@emilia-protocol/gate 0.10.0 → 0.13.0

package/dist/store-postgres.js

@@ -0,0 +1,152 @@
+// @ts-nocheck
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — reference DURABLE consumption backend: Postgres
+ * (EP-GATE-PG-CONSUMPTION-v2).
+ *
+ * Replay defense that survives restarts. This module implements the backend
+ * contract consumed by `createDurableConsumptionStore` in ./store.js:
+ *
+ *   backend = {
+ *     async addIfAbsent(key, value, { ttlSeconds }?) : boolean  // true iff inserted
+ *     async compareAndSet(key, expected, replacement, { ttlSeconds }?) : boolean
+ *     async deleteIfValue(key, expected)             : boolean
+ *     async has(key)                                 : boolean
+ *   }
+ *
+ * plus a `cleanupExpired(now)` garbage-collection statement.
+ *
+ * Each transition is one SQL statement. `addIfAbsent` decides first use;
+ * `compareAndSet` and `deleteIfValue` bind commit/release to the opaque owner of
+ * the current reservation. There is no read-then-write interval in which a
+ * delayed worker can overwrite or remove a newer worker's reservation.
+ *
+ * FAIL-CLOSED CONTRACT: if the injected `query` THROWS (connection down,
+ * timeout, constraint other than the PK, ...) the error PROPAGATES to the
+ * caller — nothing here catches it. The gate must refuse an action when
+ * one-time-use cannot be proven; a backend error is NEVER treated as
+ * not-consumed (which would admit replays during an outage) and never treated
+ * as consumed-silently (which would mask the outage as a replay verdict).
+ * Likewise, an EXPIRED row that cleanup has not yet removed still refuses:
+ * TTL expiry is garbage collection, never a grant — the gate already rejects
+ * stale receipts on freshness, so nothing is lost by refusing conservatively.
+ *
+ * Deterministic by construction: the pg-style `query(text, params)` function
+ * and the clock (`now`) are both injected, so tests run against an in-memory
+ * fake with real ON CONFLICT semantics — no network, no database.
+ */
+export const PG_CONSUMPTION_VERSION = 'EP-GATE-PG-CONSUMPTION-v2';
+/** Single consumption table. Timestamps are epoch milliseconds (BIGINT) so the
+ * injected JS clock maps 1:1 onto column values with no timezone ambiguity. */
+export const CONSUMPTION_TABLE = 'ep_gate_consumption';
+export const CONSUMPTION_TABLE_DDL = `CREATE TABLE IF NOT EXISTS ${CONSUMPTION_TABLE} (
+  consumption_key TEXT PRIMARY KEY,
+  state           TEXT NOT NULL,
+  consumed_at     BIGINT NOT NULL,
+  expires_at      BIGINT
+);
+CREATE INDEX IF NOT EXISTS ${CONSUMPTION_TABLE}_expires_idx
+  ON ${CONSUMPTION_TABLE} (expires_at) WHERE expires_at IS NOT NULL;`;
+/** The exact statements the backend issues — exported for transparency and so
+ * a fake client can implement them without parsing SQL. */
+export const CONSUMPTION_SQL = {
+    health: `SELECT
+  to_regclass('public.${CONSUMPTION_TABLE}') IS NOT NULL AS table_ready,
+  CASE WHEN to_regclass('public.${CONSUMPTION_TABLE}') IS NULL THEN FALSE
+    ELSE has_table_privilege(current_user, to_regclass('public.${CONSUMPTION_TABLE}'), 'SELECT,INSERT,UPDATE,DELETE') END AS can_use`,
+    /** $1 key, $2 state, $3 consumed_at ms, $4 expires_at ms|null. rowCount 1 = consumed, 0 = replay. */
+    addIfAbsent: `INSERT INTO ${CONSUMPTION_TABLE} (consumption_key, state, consumed_at, expires_at) `
+        + 'VALUES ($1, $2, $3, $4) ON CONFLICT (consumption_key) DO NOTHING',
+    /** $1 key, $2 expected state, $3 replacement, $4 consumed_at ms, $5 expires_at ms|null. */
+    compareAndSet: `UPDATE ${CONSUMPTION_TABLE} SET state = $3, consumed_at = $4, expires_at = $5 `
+        + 'WHERE consumption_key = $1 AND state = $2',
+    /** $1 key, $2 expected state. */
+    deleteIfValue: `DELETE FROM ${CONSUMPTION_TABLE} WHERE consumption_key = $1 AND state = $2`,
+    /** $1 key. Any row — even an expired one — counts as consumed until cleaned. */
+    has: `SELECT 1 FROM ${CONSUMPTION_TABLE} WHERE consumption_key = $1`,
+    /** $1 now ms. Removes ONLY rows whose TTL has elapsed; NULL expires_at never expires. */
+    cleanupExpired: `DELETE FROM ${CONSUMPTION_TABLE} WHERE state LIKE 'committed:%' `
+        + 'AND expires_at IS NOT NULL AND expires_at <= $1',
+};
+/**
+ * Create the Postgres consumption backend.
+ * @param {{ query?: (text: string, params: any[]) => Promise<{ rowCount: number, rows?: any[] }>, now?: number|function }} [o]
+ *   `query` is a pg-style query function (e.g. `pool.query.bind(pool)`). Injected
+ *   so tests need no database. MUST throw on failure — errors propagate (fail
+ *   closed). `now` is the injected clock (ms or () => ms).
+ * @returns backend conforming to createDurableConsumptionStore, plus cleanupExpired(now).
+ */
+export function createPostgresBackend({ query, now = Date.now, } = {}) {
+    if (typeof query !== 'function') {
+        throw new Error('createPostgresBackend: query must be an async (text, params) => { rowCount } function '
+            + '(e.g. pg pool.query). It must THROW on failure — a backend error must never look like a verdict.');
+    }
+    let lastObservedNow = Number.NEGATIVE_INFINITY;
+    const checkedNow = (candidate) => {
+        if (!Number.isSafeInteger(candidate) || candidate < 0) {
+            throw new Error('consumption clock must return a non-negative safe-integer epoch millisecond');
+        }
+        if (candidate < lastObservedNow) {
+            throw new Error(`consumption clock regression refused: ${candidate} < ${lastObservedNow}`);
+        }
+        lastObservedNow = candidate;
+        return candidate;
+    };
+    const nowMs = () => checkedNow(typeof now === 'function' ? now() : now);
+    const expiryFor = (opt) => {
+        const ttl = Number(opt?.ttlSeconds);
+        return Number.isFinite(ttl) && ttl > 0 ? nowMs() + ttl * 1000 : null;
+    };
+    return {
+        durable: true,
+        async health() {
+            const res = await query(CONSUMPTION_SQL.health, []);
+            if (!res || res.rowCount !== 1 || !Array.isArray(res.rows) || res.rows.length !== 1) {
+                throw new Error('consumption health: malformed Postgres result');
+            }
+            return {
+                ok: res.rows[0].table_ready === true && res.rows[0].can_use === true,
+                version: PG_CONSUMPTION_VERSION,
+            };
+        },
+        /** True iff THIS call inserted the row — the atomic consumed-vs-replay decision. */
+        async addIfAbsent(key, value, opt) {
+            const res = await query(CONSUMPTION_SQL.addIfAbsent, [key, value, nowMs(), expiryFor(opt)]);
+            // Fail closed on a malformed driver result: without a numeric rowCount we
+            // cannot PROVE first-use, so refuse loudly rather than guess.
+            if (!res || typeof res.rowCount !== 'number') {
+                throw new Error('addIfAbsent: query result has no numeric rowCount — cannot prove one-time use');
+            }
+            return res.rowCount === 1;
+        },
+        /** Ownership-fenced reserved -> committed transition. */
+        async compareAndSet(key, expected, replacement, opt) {
+            const res = await query(CONSUMPTION_SQL.compareAndSet, [key, expected, replacement, nowMs(), expiryFor(opt)]);
+            if (!res || typeof res.rowCount !== 'number') {
+                throw new Error('compareAndSet: query result has no numeric rowCount — cannot prove reservation ownership');
+            }
+            return res.rowCount === 1;
+        },
+        /** Remove only the reservation owned by the caller. */
+        async deleteIfValue(key, expected) {
+            const res = await query(CONSUMPTION_SQL.deleteIfValue, [key, expected]);
+            if (!res || typeof res.rowCount !== 'number') {
+                throw new Error('deleteIfValue: query result has no numeric rowCount — cannot prove reservation ownership');
+            }
+            return res.rowCount === 1;
+        },
+        /** Present = consumed. Expired-but-uncleaned rows still count (conservative). */
+        async has(key) {
+            const res = await query(CONSUMPTION_SQL.has, [key]);
+            return (res?.rows?.length ?? res?.rowCount ?? 0) > 0;
+        },
+        /** Garbage-collect rows whose TTL elapsed. Returns the number removed. */
+        async cleanupExpired(at) {
+            const cleanupAt = at === undefined ? nowMs() : checkedNow(at);
+            const res = await query(CONSUMPTION_SQL.cleanupExpired, [cleanupAt]);
+            return res?.rowCount ?? 0;
+        },
+    };
+}
+export default { createPostgresBackend, CONSUMPTION_TABLE_DDL, CONSUMPTION_TABLE, CONSUMPTION_SQL, PG_CONSUMPTION_VERSION };
+//# sourceMappingURL=store-postgres.js.map

package/dist/store-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-postgres.js","sourceRoot":"","sources":["../src/store-postgres.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAElE;+EAC+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAA8B,iBAAiB;;;;;;6BAMvD,iBAAiB;OACvC,iBAAiB,6CAA6C,CAAC;AAEtE;2DAC2D;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,MAAM,EAAE;wBACc,iBAAiB;kCACP,iBAAiB;iEACc,iBAAiB,mDAAmD;IACnI,qGAAqG;IACrG,WAAW,EAAE,eAAe,iBAAiB,qDAAqD;UAC9F,kEAAkE;IACtE,2FAA2F;IAC3F,aAAa,EAAE,UAAU,iBAAiB,qDAAqD;UAC3F,2CAA2C;IAC/C,iCAAiC;IACjC,aAAa,EAAE,eAAe,iBAAiB,4CAA4C;IAC3F,gFAAgF;IAChF,GAAG,EAAE,iBAAiB,iBAAiB,6BAA6B;IACpE,yFAAyF;IACzF,cAAc,EAAE,eAAe,iBAAiB,kCAAkC;UAC9E,iDAAiD;CACtD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,KAAK,EACL,GAAG,GAAG,IAAI,CAAC,GAAG,MAIZ,EAAE;IACJ,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wFAAwF;cACpG,kGAAkG,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC/C,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,EAAE;QAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,MAAM,eAAe,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,eAAe,GAAG,SAAS,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,KAAK,CAAC,MAAM;YACV,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI;gBACpE,OAAO,EAAE,sBAAsB;aAChC,CAAC;QACJ,CAAC;QACD,oFAAoF;QACpF,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG;YAC/B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5F,0EAA0E;YAC1E,8DAA8D;YAC9D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;YACnG,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,yDAAyD;QACzD,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG;YACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9G,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,uDAAuD;QACvD,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ;YAC/B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,iFAAiF;QACjF,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,IAAI,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,0EAA0E;QAC1E,KAAK,CAAC,cAAc,CAAC,EAAE;YACrB,MAAM,SAAS,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YACrE,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,95 @@
+/**
+ * @emilia-protocol/gate — consumption store (replay defense).
+ * @license Apache-2.0
+ *
+ * A receipt authorizes ONE action, once. The gate consumes a receipt's
+ * identifier the first time it is used; any later presentation of the same
+ * receipt is a replay and is refused. The in-memory store is an explicit
+ * test/demo opt-in; security-bearing gates use the durable contract below.
+ */
+export declare class MemoryConsumptionStore {
+    durable: boolean;
+    ownershipFenced: boolean;
+    permanentConsumption: boolean;
+    seen: Set<string>;
+    reserved: Set<string>;
+    constructor();
+    /** Returns true the FIRST time a key is seen, false on every replay. */
+    consume(key: any): Promise<boolean>;
+    /** Reserve an id while an action is in flight; blocks concurrent replay. */
+    reserve(key: any): Promise<boolean>;
+    /** Commit a reserved id after an external-effect attempt begins. */
+    commit(key: any): Promise<boolean>;
+    /** Release only when the caller can prove the external effect never began. */
+    release(key: any): Promise<boolean>;
+    has(key: any): Promise<boolean>;
+    get size(): number;
+}
+export declare const DURABLE_CONSUMPTION_VERSION = "EP-GATE-DURABLE-CONSUMPTION-v2";
+/** Capability contract required by security-bearing Gate execution paths. */
+export declare function isSecureConsumptionStore(store: any): boolean;
+/**
+ * Production custody for replay defense: a durable consumption store backed by
+ * any shared key-value backend (Redis, Postgres, DynamoDB, ...), so a receipt
+ * consumed on one pod/lambda cannot be replayed on another.
+ *
+ * The backend MUST provide atomic insert-if-absent plus atomic conditional
+ * transition and delete. Together they make replay defense and reservation
+ * ownership sound under concurrency:
+ *
+ *   backend = {
+ *     async addIfAbsent(key, value): boolean
+ *     async compareAndSet(key, expected, replacement): boolean
+ *     async deleteIfValue(key, expected): boolean
+ *     async has(key): boolean
+ *   }
+ *
+ * State per receipt id is a single ownership-fenced value. A reservation is
+ * `reserved:v2:<random token>` and only the store instance holding that token
+ * can commit or release it. This prevents a delayed worker from deleting or
+ * committing a newer worker's reservation after timeout/failover.
+ *
+ * Reservations deliberately receive NO TTL. A crash after an external effect
+ * has begun is an indeterminate outcome, and automatically reopening the key
+ * would permit a duplicate effect. Operators must reconcile abandoned
+ * reservations. `ttlSeconds` applies only after a value is committed, when the
+ * receipt's own freshness window independently prevents reuse.
+ */
+/**
+ * @param {any} backend
+ * @param {{ ttlSeconds?: number, reservationTokenFactory?: () => string }} [options]
+ */
+export declare function createDurableConsumptionStore(backend: any, { ttlSeconds, reservationTokenFactory }?: {
+    ttlSeconds?: number | null;
+    reservationTokenFactory?: () => string;
+}): {
+    durable: boolean;
+    ownershipFenced: boolean;
+    permanentConsumption: boolean;
+    retentionSeconds: number | null;
+    health(): Promise<any>;
+    reserve(key: any): Promise<boolean>;
+    commit(key: any): Promise<boolean>;
+    release(key: any): Promise<boolean>;
+    consume(key: any): Promise<boolean>;
+    has(key: any): Promise<boolean>;
+};
+/** In-memory reference backend (for tests/single-process). addIfAbsent is atomic in a single thread. */
+export declare function createMemoryBackend(): {
+    durable: boolean;
+    addIfAbsent(key: any, value: any): Promise<boolean>;
+    compareAndSet(key: any, expected: any, replacement: any): Promise<boolean>;
+    deleteIfValue(key: any, expected: any): Promise<boolean>;
+    has(key: any): Promise<boolean>;
+    get(key: any): Promise<any>;
+    readonly size: number;
+};
+declare const _default: {
+    MemoryConsumptionStore: typeof MemoryConsumptionStore;
+    createDurableConsumptionStore: typeof createDurableConsumptionStore;
+    createMemoryBackend: typeof createMemoryBackend;
+    isSecureConsumptionStore: typeof isSecureConsumptionStore;
+    DURABLE_CONSUMPTION_VERSION: string;
+};
+export default _default;
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;;IAUtB,wEAAwE;IAClE,OAAO,CAAC,GAAG,KAAA;IAMjB,4EAA4E;IACtE,OAAO,CAAC,GAAG,KAAA;IAMjB,oEAAoE;IAC9D,MAAM,CAAC,GAAG,KAAA;IAMhB,8EAA8E;IACxE,OAAO,CAAC,GAAG,KAAA;IAKX,GAAG,CAAC,GAAG,KAAA;IAIb,IAAI,IAAI,WAEP;CACF;AAED,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAE5E,6EAA6E;AAC7E,wBAAgB,wBAAwB,CAAC,KAAK,KAAA,WAQ7C;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,KAAA,EACP,EAAE,UAAU,EAAE,uBAAiD,EAAE,GAAE;IACjE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,uBAAuB,CAAC,EAAE,MAAM,MAAM,CAAC;CACnC;;;;;;;;;;;EAiEP;AAED,wGAAwG;AACxG,wBAAgB,mBAAmB;;;;;;;;EAkBlC;;;;;;;;AAED,wBAME"}

package/dist/store.js

@@ -0,0 +1,202 @@
+// @ts-nocheck
+/**
+ * @emilia-protocol/gate — consumption store (replay defense).
+ * @license Apache-2.0
+ *
+ * A receipt authorizes ONE action, once. The gate consumes a receipt's
+ * identifier the first time it is used; any later presentation of the same
+ * receipt is a replay and is refused. The in-memory store is an explicit
+ * test/demo opt-in; security-bearing gates use the durable contract below.
+ */
+export class MemoryConsumptionStore {
+    durable;
+    ownershipFenced;
+    permanentConsumption;
+    seen;
+    reserved;
+    constructor() {
+        this.durable = false;
+        this.ownershipFenced = false;
+        this.permanentConsumption = false;
+        this.seen = new Set();
+        this.reserved = new Set();
+    }
+    /** Returns true the FIRST time a key is seen, false on every replay. */
+    async consume(key) {
+        if (this.seen.has(key) || this.reserved.has(key))
+            return false;
+        this.seen.add(key);
+        return true;
+    }
+    /** Reserve an id while an action is in flight; blocks concurrent replay. */
+    async reserve(key) {
+        if (this.seen.has(key) || this.reserved.has(key))
+            return false;
+        this.reserved.add(key);
+        return true;
+    }
+    /** Commit a reserved id after an external-effect attempt begins. */
+    async commit(key) {
+        this.reserved.delete(key);
+        this.seen.add(key);
+        return true;
+    }
+    /** Release only when the caller can prove the external effect never began. */
+    async release(key) {
+        this.reserved.delete(key);
+        return true;
+    }
+    async has(key) {
+        return this.seen.has(key) || this.reserved.has(key);
+    }
+    get size() {
+        return this.seen.size;
+    }
+}
+export const DURABLE_CONSUMPTION_VERSION = 'EP-GATE-DURABLE-CONSUMPTION-v2';
+/** Capability contract required by security-bearing Gate execution paths. */
+export function isSecureConsumptionStore(store) {
+    if (!store || typeof store !== 'object')
+        return false;
+    return store.durable === true
+        && store.ownershipFenced === true
+        && store.permanentConsumption === true
+        && typeof store.consume === 'function'
+        && typeof store.reserve === 'function'
+        && typeof store.commit === 'function';
+}
+const COMMITTED_VALUE = 'committed:v2';
+const RESERVED_PREFIX = 'reserved:v2:';
+function defaultReservationToken() {
+    if (typeof globalThis.crypto?.randomUUID !== 'function') {
+        throw new Error('secure crypto.randomUUID() is required for durable reservation fencing');
+    }
+    return globalThis.crypto.randomUUID();
+}
+/**
+ * Production custody for replay defense: a durable consumption store backed by
+ * any shared key-value backend (Redis, Postgres, DynamoDB, ...), so a receipt
+ * consumed on one pod/lambda cannot be replayed on another.
+ *
+ * The backend MUST provide atomic insert-if-absent plus atomic conditional
+ * transition and delete. Together they make replay defense and reservation
+ * ownership sound under concurrency:
+ *
+ *   backend = {
+ *     async addIfAbsent(key, value): boolean
+ *     async compareAndSet(key, expected, replacement): boolean
+ *     async deleteIfValue(key, expected): boolean
+ *     async has(key): boolean
+ *   }
+ *
+ * State per receipt id is a single ownership-fenced value. A reservation is
+ * `reserved:v2:<random token>` and only the store instance holding that token
+ * can commit or release it. This prevents a delayed worker from deleting or
+ * committing a newer worker's reservation after timeout/failover.
+ *
+ * Reservations deliberately receive NO TTL. A crash after an external effect
+ * has begun is an indeterminate outcome, and automatically reopening the key
+ * would permit a duplicate effect. Operators must reconcile abandoned
+ * reservations. `ttlSeconds` applies only after a value is committed, when the
+ * receipt's own freshness window independently prevents reuse.
+ */
+/**
+ * @param {any} backend
+ * @param {{ ttlSeconds?: number, reservationTokenFactory?: () => string }} [options]
+ */
+export function createDurableConsumptionStore(backend, { ttlSeconds, reservationTokenFactory = defaultReservationToken } = {}) {
+    for (const m of ['addIfAbsent', 'compareAndSet', 'deleteIfValue', 'has']) {
+        if (typeof backend?.[m] !== 'function') {
+            throw new Error(`createDurableConsumptionStore: backend must implement async ${m}(). `
+                + 'addIfAbsent and conditional transitions MUST be atomic or replay defense is not fleet-safe.');
+        }
+    }
+    if (typeof reservationTokenFactory !== 'function') {
+        throw new Error('createDurableConsumptionStore: reservationTokenFactory must be a function');
+    }
+    if (ttlSeconds !== undefined && ttlSeconds !== null
+        && (!Number.isSafeInteger(ttlSeconds) || ttlSeconds <= 0)) {
+        throw new Error('createDurableConsumptionStore: ttlSeconds must be a positive safe integer when supplied');
+    }
+    const opt = ttlSeconds ? { ttlSeconds } : undefined;
+    const ownedReservations = new Map();
+    function ownedValue(key) {
+        const token = ownedReservations.get(key);
+        if (!token) {
+            throw new Error(`durable consumption transition refused: this store does not own reservation ${key}`);
+        }
+        return `${RESERVED_PREFIX}${token}`;
+    }
+    return {
+        durable: backend.durable === true,
+        ownershipFenced: true,
+        permanentConsumption: ttlSeconds === undefined || ttlSeconds === null,
+        retentionSeconds: ttlSeconds ?? null,
+        async health() {
+            if (typeof backend.health !== 'function')
+                return { ok: false, reason: 'backend_health_unavailable' };
+            return backend.health();
+        },
+        async reserve(key) {
+            const token = reservationTokenFactory();
+            if (typeof token !== 'string' || token.length < 16) {
+                throw new Error('reservationTokenFactory must return an unpredictable string of at least 16 characters');
+            }
+            const inserted = (await backend.addIfAbsent(key, `${RESERVED_PREFIX}${token}`)) === true;
+            if (inserted)
+                ownedReservations.set(key, token);
+            return inserted;
+        },
+        async commit(key) {
+            const expected = ownedValue(key);
+            const changed = await backend.compareAndSet(key, expected, COMMITTED_VALUE, opt);
+            if (changed !== true) {
+                throw new Error(`durable consumption commit refused: reservation ownership was lost for ${key}`);
+            }
+            ownedReservations.delete(key);
+            return true;
+        },
+        async release(key) {
+            const expected = ownedValue(key);
+            const deleted = await backend.deleteIfValue(key, expected);
+            ownedReservations.delete(key);
+            if (deleted !== true) {
+                throw new Error(`durable consumption release refused: reservation ownership was lost for ${key}`);
+            }
+            return true;
+        },
+        async consume(key) { return (await backend.addIfAbsent(key, COMMITTED_VALUE, opt)) === true; },
+        async has(key) { return (await backend.has(key)) === true; },
+    };
+}
+/** In-memory reference backend (for tests/single-process). addIfAbsent is atomic in a single thread. */
+export function createMemoryBackend() {
+    const map = new Map();
+    return {
+        durable: false,
+        async addIfAbsent(key, value) { if (map.has(key))
+            return false; map.set(key, value); return true; },
+        async compareAndSet(key, expected, replacement) {
+            if (map.get(key) !== expected)
+                return false;
+            map.set(key, replacement);
+            return true;
+        },
+        async deleteIfValue(key, expected) {
+            if (map.get(key) !== expected)
+                return false;
+            return map.delete(key);
+        },
+        async has(key) { return map.has(key); },
+        async get(key) { return map.get(key); },
+        get size() { return map.size; },
+    };
+}
+export default {
+    MemoryConsumptionStore,
+    createDurableConsumptionStore,
+    createMemoryBackend,
+    isSecureConsumptionStore,
+    DURABLE_CONSUMPTION_VERSION,
+};
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IACjC,OAAO,CAAU;IACjB,eAAe,CAAU;IACzB,oBAAoB,CAAU;IAC9B,IAAI,CAAc;IAClB,QAAQ,CAAc;IAEtB;QACE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;IAC5B,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAE5E,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CAAC,KAAK;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,KAAK,CAAC,OAAO,KAAK,IAAI;WACxB,KAAK,CAAC,eAAe,KAAK,IAAI;WAC9B,KAAK,CAAC,oBAAoB,KAAK,IAAI;WACnC,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU;WACnC,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU;WACnC,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC;AAC1C,CAAC;AAED,MAAM,eAAe,GAAG,cAAc,CAAC;AACvC,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC,SAAS,uBAAuB;IAC9B,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAO,EACP,EAAE,UAAU,EAAE,uBAAuB,GAAG,uBAAuB,KAG3D,EAAE;IAEN,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC;QACzE,IAAI,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,MAAM;kBAClF,6FAA6F,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,IAAI,OAAO,uBAAuB,KAAK,UAAU,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;WAC5C,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAE,CAAC;IAEpC,SAAS,UAAU,CAAC,GAAG;QACrB,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,+EAA+E,GAAG,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,GAAG,eAAe,GAAG,KAAK,EAAE,CAAC;IACtC,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;QACjC,eAAe,EAAE,IAAI;QACrB,oBAAoB,EAAE,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;QACrE,gBAAgB,EAAE,UAAU,IAAI,IAAI;QACpC,KAAK,CAAC,MAAM;YACV,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YACrG,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAC;YACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;YACzF,IAAI,QAAQ;gBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;YACjF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,0EAA0E,GAAG,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC3D,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,2EAA2E,GAAG,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QAC9F,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;IACtB,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QACnG,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW;YAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ;YAC/B,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC5C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,eAAe;IACb,sBAAsB;IACtB,6BAA6B;IAC7B,mBAAmB;IACnB,wBAAwB;IACxB,2BAA2B;CAC5B,CAAC"}

package/dist/strict-json.d.ts

@@ -0,0 +1,14 @@
+export declare const MAX_JSON_DEPTH = 64;
+export declare function strictJsonGate(raw: any): {
+    ok: boolean;
+    reason: string;
+} | {
+    ok: boolean;
+    reason?: undefined;
+};
+declare const _default: {
+    strictJsonGate: typeof strictJsonGate;
+    MAX_JSON_DEPTH: number;
+};
+export default _default;
+//# sourceMappingURL=strict-json.d.ts.map

package/dist/strict-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-json.d.ts","sourceRoot":"","sources":["../src/strict-json.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,cAAc,KAAK,CAAC;AAoBjC,wBAAgB,cAAc,CAAC,GAAG,KAAA;;;;;;EAwFjC;;;;;AAED,wBAAkD"}

package/dist/strict-json.js

@@ -0,0 +1,132 @@
+// @ts-nocheck
+// SPDX-License-Identifier: Apache-2.0
+// Duplicate-name and Unicode-scalar gate for signed nested JSON such as
+// WebAuthn clientDataJSON. JSON.parse remains the syntax gate.
+export const MAX_JSON_DEPTH = 64;
+function hasUnpairedUtf16Surrogate(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (next < 0xdc00 || next > 0xdfff)
+                return true;
+            index += 1;
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff) {
+            return true;
+        }
+    }
+    return false;
+}
+export function strictJsonGate(raw) {
+    if (typeof raw !== 'string')
+        return { ok: false, reason: 'JSON input must be text' };
+    if (hasUnpairedUtf16Surrogate(raw)) {
+        return { ok: false, reason: 'unpaired Unicode surrogate' };
+    }
+    try {
+        JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, reason: 'invalid JSON syntax' };
+    }
+    let index = 0;
+    const stack = [];
+    let reason = null;
+    const escapes = { '"': '"', '\\': '\\', '/': '/', b: '\b', f: '\f', n: '\n', r: '\r', t: '\t' };
+    function readString() {
+        index += 1;
+        let output = '';
+        while (index < raw.length) {
+            const character = raw[index];
+            if (character === '"') {
+                index += 1;
+                return output;
+            }
+            if (character !== '\\') {
+                output += character;
+                index += 1;
+                continue;
+            }
+            const escape = raw[index + 1];
+            if (escape !== 'u') {
+                output += escapes[escape] ?? '';
+                index += 2;
+                continue;
+            }
+            const first = Number.parseInt(raw.slice(index + 2, index + 6), 16);
+            index += 6;
+            if (first >= 0xd800 && first <= 0xdbff) {
+                if (raw[index] === '\\' && raw[index + 1] === 'u') {
+                    const second = Number.parseInt(raw.slice(index + 2, index + 6), 16);
+                    if (second >= 0xdc00 && second <= 0xdfff) {
+                        output += String.fromCharCode(first, second);
+                        index += 6;
+                        continue;
+                    }
+                }
+                reason = 'unpaired high surrogate escape';
+                return null;
+            }
+            if (first >= 0xdc00 && first <= 0xdfff) {
+                reason = 'unpaired low surrogate escape';
+                return null;
+            }
+            output += String.fromCharCode(first);
+        }
+        reason = 'unterminated string';
+        return null;
+    }
+    while (index < raw.length) {
+        const character = raw[index];
+        if (character === '{') {
+            stack.push({ object: true, keys: new Set(), expectsKey: true });
+            if (stack.length > MAX_JSON_DEPTH)
+                return { ok: false, reason: `nesting depth exceeds ${MAX_JSON_DEPTH}` };
+            index += 1;
+        }
+        else if (character === '[') {
+            stack.push({ object: false });
+            if (stack.length > MAX_JSON_DEPTH)
+                return { ok: false, reason: `nesting depth exceeds ${MAX_JSON_DEPTH}` };
+            index += 1;
+        }
+        else if (character === '}' || character === ']') {
+            stack.pop();
+            index += 1;
+        }
+        else if (character === ',') {
+            const top = stack.at(-1);
+            if (top?.object)
+                top.expectsKey = true;
+            index += 1;
+        }
+        else if (character === '"') {
+            const top = stack.at(-1);
+            const isKey = Boolean(top?.object && top.expectsKey);
+            const value = readString();
+            if (reason)
+                return { ok: false, reason };
+            if (isKey) {
+                // `isKey` is only true when `top?.object && top.expectsKey` held above,
+                // which guarantees `top` is a defined object-frame here; narrow the
+                // type for the compiler without altering the runtime reference.
+                const frame = top;
+                // `readString()` only ever returns null on a path that also sets
+                // `reason`, and the `if (reason) return` above already exited in
+                // that case, so `value` is guaranteed to be a string here.
+                const key = value;
+                if (frame.keys.has(key))
+                    return { ok: false, reason: 'duplicate object member name' };
+                frame.keys.add(key);
+                frame.expectsKey = false;
+            }
+        }
+        else {
+            index += 1;
+        }
+    }
+    return { ok: true };
+}
+export default { strictJsonGate, MAX_JSON_DEPTH };
+//# sourceMappingURL=strict-json.js.map

package/dist/strict-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-json.js","sourceRoot":"","sources":["../src/strict-json.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,wEAAwE;AACxE,+DAA+D;AAE/D,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,SAAS,yBAAyB,CAAC,KAAK;IACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,IAAI,GAAG,MAAM,IAAI,IAAI,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YAChD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAMD,MAAM,UAAU,cAAc,CAAC,GAAG;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACrF,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAAC,CAAC;IACvF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IAEhG,SAAS,UAAU;QACjB,KAAK,IAAI,CAAC,CAAC;QACX,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,IAAI,CAAC,CAAC;gBAAC,OAAO,MAAM,CAAC;YAAC,CAAC;YACrD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBAAC,MAAM,IAAI,SAAS,CAAC;gBAAC,KAAK,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACtE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChC,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;gBACvC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAClD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpE,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;wBACzC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;wBAC7C,KAAK,IAAI,CAAC,CAAC;wBACX,SAAS;oBACX,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,gCAAgC,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;gBACvC,MAAM,GAAG,+BAA+B,CAAC;gBACzC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,GAAG,qBAAqB,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,EAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,cAAc,EAAE,EAAE,CAAC;YAC3G,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,cAAc,EAAE,EAAE,CAAC;YAC3G,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAClD,KAAK,CAAC,GAAG,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,GAAG,EAAE,MAAM;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;YACvC,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;YAC3B,IAAI,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,CAAC;gBACV,wEAAwE;gBACxE,oEAAoE;gBACpE,gEAAgE;gBAChE,MAAM,KAAK,GAAG,GAAsB,CAAC;gBACrC,iEAAiE;gBACjE,iEAAiE;gBACjE,2DAA2D;gBAC3D,MAAM,GAAG,GAAG,KAAe,CAAC;gBAC5B,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;gBACtF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;YAC3B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC"}