fix(ack-id): return reply nonce for response handshakes

[Kewe63]

Summary

Fixes #174

createA2AHandshakeMessage() returned payload.nonce for every handshake message.

For response handshakes, createA2AHandshakePayload({ requestNonce }) keeps the peer's original request nonce in payload.nonce and puts the newly generated nonce in payload.replyNonce. Returning payload.nonce meant callers received the old request nonce instead of the fresh reply nonce needed to correlate the next handshake leg.

This PR returns payload.replyNonce when present, while preserving the existing initiator behavior by falling back to payload.nonce.

---

Changes

• Return payload.replyNonce ?? payload.nonce from createA2AHandshakeMessage().
• Add a regression test for response handshakes with requestNonce.

---

How to Test

pnpm --filter @agentcommercekit/ack-id test -- src/a2a/sign-message.test.ts
pnpm --filter @agentcommercekit/ack-id test
pnpm --filter @agentcommercekit/ack-id build
pnpm run lint
pnpm run check:format
pnpm run check:packages
git diff --check

Note: pnpm run check was also attempted. Build passed, but the full parallel test run hit Vitest fork worker timeout/EPIPE errors across unrelated packages in this WSL environment. The focused package tests and repo lint/format/package checks passed.

---

Checklist

• Tests pass — focused package tests green, new regression test added
• Lint, format, and package checks pass
• Follows Conventional Commits
• Changes scoped to this fix only

---

Risk & Impact

Low. The fallback (payload.replyNonce ?? payload.nonce) preserves the existing initiator behavior byte-for-byte — only response handshakes with a replyNonce present see a behavior change, which is the exact case this fixes.

Type: 🐛 Bug fix
Fixes: #174

Summary by CodeRabbit

Bug Fixes

• Improved handshake responses to return the requested nonce when replying to an existing handshake.
• Initial handshakes continue to generate and return a fresh nonce.
• Callers can reliably correlate the next step in a handshake exchange.

Tests

• Added coverage verifying nonce handling for both initial and response handshakes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 9142d3de-2e7b-4447-a783-3c736b476a79

📥 Commits

Reviewing files that changed from the base of the PR and between 7dbf8a2 and 134d3ae.

📒 Files selected for processing (1)

• .changeset/fresh-reply-nonce.md

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The A2A handshake message now returns the fresh reply nonce for response handshakes. A regression test covers requests with a nonce, and a patch changeset documents the behavior.

Changes

A2A handshake nonce handling

Layer / File(s)	Summary
Select and validate the handshake nonce packages/ack-id/src/a2a/sign-message.ts, packages/ack-id/src/a2a/sign-message.test.ts, .changeset/fresh-reply-nonce.md	The message returns payload.replyNonce when available and otherwise returns payload.nonce. The test verifies the fresh reply nonce. The changeset declares a patch release.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 134d3

This localized fix returns the fresh nonce for response handshakes while preserving initiator behavior; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main fix: returning the reply nonce for A2A response handshakes.
Linked Issues check	✅ Passed	The changes satisfy issue #174. Response handshakes now return payload.replyNonce when available, initiator handshakes retain payload.nonce, and a regression test covers requestNonce with a fresh repl…
Out of Scope Changes check	✅ Passed	All changes support issue #174. The implementation fix, regression test, and ack-id patch changeset are within scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

The changes satisfy issue #174. Response handshakes now return payload.replyNonce when available, initiator handshakes retain payload.nonce, and a regression test covers requestNonce with a fresh reply nonce.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[venables]

Thanks @Kewe63 , can you please add a changeset for this change?