@floegence/flowersec-core 3.1.0 → 3.2.0

package/README.md

@@ -18,6 +18,16 @@ npm install @floegence/flowersec-core
 - `@floegence/flowersec-core/node` adds the V3 `connect(...)`, `createConnectionController(...)`, direct-only `createAcceptor(...)`, opaque `createTunnelRuntime(...)`, `AcceptedSession`, `SessionHandlers`, and `RPCHandlers` APIs. Legacy V2 server, control-plane, and `ProxyServer` APIs are available only under the explicit `node.v2` namespace; the Go control-plane remains the only v3 invitation issuer.
 - `@floegence/flowersec-core/proxy` adds the `Session`-based HTTP/WebSocket runtime, Service Worker and controller/app-window bridges, strict `proxy.runtime@2` validation, and `connectProxyBrowser(...)` composition.
 
+The browser entrypoint also exposes the isolated
+`flowersec-private-loopback/1` parser, lease, one-shot connector, and
+connection controller. Only these dedicated APIs accept the profile, and they
+require the exact numeric-loopback HTTP origin. Ordinary `connect(...)`
+continues to accept only standard `flowersec/3` artifacts and WSS/WebTransport
+security capabilities.
+
+The complete boundary is documented in the
+[private loopback profile](../docs/PRIVATE_LOOPBACK_V1.md).
+
 The root type exports are:
 
 - Artifact lifecycle: `Artifact`, closed `ArtifactError` parse failures, and `ArtifactLease`.

package/THIRD_PARTY_NOTICES.md

@@ -3,11 +3,11 @@
 This file is generated from the canonical Flowersec source dependency inventory for flowersec-ts.
 Do not edit it manually. License decisions are reviewed by the repository source license policy.
 
-- @floegence/flowersec-node-native 3.1.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-darwin-arm64 3.1.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-darwin-x64 3.1.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-linux-arm64-gnu 3.1.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-linux-x64-gnu 3.1.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native 3.2.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-darwin-arm64 3.2.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-darwin-x64 3.2.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-linux-arm64-gnu 3.2.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-linux-x64-gnu 3.2.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
 - @noble/ciphers 2.3.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.3.0.tgz)
 - @noble/curves 2.3.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/curves/-/curves-2.3.0.tgz)
 - @noble/hashes 2.3.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/hashes/-/hashes-2.3.0.tgz)

package/dist/browser/connectSessionV3.d.ts

@@ -1,6 +1,7 @@
 import type { Session } from "../public/contract.js";
-import type { ArtifactLeaseV3 } from "../v3/artifactLease.js";
+import { type ArtifactLeaseV3 } from "../v3/artifactLease.js";
 import { type ArtifactSourceV3, type ConnectionControllerV3 } from "../v3/connectionController.js";
+import { type PrivateLoopbackArtifactLeaseV1, type PrivateLoopbackArtifactSourceV1 } from "./privateLoopbackV1.js";
 export type SessionOptionsV3 = Readonly<{
     signal?: AbortSignal;
     connectTimeoutMs?: number;
@@ -9,5 +10,17 @@ export type ConnectionControllerOptionsV3 = Readonly<{
     maximumAttempts?: number;
     connectTimeoutMs?: number;
 }>;
+export type PrivateLoopbackSessionOptionsV1 = Readonly<{
+    origin: string;
+    signal?: AbortSignal;
+    connectTimeoutMs?: number;
+}>;
+export type PrivateLoopbackConnectionControllerOptionsV1 = Readonly<{
+    origin: string;
+    maximumAttempts?: number;
+    connectTimeoutMs?: number;
+}>;
 export declare function connectV3(lease: ArtifactLeaseV3, options?: SessionOptionsV3): Promise<Session>;
 export declare function createConnectionControllerV3(source: ArtifactSourceV3, options?: ConnectionControllerOptionsV3): Promise<ConnectionControllerV3<Session>>;
+export declare function connectPrivateLoopbackV1(lease: PrivateLoopbackArtifactLeaseV1, options: PrivateLoopbackSessionOptionsV1): Promise<Session>;
+export declare function createPrivateLoopbackConnectionControllerV1(source: PrivateLoopbackArtifactSourceV1, options: PrivateLoopbackConnectionControllerOptionsV1): Promise<ConnectionControllerV3<Session>>;

package/dist/browser/connectSessionV3.js

@@ -1,10 +1,12 @@
 import { SDK_DEFAULTS } from "../defaults.js";
+import { claimArtifactLeaseV3, retireArtifactLeaseV3, } from "../v3/artifactLease.js";
 import { createConnectionControllerV3 as createCoreControllerV3, } from "../v3/connectionController.js";
 import { BrowserRuntimeCapabilityRegistryV3, createBrowserWebTransportCarrierV3, } from "../v3/browserRuntime.js";
 import { attemptClaimedArtifactLeaseV3, connectArtifactLeaseV3 } from "../v3/sessionConnector.js";
 import { readyNativeAdmissionV3, readyWebSocketAdmissionV3 } from "../v3/runtimeAdapters.js";
 import { TransportFailureV3, ConnectErrorV3 } from "../v3/security.js";
 import { browserSessionRuntimeV3 } from "../v3/browserSessionRuntime.js";
+import { unwrapPrivateLoopbackArtifactLeaseV1, validatePrivateLoopbackOriginV1, } from "./privateLoopbackV1.js";
 export async function connectV3(lease, options = {}) {
     const registry = await BrowserRuntimeCapabilityRegistryV3.create();
     return await connectArtifactLeaseV3(lease, browserRuntime(registry, options.connectTimeoutMs), options.signal);
@@ -19,6 +21,110 @@ export async function createConnectionControllerV3(source, options = {}) {
     };
     return createCoreControllerV3(source, async (context) => await attemptClaimedArtifactLeaseV3(context, runtime), coreOptions);
 }
+export async function connectPrivateLoopbackV1(lease, options) {
+    const privateOrigin = requirePrivateLoopbackOrigin(options.origin);
+    const unwrapped = unwrapPrivateLoopbackLease(lease);
+    if (new URL(unwrapped.endpoint).origin.replace(/^ws:/, "http:") !== privateOrigin) {
+        await retireInnerLease(unwrapped.innerLease);
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
+    const registry = await BrowserRuntimeCapabilityRegistryV3.create();
+    return await connectArtifactLeaseV3(unwrapped.innerLease, privateLoopbackBrowserRuntime(registry, options.connectTimeoutMs, privateOrigin), options.signal);
+}
+export async function createPrivateLoopbackConnectionControllerV1(source, options) {
+    const privateOrigin = requirePrivateLoopbackOrigin(options.origin);
+    const registry = await BrowserRuntimeCapabilityRegistryV3.create();
+    const runtime = privateLoopbackBrowserRuntime(registry, options.connectTimeoutMs, privateOrigin);
+    const mappedSource = {
+        acquire: async ({ signal }) => {
+            const result = await source.acquire({ signal });
+            return await mapPrivateLoopbackSourceResult(result, privateOrigin);
+        },
+    };
+    return createCoreControllerV3(mappedSource, async (context) => await attemptClaimedArtifactLeaseV3(context, runtime), {
+        capabilitySnapshot: runtime.capabilitySnapshot,
+        projectSessionFailure,
+        ...(options.maximumAttempts === undefined ? {} : { maximumAttempts: options.maximumAttempts }),
+    });
+}
+function requirePrivateLoopbackOrigin(raw) {
+    try {
+        return validatePrivateLoopbackOriginV1(raw);
+    }
+    catch {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
+}
+const invalidPrivateSourceResult = () => ({
+    kind: "failure",
+    code: "artifact_invalid",
+    disposition: { kind: "terminal" },
+});
+async function mapPrivateLoopbackSourceResult(result, privateOrigin) {
+    let descriptors;
+    let keys;
+    try {
+        if (typeof result !== "object" || result === null || Array.isArray(result)) {
+            return invalidPrivateSourceResult();
+        }
+        descriptors = Object.getOwnPropertyDescriptors(result);
+        keys = Reflect.ownKeys(result).sort((left, right) => String(left).localeCompare(String(right)));
+    }
+    catch {
+        return invalidPrivateSourceResult();
+    }
+    const values = keys.every((key) => typeof key === "string" && descriptors[key]?.enumerable === true &&
+        Object.hasOwn(descriptors[key], "value"));
+    const exactKeys = (expected) => values && keys.length === expected.length &&
+        keys.every((key, index) => key === expected[index]);
+    const kind = descriptors.kind?.value;
+    if (kind === "lease" && exactKeys(["kind", "lease"])) {
+        let unwrapped;
+        try {
+            unwrapped = unwrapPrivateLoopbackArtifactLeaseV1(descriptors.lease.value);
+        }
+        catch {
+            return invalidPrivateSourceResult();
+        }
+        if (new URL(unwrapped.endpoint).origin.replace(/^ws:/, "http:") !== privateOrigin) {
+            await retireInnerLease(unwrapped.innerLease);
+            return invalidPrivateSourceResult();
+        }
+        return { kind: "lease", lease: unwrapped.innerLease };
+    }
+    if (kind === "failure" && exactKeys(["code", "disposition", "kind"])) {
+        return {
+            kind: "failure",
+            code: descriptors.code.value,
+            disposition: descriptors.disposition.value,
+        };
+    }
+    const deliveredLease = descriptors.lease?.value;
+    try {
+        const unwrapped = unwrapPrivateLoopbackArtifactLeaseV1(deliveredLease);
+        await retireInnerLease(unwrapped.innerLease);
+    }
+    catch {
+        // Malformed results without an authentic private lease own no cleanup.
+    }
+    return invalidPrivateSourceResult();
+}
+async function retireInnerLease(lease) {
+    try {
+        await retireArtifactLeaseV3(claimArtifactLeaseV3(lease));
+    }
+    catch {
+        // Retirement is best-effort only when the lease is already terminal.
+    }
+}
+function unwrapPrivateLoopbackLease(lease) {
+    try {
+        return unwrapPrivateLoopbackArtifactLeaseV1(lease);
+    }
+    catch {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
+}
 function browserRuntime(registry, connectTimeoutMs) {
     const connectTimeoutMilliseconds = connectTimeoutMs ?? SDK_DEFAULTS.transport.connectTimeoutMs;
     if (!Number.isSafeInteger(connectTimeoutMilliseconds) || connectTimeoutMilliseconds < 1) {
@@ -37,21 +143,58 @@ function browserRuntime(registry, connectTimeoutMs) {
                 throw new TransportFailureV3("tls_unsupported");
             }
             validateBrowserWebSocketURL(candidate.normalized_url, artifact.path.kind);
-            const Constructor = globalThis.WebSocket;
-            if (Constructor === undefined)
+            return await dialBrowserWebSocket(candidate, artifact, candidate.normalized_url, signal);
+        },
+    };
+}
+function privateLoopbackBrowserRuntime(registry, connectTimeoutMs, privateOrigin) {
+    const connectTimeoutMilliseconds = connectTimeoutMs ?? SDK_DEFAULTS.transport.connectTimeoutMs;
+    if (!Number.isSafeInteger(connectTimeoutMilliseconds) || connectTimeoutMilliseconds < 1) {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
+    return {
+        capabilitySnapshot: () => registry.snapshot(),
+        connectTimeoutMilliseconds,
+        protocolRuntime: browserSessionRuntimeV3,
+        dial: async (candidate, artifact, _attemptNow, _capability, signal) => {
+            const targetURL = artifact.path.kind === "direct" && candidate.carrier === "websocket" &&
+                candidate.tls.mode === "ca"
+                ? privateWebSocketURL(candidate.normalized_url, privateOrigin)
+                : undefined;
+            if (targetURL === undefined)
                 throw new TransportFailureV3("tls_unsupported");
-            const protocol = artifact.path.kind === "direct" ? "flowersec.direct.v3" : "flowersec.tunnel.v3";
-            let socket;
-            try {
-                socket = new Constructor(candidate.normalized_url, protocol);
-            }
-            catch (error) {
-                throw new TransportFailureV3("connection_failed", undefined, error);
-            }
-            return await readyWebSocketAdmissionV3(candidate, artifact, socket, signal);
+            return await dialBrowserWebSocket(candidate, artifact, targetURL, signal);
         },
     };
 }
+async function dialBrowserWebSocket(candidate, artifact, targetURL, signal) {
+    const Constructor = globalThis.WebSocket;
+    if (Constructor === undefined)
+        throw new TransportFailureV3("tls_unsupported");
+    const protocol = artifact.path.kind === "direct" ? "flowersec.direct.v3" : "flowersec.tunnel.v3";
+    let socket;
+    try {
+        socket = new Constructor(targetURL, protocol);
+    }
+    catch (error) {
+        throw new TransportFailureV3("connection_failed", undefined, error);
+    }
+    return await readyWebSocketAdmissionV3(candidate, artifact, socket, signal);
+}
+function privateWebSocketURL(candidateURL, privateOrigin) {
+    try {
+        const candidate = new URL(candidateURL);
+        const origin = new URL(privateOrigin);
+        if (candidate.protocol !== "wss:" || candidate.host !== origin.host ||
+            candidate.pathname !== "/flowersec/v3/direct" || candidate.search !== "" || candidate.hash !== "")
+            return undefined;
+        candidate.protocol = "ws:";
+        return candidate.href;
+    }
+    catch {
+        return undefined;
+    }
+}
 function validateBrowserWebSocketURL(raw, path) {
     let parsed;
     try {

package/dist/browser/index.d.ts

@@ -1,8 +1,11 @@
 export * from "../facade.js";
 export * as v2 from "./v2.js";
-export { connectV3 as connect, createConnectionControllerV3 as createConnectionController, } from "./connectSessionV3.js";
+export { connectV3 as connect, createConnectionControllerV3 as createConnectionController, connectPrivateLoopbackV1, createPrivateLoopbackConnectionControllerV1, } from "./connectSessionV3.js";
+export { PRIVATE_LOOPBACK_PROFILE_V1, PrivateLoopbackArtifactErrorV1, createPrivateLoopbackArtifactLeaseV1, parsePrivateLoopbackArtifactV1, } from "./privateLoopbackV1.js";
 /** @deprecated Use connect and createConnectionController. */
 export { connectV3, createConnectionControllerV3 } from "./connectSessionV3.js";
 export type { ConnectionControllerOptionsV3 as ConnectionControllerOptions, SessionOptionsV3 as SessionOptions, } from "./connectSessionV3.js";
+export type { PrivateLoopbackConnectionControllerOptionsV1, PrivateLoopbackSessionOptionsV1, } from "./connectSessionV3.js";
+export type { PrivateLoopbackArtifactLeaseV1, PrivateLoopbackArtifactSourceResultV1, PrivateLoopbackArtifactSourceV1, PrivateLoopbackArtifactV1, } from "./privateLoopbackV1.js";
 /** @deprecated Use ConnectionControllerOptions and SessionOptions. */
 export type { ConnectionControllerOptionsV3, SessionOptionsV3 } from "./connectSessionV3.js";

package/dist/browser/index.js

@@ -1,5 +1,6 @@
 export * from "../facade.js";
 export * as v2 from "./v2.js";
-export { connectV3 as connect, createConnectionControllerV3 as createConnectionController, } from "./connectSessionV3.js";
+export { connectV3 as connect, createConnectionControllerV3 as createConnectionController, connectPrivateLoopbackV1, createPrivateLoopbackConnectionControllerV1, } from "./connectSessionV3.js";
+export { PRIVATE_LOOPBACK_PROFILE_V1, PrivateLoopbackArtifactErrorV1, createPrivateLoopbackArtifactLeaseV1, parsePrivateLoopbackArtifactV1, } from "./privateLoopbackV1.js";
 /** @deprecated Use connect and createConnectionController. */
 export { connectV3, createConnectionControllerV3 } from "./connectSessionV3.js";

package/dist/browser/privateLoopbackV1.d.ts

@@ -0,0 +1,30 @@
+import type { RetryDispositionV3 } from "../v3/security.js";
+export declare const PRIVATE_LOOPBACK_PROFILE_V1 = "flowersec-private-loopback/1";
+export declare class PrivateLoopbackArtifactV1 {
+    private readonly privateLoopbackArtifactBrand;
+    private constructor();
+}
+export declare class PrivateLoopbackArtifactLeaseV1 {
+    private readonly privateLoopbackLeaseBrand;
+    private constructor();
+}
+export declare class PrivateLoopbackArtifactErrorV1 extends Error {
+    readonly code = "invalid_artifact";
+    constructor();
+}
+export type PrivateLoopbackArtifactSourceResultV1 = Readonly<{
+    kind: "lease";
+    lease: PrivateLoopbackArtifactLeaseV1;
+}> | Readonly<{
+    kind: "failure";
+    code: string;
+    disposition: RetryDispositionV3;
+}>;
+export type PrivateLoopbackArtifactSourceV1 = Readonly<{
+    acquire(options: Readonly<{
+        signal: AbortSignal;
+    }>): Promise<PrivateLoopbackArtifactSourceResultV1>;
+}>;
+export declare function parsePrivateLoopbackArtifactV1(input: string | Uint8Array): PrivateLoopbackArtifactV1;
+export declare function createPrivateLoopbackArtifactLeaseV1(artifact: PrivateLoopbackArtifactV1, commitSpend: (signal?: AbortSignal) => Promise<void>, retireCleanup?: () => Promise<void>): PrivateLoopbackArtifactLeaseV1;
+export declare function validatePrivateLoopbackOriginV1(raw: string): string;

package/dist/browser/privateLoopbackV1.js

@@ -0,0 +1,141 @@
+import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
+import { canonicalizeJCSV3 } from "../v3/jcs.js";
+import { preflightJSONV3 } from "../v3/jsonPreflight.js";
+import { decodeArtifactV3JSON } from "../v3/artifact.js";
+import { createArtifactLeaseV3Internal } from "../v3/artifactLease.js";
+export const PRIVATE_LOOPBACK_PROFILE_V1 = "flowersec-private-loopback/1";
+const DIRECT_PATH = "/flowersec/v3/direct";
+const MIN_PRIVATE_LOOPBACK_PORT = 1024;
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const encoder = new TextEncoder();
+export class PrivateLoopbackArtifactV1 {
+    constructor() { }
+}
+export class PrivateLoopbackArtifactLeaseV1 {
+    constructor() { }
+}
+export class PrivateLoopbackArtifactErrorV1 extends Error {
+    code = "invalid_artifact";
+    constructor() {
+        super("Flowersec private loopback artifact is invalid");
+        this.name = "PrivateLoopbackArtifactError";
+    }
+}
+const artifacts = new WeakMap();
+const leases = new WeakMap();
+export function parsePrivateLoopbackArtifactV1(input) {
+    try {
+        const text = decodeBounded(input);
+        preflightJSONV3(text);
+        const value = JSON.parse(text);
+        if (!isRecord(value) || !hasExactKeys(value, ["artifact_b64u", "endpoint", "profile", "v"]) ||
+            value.v !== 1 || value.profile !== PRIVATE_LOOPBACK_PROFILE_V1 ||
+            typeof value.artifact_b64u !== "string" || typeof value.endpoint !== "string" ||
+            canonicalizeJCSV3(value) !== text) {
+            throw new Error("invalid private loopback envelope");
+        }
+        const innerBytes = base64urlDecode(value.artifact_b64u);
+        if (innerBytes.length === 0 || innerBytes.length > 65_536 || base64urlEncode(innerBytes) !== value.artifact_b64u) {
+            throw new Error("invalid nested artifact encoding");
+        }
+        const endpoint = validatePrivateLoopbackEndpointV1(value.endpoint);
+        const innerArtifact = decodeArtifactV3JSON(innerBytes);
+        validateNestedArtifact(innerArtifact, endpoint);
+        const handle = new PrivateLoopbackArtifactV1();
+        artifacts.set(handle, Object.freeze({ endpoint, innerArtifact }));
+        return Object.freeze(handle);
+    }
+    catch {
+        throw new PrivateLoopbackArtifactErrorV1();
+    }
+}
+export function createPrivateLoopbackArtifactLeaseV1(artifact, commitSpend, retireCleanup) {
+    const state = artifacts.get(artifact);
+    if (state === undefined)
+        throw new PrivateLoopbackArtifactErrorV1();
+    const lease = new PrivateLoopbackArtifactLeaseV1();
+    leases.set(lease, {
+        ...state,
+        innerLease: createArtifactLeaseV3Internal(state.innerArtifact, commitSpend, retireCleanup),
+    });
+    return Object.freeze(lease);
+}
+/** @internal Dedicated private-loopback connector boundary. */
+export function unwrapPrivateLoopbackArtifactLeaseV1(lease) {
+    const state = leases.get(lease);
+    if (state === undefined)
+        throw new PrivateLoopbackArtifactErrorV1();
+    return state;
+}
+export function validatePrivateLoopbackOriginV1(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new PrivateLoopbackArtifactErrorV1();
+    }
+    if (raw !== parsed.origin || parsed.protocol !== "http:" || parsed.username !== "" || parsed.password !== "" ||
+        !privateLoopbackPort(parsed.port) || !numericLoopbackHostname(parsed.hostname)) {
+        throw new PrivateLoopbackArtifactErrorV1();
+    }
+    return parsed.origin;
+}
+function validatePrivateLoopbackEndpointV1(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new PrivateLoopbackArtifactErrorV1();
+    }
+    if (parsed.href !== raw || parsed.protocol !== "ws:" || parsed.username !== "" || parsed.password !== "" ||
+        !privateLoopbackPort(parsed.port) || parsed.pathname !== DIRECT_PATH || parsed.search !== "" || parsed.hash !== "" ||
+        !numericLoopbackHostname(parsed.hostname)) {
+        throw new PrivateLoopbackArtifactErrorV1();
+    }
+    return raw;
+}
+function privateLoopbackPort(raw) {
+    if (!/^(0|[1-9][0-9]*)$/.test(raw))
+        return false;
+    const port = Number(raw);
+    return Number.isSafeInteger(port) && port >= MIN_PRIVATE_LOOPBACK_PORT && port <= 65_535;
+}
+function validateNestedArtifact(artifact, endpoint) {
+    if (artifact.path.kind !== "direct" || artifact.path.candidates.length !== 1) {
+        throw new PrivateLoopbackArtifactErrorV1();
+    }
+    const candidate = artifact.path.candidates[0];
+    const privateURL = new URL(endpoint);
+    privateURL.protocol = "wss:";
+    if (candidate.id !== "private-loopback" || candidate.carrier !== "websocket" || candidate.tls.mode !== "ca" ||
+        candidate.wire_profile !== "flowersec-direct/3" || candidate.normalized_url !== privateURL.href ||
+        candidate.url !== privateURL.href) {
+        throw new PrivateLoopbackArtifactErrorV1();
+    }
+}
+function numericLoopbackHostname(hostname) {
+    if (hostname === "[::1]")
+        return true;
+    if (!/^\d{1,3}(?:\.\d{1,3}){3}$/.test(hostname))
+        return false;
+    const octets = hostname.split(".").map(Number);
+    return octets.every((value) => value >= 0 && value <= 255) && octets[0] === 127;
+}
+function decodeBounded(input) {
+    const bytes = typeof input === "string" ? encoder.encode(input) : input;
+    if (bytes.length === 0 || bytes.length > 100_000)
+        throw new PrivateLoopbackArtifactErrorV1();
+    const text = decoder.decode(bytes);
+    if (encoder.encode(text).length !== bytes.length)
+        throw new PrivateLoopbackArtifactErrorV1();
+    return text;
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasExactKeys(value, expected) {
+    const keys = Object.keys(value).sort();
+    return keys.length === expected.length && keys.every((key, index) => key === expected[index]);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {
@@ -93,7 +93,7 @@
     "vitest": "4.1.10"
   },
   "optionalDependencies": {
-    "@floegence/flowersec-node-native": "3.1.0"
+    "@floegence/flowersec-node-native": "3.2.0"
   },
-  "flowersecSourceCommit": "ae5dd8e162245f2d51f9f694ea383c2df46951f2"
+  "flowersecSourceCommit": "ee03e2424a8069e4327597e732710f4ea0b5447f"
 }

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:fcf1cd69-bef4-5ee9-889d-aba8d72f1d67",
+  "serialNumber": "urn:uuid:b179f2ab-6177-5e8b-8e87-0907981b88da",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "3.1.0",
-      "purl": "pkg:npm/%40floegence/flowersec-core@3.1.0",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@3.1.0"
+      "version": "3.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-core@3.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@3.2.0"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "ef8534b94714d4ba0acb574ae521d066974c94ee3b9d4df1b2fd8e3fda9d64c6"
+        "value": "9d19fe4ff25f8c891b27e02476657c2674f7ae772dc1a10cfc4fbaa094f2d69d"
       }
     ]
   },
@@ -22,9 +22,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native",
-      "version": "3.1.0",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native@3.1.0",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native@3.1.0",
+      "version": "3.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native@3.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native@3.2.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -50,9 +50,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-darwin-arm64",
-      "version": "3.1.0",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@3.1.0",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@3.1.0",
+      "version": "3.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@3.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@3.2.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -78,9 +78,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-darwin-x64",
-      "version": "3.1.0",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@3.1.0",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@3.1.0",
+      "version": "3.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@3.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@3.2.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -106,9 +106,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-linux-arm64-gnu",
-      "version": "3.1.0",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@3.1.0",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@3.1.0",
+      "version": "3.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@3.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@3.2.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -134,9 +134,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-linux-x64-gnu",
-      "version": "3.1.0",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@3.1.0",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@3.1.0",
+      "version": "3.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@3.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@3.2.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -330,9 +330,9 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@3.1.0",
+      "ref": "pkg:npm/%40floegence/flowersec-core@3.2.0",
       "dependsOn": [
-        "pkg:npm/%40floegence/flowersec-node-native@3.1.0",
+        "pkg:npm/%40floegence/flowersec-node-native@3.2.0",
         "pkg:npm/%40noble/ciphers@2.3.0",
         "pkg:npm/%40noble/curves@2.3.0",
         "pkg:npm/%40noble/hashes@2.3.0",
@@ -341,28 +341,28 @@
       ]
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native@3.1.0",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native@3.2.0",
       "dependsOn": [
-        "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@3.1.0",
-        "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@3.1.0",
-        "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@3.1.0",
-        "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@3.1.0"
+        "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@3.2.0",
+        "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@3.2.0",
+        "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@3.2.0",
+        "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@3.2.0"
       ]
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@3.1.0",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@3.2.0",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@3.1.0",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@3.2.0",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@3.1.0",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@3.2.0",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@3.1.0",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@3.2.0",
       "dependsOn": []
     },
     {

package/sbom/spdx.json

@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "flowersec-ts",
-  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/ef8534b94714d4ba0acb574ae521d066974c94ee3b9d4df1b2fd8e3fda9d64c6",
+  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/9d19fe4ff25f8c891b27e02476657c2674f7ae772dc1a10cfc4fbaa094f2d69d",
   "creationInfo": {
     "created": "1970-01-01T00:00:00Z",
     "creators": [
@@ -13,26 +13,26 @@
   "packages": [
     {
       "name": "@floegence/flowersec-core",
-      "SPDXID": "SPDXRef-Package-e8ee53a3af1d6320f196",
-      "versionInfo": "3.1.0",
+      "SPDXID": "SPDXRef-Package-6e9d04974b38b4b1d01d",
+      "versionInfo": "3.2.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "NOASSERTION",
       "copyrightText": "NOASSERTION",
-      "comment": "Flowersec source inventory SHA-256: ef8534b94714d4ba0acb574ae521d066974c94ee3b9d4df1b2fd8e3fda9d64c6",
+      "comment": "Flowersec source inventory SHA-256: 9d19fe4ff25f8c891b27e02476657c2674f7ae772dc1a10cfc4fbaa094f2d69d",
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@3.1.0"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@3.2.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native",
-      "SPDXID": "SPDXRef-Package-aba8e320260fd3ac9020",
-      "versionInfo": "3.1.0",
+      "SPDXID": "SPDXRef-Package-2734898f9252221184a8",
+      "versionInfo": "3.2.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -42,14 +42,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native@3.1.0"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native@3.2.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-darwin-arm64",
-      "SPDXID": "SPDXRef-Package-f233d72278387d44a1ba",
-      "versionInfo": "3.1.0",
+      "SPDXID": "SPDXRef-Package-b4db4f0ebb5d24013241",
+      "versionInfo": "3.2.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -59,14 +59,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@3.1.0"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@3.2.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-darwin-x64",
-      "SPDXID": "SPDXRef-Package-e573e3e6376d6ba492ef",
-      "versionInfo": "3.1.0",
+      "SPDXID": "SPDXRef-Package-c7c6a584b06a11abe1d5",
+      "versionInfo": "3.2.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -76,14 +76,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@3.1.0"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@3.2.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-linux-arm64-gnu",
-      "SPDXID": "SPDXRef-Package-acd2c580f8743b3f3f2f",
-      "versionInfo": "3.1.0",
+      "SPDXID": "SPDXRef-Package-3e2771fdb680ee2c9ad4",
+      "versionInfo": "3.2.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -93,14 +93,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@3.1.0"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@3.2.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-linux-x64-gnu",
-      "SPDXID": "SPDXRef-Package-d12977a232293545f634",
-      "versionInfo": "3.1.0",
+      "SPDXID": "SPDXRef-Package-dd726d568c7ccf9508bf",
+      "versionInfo": "3.2.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -110,7 +110,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@3.1.0"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@3.2.0"
         }
       ]
     },
@@ -221,57 +221,57 @@
     {
       "spdxElementId": "SPDXRef-DOCUMENT",
       "relationshipType": "DESCRIBES",
-      "relatedSpdxElement": "SPDXRef-Package-e8ee53a3af1d6320f196"
+      "relatedSpdxElement": "SPDXRef-Package-6e9d04974b38b4b1d01d"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e8ee53a3af1d6320f196",
+      "spdxElementId": "SPDXRef-Package-6e9d04974b38b4b1d01d",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-aba8e320260fd3ac9020"
+      "relatedSpdxElement": "SPDXRef-Package-2734898f9252221184a8"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e8ee53a3af1d6320f196",
+      "spdxElementId": "SPDXRef-Package-6e9d04974b38b4b1d01d",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-5ce913a03239b02770fb"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e8ee53a3af1d6320f196",
+      "spdxElementId": "SPDXRef-Package-6e9d04974b38b4b1d01d",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-01009adf60db02c13634"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e8ee53a3af1d6320f196",
+      "spdxElementId": "SPDXRef-Package-6e9d04974b38b4b1d01d",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-8815b117c8a1d5f7eeb0"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e8ee53a3af1d6320f196",
+      "spdxElementId": "SPDXRef-Package-6e9d04974b38b4b1d01d",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-f8b45a289df643042b94"
     },
     {
-      "spdxElementId": "SPDXRef-Package-e8ee53a3af1d6320f196",
+      "spdxElementId": "SPDXRef-Package-6e9d04974b38b4b1d01d",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-b779412f685822663496"
     },
     {
-      "spdxElementId": "SPDXRef-Package-aba8e320260fd3ac9020",
+      "spdxElementId": "SPDXRef-Package-2734898f9252221184a8",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-f233d72278387d44a1ba"
+      "relatedSpdxElement": "SPDXRef-Package-b4db4f0ebb5d24013241"
     },
     {
-      "spdxElementId": "SPDXRef-Package-aba8e320260fd3ac9020",
+      "spdxElementId": "SPDXRef-Package-2734898f9252221184a8",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-e573e3e6376d6ba492ef"
+      "relatedSpdxElement": "SPDXRef-Package-c7c6a584b06a11abe1d5"
     },
     {
-      "spdxElementId": "SPDXRef-Package-aba8e320260fd3ac9020",
+      "spdxElementId": "SPDXRef-Package-2734898f9252221184a8",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-acd2c580f8743b3f3f2f"
+      "relatedSpdxElement": "SPDXRef-Package-3e2771fdb680ee2c9ad4"
     },
     {
-      "spdxElementId": "SPDXRef-Package-aba8e320260fd3ac9020",
+      "spdxElementId": "SPDXRef-Package-2734898f9252221184a8",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-d12977a232293545f634"
+      "relatedSpdxElement": "SPDXRef-Package-dd726d568c7ccf9508bf"
     },
     {
       "spdxElementId": "SPDXRef-Package-01009adf60db02c13634",