@7h3/protocol 0.4.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (63) hide show
  1. package/CHANGELOG.md +60 -0
  2. package/README.md +1169 -175
  3. package/bin/7h3.ts +22 -1
  4. package/docs/assets/banner-github.png +0 -0
  5. package/docs/assets/banner.svg +123 -0
  6. package/package.json +55 -13
  7. package/sdk/browser/package.json +1 -1
  8. package/sdk/go/cbor.go +551 -0
  9. package/sdk/go/cbor_test.go +232 -0
  10. package/sdk/go/encryption.go +280 -0
  11. package/sdk/go/encryption_test.go +318 -0
  12. package/sdk/go/go.mod +5 -1
  13. package/sdk/go/go.sum +4 -0
  14. package/sdk/go/replay.go +121 -0
  15. package/sdk/go/replay_test.go +149 -0
  16. package/sdk/pq/package-lock.json +1358 -0
  17. package/sdk/pq/package.json +42 -0
  18. package/sdk/pq/src/index.test.ts +143 -0
  19. package/sdk/pq/src/index.ts +166 -0
  20. package/sdk/pq/tsconfig.json +14 -0
  21. package/sdk/pq/vitest.config.ts +7 -0
  22. package/sdk/python/protocol_7h3/encryption.py +252 -0
  23. package/sdk/python/protocol_7h3/pq.py +244 -0
  24. package/sdk/python/protocol_7h3/replay.py +98 -0
  25. package/sdk/python/pyproject.toml +1 -1
  26. package/sdk/python/tests/test_encryption.py +206 -0
  27. package/sdk/rust/Cargo.lock +1 -1
  28. package/sdk/rust/Cargo.toml +1 -1
  29. package/sdk/threshold/index.d.ts +68 -0
  30. package/sdk/threshold/index.d.ts.map +1 -0
  31. package/sdk/threshold/index.js +254 -0
  32. package/sdk/threshold/package-lock.json +1361 -0
  33. package/sdk/threshold/package.json +39 -0
  34. package/sdk/threshold/src/index.d.ts +68 -0
  35. package/sdk/threshold/src/index.d.ts.map +1 -0
  36. package/sdk/threshold/src/index.js +254 -0
  37. package/sdk/threshold/src/index.test.ts +238 -0
  38. package/sdk/threshold/src/index.ts +355 -0
  39. package/sdk/threshold/tsconfig.json +19 -0
  40. package/sdk/threshold/vitest.config.ts +12 -0
  41. package/src/capability.test.ts +504 -0
  42. package/src/capability.ts +380 -0
  43. package/src/cborCodec.test.ts +263 -0
  44. package/src/cborCodec.ts +339 -0
  45. package/src/encryption.test.ts +206 -0
  46. package/src/encryption.ts +245 -0
  47. package/src/envelopeCbor.ts +140 -0
  48. package/src/gateway.ts +75 -0
  49. package/src/httpBinding.ts +37 -11
  50. package/src/index.ts +7 -0
  51. package/src/otel.ts +136 -0
  52. package/src/protocol.d.ts +67 -0
  53. package/src/protocol.d.ts.map +1 -0
  54. package/src/protocol.js +294 -0
  55. package/src/protocol.ts +1 -0
  56. package/src/replayStores.test.ts +133 -1
  57. package/src/replayStores.ts +136 -3
  58. package/src/stream.test.ts +254 -0
  59. package/src/stream.ts +417 -0
  60. package/src/telemetry.test.ts +251 -0
  61. package/src/telemetry.ts +299 -0
  62. package/src/wsBinding.ts +100 -0
  63. package/vitest.config.ts +11 -0
package/CHANGELOG.md CHANGED
@@ -6,6 +6,66 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
6
6
 
7
7
  ---
8
8
 
9
+ ## v0.5.0
10
+
11
+ ### New features
12
+
13
+ **Feature 1 — Distributed Redis replay cache**
14
+ - RedisReplayStore: atomic SET NX PX prevents cross-instance replay attacks
15
+ - ClusterRedisReplayStore: queries all Redis Cluster nodes
16
+ - InMemoryReplayStore improvements
17
+ - Go SDK: InMemoryReplayStore + RedisReplayStore (inject-your-client)
18
+ - Python SDK: RedisReplayStore using redis-py
19
+
20
+ **Feature 2 — End-to-end encryption (X25519 + ChaCha20-Poly1305)**
21
+ - sealEnvelope / openEnvelope: encrypt body before signing, verify before decrypting
22
+ - generateX25519KeyPair: ephemeral key pairs for forward secrecy
23
+ - Zero new dependencies: Node.js built-in crypto.ecdh + crypto.createCipheriv('chacha20-poly1305')
24
+ - Python SDK: X25519 + ChaCha20-Poly1305 via cryptography package
25
+ - Go SDK: crypto/ecdh + golang.org/x/crypto/chacha20poly1305
26
+
27
+ **Feature 3 — Capability tokens and delegation chains**
28
+ - issueCapabilityToken: scoped, time-bounded, cryptographically signed credentials
29
+ - delegateCapabilityToken: sub-delegate with equal or narrower scope
30
+ - verifyCapabilityChain: verify full A→B→C delegation chain
31
+ - Gateway integration: x-7h3-capability header accepted alongside signatures
32
+ - tokenMatchesScope: glob path matching
33
+
34
+ **Feature 4 — Streaming message signing**
35
+ - SignedStreamWriter / SignedStreamReader: per-chunk HMAC + final Ed25519
36
+ - signStream / verifyStream: convenience wrappers for arrays
37
+ - WebSocket integration: createSignedWebSocketStream / receiveSignedWebSocketStream
38
+ - Tampering detected mid-stream on the failing chunk
39
+
40
+ **Feature 5 — Prometheus metrics + OpenTelemetry**
41
+ - Protocol7h3Metrics: counters and histograms for all verification events
42
+ - renderPrometheusText: zero-dep Prometheus exposition format
43
+ - createMetricsMiddleware: serve /metrics endpoint
44
+ - CLI: 7h3 gateway --metrics-port N
45
+ - setOtelProvider / withVerificationSpan: optional OTel tracing
46
+
47
+ **Feature 6 — Post-quantum signatures (ML-DSA) — @7h3/protocol-pq**
48
+ - generatePqKeyPair: ML-DSA-65 and ML-DSA-87 keypairs
49
+ - signEnvelopePq / verifyEnvelopePq: same envelope format, alg: 'ML-DSA-65'
50
+ - Python SDK: Dilithium2/3/5 via dilithium-py
51
+ - Separate package to keep @7h3/protocol at zero runtime deps
52
+
53
+ **Feature 7 — CBOR binary wire format**
54
+ - encodeCbor / decodeCbor: zero-dep deterministic CBOR (RFC 8949)
55
+ - encodeEnvelopeCbor / decodeEnvelopeCbor: compact numeric-key encoding (~40% smaller)
56
+ - HTTP binding: Content-Type: application/7h3-cbor support
57
+ - Go SDK: EncodeEnvelopeCBOR / DecodeEnvelopeCBOR
58
+
59
+ **Feature 8 — M-of-N threshold signatures (BLS12-381) — @7h3/protocol-threshold**
60
+ - generateBlsKeyPair: BLS12-381 keypairs
61
+ - signEnvelopeBls: partial signature from one participant
62
+ - aggregateSignatures: combine M-of-N partial sigs into one
63
+ - verifyThresholdEnvelope: single verify call on aggregated sig
64
+ - splitPrivateKey / reconstructPrivateKey: Shamir Secret Sharing over BLS scalar field
65
+ - Separate package (@7h3/protocol-threshold) using @noble/curves
66
+
67
+ ---
68
+
9
69
  ## [0.1.2] — 2026-06-05
10
70
 
11
71
  ### Added