@floegence/flowersec-core 2.5.4 → 3.0.0

package/dist/v3/sessionConnector.d.ts

@@ -0,0 +1,37 @@
+import type { Session } from "../public/contract.js";
+import type { RpcRouter } from "../rpc/server.js";
+import { type ArtifactV3, type CanonicalArtifactCandidateV3 } from "./artifact.js";
+import { type ArtifactLeaseV3 } from "./artifactLease.js";
+import type { CarrierSessionV3, NativeCarrierStreamV3 } from "./carrier.js";
+import type { LeaseAttemptContextV3, LeaseAttemptResultV3 } from "./connectionController.js";
+import { type SessionDeadlineFactoryV3, type SessionProtocolRuntimeV3 } from "./session.js";
+import { type RuntimeCapabilityDescriptorV3 } from "./capability.js";
+export type ClientAdmissionChannelV3 = Readonly<{
+    framing: "message";
+    write(data: Uint8Array, signal?: AbortSignal): Promise<void>;
+    read(signal?: AbortSignal): Promise<Uint8Array>;
+    abort(error: Error): void;
+}> | Readonly<{
+    framing: "stream";
+    stream: NativeCarrierStreamV3;
+    abort(error: Error): void;
+}>;
+export type ReadyAdmissionTransportV3 = Readonly<{
+    candidate: CanonicalArtifactCandidateV3;
+    openAdmissionChannel(signal?: AbortSignal): Promise<ClientAdmissionChannelV3>;
+    finalize(): CarrierSessionV3;
+    close(): Promise<void>;
+    abort(): void;
+}>;
+export type CandidateDialerV3 = (candidate: CanonicalArtifactCandidateV3, artifact: ArtifactV3, attemptNowUnixSeconds: number, capability: RuntimeCapabilityDescriptorV3, signal: AbortSignal) => Promise<ReadyAdmissionTransportV3>;
+export type SessionConnectorRuntimeV3 = Readonly<{
+    capabilitySnapshot(): RuntimeCapabilityDescriptorV3;
+    dial: CandidateDialerV3;
+    protocolRuntime: SessionProtocolRuntimeV3;
+    connectTimeoutMilliseconds?: number;
+    createRPCRouter?: () => RpcRouter;
+    nowUnixSeconds?: () => number;
+    deadlineFactory?: SessionDeadlineFactoryV3;
+}>;
+export declare function connectArtifactLeaseV3(lease: ArtifactLeaseV3, runtime: SessionConnectorRuntimeV3, signal?: AbortSignal): Promise<Session>;
+export declare function attemptClaimedArtifactLeaseV3(context: LeaseAttemptContextV3, runtime: SessionConnectorRuntimeV3): Promise<LeaseAttemptResultV3<Session>>;

package/dist/v3/sessionConnector.js

@@ -0,0 +1,440 @@
+import { base64urlDecode } from "../utils/base64url.js";
+import { SDK_DEFAULTS } from "../defaults.js";
+import { AdmissionStatusV3, admissionBindingV3, buildFSB3RequestV3, canonicalizeCandidatesV3, decodeFSA3ResponseV3, encodeFSB3RequestV3, validateArtifactV3, } from "./artifact.js";
+import { artifactLeaseStateV3, claimArtifactLeaseV3, claimedArtifactV3, commitArtifactLeaseSpendV3, retireArtifactLeaseV3, } from "./artifactLease.js";
+import { aggregateCandidateFailuresV3, } from "./controller.js";
+import { projectSessionV3 } from "./publicSession.js";
+import { ConnectErrorV3, TransportFailureV3, snapshotTransportSecurityPolicyV3, } from "./security.js";
+import { establishSessionV3, } from "./session.js";
+import { supportsCandidateSecurityV3, validateRuntimeCapabilityDescriptorV3, } from "./capability.js";
+export async function connectArtifactLeaseV3(lease, runtime, signal) {
+    let claim;
+    try {
+        claim = claimArtifactLeaseV3(lease);
+    }
+    catch {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
+    const artifact = claimedArtifactV3(claim);
+    const now = runtime.nowUnixSeconds ?? (() => Math.floor(Date.now() / 1_000));
+    let capability;
+    let candidates;
+    try {
+        capability = runtime.capabilitySnapshot();
+        validateRuntimeCapabilityDescriptorV3(capability);
+        validateArtifactV3(artifact);
+        assertArtifactFresh(artifact, now);
+        candidates = canonicalizeCandidatesV3(artifact.path.kind, artifact.path.candidates).candidates;
+    }
+    catch (error) {
+        await retireArtifactLeaseV3(claim);
+        throw publicPreSpendError(error);
+    }
+    const controller = new AbortController();
+    const unlink = linkAbort(signal, controller);
+    try {
+        const result = await attemptClaimedArtifactLeaseV3({
+            kind: "primary",
+            artifact,
+            candidates,
+            claim,
+            signal: controller.signal,
+            capability,
+            assertArtifactFresh: () => assertArtifactFresh(artifact, now),
+        }, runtime);
+        if (result.kind === "established")
+            return result.session;
+        if (artifactLeaseStateV3(claim) === "claimed")
+            await retireArtifactLeaseV3(claim);
+        if (result.kind === "candidate_failures") {
+            const failure = aggregateCandidateFailuresV3(result.failures, false);
+            throw failure === "policy_refresh"
+                ? new ConnectErrorV3("transport_security_failed", { kind: "terminal" })
+                : failure;
+        }
+        throw result.error;
+    }
+    finally {
+        unlink();
+    }
+}
+export async function attemptClaimedArtifactLeaseV3(context, runtime) {
+    let timeoutMilliseconds;
+    try {
+        timeoutMilliseconds = normalizeConnectTimeoutMilliseconds(runtime.connectTimeoutMilliseconds);
+    }
+    catch (error) {
+        return { kind: "pre_spend_failure", error: publicPreSpendError(error) };
+    }
+    const controller = new AbortController();
+    const unlink = linkConnectAttemptAbort(context.signal, controller);
+    const timer = setTimeout(() => controller.abort(new ConnectErrorV3("connection_failed", { kind: "retryable" })), timeoutMilliseconds);
+    try {
+        throwIfAborted(controller.signal);
+        return await attemptClaimedArtifactLeaseWithinDeadlineV3({ ...context, signal: controller.signal }, runtime);
+    }
+    catch (error) {
+        const projected = error instanceof ConnectErrorV3
+            ? error
+            : new ConnectErrorV3("connection_failed", { kind: "terminal" });
+        return artifactLeaseStateV3(context.claim) === "claimed"
+            ? { kind: "pre_spend_failure", error: projected }
+            : { kind: "post_spend_failure", error: projected };
+    }
+    finally {
+        clearTimeout(timer);
+        unlink();
+    }
+}
+async function attemptClaimedArtifactLeaseWithinDeadlineV3(context, runtime) {
+    const role = context.artifact.path.kind === "tunnel" && context.artifact.path.role === 2
+        ? "server"
+        : "client";
+    const failures = [];
+    const pending = new Map();
+    const controllers = new Map();
+    const preparedTransportCleanups = new Map();
+    const cleanupPreparedTransport = (transport) => {
+        const existing = preparedTransportCleanups.get(transport);
+        if (existing !== undefined)
+            return existing;
+        const cleanup = closePreparedTransportV3(transport, context.signal);
+        preparedTransportCleanups.set(transport, cleanup);
+        return cleanup;
+    };
+    let attemptNow;
+    try {
+        // A candidate race has one fixed wall-clock snapshot for every pin policy.
+        attemptNow = readAttemptNow(runtime.nowUnixSeconds);
+    }
+    catch (error) {
+        return {
+            kind: "pre_spend_failure",
+            error: publicPreSpendError(error),
+        };
+    }
+    for (const [index, candidate] of context.candidates.entries()) {
+        throwIfAborted(context.signal);
+        if (!supportsCandidateSecurityV3(context.capability, candidate.carrier, context.artifact.path.kind, role, candidate.tls.mode)) {
+            failures.push({ candidate, failure: new TransportFailureV3("tls_unsupported") });
+            continue;
+        }
+        try {
+            const tuple = context.capability.tuples.find((entry) => entry.carrier === candidate.carrier && entry.path === context.artifact.path.kind &&
+                entry.networkMode === "dial" && entry.sessionRole === role);
+            snapshotTransportSecurityPolicyV3(candidate.tls, attemptNow, tuple?.securityModes ?? []);
+        }
+        catch (error) {
+            failures.push({ candidate, failure: asTransportFailure(error) });
+            continue;
+        }
+        const controller = new AbortController();
+        controllers.set(index, controller);
+        const unlink = linkAbort(context.signal, controller);
+        const task = Promise.resolve().then(async () => {
+            throwIfAborted(controller.signal);
+            return await runtime.dial(candidate, context.artifact, attemptNow, context.capability, controller.signal);
+        })
+            .then((ready) => ({ index, ready }))
+            .catch((error) => ({ index, failure: asTransportFailure(error) }))
+            .finally(unlink);
+        pending.set(index, task);
+    }
+    let winner;
+    try {
+        while (pending.size > 0 && winner === undefined) {
+            throwIfAborted(context.signal);
+            const result = await raceAbort(Promise.race(pending.values()), context.signal);
+            throwIfAborted(context.signal);
+            pending.delete(result.index);
+            if (result.ready !== undefined)
+                winner = result.ready;
+            else {
+                const candidate = context.candidates[result.index];
+                failures.push({ candidate, failure: result.failure ?? new TransportFailureV3("connection_failed") });
+            }
+        }
+    }
+    finally {
+        for (const [index, controller] of controllers) {
+            if (context.candidates[index] !== winner?.candidate)
+                controller.abort(new Error("candidate lost race"));
+        }
+        for (const task of pending.values()) {
+            void task.then(async (result) => {
+                if (result.ready !== undefined && result.ready !== winner) {
+                    await cleanupPreparedTransport(result.ready);
+                }
+            }).catch(() => undefined);
+        }
+    }
+    if (winner === undefined) {
+        try {
+            context.assertArtifactFresh();
+        }
+        catch (error) {
+            return { kind: "pre_spend_failure", error: publicPreSpendError(error) };
+        }
+        return { kind: "candidate_failures", failures: Object.freeze(failures) };
+    }
+    try {
+        context.assertArtifactFresh();
+        const rawFSB3 = encodeFSB3RequestV3(buildFSB3RequestV3(context.artifact, winner.candidate.id));
+        const config = sessionConfigFromArtifactV3(context.artifact, rawFSB3, runtime);
+        const channel = await raceAbort(winner.openAdmissionChannel(context.signal), context.signal);
+        try {
+            context.assertArtifactFresh();
+            await commitArtifactLeaseSpendV3(context.claim, context.signal);
+            context.assertArtifactFresh();
+            const response = channel.framing === "message"
+                ? await exchangeMessage(channel, rawFSB3, context.signal)
+                : await exchangeStream(channel.stream, rawFSB3, context.signal);
+            const fsa3 = decodeFSA3ResponseV3(response);
+            if (fsa3.status !== AdmissionStatusV3.Success) {
+                throw new ConnectErrorV3("connection_failed", {
+                    kind: fsa3.status === AdmissionStatusV3.Retryable ? "retryable" : "terminal",
+                });
+            }
+            const carrier = winner.finalize();
+            try {
+                const session = await raceAbort(establishSessionV3(carrier, config, { signal: context.signal }), context.signal);
+                return { kind: "established", session: projectSessionV3(session) };
+            }
+            catch (error) {
+                carrier.abort({ code: 6, reason: "session establishment failed" });
+                throw error instanceof ConnectErrorV3
+                    ? error
+                    : new ConnectErrorV3("connection_failed", { kind: "retryable" });
+            }
+        }
+        catch (error) {
+            channel.abort(asError(error));
+            throw error;
+        }
+    }
+    catch (error) {
+        await cleanupPreparedTransport(winner);
+        throwIfAborted(context.signal);
+        if (artifactLeaseStateV3(context.claim) === "claimed") {
+            return { kind: "pre_spend_failure", error: publicPreSpendError(error) };
+        }
+        return {
+            kind: "post_spend_failure",
+            error: error instanceof ConnectErrorV3
+                ? error
+                : new ConnectErrorV3("connection_failed", { kind: "terminal" }),
+        };
+    }
+}
+function sessionConfigFromArtifactV3(artifact, rawFSB3, runtime) {
+    const localBinding = admissionBindingV3(rawFSB3);
+    const tunnel = artifact.path.kind === "tunnel" ? artifact.path : undefined;
+    return {
+        role: tunnel?.role === 2 ? "server" : "client",
+        path: artifact.path.kind,
+        channelID: artifact.session.channel_id,
+        sessionContractHash: base64urlDecode(artifact.session.contract_hash_b64u),
+        suite: artifact.session.default_suite,
+        psk: base64urlDecode(artifact.session.e2ee_psk_b64u),
+        maxInboundStreams: artifact.session.max_inbound_streams,
+        sessionContract: artifact.session,
+        ...(runtime.createRPCRouter === undefined ? {} : { rpcRouter: runtime.createRPCRouter() }),
+        idleTimeoutMs: artifact.session.idle_timeout_seconds * 1_000,
+        closeTimeoutMs: 5_000,
+        runtime: runtime.protocolRuntime,
+        localAdmissionBinding: localBinding,
+        peerAdmissionBinding: tunnel === undefined ? localBinding : new Uint8Array(32),
+        localEndpointInstanceID: tunnel?.local_endpoint_instance_id ?? "",
+        expectedPeerEndpointInstanceID: tunnel?.expected_peer_endpoint_instance_id ?? "",
+        deadlines: {
+            establishTimeoutMs: artifact.session.establish_timeout_seconds * 1_000,
+            rekeyPrepareTimeoutMs: artifact.session.rekey_prepare_timeout_seconds * 1_000,
+            rekeyCompletionTimeoutMs: artifact.session.rekey_completion_timeout_seconds * 1_000,
+            ...(runtime.deadlineFactory === undefined ? {} : { factory: runtime.deadlineFactory }),
+        },
+    };
+}
+async function exchangeMessage(channel, rawFSB3, signal) {
+    await raceAbort(channel.write(rawFSB3, signal), signal);
+    return await raceAbort(channel.read(signal), signal);
+}
+async function exchangeStream(stream, rawFSB3, signal) {
+    await writeAll(stream, rawFSB3, signal);
+    await raceAbort(stream.closeWrite(), signal);
+    const reader = new ExactReader(stream);
+    const header = await reader.readExactly(8, signal);
+    const reasonLength = new DataView(header.buffer, header.byteOffset, header.byteLength).getUint16(6, false);
+    if (reasonLength > 64)
+        throw new ConnectErrorV3("connection_failed", { kind: "terminal" });
+    const reason = await reader.readExactly(reasonLength, signal);
+    await reader.expectEOF(signal);
+    return concat(header, reason);
+}
+class ExactReader {
+    stream;
+    #chunks = [];
+    #offset = 0;
+    #bytes = 0;
+    constructor(stream) {
+        this.stream = stream;
+    }
+    async readExactly(length, signal) {
+        while (this.#bytes < length) {
+            const chunk = await raceAbort(this.stream.read(), signal);
+            if (chunk === null)
+                throw new ConnectErrorV3("connection_failed", { kind: "terminal" });
+            if (chunk.length > 0) {
+                this.#chunks.push(chunk);
+                this.#bytes += chunk.length;
+            }
+        }
+        const output = new Uint8Array(length);
+        let written = 0;
+        while (written < length) {
+            const chunk = this.#chunks[0];
+            const take = Math.min(length - written, chunk.length - this.#offset);
+            output.set(chunk.subarray(this.#offset, this.#offset + take), written);
+            written += take;
+            this.#offset += take;
+            this.#bytes -= take;
+            if (this.#offset === chunk.length) {
+                this.#chunks.shift();
+                this.#offset = 0;
+            }
+        }
+        return output;
+    }
+    async expectEOF(signal) {
+        if (this.#bytes !== 0)
+            throw new ConnectErrorV3("connection_failed", { kind: "terminal" });
+        while (true) {
+            const chunk = await raceAbort(this.stream.read(), signal);
+            if (chunk === null)
+                return;
+            if (chunk.length !== 0)
+                throw new ConnectErrorV3("connection_failed", { kind: "terminal" });
+        }
+    }
+}
+async function writeAll(stream, data, signal) {
+    let offset = 0;
+    while (offset < data.length) {
+        const written = await raceAbort(stream.write(data.subarray(offset)), signal);
+        if (written < 1 || written > data.length - offset) {
+            throw new ConnectErrorV3("connection_failed", { kind: "terminal" });
+        }
+        offset += written;
+    }
+}
+function readAttemptNow(now) {
+    const value = (now ?? (() => Math.floor(Date.now() / 1_000)))();
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new TransportFailureV3("invalid_artifact");
+    return value;
+}
+function assertArtifactFresh(artifact, now) {
+    const value = now();
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    if (value >= artifact.session.init_expire_at_unix_s) {
+        throw new ConnectErrorV3("expired_artifact", { kind: "retryable" });
+    }
+}
+function publicPreSpendError(error) {
+    if (error instanceof ConnectErrorV3)
+        return error;
+    return new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+}
+function normalizeConnectTimeoutMilliseconds(value) {
+    const timeout = value ?? SDK_DEFAULTS.transport.connectTimeoutMs;
+    if (!Number.isSafeInteger(timeout) || timeout < 1) {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
+    return timeout;
+}
+function asTransportFailure(error) {
+    return error instanceof TransportFailureV3
+        ? error
+        : new TransportFailureV3("connection_failed", undefined, error);
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+function linkAbort(parent, child) {
+    if (parent === undefined)
+        return () => undefined;
+    const abort = () => child.abort(parent.reason);
+    if (parent.aborted)
+        abort();
+    else
+        parent.addEventListener("abort", abort, { once: true });
+    return () => parent.removeEventListener("abort", abort);
+}
+function linkConnectAttemptAbort(parent, child) {
+    const abort = () => child.abort(new ConnectErrorV3("connection_failed", { kind: "terminal" }));
+    if (parent.aborted)
+        abort();
+    else
+        parent.addEventListener("abort", abort, { once: true });
+    return () => parent.removeEventListener("abort", abort);
+}
+function throwIfAborted(signal) {
+    if (signal.aborted)
+        throw signal.reason;
+}
+async function closePreparedTransportV3(transport, signal) {
+    const closing = Promise.resolve()
+        .then(async () => await transport.close())
+        .catch(() => undefined);
+    if (signal.aborted) {
+        abortPreparedTransportV3(transport);
+        return;
+    }
+    try {
+        await raceAbort(closing, signal);
+    }
+    catch {
+        abortPreparedTransportV3(transport);
+    }
+}
+function abortPreparedTransportV3(transport) {
+    try {
+        transport.abort();
+    }
+    catch { /* best effort */ }
+}
+async function raceAbort(promise, signal) {
+    if (signal.aborted)
+        throw signal.reason;
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => signal.removeEventListener("abort", abort);
+        const abort = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(signal.reason);
+        };
+        signal.addEventListener("abort", abort, { once: true });
+        void promise.then((value) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(value);
+        }, (error) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(error);
+        });
+    });
+}
+function concat(left, right) {
+    const output = new Uint8Array(left.length + right.length);
+    output.set(left);
+    output.set(right, left.length);
+    return output;
+}

package/dist/v3/streamLifetimeLedger.d.ts

@@ -0,0 +1,31 @@
+export declare const MAX_STREAM_LIFETIME_SLOTS_V3 = 1048576;
+export declare function maxLogicalStreamIDV3(openerRole: 1 | 2): bigint;
+export declare enum StreamLifetimeStateV3 {
+    Empty = 0,
+    AbandonedNoFSS3 = 1,
+    PrefaceSeen = 2,
+    ActiveOrResolved = 3
+}
+export type LateFSS3ActionV3 = "accepted" | "reset";
+export declare class StreamLifetimeLedgerV3Error extends Error {
+    readonly code: "capacity" | "duplicate" | "invalid_state";
+    constructor(code: "capacity" | "duplicate" | "invalid_state", message: string);
+}
+export declare class StreamLifetimeLedgerV3 {
+    private readonly openerRole;
+    private readonly states;
+    private resolvedFrontier;
+    constructor(openerRole: 1 | 2);
+    get frontier(): bigint;
+    get backingBytes(): number;
+    state(id: bigint): StreamLifetimeStateV3;
+    validFSS3(id: bigint): LateFSS3ActionV3;
+    validOpen(id: bigint): void;
+    peerReset(id: bigint): void;
+    localResetCommitted(id: bigint): void;
+    private requireSlot;
+    private slotIndex;
+    private stateAt;
+    private setStateAt;
+    private advanceFrontier;
+}

package/dist/v3/streamLifetimeLedger.js

@@ -0,0 +1,131 @@
+export const MAX_STREAM_LIFETIME_SLOTS_V3 = 1_048_576;
+export function maxLogicalStreamIDV3(openerRole) {
+    return BigInt(MAX_STREAM_LIFETIME_SLOTS_V3) * 2n - (openerRole === 1 ? 1n : 0n);
+}
+export var StreamLifetimeStateV3;
+(function (StreamLifetimeStateV3) {
+    StreamLifetimeStateV3[StreamLifetimeStateV3["Empty"] = 0] = "Empty";
+    StreamLifetimeStateV3[StreamLifetimeStateV3["AbandonedNoFSS3"] = 1] = "AbandonedNoFSS3";
+    StreamLifetimeStateV3[StreamLifetimeStateV3["PrefaceSeen"] = 2] = "PrefaceSeen";
+    StreamLifetimeStateV3[StreamLifetimeStateV3["ActiveOrResolved"] = 3] = "ActiveOrResolved";
+})(StreamLifetimeStateV3 || (StreamLifetimeStateV3 = {}));
+export class StreamLifetimeLedgerV3Error extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "StreamLifetimeLedgerV3Error";
+    }
+}
+export class StreamLifetimeLedgerV3 {
+    openerRole;
+    states = new Uint8Array(MAX_STREAM_LIFETIME_SLOTS_V3 / 4);
+    resolvedFrontier = 0n;
+    constructor(openerRole) {
+        this.openerRole = openerRole;
+    }
+    get frontier() {
+        return this.resolvedFrontier;
+    }
+    get backingBytes() {
+        return this.states.byteLength;
+    }
+    state(id) {
+        const index = this.slotIndex(id, false);
+        return index === undefined ? StreamLifetimeStateV3.Empty : this.stateAt(index);
+    }
+    validFSS3(id) {
+        const index = this.requireSlot(id);
+        switch (this.stateAt(index)) {
+            case StreamLifetimeStateV3.Empty:
+                this.setStateAt(index, StreamLifetimeStateV3.PrefaceSeen);
+                return "accepted";
+            case StreamLifetimeStateV3.AbandonedNoFSS3:
+                this.setStateAt(index, StreamLifetimeStateV3.ActiveOrResolved);
+                this.advanceFrontier();
+                return "reset";
+            case StreamLifetimeStateV3.PrefaceSeen:
+            case StreamLifetimeStateV3.ActiveOrResolved:
+                throw new StreamLifetimeLedgerV3Error("duplicate", "duplicate logical stream identity");
+        }
+    }
+    validOpen(id) {
+        const index = this.requireSlot(id);
+        if (this.stateAt(index) !== StreamLifetimeStateV3.PrefaceSeen) {
+            throw new StreamLifetimeLedgerV3Error("invalid_state", "OPEN without a pending FSS3 identity");
+        }
+        this.setStateAt(index, StreamLifetimeStateV3.ActiveOrResolved);
+        this.advanceFrontier();
+    }
+    peerReset(id) {
+        const index = this.requireSlot(id);
+        switch (this.stateAt(index)) {
+            case StreamLifetimeStateV3.Empty:
+                this.setStateAt(index, StreamLifetimeStateV3.AbandonedNoFSS3);
+                break;
+            case StreamLifetimeStateV3.PrefaceSeen:
+                this.setStateAt(index, StreamLifetimeStateV3.ActiveOrResolved);
+                break;
+            case StreamLifetimeStateV3.AbandonedNoFSS3:
+            case StreamLifetimeStateV3.ActiveOrResolved:
+                break;
+        }
+        this.advanceFrontier();
+    }
+    localResetCommitted(id) {
+        const index = this.requireSlot(id);
+        const state = this.stateAt(index);
+        if (state === StreamLifetimeStateV3.ActiveOrResolved)
+            return;
+        if (state !== StreamLifetimeStateV3.PrefaceSeen) {
+            throw new StreamLifetimeLedgerV3Error("invalid_state", "ordered reset without a pending FSS3 identity");
+        }
+        this.setStateAt(index, StreamLifetimeStateV3.ActiveOrResolved);
+        this.advanceFrontier();
+    }
+    requireSlot(id) {
+        const index = this.slotIndex(id, true);
+        if (index === undefined) {
+            throw new StreamLifetimeLedgerV3Error("capacity", "logical stream lifetime ledger capacity exceeded");
+        }
+        return index;
+    }
+    slotIndex(id, validate) {
+        const validParity = id > 0n && (this.openerRole === 1 ? (id & 1n) === 1n : (id & 1n) === 0n);
+        if (!validParity) {
+            if (validate)
+                throw new StreamLifetimeLedgerV3Error("capacity", "logical stream identity is outside the opener role");
+            return undefined;
+        }
+        const ordinal = this.openerRole === 1 ? (id + 1n) / 2n : id / 2n;
+        if (ordinal < 1n || ordinal > BigInt(MAX_STREAM_LIFETIME_SLOTS_V3))
+            return undefined;
+        return Number(ordinal - 1n);
+    }
+    stateAt(index) {
+        const shift = (index % 4) * 2;
+        return ((this.states[Math.floor(index / 4)] >>> shift) & 0x03);
+    }
+    setStateAt(index, state) {
+        const byteIndex = Math.floor(index / 4);
+        const shift = (index % 4) * 2;
+        const mask = 0x03 << shift;
+        this.states[byteIndex] = (this.states[byteIndex] & ~mask) | (state << shift);
+    }
+    advanceFrontier() {
+        let next = this.resolvedFrontier === 0n
+            ? (this.openerRole === 1 ? 1n : 2n)
+            : this.resolvedFrontier + 2n;
+        while (true) {
+            const index = this.slotIndex(next, false);
+            if (index === undefined)
+                return;
+            const state = this.stateAt(index);
+            if (state !== StreamLifetimeStateV3.AbandonedNoFSS3 && state !== StreamLifetimeStateV3.ActiveOrResolved) {
+                return;
+            }
+            this.resolvedFrontier = next;
+            next += 2n;
+        }
+    }
+}

package/dist/v3/streamMetadata.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/v3/streamMetadata.js

@@ -0,0 +1,7 @@
+import { createStreamMetadata, streamMetadataValues, } from "../public/streamMetadata.js";
+/** @internal */
+export { createStreamMetadata, StreamMetadataError } from "../public/streamMetadata.js";
+/** @internal */
+export const createStreamMetadataV3 = createStreamMetadata;
+/** @internal */
+export const streamMetadataValuesV3 = streamMetadataValues;