@floegence/flowersec-core 3.2.1 → 4.0.0

package/dist/v2/artifactLease.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/v2/artifactLease.js

@@ -1,7 +0,0 @@
-import { commitArtifactLeaseSpend, createArtifactLease } from "../public/artifactLease.js";
-/** @internal */
-export { ArtifactLease, ArtifactLeaseError, createArtifactLease } from "../public/artifactLease.js";
-/** @internal */
-export const createArtifactLeaseV2 = createArtifactLease;
-/** @internal */
-export const commitArtifactLeaseSpendV2 = commitArtifactLeaseSpend;

package/dist/v2/capability.d.ts

@@ -1,29 +0,0 @@
-import type { CarrierKind, PathKind } from "./contract.js";
-export type NetworkModeV2 = "dial" | "listen";
-export type SessionRoleV2 = "client" | "server";
-export type RuntimeCapabilityTupleV2 = Readonly<{
-    carrier: CarrierKind;
-    networkMode: NetworkModeV2;
-    path: PathKind;
-    sessionRole: SessionRoleV2;
-    reliableStreams: boolean;
-    datagrams: boolean;
-    migration: boolean;
-}>;
-export type UnsupportedRuntimeCarrierV2 = Readonly<{
-    carrier: CarrierKind;
-    reason: string;
-}>;
-export type RuntimeCapabilityDescriptorV2 = Readonly<{
-    language: string;
-    runtime: string;
-    schemaVersion: 2;
-    tuples: readonly RuntimeCapabilityTupleV2[];
-    unsupported: readonly UnsupportedRuntimeCarrierV2[];
-}>;
-export declare function defineRuntimeCapabilityDescriptorV2(runtime: string, tuples: readonly RuntimeCapabilityTupleV2[], unsupportedCarriers: readonly UnsupportedRuntimeCarrierV2[]): RuntimeCapabilityDescriptorV2;
-export declare function encodeRuntimeCapabilityDescriptorV2(descriptor: RuntimeCapabilityDescriptorV2): string;
-export declare function decodeRuntimeCapabilityDescriptorV2(raw: string): RuntimeCapabilityDescriptorV2;
-export declare function runtimeCapabilityDigestV2(descriptor: RuntimeCapabilityDescriptorV2): Uint8Array;
-export declare function runtimeCapabilityDigestHexV2(descriptor: RuntimeCapabilityDescriptorV2): string;
-export declare function validateRuntimeCapabilityDescriptorV2(descriptor: RuntimeCapabilityDescriptorV2): void;

package/dist/v2/capability.js

@@ -1,190 +0,0 @@
-import { sha256 } from "@noble/hashes/sha2.js";
-const encoder = new TextEncoder();
-const carriers = Object.freeze(["raw_quic", "websocket", "webtransport"]);
-const registryToken = /^[a-z][a-z0-9_]{0,127}$/;
-const digestLabel = encoder.encode("flowersec-v2-runtime-capability\0");
-export function defineRuntimeCapabilityDescriptorV2(runtime, tuples, unsupportedCarriers) {
-    const value = {
-        language: "typescript",
-        runtime,
-        schemaVersion: 2,
-        tuples: Object.freeze(tuples.map((entry) => Object.freeze({ ...entry }))),
-        unsupported: Object.freeze(unsupportedCarriers.map((entry) => Object.freeze({ ...entry }))),
-    };
-    validateRuntimeCapabilityDescriptorV2(value);
-    return Object.freeze(value);
-}
-export function encodeRuntimeCapabilityDescriptorV2(descriptor) {
-    validateRuntimeCapabilityDescriptorV2(descriptor);
-    return JSON.stringify({
-        language: descriptor.language,
-        runtime: descriptor.runtime,
-        schemaVersion: descriptor.schemaVersion,
-        tuples: descriptor.tuples.map(({ carrier, networkMode, path, sessionRole, reliableStreams, datagrams, migration, }) => ({
-            carrier, datagrams, migration, networkMode, path, reliableStreams, sessionRole,
-        })),
-        unsupported: descriptor.unsupported.map(({ carrier, reason }) => ({ carrier, reason })),
-    });
-}
-export function decodeRuntimeCapabilityDescriptorV2(raw) {
-    const parsed = JSON.parse(raw);
-    const value = decodeDescriptor(parsed);
-    const canonical = encodeRuntimeCapabilityDescriptorV2(value);
-    if (canonical !== raw)
-        throw new TypeError("runtime capability descriptor is not canonical JSON");
-    return value;
-}
-export function runtimeCapabilityDigestV2(descriptor) {
-    const canonical = encoder.encode(encodeRuntimeCapabilityDescriptorV2(descriptor));
-    const length = new Uint8Array(4);
-    new DataView(length.buffer).setUint32(0, canonical.length);
-    const preimage = new Uint8Array(digestLabel.length + length.length + canonical.length);
-    preimage.set(digestLabel, 0);
-    preimage.set(length, digestLabel.length);
-    preimage.set(canonical, digestLabel.length + length.length);
-    return sha256(preimage);
-}
-export function runtimeCapabilityDigestHexV2(descriptor) {
-    return Array.from(runtimeCapabilityDigestV2(descriptor), (value) => value.toString(16).padStart(2, "0")).join("");
-}
-export function validateRuntimeCapabilityDescriptorV2(descriptor) {
-    if (descriptor.schemaVersion !== 2 || !registryToken.test(descriptor.language) ||
-        !registryToken.test(descriptor.runtime) || descriptor.tuples.length + descriptor.unsupported.length === 0) {
-        throw new TypeError("invalid runtime capability descriptor header");
-    }
-    const supported = new Set();
-    let previousTuple;
-    for (const current of descriptor.tuples) {
-        validateTuple(current);
-        if (previousTuple !== undefined && compareTuple(previousTuple, current) >= 0) {
-            throw new TypeError("runtime capability tuples must be unique and canonically sorted");
-        }
-        supported.add(current.carrier);
-        previousTuple = current;
-    }
-    const unavailable = new Set();
-    let previousUnsupported;
-    for (const current of descriptor.unsupported) {
-        if (!carriers.includes(current.carrier) || !registryToken.test(current.reason) || supported.has(current.carrier)) {
-            throw new TypeError("invalid unsupported runtime carrier");
-        }
-        if (previousUnsupported !== undefined && compareUnsupported(previousUnsupported, current) >= 0) {
-            throw new TypeError("unsupported runtime carriers must be unique and canonically sorted");
-        }
-        unavailable.add(current.carrier);
-        previousUnsupported = current;
-    }
-    for (const carrier of carriers) {
-        if (supported.has(carrier) === unavailable.has(carrier)) {
-            throw new TypeError(`runtime capability must support or explicitly reject ${carrier}`);
-        }
-    }
-}
-function decodeDescriptor(input) {
-    const object = exactObject(input, ["language", "runtime", "schemaVersion", "tuples", "unsupported"]);
-    if (!Array.isArray(object.tuples) || !Array.isArray(object.unsupported)) {
-        throw new TypeError("runtime capability collections must be arrays");
-    }
-    const tuples = object.tuples.map((input) => {
-        const value = exactObject(input, [
-            "carrier", "networkMode", "path", "sessionRole", "reliableStreams", "datagrams", "migration",
-        ]);
-        if (typeof value.reliableStreams !== "boolean" || typeof value.datagrams !== "boolean" ||
-            typeof value.migration !== "boolean") {
-            throw new TypeError("invalid runtime capability features");
-        }
-        const decoded = Object.freeze({
-            carrier: requireCarrier(value.carrier),
-            networkMode: requireNetworkMode(value.networkMode),
-            path: requirePath(value.path),
-            sessionRole: requireSessionRole(value.sessionRole),
-            reliableStreams: true,
-            datagrams: value.datagrams,
-            migration: value.migration,
-        });
-        if (decoded.reliableStreams !== value.reliableStreams) {
-            throw new TypeError("runtime capability requires reliable streams");
-        }
-        return decoded;
-    });
-    const unsupportedCarriers = object.unsupported.map((input) => {
-        const value = exactObject(input, ["carrier", "reason"]);
-        if (typeof value.reason !== "string")
-            throw new TypeError("unsupported reason must be a string");
-        return Object.freeze({ carrier: requireCarrier(value.carrier), reason: value.reason });
-    });
-    if (typeof object.language !== "string" || typeof object.runtime !== "string" || object.schemaVersion !== 2) {
-        throw new TypeError("invalid runtime capability descriptor header");
-    }
-    const result = Object.freeze({
-        language: object.language,
-        runtime: object.runtime,
-        schemaVersion: 2,
-        tuples: Object.freeze(tuples),
-        unsupported: Object.freeze(unsupportedCarriers),
-    });
-    validateRuntimeCapabilityDescriptorV2(result);
-    return result;
-}
-function validateTuple(value) {
-    if (!carriers.includes(value.carrier) || !["dial", "listen"].includes(value.networkMode) ||
-        !["direct", "tunnel"].includes(value.path) || !["client", "server"].includes(value.sessionRole) ||
-        value.reliableStreams !== true || typeof value.datagrams !== "boolean" || typeof value.migration !== "boolean") {
-        throw new TypeError("invalid runtime capability tuple");
-    }
-    if (value.carrier === "websocket" && (value.datagrams || value.migration)) {
-        throw new TypeError("WebSocket runtime capability cannot advertise datagrams or migration");
-    }
-    const valid = value.path === "direct"
-        ? (value.networkMode === "dial" && value.sessionRole === "client") ||
-            (value.networkMode === "listen" && value.sessionRole === "server")
-        : value.networkMode === "dial";
-    if (!valid)
-        throw new TypeError("invalid runtime capability deployment role");
-}
-function compareTuple(left, right) {
-    return compareStrings([left.carrier, left.networkMode, left.sessionRole, left.path], [right.carrier, right.networkMode, right.sessionRole, right.path]);
-}
-function compareUnsupported(left, right) {
-    return left.carrier < right.carrier ? -1 : left.carrier > right.carrier ? 1 : 0;
-}
-function compareStrings(left, right) {
-    for (let index = 0; index < left.length; index++) {
-        if (left[index] < right[index])
-            return -1;
-        if (left[index] > right[index])
-            return 1;
-    }
-    return 0;
-}
-function exactObject(input, keys) {
-    if (typeof input !== "object" || input === null || Array.isArray(input))
-        throw new TypeError("expected object");
-    const object = input;
-    const actual = Object.keys(object).sort();
-    const expected = [...keys].sort();
-    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
-        throw new TypeError("runtime capability object has unknown or missing fields");
-    }
-    return object;
-}
-function requireCarrier(value) {
-    if (typeof value !== "string" || !carriers.includes(value))
-        throw new TypeError("invalid carrier");
-    return value;
-}
-function requireNetworkMode(value) {
-    if (value !== "dial" && value !== "listen")
-        throw new TypeError("invalid network mode");
-    return value;
-}
-function requireSessionRole(value) {
-    if (value !== "client" && value !== "server")
-        throw new TypeError("invalid session role");
-    return value;
-}
-function requirePath(value) {
-    if (value !== "direct" && value !== "tunnel")
-        throw new TypeError("invalid path");
-    return value;
-}

package/dist/v2/carrier.d.ts

@@ -1,84 +0,0 @@
-import type { CarrierKind, OperationOptionsV2, PathKind } from "./contract.js";
-export type CarrierErrorCode = "aborted" | "closed" | "reset" | "stop_sending" | "stop_sending_unavailable" | "write_closed" | "datagram_unavailable";
-export declare class CarrierError extends Error {
-    readonly code: CarrierErrorCode;
-    readonly cause?: unknown | undefined;
-    constructor(code: CarrierErrorCode, message: string, cause?: unknown | undefined);
-}
-export interface CarrierStreamV2 {
-    read(options?: OperationOptionsV2): Promise<Uint8Array | null>;
-    write(data: Uint8Array, options?: OperationOptionsV2): Promise<number>;
-    closeWrite(): Promise<void>;
-    stopSending(): Promise<void>;
-    reset(): Promise<void>;
-    /**
-     * Synchronously initiates idempotent forced teardown. Pending and future
-     * stream primitives must settle, but this call does not await cleanup.
-     */
-    abort(error?: Error): void;
-}
-export interface CarrierUnreliableDatagramsV2 {
-    readonly maxDatagramSize: number;
-    send(data: Uint8Array, options?: Readonly<{
-        signal?: AbortSignal;
-        expiresAt?: number;
-    }>): Promise<"accepted" | "dropped_budget" | "dropped_expired" | "dropped_carrier">;
-    receive(options?: OperationOptionsV2): Promise<Uint8Array>;
-}
-export interface CarrierSessionV2 {
-    readonly kind: CarrierKind;
-    readonly path: PathKind;
-    readonly inboundBidirectionalStreamCapacity: number;
-    readonly unreliableDatagrams?: CarrierUnreliableDatagramsV2 | undefined;
-    openStream(options?: OperationOptionsV2): Promise<CarrierStreamV2>;
-    acceptStream(options?: OperationOptionsV2): Promise<CarrierStreamV2>;
-    waitTermination(): Promise<void>;
-    close(error?: Readonly<{
-        code: number;
-        reason: string;
-    }>): Promise<void>;
-    /**
-     * Synchronously initiates idempotent forced teardown. Pending and future
-     * session and stream primitives must settle, but this call does not await cleanup.
-     */
-    abort(error?: Readonly<{
-        code: number;
-        reason: string;
-    }>): void;
-}
-export type NativeCarrierStreamV2 = Readonly<{
-    read(): Promise<Uint8Array | null>;
-    write(data: Uint8Array): Promise<number>;
-    closeWrite(): Promise<void>;
-    stopSending(): Promise<void>;
-    reset(): Promise<void>;
-    /** Cancels pending local primitives without initiating peer-visible teardown. */
-    cancelPending?(): void;
-    /** See {@link CarrierStreamV2.abort}. */
-    abort(error?: Error): void;
-}>;
-export type NativeCarrierSessionV2 = Readonly<{
-    kind: "webtransport" | "raw_quic";
-    path: PathKind;
-    inboundBidirectionalStreamCapacity: number;
-    unreliableDatagrams?: CarrierUnreliableDatagramsV2 | undefined;
-    openStream(options?: OperationOptionsV2): Promise<NativeCarrierStreamV2>;
-    acceptStream(options?: OperationOptionsV2): Promise<NativeCarrierStreamV2>;
-    waitTermination(): Promise<void>;
-    close(error?: Readonly<{
-        code: number;
-        reason: string;
-    }>): Promise<void>;
-    /** See {@link CarrierSessionV2.abort}. */
-    abort(error?: Readonly<{
-        code: number;
-        reason: string;
-    }>): void;
-}>;
-export declare function adaptNativeCarrierSessionV2(native: NativeCarrierSessionV2): CarrierSessionV2;
-export declare function createMemoryCarrierPairV2(options: Readonly<{
-    kind: CarrierKind;
-    path: PathKind;
-    inboundBidirectionalStreamCapacity: number;
-    maxPendingStreams?: number;
-}>): readonly [CarrierSessionV2, CarrierSessionV2];