUE_LIMIT_EXCEEDED", "RELAY_BYTE_BUDGET_EXCEEDED", "SENDER_QUOTA_EXCEEDED", "INVALID_RECIPIENT_DID", "MISSING_RECIPIENT_DID", "INVALID_DID", "RELAY_TAMPERING_DETECTED", "INVALID_AGENT_CARD", "INVALID_AGENT_SNAPSHOT", "AMBIGUOUS_AGENT_CARD_OWNER", "AGENT_CARD_EXPIRED", "AGENT_CARD_EXPIRY_TOO_LONG", "AGENT_CARD_DELEGATION_REQUIRED", "AGENT_DELEGATION_REQUIRED", "AGENT_CARD_DELEGATION_INVALID", "AGENT_CARD_TOO_LARGE", "AGENT_REGISTRY_FULL", "AGENT_CARD_TTL_INVALID", "AGENT_OWNER_OR_VERSION_MISMATCH", "NO_AGENT_REGISTERED", "RELAY_UNAUTHORIZED", "RELAY_AUTH_REQUIRED", "RELAY_AUTH_INVALID", "RELAY_AUTH_SIGNATURE_INVALID", "RELAY_AUTH_RECIPIENT_MISMATCH", "RELAY_AUTH_ACTION_MISMATCH", "RELAY_AUTH_EXPIRED", "RELAY_AUTH_FUTURE_ISSUED_AT", "RELAY_AUTH_REPLAYED", "RELAY_AUTH_NONCE_INVALID", "RELAY_AUTH_ORIGIN_REQUIRED", "RELAY_AUTH_ORIGIN_MISMATCH", "RELAY_QUERY_AUTH_DISABLED", "INVALID_RELAY_ORIGIN", "RATE_LIMITED", "RATE_LIMITER_UNAVAILABLE", "PAYLOAD_TOO_LARGE", "BODY_TOO_LARGE", "MISSING_BODY", "INVALID_JSON", "INVALID_UNICODE", "INVALID_LIMIT", "INVALID_RELAY_LIMIT", "INVALID_TIMEOUT", "INVALID_WAIT", "MISSING_ENVELOPE_ID", "UNSUPPORTED_METHOD", "NOT_FOUND", "WEBSOCKET_UPGRADE_REQUIRED", "INVALID_REQUEST", "INVALID_RELAY_SNAPSHOT", "RELAY_INTERNAL_ERROR"];
+export declare const KNOWN_RELAY_ERROR_CODES: readonly ["INVALID_ENVELOPE", "INVALID_SIGNED_ENVELOPE", "ENVELOPE_EXPIRED", "REPLAYED_ENVELOPE", "DUPLICATE_ENVELOPE_ID", "ENVELOPE_TOO_LARGE", "RELAY_CAPACITY", "RELAY_RETRY_LATER", "RELAY_QUEUE_FULL", "QUEUE_BYTES_EXCEEDED", "QUEUE_LIMIT_EXCEEDED", "RELAY_BYTE_BUDGET_EXCEEDED", "SENDER_QUOTA_EXCEEDED", "INVALID_RECIPIENT_DID", "MISSING_RECIPIENT_DID", "INVALID_DID", "RELAY_TAMPERING_DETECTED", "INVALID_AGENT_CARD", "INVALID_AGENT_SNAPSHOT", "AMBIGUOUS_AGENT_CARD_OWNER", "AGENT_CARD_EXPIRED", "AGENT_CARD_EXPIRY_TOO_LONG", "AGENT_CARD_DELEGATION_REQUIRED", "AGENT_DELEGATION_REQUIRED", "AGENT_CARD_DELEGATION_INVALID", "AGENT_CARD_TOO_LARGE", "AGENT_REGISTRY_FULL", "AGENT_CARD_TTL_INVALID", "AGENT_OWNER_OR_VERSION_MISMATCH", "NO_AGENT_REGISTERED", "RELAY_UNAUTHORIZED", "RELAY_AUTH_REQUIRED", "RELAY_AUTH_INVALID", "RELAY_AUTH_SIGNATURE_INVALID", "RELAY_AUTH_RECIPIENT_MISMATCH", "RELAY_AUTH_ACTION_MISMATCH", "RELAY_AUTH_EXPIRED", "RELAY_AUTH_FUTURE_ISSUED_AT", "RELAY_AUTH_REPLAYED", "RELAY_AUTH_NONCE_INVALID", "RELAY_AUTH_ORIGIN_REQUIRED", "RELAY_AUTH_ORIGIN_MISMATCH", "RELAY_QUERY_AUTH_DISABLED", "INVALID_RELAY_ORIGIN", "RATE_LIMITED", "RATE_LIMITER_UNAVAILABLE", "PAYLOAD_TOO_LARGE", "BODY_TOO_LARGE", "MISSING_BODY", "INVALID_JSON", "INVALID_UNICODE", "INVALID_LIMIT", "INVALID_RELAY_LIMIT", "INVALID_TIMEOUT", "INVALID_WAIT", "MISSING_ENVELOPE_ID", "UNSUPPORTED_METHOD", "NOT_FOUND", "WEBSOCKET_UPGRADE_REQUIRED", "INVALID_REQUEST", "INVALID_RELAY_SNAPSHOT", "RELAY_INTERNAL_ERROR"];
 /**
  * Public error code for an untrusted caller.
  * Parser and URL failures become INVALID_REQUEST. Any other message is returned
@@ -219,6 +219,12 @@ export interface MappedRelayError {
 export declare function mapRelayError(error: unknown): MappedRelayError;
 /** Auth failures that must stay 401s with a stable error code. */
 export declare function relayAuthFailure(error: unknown): string | undefined;
+/** Shared HTTP and WebSocket admission error fields. */
+export declare function relayErrorBody(error: unknown): {
+    error: string;
+    retryable?: true;
+    retryAfterMs?: number;
+};
 export declare function relayErrorResponse(error: unknown, relay?: InMemoryRelay): Response;
 /**
  * Bearer credential for a relay request.

package/dist/packages/relay/dist/fetch.js

@@ -29,7 +29,7 @@ export const DEFAULT_MAX_ENVELOPE_BYTES = 256 * 1024;
 export const DEFAULT_MAX_QUEUE_SIZE = 256;
 /** Sum of queued envelope JSON sizes for one recipient. */
 export const DEFAULT_MAX_QUEUE_BYTES_PER_RECIPIENT = 4 * 1024 * 1024;
-export const DEFAULT_ENVELOPE_TTL_MS = 10 * 60 * 1000;
+export const DEFAULT_ENVELOPE_TTL_MS = 24 * 60 * 60 * 1000;
 export const DEFAULT_SEEN_TTL_MS = 60 * 60 * 1000;
 export const DEFAULT_AUTH_SEEN_TTL_MS = 10 * 60 * 1000;
 export const DEFAULT_AGENT_CARD_TTL_MS = 60 * 60 * 1000;
@@ -37,7 +37,13 @@ export const DEFAULT_AGENT_CARD_TTL_MS = 60 * 60 * 1000;
 export const DEFAULT_MAX_SEEN_ENTRIES = 4096;
 export const DEFAULT_MAX_QUEUES = 10000;
 export const DEFAULT_MAX_AGENTS = 10000;
+const CONNECTION_CONTROL_EVENTS = new Set([
+    'CONNECTION_REQUEST',
+    'CONNECTION_ACCEPTED',
+    'CONNECTION_ACK',
+]);
 const WORKER_PRIMARY_EVENTS = new Set([
+    ...CONNECTION_CONTROL_EVENTS,
     'PROPOSE',
     'REVOKE',
     'VERIFY_ACCEPT',
@@ -69,6 +75,11 @@ const BILATERAL_AUDIT_EVENTS = new Set([
 ]);
 export function classifyEnvelopeRole(envelope, state) {
     const { eventType: type, seq, senderDid, recipientDid } = envelope.payload;
+    // Control delivery does not participate in bilateral task role/sequence inference.
+    if (type === 'DELIVERY_STATUS')
+        return 'requester';
+    if (CONNECTION_CONTROL_EVENTS.has(type))
+        return 'worker';
     const cross = senderDid !== recipientDid;
     if (WORKER_PRIMARY_EVENTS.has(type)) {
         if (state) {
@@ -619,21 +630,25 @@ export class InMemoryRelay {
         if (!verifyRelayEnvelope(envelope))
             throw new Error('INVALID_ENVELOPE');
         this.evictExpired();
-        if (this.seen.has(envelope.payload.envelopeId) || this.operations.has('expiry:' + envelope.payload.envelopeId))
+        const id = envelope.payload.envelopeId;
+        if (this.seen.has(id) || this.operations.has('expiry:' + id) ||
+            [...this.queues.values()].some(queue => queue.some(item => item.envelope.payload.envelopeId === id)))
             throw new Error('REPLAYED_ENVELOPE');
         const did = envelope.payload.recipientDid;
         const queue = this.queues.get(did) ?? [];
         const bytes = Buffer.byteLength(JSON.stringify(envelope));
-        if (!this.queues.has(did) && this.queues.size >= this.maxQueues)
-            throw new Error('RELAY_CAPACITY');
-        if (queue.length >= this.maxQueueSize || bytes > this.maxEnvelopeBytes)
-            throw new Error('RELAY_CAPACITY');
+        if (bytes > this.maxEnvelopeBytes || bytes > this.maxQueueBytesPerRecipient)
+            throw new Error('ENVELOPE_TOO_LARGE');
+        if ((!this.queues.has(did) && this.queues.size >= this.maxQueues) ||
+            queue.length >= this.maxQueueSize)
+            throw new Error('RELAY_RETRY_LATER');
         if (this.queuedBytes(queue) + bytes > this.maxQueueBytesPerRecipient)
-            throw new Error('QUEUE_BYTES_EXCEEDED');
+            throw new Error('RELAY_RETRY_LATER');
         if (this.senderCount(queue, envelope.payload.senderDid) >= this.maxEnvelopesPerSender)
-            throw new Error('SENDER_QUOTA_EXCEEDED');
+            throw new Error('RELAY_RETRY_LATER');
         this.remember(this.seen, envelope.payload.envelopeId, this.maxSeenEntries, this.seenTtlMs);
-        const role = classifyEnvelopeRole(envelope, this.stateForTask(envelope.payload.taskId));
+        const role = classifyEnvelopeRole(envelope, CONNECTION_CONTROL_EVENTS.has(envelope.payload.eventType)
+            ? undefined : this.stateForTask(envelope.payload.taskId));
         const wire = structuredClone(envelope);
         const stored = this.tamper ? this.tamper(wire) : wire;
         queue.push({
@@ -879,7 +894,8 @@ export class InMemoryRelay {
                 leasedUntil: leaseExpiry.get(envelope.payload.envelopeId),
                 bytes: Buffer.byteLength(JSON.stringify(envelope)),
                 expiresAt: envelopeExpiry.get(envelope.payload.envelopeId) ?? this.now() + this.envelopeTtlMs,
-                role: classifyEnvelopeRole(envelope, this.stateForTask(envelope.payload.taskId)),
+                role: classifyEnvelopeRole(envelope, CONNECTION_CONTROL_EVENTS.has(envelope.payload.eventType)
+                    ? undefined : this.stateForTask(envelope.payload.taskId)),
             })));
         }
         this.seen = new Map(snapshot.seen.map((id) => [id, seenExpiry.get(id) ?? this.now() + this.seenTtlMs]));
@@ -969,6 +985,7 @@ export const KNOWN_RELAY_ERROR_CODES = [
     'DUPLICATE_ENVELOPE_ID',
     'ENVELOPE_TOO_LARGE',
     'RELAY_CAPACITY',
+    'RELAY_RETRY_LATER',
     'RELAY_QUEUE_FULL',
     'QUEUE_BYTES_EXCEEDED',
     'QUEUE_LIMIT_EXCEEDED',
@@ -1034,6 +1051,7 @@ const RELAY_ERROR_STATUS = {
     DUPLICATE_ENVELOPE_ID: 400,
     ENVELOPE_TOO_LARGE: 400,
     RELAY_CAPACITY: 400,
+    RELAY_RETRY_LATER: 429,
     RELAY_QUEUE_FULL: 400,
     INVALID_RECIPIENT_DID: 400,
     MISSING_RECIPIENT_DID: 400,
@@ -1124,14 +1142,25 @@ export function relayAuthFailure(error) {
     const code = sanitizeRelayErrorCode(error);
     return RELAY_ERROR_STATUS[code] === 401 ? code : undefined;
 }
+/** Shared HTTP and WebSocket admission error fields. */
+export function relayErrorBody(error) {
+    const code = sanitizeRelayErrorCode(error);
+    return code === 'RELAY_RETRY_LATER'
+        ? { error: code, retryable: true, retryAfterMs: 60_000 }
+        : { error: code };
+}
 export function relayErrorResponse(error, relay) {
     const mapped = mapRelayError(error);
+    const body = relayErrorBody(error);
     if (mapped.status === 429) {
-        return Response.json({ error: mapped.error }, {
+        const retryAfter = body.retryAfterMs !== undefined
+            ? Math.ceil(body.retryAfterMs / 1000)
+            : (relay?.retryAfterSeconds() ?? 60);
+        return Response.json(body, {
             status: 429,
             headers: {
                 ...relayHttpHeaders('json'),
-                'retry-after': String(relay?.retryAfterSeconds() ?? 60),
+                'retry-after': String(retryAfter),
             },
         });
     }