@floegence/flowersec-core 2.1.0 → 2.3.0

package/README.md

@@ -2,19 +2,19 @@
 
 `@floegence/flowersec-core` is the ESM-only Flowersec v2 SDK for browsers and Node.js. Its public package surface is limited to the root, `/browser`, `/node`, and `/proxy` entrypoints.
 
-Flowersec 2.1.0 is the coordinated TypeScript SDK release.
+Flowersec 2.3.0 is the coordinated TypeScript SDK release.
 
 ## Install
 
 ```bash
-npm install @floegence/flowersec-core@2.1.0
+npm install @floegence/flowersec-core@2.3.0
 ```
 
 ## Public API
 
 - `@floegence/flowersec-core` exports the portable artifact, lease, session, stream, RPC, stream-metadata, and connection-controller API, plus profile-owned unreliable messages when negotiated.
 - `@floegence/flowersec-core/browser` adds `connect(...)`, `createConnectionController(...)`, and their options.
-- `@floegence/flowersec-core/node` adds `connect(...)`, `createConnectionController(...)`, and their options.
+- `@floegence/flowersec-core/node` adds `connect(...)`, `createConnectionController(...)`, `createAcceptor(...)`, `SessionHandlers`, and `AcceptedSession`.
 - `@floegence/flowersec-core/proxy` adds the `Session`-based HTTP/WebSocket runtime, Service Worker and controller/app-window bridges, strict `proxy.runtime@2` validation, and `connectProxyBrowser(...)` composition.
 
 The root type exports are:
@@ -52,8 +52,10 @@ carrier-neutral sessions, RPC, reliable streams, redacted public errors, and
 the optional single-owner `ConnectionController`. Callers should not compare
 raw TypeScript error-code strings with other SDKs.
 
-Only this portable core is required to align across languages. Complete SDK
-profiles and language conveniences intentionally differ by runtime.
+Portable core, connection control, session/RPC/stream lifecycle, accepted-session
+workflows, and published consumer workflows align across every applicable SDK.
+Platform-limited profiles are unsupported only with an explicit alternative
+boundary and executable test ID in `stability/language_capabilities.json`.
 
 The TypeScript SDK profile is split by entrypoint: browsers own WebSocket and
 WebTransport dialing, while Node.js owns WebSocket and WebTransport dialing through

package/dist/connector/sessionAcceptor.d.ts

@@ -1,6 +1,7 @@
 import { AdmissionStatusV2, type ArtifactV2, type DecodedFSB2RequestV2 } from "../v2/artifact.js";
 import { type NativeCarrierSessionV2 } from "../v2/carrier.js";
 import type { SessionProtocolRuntimeV2, SessionV2 as InternalSessionV2 } from "../v2/session.js";
+import type { RpcRouter } from "../rpc/server.js";
 export type AdmissionDecisionV2 = Readonly<{
     accepted: true;
     artifact: ArtifactV2;
@@ -12,5 +13,6 @@ export type AdmissionDecisionV2 = Readonly<{
 export type AdmissionAuthorizerV2 = (request: DecodedFSB2RequestV2, signal?: AbortSignal) => Promise<AdmissionDecisionV2>;
 export declare function acceptNativeSessionV2(carrier: NativeCarrierSessionV2, authorize: AdmissionAuthorizerV2, options: Readonly<{
     runtime: SessionProtocolRuntimeV2;
+    rpcRouter?: RpcRouter;
     signal?: AbortSignal;
 }>): Promise<InternalSessionV2>;

package/dist/connector/sessionAcceptor.js

@@ -1,4 +1,4 @@
-import { AdmissionStatusV2, decodeFSB2RequestV2, encodeFSA2ResponseV2, } from "../v2/artifact.js";
+import { AdmissionStatusV2, buildFSB2RequestV2, decodeFSB2RequestV2, encodeFSB2RequestV2, encodeFSA2ResponseV2, } from "../v2/artifact.js";
 import { adaptNativeCarrierSessionV2 } from "../v2/carrier.js";
 import { establishSessionV2 } from "../v2/session.js";
 import { AdmissionSessionV2Error } from "../v2/admissionError.js";
@@ -11,6 +11,11 @@ export async function acceptNativeSessionV2(carrier, authorize, options) {
         const rawFSB2 = await readFSB2(admission, options.signal);
         const decoded = decodeFSB2RequestV2(rawFSB2);
         const decision = await authorize(decoded, options.signal);
+        if (decision.accepted) {
+            const expected = encodeFSB2RequestV2(buildFSB2RequestV2(decision.artifact, decoded.request.chosen_candidate_id));
+            if (!equalBytes(expected, rawFSB2))
+                throw new Error("authorized artifact does not match admission");
+        }
         const response = decision.accepted
             ? { status: AdmissionStatusV2.Success, reason: "" }
             : { status: decision.status, reason: decision.reason };
@@ -19,7 +24,8 @@ export async function acceptNativeSessionV2(carrier, authorize, options) {
         if (!decision.accepted) {
             throw new AdmissionSessionV2Error(decision.reason, `Flowersec v2 admission rejected: ${decision.reason}`);
         }
-        return await establishSessionV2(adaptNativeCarrierSessionV2(carrier), sessionConfigFromArtifactV2(decision.artifact, rawFSB2, options.runtime, undefined, "server"), signalOptions(options.signal));
+        const config = sessionConfigFromArtifactV2(decision.artifact, rawFSB2, options.runtime, undefined, "server");
+        return await establishSessionV2(adaptNativeCarrierSessionV2(carrier), options.rpcRouter === undefined ? config : { ...config, rpcRouter: options.rpcRouter }, signalOptions(options.signal));
     }
     catch (error) {
         admission.abort(asError(error));
@@ -27,6 +33,14 @@ export async function acceptNativeSessionV2(carrier, authorize, options) {
         throw error;
     }
 }
+function equalBytes(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < left.length; index += 1)
+        difference |= left[index] ^ right[index];
+    return difference === 0;
+}
 async function readFSB2(stream, signal) {
     const reader = new NativeReader(stream);
     const header = await reader.readExactly(12, signal);

package/dist/node/acceptor.d.ts

@@ -0,0 +1,64 @@
+import { type Artifact } from "../public/artifact.js";
+import { type IncomingStream, type JsonValue, type OperationOptions, type Session } from "../public/contract.js";
+export declare class RuntimeAuthorizationRequest {
+    readonly lookupKey: string;
+    private readonly requestBrand;
+    private constructor();
+}
+export type AuthorizationDecision = Readonly<{
+    decision: "allow";
+    artifact: Artifact;
+}> | Readonly<{
+    decision: "reject" | "retry";
+    reason: string;
+}>;
+export type RPCHandlerResult = Readonly<{
+    payload: JsonValue;
+}> | Readonly<{
+    error: Readonly<{
+        code: number;
+        message?: string;
+    }>;
+}>;
+export type RPCHandler = (payload: JsonValue, request: Readonly<{
+    typeId: number;
+}>) => Promise<RPCHandlerResult>;
+export type StreamHandler = (incoming: IncomingStream, options: OperationOptions) => Promise<void>;
+export type SessionHandlerOptions = Readonly<{
+    maxConcurrentStreams?: number;
+}>;
+export declare class SessionHandlersError extends Error {
+    readonly code: "invalid_handler" | "already_registered" | "frozen";
+    constructor(code: "invalid_handler" | "already_registered" | "frozen");
+}
+export declare class SessionHandlers {
+    constructor(options?: SessionHandlerOptions);
+    handleRPC(typeId: number, handler: RPCHandler): void;
+    handleStream(kind: string, handler: StreamHandler): void;
+}
+export type AcceptorOptions = Readonly<{
+    host: string;
+    port: number;
+    path: string;
+    certificate: string;
+    privateKey: string;
+    maxInboundStreams: number;
+    authorize(request: RuntimeAuthorizationRequest, options: OperationOptions): Promise<AuthorizationDecision>;
+    resolveHandlers?(request: RuntimeAuthorizationRequest, options: OperationOptions): Promise<SessionHandlers> | SessionHandlers;
+}>;
+export declare class AcceptedSession {
+    private constructor();
+    get session(): Session;
+    serve(options?: OperationOptions): Promise<void>;
+    close(): Promise<void>;
+}
+export declare class Acceptor {
+    private constructor();
+    address(): Readonly<{
+        host: string;
+        port: number;
+    }>;
+    accept(operation?: OperationOptions): Promise<AcceptedSession>;
+    close(): Promise<void>;
+}
+export declare function createAcceptor(options: AcceptorOptions): Promise<Acceptor>;

package/dist/node/acceptor.js

@@ -0,0 +1,208 @@
+import { sha256 } from "@noble/hashes/sha256";
+import { RpcRouter } from "../rpc/server.js";
+import { acceptNativeSessionV2 } from "../connector/sessionAcceptor.js";
+import { nodeSessionRuntimeV2 } from "./sessionRuntime.js";
+import { startNodeWebTransportServerV2, } from "./webTransportServer.js";
+import { unwrapArtifact } from "../public/artifact.js";
+import { SessionError, } from "../public/contract.js";
+import { projectSessionV2 } from "../v2/publicSession.js";
+import { base64urlEncode } from "../utils/base64url.js";
+const DEFAULT_MAX_CONCURRENT_STREAMS = 64;
+const MAX_CONCURRENT_STREAMS = 128;
+const encoder = new TextEncoder();
+export class RuntimeAuthorizationRequest {
+    lookupKey;
+    constructor(lookupKey) {
+        this.lookupKey = lookupKey;
+    }
+}
+export class SessionHandlersError extends Error {
+    code;
+    constructor(code) {
+        super(`Flowersec session handler registration failed (code=${code})`);
+        this.code = code;
+        this.name = "SessionHandlersError";
+    }
+}
+export class SessionHandlers {
+    constructor(options = {}) {
+        const maximum = options.maxConcurrentStreams ?? DEFAULT_MAX_CONCURRENT_STREAMS;
+        if (!Number.isSafeInteger(maximum) || maximum < 1 || maximum > MAX_CONCURRENT_STREAMS) {
+            throw new SessionHandlersError("invalid_handler");
+        }
+        sessionHandlerStates.set(this, {
+            maxConcurrentStreams: maximum,
+            rpc: new Map(),
+            streams: new Map(),
+            frozen: false,
+        });
+    }
+    handleRPC(typeId, handler) {
+        const state = mutableHandlerState(this);
+        if (!Number.isSafeInteger(typeId) || typeId < 1 || typeId > 0xffff_ffff || typeof handler !== "function") {
+            throw new SessionHandlersError("invalid_handler");
+        }
+        if (state.rpc.has(typeId))
+            throw new SessionHandlersError("already_registered");
+        state.rpc.set(typeId, handler);
+    }
+    handleStream(kind, handler) {
+        const state = mutableHandlerState(this);
+        if (kind.length < 1 || encoder.encode(kind).length > 255 || kind === "flowersec.rpc.v2" || typeof handler !== "function") {
+            throw new SessionHandlersError("invalid_handler");
+        }
+        if (state.streams.has(kind))
+            throw new SessionHandlersError("already_registered");
+        state.streams.set(kind, handler);
+    }
+}
+const sessionHandlerStates = new WeakMap();
+function mutableHandlerState(handlers) {
+    const state = sessionHandlerStates.get(handlers);
+    if (state === undefined)
+        throw new SessionHandlersError("invalid_handler");
+    if (state.frozen)
+        throw new SessionHandlersError("frozen");
+    return state;
+}
+function freezeHandlers(handlers, router) {
+    const state = mutableHandlerState(handlers);
+    state.frozen = true;
+    for (const [typeId, handler] of state.rpc) {
+        router.register(typeId, async (payload) => {
+            const result = await handler(payload, Object.freeze({ typeId }));
+            if ("error" in result)
+                return { payload: null, error: validRPCError(result.error) };
+            return { payload: result.payload };
+        });
+    }
+    return Object.freeze({
+        maxConcurrentStreams: state.maxConcurrentStreams,
+        streams: new Map(state.streams),
+    });
+}
+export class AcceptedSession {
+    constructor() { }
+    get session() {
+        return acceptedSessionState(this).session;
+    }
+    async serve(options = {}) {
+        const active = new Set();
+        const state = acceptedSessionState(this);
+        try {
+            while (true) {
+                if (options.signal?.aborted)
+                    throw new SessionError("canceled");
+                const incoming = await this.session.acceptStream(options);
+                const handler = state.handlers.streams.get(incoming.kind);
+                if (handler === undefined || active.size >= state.handlers.maxConcurrentStreams) {
+                    await incoming.stream.reset();
+                    continue;
+                }
+                const task = handler(incoming, options)
+                    .finally(() => incoming.stream.close())
+                    .finally(() => active.delete(task));
+                active.add(task);
+            }
+        }
+        finally {
+            await this.session.close().catch(() => undefined);
+            await Promise.allSettled(active);
+        }
+    }
+    async close() {
+        await this.session.close();
+    }
+}
+const acceptedSessionStates = new WeakMap();
+function acceptedSessionState(accepted) {
+    const state = acceptedSessionStates.get(accepted);
+    if (state === undefined)
+        throw new SessionError("operation_failed");
+    return state;
+}
+function createAcceptedSession(session, handlers) {
+    const accepted = new AcceptedSession();
+    acceptedSessionStates.set(accepted, { session, handlers });
+    return Object.freeze(accepted);
+}
+export class Acceptor {
+    constructor() { }
+    address() {
+        return acceptorState(this).server.address();
+    }
+    async accept(operation = {}) {
+        const state = acceptorState(this);
+        const carrier = await state.server.accept(operation);
+        const router = new RpcRouter();
+        let handlers;
+        const internal = await acceptNativeSessionV2(carrier, async (decoded, signal) => {
+            const request = runtimeAuthorizationRequest(decoded);
+            const decision = await state.options.authorize(request, signal === undefined ? {} : { signal });
+            if (decision.decision !== "allow") {
+                return {
+                    accepted: false,
+                    status: decision.decision === "retry" ? 2 : 1,
+                    reason: decision.reason,
+                };
+            }
+            const registry = state.options.resolveHandlers === undefined
+                ? new SessionHandlers()
+                : await state.options.resolveHandlers(request, signal === undefined ? {} : { signal });
+            handlers = freezeHandlers(registry, router);
+            return { accepted: true, artifact: unwrapArtifact(decision.artifact) };
+        }, {
+            runtime: nodeSessionRuntimeV2,
+            rpcRouter: router,
+            ...(operation.signal === undefined ? {} : { signal: operation.signal }),
+        });
+        if (handlers === undefined) {
+            await internal.close().catch(() => undefined);
+            throw new SessionError("operation_failed");
+        }
+        return createAcceptedSession(projectSessionV2(internal), handlers);
+    }
+    async close() {
+        await acceptorState(this).server.close();
+    }
+}
+const acceptorStates = new WeakMap();
+function acceptorState(acceptor) {
+    const state = acceptorStates.get(acceptor);
+    if (state === undefined)
+        throw new SessionError("operation_failed");
+    return state;
+}
+export async function createAcceptor(options) {
+    if (!Number.isSafeInteger(options.maxInboundStreams) || options.maxInboundStreams < 1 || options.maxInboundStreams > 128) {
+        throw new TypeError("invalid Flowersec Acceptor options");
+    }
+    const server = await startNodeWebTransportServerV2({
+        host: options.host,
+        port: options.port,
+        path: options.path,
+        certificate: options.certificate,
+        privateKey: options.privateKey,
+        carrierPath: "direct",
+        inboundBidirectionalStreamCapacity: options.maxInboundStreams + 2,
+    });
+    const acceptor = new Acceptor();
+    acceptorStates.set(acceptor, { server, options });
+    return Object.freeze(acceptor);
+}
+function runtimeAuthorizationRequest(decoded) {
+    const credential = decoded.request.pathKind === "direct"
+        ? decoded.request.routing_token
+        : decoded.request.attach_token;
+    const lookupKey = base64urlEncode(sha256(encoder.encode(credential)));
+    return new RuntimeAuthorizationRequest(lookupKey);
+}
+function validRPCError(error) {
+    if (!Number.isSafeInteger(error.code) || error.code < 1 || error.code > 0xffff_ffff) {
+        return { code: 500, message: "handler failed" };
+    }
+    if (error.message !== undefined && encoder.encode(error.message).length > 1024) {
+        return { code: 500, message: "handler failed" };
+    }
+    return error.message === undefined ? { code: error.code } : { code: error.code, message: error.message };
+}

package/dist/node/index.d.ts

@@ -1,3 +1,5 @@
 export { connect, createConnectionController } from "./connectSession.js";
+export { AcceptedSession, Acceptor, RuntimeAuthorizationRequest, SessionHandlers, SessionHandlersError, createAcceptor, } from "./acceptor.js";
+export type { AcceptorOptions, AuthorizationDecision, RPCHandler, RPCHandlerResult, SessionHandlerOptions, StreamHandler, } from "./acceptor.js";
 export type { ConnectionControllerOptions, SessionOptions, SessionTLSOptions, } from "./connectSession.js";
 export * from "../facade.js";

package/dist/node/index.js

@@ -1,2 +1,3 @@
 export { connect, createConnectionController } from "./connectSession.js";
+export { AcceptedSession, Acceptor, RuntimeAuthorizationRequest, SessionHandlers, SessionHandlersError, createAcceptor, } from "./acceptor.js";
 export * from "../facade.js";

package/dist/v2/artifact.js

@@ -454,12 +454,17 @@ function normalizeCandidateURL(kind, carrier, raw) {
         default:
             throw invalidCandidate("carrier registry");
     }
-    if (scheme !== expectedScheme)
+    const loopbackPlaintext = carrier === "websocket" && scheme === "ws" && kind === "direct" && isLoopbackHost(normalizedAuthority);
+    if (scheme !== expectedScheme && !loopbackPlaintext)
         throw invalidCandidate("carrier scheme");
     if (carrier !== "raw_quic" && path !== expectedPath)
         throw invalidCandidate("carrier URL path");
     return `${scheme}://${normalizedAuthority}${path}`;
 }
+function isLoopbackHost(authority) {
+    const host = authority.startsWith("[") ? authority.slice(1, authority.indexOf("]")) : authority.split(":")[0];
+    return host === "127.0.0.1" || host === "::1";
+}
 function normalizeAuthority(authority) {
     let host;
     let portText = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3a3de657-a6c7-5262-8788-686263f18f4a",
+  "serialNumber": "urn:uuid:cf8e8ff3-da93-5d33-8d7d-3757e60b3f70",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "2.1.0",
-      "purl": "pkg:npm/%40floegence/flowersec-core@2.1.0",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.1.0"
+      "version": "2.3.0",
+      "purl": "pkg:npm/%40floegence/flowersec-core@2.3.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.3.0"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "212330df6f0cfcf64ebc4710f73833ffa6d31e4701a246e8b1f4a6a6f74418f8"
+        "value": "ff5c9ce47b84ad4cc8a7e9ca5d1605dbaaeaae54743cb071442e146cbc1ca912"
       }
     ]
   },
@@ -2290,7 +2290,7 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@2.1.0",
+      "ref": "pkg:npm/%40floegence/flowersec-core@2.3.0",
       "dependsOn": [
         "pkg:npm/%40fails-components/webtransport-transport-http3-quiche@1.6.7",
         "pkg:npm/%40fails-components/webtransport@1.6.7",

package/sbom/spdx.json

@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "flowersec-ts",
-  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/212330df6f0cfcf64ebc4710f73833ffa6d31e4701a246e8b1f4a6a6f74418f8",
+  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/ff5c9ce47b84ad4cc8a7e9ca5d1605dbaaeaae54743cb071442e146cbc1ca912",
   "creationInfo": {
     "created": "1970-01-01T00:00:00Z",
     "creators": [
@@ -13,19 +13,19 @@
   "packages": [
     {
       "name": "@floegence/flowersec-core",
-      "SPDXID": "SPDXRef-Package-e11fb24ba960cd06eb83",
-      "versionInfo": "2.1.0",
+      "SPDXID": "SPDXRef-Package-7a598ff0897002980d8f",
+      "versionInfo": "2.3.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "NOASSERTION",
       "copyrightText": "NOASSERTION",
-      "comment": "Flowersec source inventory SHA-256: 212330df6f0cfcf64ebc4710f73833ffa6d31e4701a246e8b1f4a6a6f74418f8",
+      "comment": "Flowersec source inventory SHA-256: ff5c9ce47b84ad4cc8a7e9ca5d1605dbaaeaae54743cb071442e146cbc1ca912",
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@2.1.0"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@2.3.0"
         }
       ]
     },
@@ -1411,7 +1411,7 @@
     {
       "spdxElementId": "SPDXRef-DOCUMENT",
       "relationshipType": "DESCRIBES",
-      "relatedSpdxElement": "SPDXRef-Package-e11fb24ba960cd06eb83"
+      "relatedSpdxElement": "SPDXRef-Package-7a598ff0897002980d8f"
     },
     {
       "spdxElementId": "SPDXRef-Package-789c0f508771e385c5e8",
@@ -1459,37 +1459,37 @@
       "relatedSpdxElement": "SPDXRef-Package-1a7f123f21a1eaf4fd69"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e11fb24ba960cd06eb83",
+      "spdxElementId": "SPDXRef-Package-7a598ff0897002980d8f",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-789c0f508771e385c5e8"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e11fb24ba960cd06eb83",
+      "spdxElementId": "SPDXRef-Package-7a598ff0897002980d8f",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-4b35e4821b43dc47a168"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e11fb24ba960cd06eb83",
+      "spdxElementId": "SPDXRef-Package-7a598ff0897002980d8f",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-24f128c8779cacb70e46"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e11fb24ba960cd06eb83",
+      "spdxElementId": "SPDXRef-Package-7a598ff0897002980d8f",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-6a42d288421aaee354ff"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e11fb24ba960cd06eb83",
+      "spdxElementId": "SPDXRef-Package-7a598ff0897002980d8f",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-d976986d5d79eddc7789"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e11fb24ba960cd06eb83",
+      "spdxElementId": "SPDXRef-Package-7a598ff0897002980d8f",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-f8b45a289df643042b94"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e11fb24ba960cd06eb83",
+      "spdxElementId": "SPDXRef-Package-7a598ff0897002980d8f",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-38fe7b92bdac2a86fb61"
     },