@floegence/flowersec-core 2.4.2 → 2.5.1

package/README.md

@@ -65,6 +65,20 @@ const session = await controller.waitForSession();
 The immutable callback definition applies to every generation, while each
 Session gets a fresh router. Terminated Session work is never replayed.
 
+### Application streams on any Session
+
+```ts
+import { StreamHandlers } from "@floegence/flowersec-core";
+
+const streamHandlers = new StreamHandlers({ maxConcurrentStreams: 32 });
+streamHandlers.handleStream("files/read", async (incoming) => serveFile(incoming));
+await streamHandlers.serve(session);
+```
+
+The portable root, browser, and Node entrypoints share this dispatcher. The
+sealed registrar used by Node `ProxyServer.register(...)` is exported only from
+the Node entrypoint.
+
 For the complete durable `ArtifactLease` spend workflow, see the
 [TypeScript cookbook](../examples/ts/README.md). Node raw-QUIC-only artifacts
 may omit `origin`; providing an absolute HTTP(S) origin enables WebSocket
@@ -98,7 +112,7 @@ The Browser and Node `connect(...)` operations are one-shot and never reconnect.
 
 The controller has one scheduler and one in-flight attempt. Its states are `idle`, `connecting`, `connected`, `waiting`, `failed`, and `closed`; immutable snapshots expose `ConnectionSnapshot.retryDisposition` while the corresponding retry decision applies and clear it before a new attempt, after connection, and on close. Call `start()` once, observe snapshots with `subscribe(...)`, await an established session with `waitForSession(...)`, and use `retryNow()` only to wake a `waiting` controller. `close()` cancels acquisition, connection, and waiting before closing the current session.
 
-Node `SessionHandlers` accept application stream kinds whose UTF-8 encoding is 1 through 255 bytes and reserve `flowersec.rpc.v2` for Flowersec RPC. `AcceptedSession.serve(...)` half-closes successfully handled streams. A rejected handler Promise resets only that stream; the accept loop and unrelated streams continue.
+`StreamHandlers` and Node `SessionHandlers` accept application stream kinds containing 1 through 128 canonical UTF-8 bytes, reject leading or trailing Unicode whitespace, controls, and unassigned scalars, and reserve `flowersec.rpc.v2` for Flowersec RPC. Successful handlers half-close their stream. A rejected handler Promise resets only that stream; the accept loop and unrelated streams continue.
 
 Reliable streams apply bounded per-stream receive backpressure instead of buffering application data without limit. A slow consumer pauses carrier progress until reads release capacity; records retain carrier order, so a rekey behind backpressured DATA completes after the consumer resumes. `closeWrite()` sends the graceful FIN and keeps reads available. `reset()` and `close()` abort both directions. If a write is canceled or fails after its wire commit may have started, only that stream becomes terminal and cannot be reused.
 

package/dist/facade.d.ts

@@ -2,6 +2,8 @@ export type { ByteStream, IncomingStream, JsonObject, JsonPrimitive, JsonValue,
 export { SessionError, UnreliableMessageError } from "./public/contract.js";
 export { createStreamMetadata, StreamMetadataError } from "./public/streamMetadata.js";
 export type { StreamMetadata } from "./public/streamMetadata.js";
+export { HandlerRegistrationError, StreamHandlers, } from "./public/streamHandlers.js";
+export type { StreamHandler, StreamHandlerOptions, } from "./public/streamHandlers.js";
 export { ArtifactLeaseError, createArtifactLease, } from "./public/artifactLease.js";
 export type { ArtifactLease } from "./public/artifactLease.js";
 export { Artifact, ArtifactError, parseArtifact } from "./public/artifact.js";

package/dist/facade.js

@@ -1,5 +1,6 @@
 export { SessionError, UnreliableMessageError } from "./public/contract.js";
 export { createStreamMetadata, StreamMetadataError } from "./public/streamMetadata.js";
+export { HandlerRegistrationError, StreamHandlers, } from "./public/streamHandlers.js";
 export { ArtifactLeaseError, createArtifactLease, } from "./public/artifactLease.js";
 export { Artifact, ArtifactError, parseArtifact } from "./public/artifact.js";
 export { ConnectError } from "./public/connectError.js";

package/dist/node/acceptor.d.ts

@@ -1,6 +1,9 @@
-import { type IncomingStream, type JsonValue, type OperationOptions, type Session } from "../public/contract.js";
+import { type JsonValue, type OperationOptions, type Session } from "../public/contract.js";
 import { type DirectAuthorizationDecision, type RuntimeAuthorizationRequest } from "./controlplane.js";
+import { type StreamHandler, type StreamHandlerOptions } from "../public/streamHandlers.js";
 export type { RuntimeAuthorizationRequest } from "./controlplane.js";
+export { HandlerRegistrationError } from "../public/streamHandlers.js";
+export type { StreamHandler } from "../public/streamHandlers.js";
 export type AuthorizationDecision = DirectAuthorizationDecision;
 export type RPCHandlerResult = Readonly<{
     payload: JsonValue;
@@ -16,20 +19,14 @@ export type RPCHandler = (payload: JsonValue, request: Readonly<{
 export type NotificationHandler = (payload: JsonValue, request: Readonly<{
     typeId: number;
 }>) => Promise<void> | void;
-export type StreamHandler = (incoming: IncomingStream, options: OperationOptions) => Promise<void>;
-export type SessionHandlerOptions = Readonly<{
-    maxConcurrentStreams?: number;
-}>;
-export declare class HandlerRegistrationError extends Error {
-    readonly code: "invalid_handler" | "already_registered" | "frozen";
-    constructor(code: "invalid_handler" | "already_registered" | "frozen");
-}
+export type SessionHandlerOptions = StreamHandlerOptions;
 export declare class RPCHandlers {
     constructor();
     handleRPC(typeId: number, handler: RPCHandler): void;
     handleNotification(typeId: number, handler: NotificationHandler): void;
 }
 export declare class SessionHandlers {
+    private readonly streamHandlerRegistrarBrand;
     constructor(options?: SessionHandlerOptions);
     handleRPC(typeId: number, handler: RPCHandler): void;
     handleNotification(typeId: number, handler: NotificationHandler): void;

package/dist/node/acceptor.js

@@ -9,18 +9,9 @@ import { unwrapArtifact } from "../public/artifact.js";
 import { SessionError, } from "../public/contract.js";
 import { projectSessionV2 } from "../v2/publicSession.js";
 import { runtimeAuthorizationRequestFromDecoded, } from "./controlplane.js";
-const DEFAULT_MAX_CONCURRENT_STREAMS = 64;
-const MAX_CONCURRENT_STREAMS = 128;
+import { HandlerRegistrationError, StreamHandlers, freezeStreamHandlers, registerStreamHandlersAtomically, serveFrozenStreamHandlers, } from "../public/streamHandlers.js";
+export { HandlerRegistrationError } from "../public/streamHandlers.js";
 const DEFAULT_CLEANUP_TIMEOUT_MS = 2_000;
-const encoder = new TextEncoder();
-export class HandlerRegistrationError extends Error {
-    code;
-    constructor(code) {
-        super(`Flowersec handler registration failed (code=${code})`);
-        this.code = code;
-        this.name = "HandlerRegistrationError";
-    }
-}
 export class RPCHandlers {
     constructor() {
         rpcHandlerStates.set(this, createRPCHandlerState());
@@ -34,16 +25,9 @@ export class RPCHandlers {
 }
 export class SessionHandlers {
     constructor(options = {}) {
-        const maximum = options.maxConcurrentStreams ?? DEFAULT_MAX_CONCURRENT_STREAMS;
-        if (!Number.isSafeInteger(maximum) ||
-            maximum < 1 ||
-            maximum > MAX_CONCURRENT_STREAMS) {
-            throw new HandlerRegistrationError("invalid_handler");
-        }
         sessionHandlerStates.set(this, {
-            maxConcurrentStreams: maximum,
             rpc: createRPCHandlerState(),
-            streams: new Map(),
+            streams: new StreamHandlers(options),
             frozen: false,
         });
     }
@@ -57,15 +41,7 @@ export class SessionHandlers {
     }
     handleStream(kind, handler) {
         const state = mutableSessionHandlerState(this);
-        if (kind.length < 1 ||
-            encoder.encode(kind).length > 255 ||
-            kind === "flowersec.rpc.v2" ||
-            typeof handler !== "function") {
-            throw new HandlerRegistrationError("invalid_handler");
-        }
-        if (state.streams.has(kind))
-            throw new HandlerRegistrationError("already_registered");
-        state.streams.set(kind, handler);
+        state.streams.handleStream(kind, handler);
     }
 }
 const rpcHandlerStates = new WeakMap();
@@ -89,6 +65,11 @@ function mutableSessionHandlerState(handlers) {
         throw new HandlerRegistrationError("frozen");
     return state;
 }
+/** @internal */
+export function registerSessionStreamHandlersAtomically(handlers, entries) {
+    const state = mutableSessionHandlerState(handlers);
+    registerStreamHandlersAtomically(state.streams, entries);
+}
 function registerRPC(state, typeId, handler) {
     validateRPCRegistration(typeId, handler);
     if (state.requests.has(typeId) || state.notifications.has(typeId)) {
@@ -162,63 +143,18 @@ function freezeSessionHandlers(handlers) {
     state.frozen = true;
     state.snapshot = Object.freeze({
         rpc: freezeRPCHandlerState(state.rpc),
-        maxConcurrentStreams: state.maxConcurrentStreams,
-        streams: new Map(state.streams),
+        streams: freezeStreamHandlers(state.streams),
     });
     return state.snapshot;
 }
-/** @internal */
-export function registerSessionStreamsAtomically(handlers, entries) {
-    const state = mutableSessionHandlerState(handlers);
-    const pending = new Set();
-    for (const [kind, handler] of entries) {
-        if (kind.length < 1 ||
-            encoder.encode(kind).length > 255 ||
-            kind === "flowersec.rpc.v2" ||
-            typeof handler !== "function")
-            throw new HandlerRegistrationError("invalid_handler");
-        if (state.streams.has(kind) || pending.has(kind))
-            throw new HandlerRegistrationError("already_registered");
-        pending.add(kind);
-    }
-    for (const [kind, handler] of entries)
-        state.streams.set(kind, handler);
-}
 export class AcceptedSession {
     constructor() { }
     get session() {
         return acceptedSessionState(this).session;
     }
     async serve(options = {}) {
-        const active = new Set();
         const state = acceptedSessionState(this);
-        try {
-            while (true) {
-                if (options.signal?.aborted)
-                    throw new SessionError("canceled");
-                const incoming = await this.session.acceptStream(options);
-                const handler = state.handlers.streams.get(incoming.kind);
-                if (handler === undefined ||
-                    active.size >= state.handlers.maxConcurrentStreams) {
-                    await incoming.stream.reset();
-                    continue;
-                }
-                const task = (async () => {
-                    try {
-                        await handler(incoming, options);
-                        await incoming.stream.closeWrite();
-                    }
-                    catch {
-                        await incoming.stream.reset().catch(() => undefined);
-                    }
-                })().finally(() => active.delete(task));
-                active.add(task);
-            }
-        }
-        finally {
-            await this.close().catch(() => undefined);
-            await Promise.allSettled(active);
-        }
+        await serveFrozenStreamHandlers(state.handlers.streams, this.session, options, async () => await this.close());
     }
     async close() {
         const state = acceptedSessionState(this);

package/dist/node/index.d.ts

@@ -1,11 +1,11 @@
 export { connect, createConnectionController } from "./connectSession.js";
 export { AcceptedSession, Acceptor, HandlerRegistrationError, RPCHandlers, SessionHandlers, createAcceptor, } from "./acceptor.js";
-export type { AcceptorListener, AcceptorOptions, AuthorizationDecision, RPCHandler, RPCHandlerResult, NotificationHandler, SessionHandlerOptions, StreamHandler, } from "./acceptor.js";
+export type { AcceptorListener, AcceptorOptions, AuthorizationDecision, RPCHandler, RPCHandlerResult, NotificationHandler, SessionHandlerOptions, } from "./acceptor.js";
 export { TunnelRuntime, createTunnelRuntime } from "./tunnelRuntime.js";
 export type { TunnelAuthorizationDecision, TunnelRuntimeListener, TunnelRuntimeOptions, } from "./tunnelRuntime.js";
 export type { ConnectionControllerOptions, SessionOptions, SessionTLSOptions, } from "./connectSession.js";
 export { AuthorizationRecord, AuthorizationResponse, TunnelAuthorizationResponse, ControlPlaneError, EndpointSet, IssuedArtifact, Issuer, RuntimeAuthorizationRequest, authorizeRuntime, authorizeTunnelRuntime, createEndpointSet, parseAuthorizationRecord, parseRuntimeAuthorizationRequest, rejectRuntime, rejectTunnelRuntime, } from "./controlplane.js";
 export type { ArtifactMetadata, ControlPlaneErrorCode, DirectIssueOptions, IssuedTunnelPair, Scope, SessionOptions as ControlPlaneSessionOptions, TunnelIssueOptions, } from "./controlplane.js";
 export { ProxyServer, ProxyServerError } from "./proxyServer.js";
-export type { ProxyServerOptions } from "./proxyServer.js";
+export type { ProxyServerOptions, StreamHandlerRegistrar } from "./proxyServer.js";
 export * from "../facade.js";

package/dist/node/proxyServer.d.ts

@@ -1,4 +1,6 @@
+import { StreamHandlers } from "../public/streamHandlers.js";
 import { SessionHandlers } from "./acceptor.js";
+export type StreamHandlerRegistrar = StreamHandlers | SessionHandlers;
 export type ProxyServerOptions = Readonly<{
     upstream: string;
     upstreamOrigin: string;
@@ -26,6 +28,6 @@ export declare class ProxyServerError extends Error {
 export declare class ProxyServer {
     #private;
     constructor(options: ProxyServerOptions);
-    register(handlers: SessionHandlers): void;
+    register(handlers: StreamHandlerRegistrar): void;
     close(): Promise<void>;
 }

package/dist/node/proxyServer.js

@@ -2,7 +2,8 @@ import { createRequire } from "node:module";
 import { SessionError } from "../public/contract.js";
 import { writeJsonFrame } from "../framing/jsonframe.js";
 import { ProxyByteReader, writeAll } from "../proxy/stream.js";
-import { registerSessionStreamsAtomically, SessionHandlers, } from "./acceptor.js";
+import { StreamHandlers, registerStreamHandlersAtomically, } from "../public/streamHandlers.js";
+import { SessionHandlers, registerSessionStreamHandlersAtomically, } from "./acceptor.js";
 const HTTP_KIND = "flowersec-proxy/http1";
 const WS_KIND = "flowersec-proxy/ws";
 const WIRE_VERSION = 1;
@@ -38,13 +39,20 @@ export class ProxyServer {
     register(handlers) {
         if (this.#closed)
             throw new ProxyServerError("closed");
-        if (!(handlers instanceof SessionHandlers))
-            throw new ProxyServerError("handler_registration");
         try {
-            registerSessionStreamsAtomically(handlers, [
+            const registrations = [
                 [HTTP_KIND, this.#httpHandler()],
                 [WS_KIND, this.#webSocketHandler()],
-            ]);
+            ];
+            if (handlers instanceof StreamHandlers) {
+                registerStreamHandlersAtomically(handlers, registrations);
+            }
+            else if (handlers instanceof SessionHandlers) {
+                registerSessionStreamHandlersAtomically(handlers, registrations);
+            }
+            else {
+                throw new TypeError("invalid Flowersec stream handler registrar");
+            }
         }
         catch (error) {
             this.#report(error);

package/dist/public/streamHandlers.d.ts

@@ -0,0 +1,20 @@
+import { type IncomingStream, type OperationOptions, type Session } from "./contract.js";
+export type StreamHandler = (incoming: IncomingStream, options: OperationOptions) => Promise<void>;
+export type StreamHandlerOptions = Readonly<{
+    maxConcurrentStreams?: number;
+}>;
+export declare class HandlerRegistrationError extends Error {
+    readonly code: "invalid_handler" | "already_registered" | "frozen";
+    constructor(code: "invalid_handler" | "already_registered" | "frozen");
+}
+export type FrozenStreamHandlers = Readonly<{
+    maxConcurrentStreams: number;
+    streams: ReadonlyMap<string, StreamHandler>;
+}>;
+/** Carrier-neutral application-stream handlers for any established Session. */
+export declare class StreamHandlers {
+    private readonly streamHandlerRegistrarBrand;
+    constructor(options?: StreamHandlerOptions);
+    handleStream(kind: string, handler: StreamHandler): void;
+    serve(session: Session, options?: OperationOptions): Promise<void>;
+}

package/dist/public/streamHandlers.js

@@ -0,0 +1,124 @@
+import { SessionError, } from "./contract.js";
+import { validApplicationStreamKind } from "../v2/protocol.js";
+const DEFAULT_MAX_CONCURRENT_STREAMS = 64;
+const MAX_CONCURRENT_STREAMS = 128;
+export class HandlerRegistrationError extends Error {
+    code;
+    constructor(code) {
+        super(`Flowersec handler registration failed (code=${code})`);
+        this.code = code;
+        this.name = "HandlerRegistrationError";
+    }
+}
+const streamHandlerStates = new WeakMap();
+/** Carrier-neutral application-stream handlers for any established Session. */
+export class StreamHandlers {
+    constructor(options = {}) {
+        const maximum = options.maxConcurrentStreams ?? DEFAULT_MAX_CONCURRENT_STREAMS;
+        if (!Number.isSafeInteger(maximum) ||
+            maximum < 1 ||
+            maximum > MAX_CONCURRENT_STREAMS) {
+            throw new HandlerRegistrationError("invalid_handler");
+        }
+        streamHandlerStates.set(this, {
+            maxConcurrentStreams: maximum,
+            streams: new Map(),
+            frozen: false,
+        });
+    }
+    handleStream(kind, handler) {
+        registerStreamHandlersAtomically(this, [[kind, handler]]);
+    }
+    async serve(session, options = {}) {
+        if (session === null || typeof session !== "object") {
+            throw new HandlerRegistrationError("invalid_handler");
+        }
+        await serveFrozenStreamHandlers(freezeStreamHandlers(this), session, options, async () => await session.close());
+    }
+}
+function mutableStreamHandlerState(handlers) {
+    const state = streamHandlerStates.get(handlers);
+    if (state === undefined)
+        throw new HandlerRegistrationError("invalid_handler");
+    if (state.frozen)
+        throw new HandlerRegistrationError("frozen");
+    return state;
+}
+function registerIntoState(state, entries) {
+    if (entries.length === 0)
+        throw new HandlerRegistrationError("invalid_handler");
+    const pending = new Set();
+    for (const [kind, handler] of entries) {
+        if (!validApplicationStreamKind(kind) ||
+            kind === "flowersec.rpc.v2" ||
+            typeof handler !== "function") {
+            throw new HandlerRegistrationError("invalid_handler");
+        }
+        if (state.streams.has(kind) || pending.has(kind)) {
+            throw new HandlerRegistrationError("already_registered");
+        }
+        pending.add(kind);
+    }
+    for (const [kind, handler] of entries)
+        state.streams.set(kind, handler);
+}
+/** @internal */
+export function registerStreamHandlersAtomically(handlers, entries) {
+    registerIntoState(mutableStreamHandlerState(handlers), entries);
+}
+/** @internal */
+export function freezeStreamHandlers(handlers) {
+    const state = streamHandlerStates.get(handlers);
+    if (state === undefined)
+        throw new HandlerRegistrationError("invalid_handler");
+    if (state.snapshot !== undefined)
+        return state.snapshot;
+    state.frozen = true;
+    state.snapshot = Object.freeze({
+        maxConcurrentStreams: state.maxConcurrentStreams,
+        streams: new Map(state.streams),
+    });
+    return state.snapshot;
+}
+/** @internal */
+export async function serveFrozenStreamHandlers(snapshot, session, options, close) {
+    const active = new Set();
+    const controller = new AbortController();
+    const abortFromCaller = () => controller.abort(options.signal?.reason);
+    if (options.signal?.aborted === true)
+        abortFromCaller();
+    else
+        options.signal?.addEventListener("abort", abortFromCaller, { once: true });
+    const handlerOptions = Object.freeze({
+        signal: controller.signal,
+    });
+    try {
+        while (true) {
+            if (controller.signal.aborted)
+                throw new SessionError("canceled");
+            const incoming = await session.acceptStream(handlerOptions);
+            const handler = snapshot.streams.get(incoming.kind);
+            if (handler === undefined ||
+                active.size >= snapshot.maxConcurrentStreams) {
+                await incoming.stream.reset();
+                continue;
+            }
+            const task = (async () => {
+                try {
+                    await handler(incoming, handlerOptions);
+                    await incoming.stream.closeWrite();
+                }
+                catch {
+                    await incoming.stream.reset().catch(() => undefined);
+                }
+            })().finally(() => active.delete(task));
+            active.add(task);
+        }
+    }
+    finally {
+        options.signal?.removeEventListener("abort", abortFromCaller);
+        controller.abort(new SessionError("closed"));
+        await close().catch(() => undefined);
+        await Promise.allSettled(active);
+    }
+}

package/dist/v2/protocol.js

@@ -567,16 +567,21 @@ function bytesEqual(left, right) {
 }
 function validateOpenKind(value) {
     const encoded = encoder.encode(value);
-    if (!validOpenUnicodeString(value, MAX_OPEN_KIND_BYTES, false)) {
+    if (!validApplicationStreamKind(value)) {
         throw new ProtocolV2Error("invalid OPEN kind");
     }
-    const scalars = Array.from(value);
-    if (isUnicodeWhitespace(scalars[0].codePointAt(0)) ||
-        isUnicodeWhitespace(scalars.at(-1).codePointAt(0))) {
-        throw new ProtocolV2Error("OPEN kind has leading or trailing Unicode whitespace");
-    }
     return encoded;
 }
+/** @internal */
+export function validApplicationStreamKind(value) {
+    if (typeof value !== "string" ||
+        !validOpenUnicodeString(value, MAX_OPEN_KIND_BYTES, false)) {
+        return false;
+    }
+    const scalars = Array.from(value);
+    return !(isUnicodeWhitespace(scalars[0].codePointAt(0)) ||
+        isUnicodeWhitespace(scalars.at(-1).codePointAt(0)));
+}
 function canonicalMetadata(raw, allowEmpty) {
     if (raw.length === 0 && allowEmpty)
         return encoder.encode("{}");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "2.4.2",
+  "version": "2.5.1",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {
@@ -77,7 +77,7 @@
     "ws": "^8.21.2"
   },
   "optionalDependencies": {
-    "@floegence/flowersec-node-native": "2.4.2"
+    "@floegence/flowersec-node-native": "2.5.1"
   },
   "devDependencies": {
     "@playwright/test": "1.62.1",
@@ -95,5 +95,5 @@
     "vite": "^8.2.1",
     "vitest": "4.1.10"
   },
-  "flowersecSourceCommit": "1393acdb891a6c935a435bee9068f65b68268795"
+  "flowersecSourceCommit": "8debd2888634e8e7c88fd848ff5b08d22aa6d1f2"
 }

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a7cb7385-1123-5452-8424-bbcb7904bbbb",
+  "serialNumber": "urn:uuid:7870295b-822d-59a5-8999-b6c86bdedcd2",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "2.4.2",
-      "purl": "pkg:npm/%40floegence/flowersec-core@2.4.2",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.4.2"
+      "version": "2.5.1",
+      "purl": "pkg:npm/%40floegence/flowersec-core@2.5.1",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.5.1"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "59d233df0e12f2c371ab542c83edf97a2968a75c7d17c057e453b97f530a90e4"
+        "value": "aba1d1c470bb7af7da0d63211ac38f323b17e6e6f91337c0951508521d23b2b0"
       }
     ]
   },
@@ -190,7 +190,7 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@2.4.2",
+      "ref": "pkg:npm/%40floegence/flowersec-core@2.5.1",
       "dependsOn": [
         "pkg:npm/%40noble/ciphers@2.3.0",
         "pkg:npm/%40noble/curves@2.3.0",

package/sbom/spdx.json

@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "flowersec-ts",
-  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/59d233df0e12f2c371ab542c83edf97a2968a75c7d17c057e453b97f530a90e4",
+  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/aba1d1c470bb7af7da0d63211ac38f323b17e6e6f91337c0951508521d23b2b0",
   "creationInfo": {
     "created": "1970-01-01T00:00:00Z",
     "creators": [
@@ -13,19 +13,19 @@
   "packages": [
     {
       "name": "@floegence/flowersec-core",
-      "SPDXID": "SPDXRef-Package-9eec732cc29715c69e1e",
-      "versionInfo": "2.4.2",
+      "SPDXID": "SPDXRef-Package-8e2bb9ca6799b3b43dc6",
+      "versionInfo": "2.5.1",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "NOASSERTION",
       "copyrightText": "NOASSERTION",
-      "comment": "Flowersec source inventory SHA-256: 59d233df0e12f2c371ab542c83edf97a2968a75c7d17c057e453b97f530a90e4",
+      "comment": "Flowersec source inventory SHA-256: aba1d1c470bb7af7da0d63211ac38f323b17e6e6f91337c0951508521d23b2b0",
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@2.4.2"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@2.5.1"
         }
       ]
     },
@@ -136,30 +136,30 @@
     {
       "spdxElementId": "SPDXRef-DOCUMENT",
       "relationshipType": "DESCRIBES",
-      "relatedSpdxElement": "SPDXRef-Package-9eec732cc29715c69e1e"
+      "relatedSpdxElement": "SPDXRef-Package-8e2bb9ca6799b3b43dc6"
     },
     {
-      "spdxElementId": "SPDXRef-Package-9eec732cc29715c69e1e",
+      "spdxElementId": "SPDXRef-Package-8e2bb9ca6799b3b43dc6",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-5ce913a03239b02770fb"
     },
     {
-      "spdxElementId": "SPDXRef-Package-9eec732cc29715c69e1e",
+      "spdxElementId": "SPDXRef-Package-8e2bb9ca6799b3b43dc6",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-01009adf60db02c13634"
     },
     {
-      "spdxElementId": "SPDXRef-Package-9eec732cc29715c69e1e",
+      "spdxElementId": "SPDXRef-Package-8e2bb9ca6799b3b43dc6",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-8815b117c8a1d5f7eeb0"
     },
     {
-      "spdxElementId": "SPDXRef-Package-9eec732cc29715c69e1e",
+      "spdxElementId": "SPDXRef-Package-8e2bb9ca6799b3b43dc6",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-f8b45a289df643042b94"
     },
     {
-      "spdxElementId": "SPDXRef-Package-9eec732cc29715c69e1e",
+      "spdxElementId": "SPDXRef-Package-8e2bb9ca6799b3b43dc6",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-b779412f685822663496"
     },