@emilia-protocol/gate 0.10.0 → 0.13.0

package/store.js

@@ -1,198 +1,4 @@
-/**
- * @emilia-protocol/gate — consumption store (replay defense).
- * @license Apache-2.0
- *
- * A receipt authorizes ONE action, once. The gate consumes a receipt's
- * identifier the first time it is used; any later presentation of the same
- * receipt is a replay and is refused. The in-memory store is an explicit
- * test/demo opt-in; security-bearing gates use the durable contract below.
- */
-export class MemoryConsumptionStore {
-  constructor() {
-    this.durable = false;
-    this.ownershipFenced = false;
-    this.permanentConsumption = false;
-    this.seen = new Set();
-    this.reserved = new Set();
-  }
-
-  /** Returns true the FIRST time a key is seen, false on every replay. */
-  async consume(key) {
-    if (this.seen.has(key) || this.reserved.has(key)) return false;
-    this.seen.add(key);
-    return true;
-  }
-
-  /** Reserve an id while an action is in flight; blocks concurrent replay. */
-  async reserve(key) {
-    if (this.seen.has(key) || this.reserved.has(key)) return false;
-    this.reserved.add(key);
-    return true;
-  }
-
-  /** Commit a reserved id after an external-effect attempt begins. */
-  async commit(key) {
-    this.reserved.delete(key);
-    this.seen.add(key);
-    return true;
-  }
-
-  /** Release only when the caller can prove the external effect never began. */
-  async release(key) {
-    this.reserved.delete(key);
-    return true;
-  }
-
-  async has(key) {
-    return this.seen.has(key) || this.reserved.has(key);
-  }
-
-  get size() {
-    return this.seen.size;
-  }
-}
-
-export const DURABLE_CONSUMPTION_VERSION = 'EP-GATE-DURABLE-CONSUMPTION-v2';
-
-/** Capability contract required by security-bearing Gate execution paths. */
-export function isSecureConsumptionStore(store) {
-  if (!store || typeof store !== 'object') return false;
-  return store.durable === true
-    && store.ownershipFenced === true
-    && store.permanentConsumption === true
-    && typeof store.consume === 'function'
-    && typeof store.reserve === 'function'
-    && typeof store.commit === 'function';
-}
-
-const COMMITTED_VALUE = 'committed:v2';
-const RESERVED_PREFIX = 'reserved:v2:';
-
-function defaultReservationToken() {
-  if (typeof globalThis.crypto?.randomUUID !== 'function') {
-    throw new Error('secure crypto.randomUUID() is required for durable reservation fencing');
-  }
-  return globalThis.crypto.randomUUID();
-}
-
-/**
- * Production custody for replay defense: a durable consumption store backed by
- * any shared key-value backend (Redis, Postgres, DynamoDB, ...), so a receipt
- * consumed on one pod/lambda cannot be replayed on another.
- *
- * The backend MUST provide atomic insert-if-absent plus atomic conditional
- * transition and delete. Together they make replay defense and reservation
- * ownership sound under concurrency:
- *
- *   backend = {
- *     async addIfAbsent(key, value): boolean
- *     async compareAndSet(key, expected, replacement): boolean
- *     async deleteIfValue(key, expected): boolean
- *     async has(key): boolean
- *   }
- *
- * State per receipt id is a single ownership-fenced value. A reservation is
- * `reserved:v2:<random token>` and only the store instance holding that token
- * can commit or release it. This prevents a delayed worker from deleting or
- * committing a newer worker's reservation after timeout/failover.
- *
- * Reservations deliberately receive NO TTL. A crash after an external effect
- * has begun is an indeterminate outcome, and automatically reopening the key
- * would permit a duplicate effect. Operators must reconcile abandoned
- * reservations. `ttlSeconds` applies only after a value is committed, when the
- * receipt's own freshness window independently prevents reuse.
- */
-export function createDurableConsumptionStore(backend, { ttlSeconds, reservationTokenFactory = defaultReservationToken } = {}) {
-  for (const m of ['addIfAbsent', 'compareAndSet', 'deleteIfValue', 'has']) {
-    if (typeof backend?.[m] !== 'function') {
-      throw new Error(`createDurableConsumptionStore: backend must implement async ${m}(). `
-        + 'addIfAbsent and conditional transitions MUST be atomic or replay defense is not fleet-safe.');
-    }
-  }
-  if (typeof reservationTokenFactory !== 'function') {
-    throw new Error('createDurableConsumptionStore: reservationTokenFactory must be a function');
-  }
-  if (ttlSeconds !== undefined && ttlSeconds !== null
-      && (!Number.isSafeInteger(ttlSeconds) || ttlSeconds <= 0)) {
-    throw new Error('createDurableConsumptionStore: ttlSeconds must be a positive safe integer when supplied');
-  }
-  const opt = ttlSeconds ? { ttlSeconds } : undefined;
-  const ownedReservations = new Map();
-
-  function ownedValue(key) {
-    const token = ownedReservations.get(key);
-    if (!token) {
-      throw new Error(`durable consumption transition refused: this store does not own reservation ${key}`);
-    }
-    return `${RESERVED_PREFIX}${token}`;
-  }
-
-  return {
-    durable: backend.durable === true,
-    ownershipFenced: true,
-    permanentConsumption: ttlSeconds === undefined || ttlSeconds === null,
-    retentionSeconds: ttlSeconds ?? null,
-    async health() {
-      if (typeof backend.health !== 'function') return { ok: false, reason: 'backend_health_unavailable' };
-      return backend.health();
-    },
-    async reserve(key) {
-      const token = reservationTokenFactory();
-      if (typeof token !== 'string' || token.length < 16) {
-        throw new Error('reservationTokenFactory must return an unpredictable string of at least 16 characters');
-      }
-      const inserted = (await backend.addIfAbsent(key, `${RESERVED_PREFIX}${token}`)) === true;
-      if (inserted) ownedReservations.set(key, token);
-      return inserted;
-    },
-    async commit(key) {
-      const expected = ownedValue(key);
-      const changed = await backend.compareAndSet(key, expected, COMMITTED_VALUE, opt);
-      if (changed !== true) {
-        throw new Error(`durable consumption commit refused: reservation ownership was lost for ${key}`);
-      }
-      ownedReservations.delete(key);
-      return true;
-    },
-    async release(key) {
-      const expected = ownedValue(key);
-      const deleted = await backend.deleteIfValue(key, expected);
-      ownedReservations.delete(key);
-      if (deleted !== true) {
-        throw new Error(`durable consumption release refused: reservation ownership was lost for ${key}`);
-      }
-      return true;
-    },
-    async consume(key) { return (await backend.addIfAbsent(key, COMMITTED_VALUE, opt)) === true; },
-    async has(key) { return (await backend.has(key)) === true; },
-  };
-}
-
-/** In-memory reference backend (for tests/single-process). addIfAbsent is atomic in a single thread. */
-export function createMemoryBackend() {
-  const map = new Map();
-  return {
-    durable: false,
-    async addIfAbsent(key, value) { if (map.has(key)) return false; map.set(key, value); return true; },
-    async compareAndSet(key, expected, replacement) {
-      if (map.get(key) !== expected) return false;
-      map.set(key, replacement);
-      return true;
-    },
-    async deleteIfValue(key, expected) {
-      if (map.get(key) !== expected) return false;
-      return map.delete(key);
-    },
-    async has(key) { return map.has(key); },
-    async get(key) { return map.get(key); },
-    get size() { return map.size; },
-  };
-}
-
-export default {
-  MemoryConsumptionStore,
-  createDurableConsumptionStore,
-  createMemoryBackend,
-  isSecureConsumptionStore,
-  DURABLE_CONSUMPTION_VERSION,
-};
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript store module.
+export * from './dist/store.js';
+export { default } from './dist/store.js';

package/strict-json.js

@@ -1,86 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-// Duplicate-name and Unicode-scalar gate for signed nested JSON such as
-// WebAuthn clientDataJSON. JSON.parse remains the syntax gate.
-
-export const MAX_JSON_DEPTH = 64;
-
-export function strictJsonGate(raw) {
-  if (typeof raw !== 'string') return { ok: false, reason: 'JSON input must be text' };
-  try { JSON.parse(raw); } catch { return { ok: false, reason: 'invalid JSON syntax' }; }
-  let index = 0;
-  const stack = [];
-  let reason = null;
-  const escapes = { '"': '"', '\\': '\\', '/': '/', b: '\b', f: '\f', n: '\n', r: '\r', t: '\t' };
-
-  function readString() {
-    index += 1;
-    let output = '';
-    while (index < raw.length) {
-      const character = raw[index];
-      if (character === '"') { index += 1; return output; }
-      if (character !== '\\') { output += character; index += 1; continue; }
-      const escape = raw[index + 1];
-      if (escape !== 'u') {
-        output += escapes[escape] ?? '';
-        index += 2;
-        continue;
-      }
-      const first = Number.parseInt(raw.slice(index + 2, index + 6), 16);
-      index += 6;
-      if (first >= 0xd800 && first <= 0xdbff) {
-        if (raw[index] === '\\' && raw[index + 1] === 'u') {
-          const second = Number.parseInt(raw.slice(index + 2, index + 6), 16);
-          if (second >= 0xdc00 && second <= 0xdfff) {
-            output += String.fromCharCode(first, second);
-            index += 6;
-            continue;
-          }
-        }
-        reason = 'unpaired high surrogate escape';
-        return null;
-      }
-      if (first >= 0xdc00 && first <= 0xdfff) {
-        reason = 'unpaired low surrogate escape';
-        return null;
-      }
-      output += String.fromCharCode(first);
-    }
-    reason = 'unterminated string';
-    return null;
-  }
-
-  while (index < raw.length) {
-    const character = raw[index];
-    if (character === '{') {
-      stack.push({ object: true, keys: new Set(), expectsKey: true });
-      if (stack.length > MAX_JSON_DEPTH) return { ok: false, reason: `nesting depth exceeds ${MAX_JSON_DEPTH}` };
-      index += 1;
-    } else if (character === '[') {
-      stack.push({ object: false });
-      if (stack.length > MAX_JSON_DEPTH) return { ok: false, reason: `nesting depth exceeds ${MAX_JSON_DEPTH}` };
-      index += 1;
-    } else if (character === '}' || character === ']') {
-      stack.pop();
-      index += 1;
-    } else if (character === ',') {
-      const top = stack.at(-1);
-      if (top?.object) top.expectsKey = true;
-      index += 1;
-    } else if (character === '"') {
-      const top = stack.at(-1);
-      const isKey = Boolean(top?.object && top.expectsKey);
-      const value = readString();
-      if (reason) return { ok: false, reason };
-      if (isKey) {
-        if (top.keys.has(value)) return { ok: false, reason: 'duplicate object member name' };
-        top.keys.add(value);
-        top.expectsKey = false;
-      }
-    } else {
-      index += 1;
-    }
-  }
-  return { ok: true };
-}
-
-export default { strictJsonGate, MAX_JSON_DEPTH };
+// Compatibility entry point for the TypeScript strict-json module.
+export * from './dist/strict-json.js';
+export { default } from './dist/strict-json.js';

package/trust-program-adapters.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript Gate Trust Program adapters.
+export * from './dist/trust-program-adapters.js';
+export { default } from './dist/trust-program-adapters.js';

package/trust-program-postgres.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript Gate Trust Program PostgreSQL store.
+export * from './dist/trust-program-postgres.js';
+export { default } from './dist/trust-program-postgres.js';

package/trust-program-revocation.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript Trust Program revocation module.
+export * from './dist/trust-program-revocation.js';
+export { default } from './dist/trust-program-revocation.js';

package/trust-program.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript Gate Trust Program module.
+export * from './dist/trust-program.js';
+export { default } from './dist/trust-program.js';

package/witness-postgres.js

@@ -1,97 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-/**
- * Tenant-scoped Postgres sequence store for EP-GATE-NETWORK-WITNESS-v1.
- *
- * The migration owns synchronization and authorization. Runtime callers get
- * EXECUTE on one SECURITY DEFINER function, not INSERT/UPDATE privileges on the
- * checkpoint table. Database ambiguity is allowed to throw so the witness
- * ingestion kernel can fail closed as `sequence_store_unavailable`.
- */
-
-export const PG_WITNESS_SEQUENCE_VERSION = 'EP-GATE-PG-WITNESS-SEQUENCE-v1';
-export const WITNESS_CHECKPOINT_FUNCTION = 'emilia_gate_evidence.advance_network_witness_checkpoint';
-
-const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
-const CLOSED_REASONS = new Set(['statement_replay', 'sequence_rollback', 'sequence_equivocation']);
-
-export const WITNESS_SEQUENCE_SQL = Object.freeze({
-  advance: `SELECT accepted, reason
-FROM ${WITNESS_CHECKPOINT_FUNCTION}($1, $2, $3::bytea, $4::bigint, $5)`,
-});
-
-function scopedId(value, label) {
-  if (typeof value !== 'string' || value.length === 0 || value.length > 256
-      || /[\u0000-\u001f\u007f]/.test(value)) {
-    throw new Error(`${label} must be a non-empty control-free string of at most 256 characters`);
-  }
-  return value;
-}
-
-function streamBytes(value) {
-  if (typeof value !== 'string' || value.length > 513) {
-    throw new Error('witness streamId is invalid');
-  }
-  const parts = value.split('\0');
-  if (parts.length !== 2 || parts.some((part) => part.length === 0 || part.length > 256
-      || /[\u0000-\u001f\u007f]/.test(part))) {
-    throw new Error('witness streamId must contain one witness-id/capture-point separator');
-  }
-  return Buffer.from(value, 'utf8');
-}
-
-function definitiveRow(result) {
-  if (!result || result.rowCount !== 1 || !Array.isArray(result.rows)
-      || result.rows.length !== 1 || typeof result.rows[0]?.accepted !== 'boolean') {
-    throw new Error('witness checkpoint outcome is unproven');
-  }
-  const { accepted, reason } = result.rows[0];
-  if (accepted) {
-    if (reason !== null && reason !== undefined && reason !== '') {
-      throw new Error('accepted witness checkpoint carried a refusal reason');
-    }
-    return { accepted: true, reason: null };
-  }
-  if (!CLOSED_REASONS.has(reason)) {
-    throw new Error('witness checkpoint returned an unknown refusal reason');
-  }
-  return { accepted: false, reason };
-}
-
-/**
- * Create the durable store expected by acceptNetworkWitnessStatement().
- * `query` is a node-postgres style function such as pool.query.bind(pool).
- */
-export function createPostgresWitnessSequenceStore({ query, tenantId, gateId } = {}) {
-  if (typeof query !== 'function') {
-    throw new Error('createPostgresWitnessSequenceStore: query must be an async pg-style function');
-  }
-  const tenant = scopedId(tenantId, 'tenantId');
-  const gate = scopedId(gateId, 'gateId');
-  return Object.freeze({
-    durable: true,
-    scope: Object.freeze({ tenantId: tenant, gateId: gate }),
-    async advance(streamId, sequence, statementDigest) {
-      if (!Number.isSafeInteger(sequence) || sequence < 0) {
-        throw new Error('witness sequence must be a non-negative safe integer');
-      }
-      if (typeof statementDigest !== 'string' || !DIGEST_RE.test(statementDigest)) {
-        throw new Error('witness statement digest is invalid');
-      }
-      const result = await query(WITNESS_SEQUENCE_SQL.advance, [
-        tenant,
-        gate,
-        streamBytes(streamId),
-        sequence,
-        statementDigest,
-      ]);
-      return definitiveRow(result);
-    },
-  });
-}
-
-export default {
-  PG_WITNESS_SEQUENCE_VERSION,
-  WITNESS_CHECKPOINT_FUNCTION,
-  WITNESS_SEQUENCE_SQL,
-  createPostgresWitnessSequenceStore,
-};
+// Compatibility entry point for the TypeScript witness-postgres module.
+export * from './dist/witness-postgres.js';
+export { default } from './dist/witness-postgres.js';

package/zk-range-proof.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript zk-range-proof module.
+export * from './dist/zk-range-proof.js';
+export { default } from './dist/zk-range-proof.js';