@floegence/flowersec-core 5.0.5 → 5.2.0

package/THIRD_PARTY_NOTICES.md

@@ -3,11 +3,11 @@
 This file is generated from the canonical Flowersec source dependency inventory for flowersec-ts.
 Do not edit it manually. License decisions are reviewed by the repository source license policy.
 
-- @floegence/flowersec-node-native 5.0.5 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-darwin-arm64 5.0.5 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-darwin-x64 5.0.5 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-linux-arm64-gnu 5.0.5 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-linux-x64-gnu 5.0.5 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native 5.2.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-darwin-arm64 5.2.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-darwin-x64 5.2.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-linux-arm64-gnu 5.2.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-linux-x64-gnu 5.2.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
 - @noble/ciphers 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.4.0.tgz)
 - @noble/curves 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/curves/-/curves-2.4.0.tgz)
 - @noble/hashes 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/hashes/-/hashes-2.4.0.tgz)

package/dist/browser/connectSessionV3.d.ts

@@ -2,6 +2,7 @@ import type { Session } from "../public/contract.js";
 import { type ArtifactLeaseV3 } from "../v3/artifactLease.js";
 import { type ArtifactSourceV3, type ConnectionControllerV3 } from "../v3/connectionController.js";
 import { type PrivateLoopbackArtifactLeaseV1, type PrivateLoopbackArtifactSourceV1 } from "./privateLoopbackV1.js";
+import { type HTTPDirectArtifactLeaseV1, type HTTPDirectArtifactSourceV1 } from "./httpDirectV1.js";
 export type SessionOptionsV3 = Readonly<{
     signal?: AbortSignal;
     connectTimeoutMs?: number;
@@ -22,5 +23,9 @@ export type PrivateLoopbackConnectionControllerOptionsV1 = Readonly<{
 }>;
 export declare function connectV3(lease: ArtifactLeaseV3, options?: SessionOptionsV3): Promise<Session>;
 export declare function createConnectionControllerV3(source: ArtifactSourceV3, options?: ConnectionControllerOptionsV3): Promise<ConnectionControllerV3<Session>>;
+export type HTTPDirectSessionOptionsV1 = PrivateLoopbackSessionOptionsV1;
+export type HTTPDirectConnectionControllerOptionsV1 = PrivateLoopbackConnectionControllerOptionsV1;
 export declare function connectPrivateLoopbackV1(lease: PrivateLoopbackArtifactLeaseV1, options: PrivateLoopbackSessionOptionsV1): Promise<Session>;
+export declare function connectHTTPDirectV1(lease: HTTPDirectArtifactLeaseV1, options: HTTPDirectSessionOptionsV1): Promise<Session>;
 export declare function createPrivateLoopbackConnectionControllerV1(source: PrivateLoopbackArtifactSourceV1, options: PrivateLoopbackConnectionControllerOptionsV1): Promise<ConnectionControllerV3<Session>>;
+export declare function createHTTPDirectConnectionControllerV1(source: HTTPDirectArtifactSourceV1, options: HTTPDirectConnectionControllerOptionsV1): Promise<ConnectionControllerV3<Session>>;

package/dist/browser/connectSessionV3.js

@@ -7,6 +7,7 @@ import { readyNativeAdmissionV3, readyWebSocketAdmissionV3 } from "../v3/runtime
 import { TransportFailureV3, ConnectErrorV3 } from "../v3/security.js";
 import { browserSessionRuntimeV3 } from "../v3/browserSessionRuntime.js";
 import { unwrapPrivateLoopbackArtifactLeaseV1, validatePrivateLoopbackOriginV1, } from "./privateLoopbackV1.js";
+import { unwrapHTTPDirectArtifactLeaseV1, validateHTTPDirectOriginV1, } from "./httpDirectV1.js";
 export async function connectV3(lease, options = {}) {
     return await connectArtifactLeaseWithRuntimeV3(lease, options, async () => {
         const registry = await BrowserRuntimeCapabilityRegistryV3.create();
@@ -23,26 +24,49 @@ export async function createConnectionControllerV3(source, options = {}) {
     };
     return createCoreControllerV3(source, async (context) => await attemptClaimedArtifactLeaseV3(context, runtime), coreOptions);
 }
+const privateProfile = {
+    validateOrigin: validatePrivateLoopbackOriginV1,
+    unwrap: (lease) => unwrapPrivateLoopbackArtifactLeaseV1(lease),
+};
+const httpProfile = {
+    validateOrigin: validateHTTPDirectOriginV1,
+    unwrap: (lease) => unwrapHTTPDirectArtifactLeaseV1(lease),
+};
 export async function connectPrivateLoopbackV1(lease, options) {
-    const unwrapped = unwrapPrivateLoopbackLease(lease);
+    return await connectDirectProfile(lease, options, privateProfile);
+}
+export async function connectHTTPDirectV1(lease, options) {
+    return await connectDirectProfile(lease, options, httpProfile);
+}
+export async function createPrivateLoopbackConnectionControllerV1(source, options) {
+    return await createDirectProfileController(source, options, privateProfile);
+}
+export async function createHTTPDirectConnectionControllerV1(source, options) {
+    return await createDirectProfileController(source, options, httpProfile);
+}
+async function connectDirectProfile(lease, options, profile) {
+    let unwrapped;
+    try {
+        unwrapped = profile.unwrap(lease);
+    }
+    catch {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
     return await connectArtifactLeaseWithRuntimeV3(unwrapped.innerLease, options, async () => {
-        const privateOrigin = requirePrivateLoopbackOrigin(options.origin);
-        if (new URL(unwrapped.endpoint).origin.replace(/^ws:/, "http:") !== privateOrigin) {
+        const origin = requireProfileOrigin(options.origin, profile);
+        if (new URL(unwrapped.endpoint).origin.replace(/^ws:/, "http:") !== origin) {
             throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
         }
         const registry = await BrowserRuntimeCapabilityRegistryV3.create();
-        return privateLoopbackBrowserRuntime(registry, options.connectTimeoutMs, privateOrigin);
+        return directProfileBrowserRuntime(registry, options.connectTimeoutMs, origin);
     });
 }
-export async function createPrivateLoopbackConnectionControllerV1(source, options) {
-    const privateOrigin = requirePrivateLoopbackOrigin(options.origin);
+async function createDirectProfileController(source, options, profile) {
+    const origin = requireProfileOrigin(options.origin, profile);
     const registry = await BrowserRuntimeCapabilityRegistryV3.create();
-    const runtime = privateLoopbackBrowserRuntime(registry, options.connectTimeoutMs, privateOrigin);
+    const runtime = directProfileBrowserRuntime(registry, options.connectTimeoutMs, origin);
     const mappedSource = {
-        acquire: async ({ signal }) => {
-            const result = await source.acquire({ signal });
-            return await mapPrivateLoopbackSourceResult(result, privateOrigin);
-        },
+        acquire: async ({ signal }) => await mapDirectProfileSourceResult(await source.acquire({ signal }), origin, profile),
     };
     return createCoreControllerV3(mappedSource, async (context) => await attemptClaimedArtifactLeaseV3(context, runtime), {
         capabilitySnapshot: runtime.capabilitySnapshot,
@@ -50,31 +74,31 @@ export async function createPrivateLoopbackConnectionControllerV1(source, option
         ...(options.maximumAttempts === undefined ? {} : { maximumAttempts: options.maximumAttempts }),
     });
 }
-function requirePrivateLoopbackOrigin(raw) {
+function requireProfileOrigin(raw, profile) {
     try {
-        return validatePrivateLoopbackOriginV1(raw);
+        return profile.validateOrigin(raw);
     }
     catch {
         throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
     }
 }
-const invalidPrivateSourceResult = () => ({
+const invalidProfileSourceResult = () => ({
     kind: "failure",
     code: "artifact_invalid",
     disposition: { kind: "terminal" },
 });
-async function mapPrivateLoopbackSourceResult(result, privateOrigin) {
+async function mapDirectProfileSourceResult(result, profileOrigin, profile) {
     let descriptors;
     let keys;
     try {
         if (typeof result !== "object" || result === null || Array.isArray(result)) {
-            return invalidPrivateSourceResult();
+            return invalidProfileSourceResult();
         }
         descriptors = Object.getOwnPropertyDescriptors(result);
         keys = Reflect.ownKeys(result).sort((left, right) => String(left).localeCompare(String(right)));
     }
     catch {
-        return invalidPrivateSourceResult();
+        return invalidProfileSourceResult();
     }
     const values = keys.every((key) => typeof key === "string" && descriptors[key]?.enumerable === true &&
         Object.hasOwn(descriptors[key], "value"));
@@ -84,14 +108,14 @@ async function mapPrivateLoopbackSourceResult(result, privateOrigin) {
     if (kind === "lease" && exactKeys(["kind", "lease"])) {
         let unwrapped;
         try {
-            unwrapped = unwrapPrivateLoopbackArtifactLeaseV1(descriptors.lease.value);
+            unwrapped = profile.unwrap(descriptors.lease.value);
         }
         catch {
-            return invalidPrivateSourceResult();
+            return invalidProfileSourceResult();
         }
-        if (new URL(unwrapped.endpoint).origin.replace(/^ws:/, "http:") !== privateOrigin) {
+        if (new URL(unwrapped.endpoint).origin.replace(/^ws:/, "http:") !== profileOrigin) {
             await retireInnerLease(unwrapped.innerLease);
-            return invalidPrivateSourceResult();
+            return invalidProfileSourceResult();
         }
         return { kind: "lease", lease: unwrapped.innerLease };
     }
@@ -104,13 +128,13 @@ async function mapPrivateLoopbackSourceResult(result, privateOrigin) {
     }
     const deliveredLease = descriptors.lease?.value;
     try {
-        const unwrapped = unwrapPrivateLoopbackArtifactLeaseV1(deliveredLease);
+        const unwrapped = profile.unwrap(deliveredLease);
         await retireInnerLease(unwrapped.innerLease);
     }
     catch {
-        // Malformed results without an authentic private lease own no cleanup.
+        // Malformed results without an authentic profile lease own no cleanup.
     }
-    return invalidPrivateSourceResult();
+    return invalidProfileSourceResult();
 }
 async function retireInnerLease(lease) {
     try {
@@ -120,14 +144,6 @@ async function retireInnerLease(lease) {
         // Retirement is best-effort only when the lease is already terminal.
     }
 }
-function unwrapPrivateLoopbackLease(lease) {
-    try {
-        return unwrapPrivateLoopbackArtifactLeaseV1(lease);
-    }
-    catch {
-        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
-    }
-}
 function browserRuntime(registry, connectTimeoutMs) {
     const connectTimeoutMilliseconds = connectTimeoutMs ?? SDK_DEFAULTS.transport.connectTimeoutMs;
     if (!Number.isSafeInteger(connectTimeoutMilliseconds) || connectTimeoutMilliseconds < 1) {
@@ -150,7 +166,7 @@ function browserRuntime(registry, connectTimeoutMs) {
         },
     };
 }
-function privateLoopbackBrowserRuntime(registry, connectTimeoutMs, privateOrigin) {
+function directProfileBrowserRuntime(registry, connectTimeoutMs, profileOrigin) {
     const connectTimeoutMilliseconds = connectTimeoutMs ?? SDK_DEFAULTS.transport.connectTimeoutMs;
     if (!Number.isSafeInteger(connectTimeoutMilliseconds) || connectTimeoutMilliseconds < 1) {
         throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
@@ -162,7 +178,7 @@ function privateLoopbackBrowserRuntime(registry, connectTimeoutMs, privateOrigin
         dial: async (candidate, artifact, _attemptNow, _capability, signal) => {
             const targetURL = artifact.path.kind === "direct" && candidate.carrier === "websocket" &&
                 candidate.tls.mode === "ca"
-                ? privateWebSocketURL(candidate.normalized_url, privateOrigin)
+                ? profileWebSocketURL(candidate.normalized_url, profileOrigin)
                 : undefined;
             if (targetURL === undefined)
                 throw new TransportFailureV3("tls_unsupported");
@@ -184,14 +200,18 @@ async function dialBrowserWebSocket(candidate, artifact, targetURL, signal) {
     }
     return await readyWebSocketAdmissionV3(candidate, artifact, socket, signal);
 }
-function privateWebSocketURL(candidateURL, privateOrigin) {
+function profileWebSocketURL(candidateURL, profileOrigin) {
     try {
         const candidate = new URL(candidateURL);
-        const origin = new URL(privateOrigin);
-        if (candidate.protocol !== "wss:" || candidate.host !== origin.host ||
+        const origin = new URL(profileOrigin);
+        if (candidate.protocol !== "wss:" ||
             candidate.pathname !== "/flowersec/v3/direct" || candidate.search !== "" || candidate.hash !== "")
             return undefined;
+        const port = candidate.port || "443";
         candidate.protocol = "ws:";
+        candidate.port = port;
+        if (candidate.origin.replace(/^ws:/, "http:") !== origin.origin)
+            return undefined;
         return candidate.href;
     }
     catch {

package/dist/browser/directWebSocketProfileV1.d.ts

@@ -0,0 +1,14 @@
+import { type ArtifactLeaseV3 } from "../v3/artifactLease.js";
+export declare function createDirectWebSocketProfileV1<Artifact extends object, Lease extends object>(options: Readonly<{
+    profile: string;
+    candidateID: string;
+    validateEndpoint: (raw: string) => string;
+    error: () => Error;
+}>): {
+    parse(input: string | Uint8Array): Artifact;
+    createLease(artifact: Artifact, commitSpend: (signal?: AbortSignal) => Promise<void>, retireCleanup?: () => Promise<void>): Lease;
+    unwrap(lease: Lease): Readonly<{
+        endpoint: string;
+        innerLease: ArtifactLeaseV3;
+    }>;
+};

package/dist/browser/directWebSocketProfileV1.js

@@ -0,0 +1,71 @@
+import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
+import { canonicalizeJCSV3 } from "../v3/jcs.js";
+import { preflightJSONV3 } from "../v3/jsonPreflight.js";
+import { decodeArtifactV3JSON } from "../v3/artifact.js";
+import { createArtifactLeaseV3Internal } from "../v3/artifactLease.js";
+// Each profile gets distinct opaque handles and lease storage. Only bounded
+// decoding and v3 binding validation are shared, never admission authority.
+export function createDirectWebSocketProfileV1(options) {
+    const artifacts = new WeakMap();
+    const leases = new WeakMap();
+    const encoder = new TextEncoder();
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    return {
+        parse(input) {
+            try {
+                const bytes = typeof input === "string" ? encoder.encode(input) : input;
+                if (bytes.length === 0 || bytes.length > 100_000)
+                    throw options.error();
+                const text = decoder.decode(bytes);
+                if (encoder.encode(text).length !== bytes.length)
+                    throw options.error();
+                preflightJSONV3(text);
+                const value = JSON.parse(text);
+                if (value === null || typeof value !== "object" || Array.isArray(value))
+                    throw options.error();
+                const wire = value;
+                const keys = Object.keys(wire).sort();
+                const expected = ["artifact_b64u", "endpoint", "profile", "v"];
+                if (keys.length !== expected.length || !keys.every((key, index) => key === expected[index]) ||
+                    wire.v !== 1 || wire.profile !== options.profile || typeof wire.artifact_b64u !== "string" ||
+                    typeof wire.endpoint !== "string" || canonicalizeJCSV3(value) !== text)
+                    throw options.error();
+                const innerBytes = base64urlDecode(wire.artifact_b64u);
+                if (innerBytes.length === 0 || innerBytes.length > 65_536 || base64urlEncode(innerBytes) !== wire.artifact_b64u)
+                    throw options.error();
+                const endpoint = options.validateEndpoint(wire.endpoint);
+                const innerArtifact = decodeArtifactV3JSON(innerBytes);
+                if (innerArtifact.path.kind !== "direct" || innerArtifact.path.candidates.length !== 1)
+                    throw options.error();
+                const candidate = innerArtifact.path.candidates[0];
+                const binding = new URL(endpoint);
+                const port = binding.port || "80";
+                binding.protocol = "wss:";
+                binding.port = port;
+                if (candidate.id !== options.candidateID || candidate.carrier !== "websocket" || candidate.tls.mode !== "ca" ||
+                    candidate.wire_profile !== "flowersec-direct/3" || candidate.normalized_url !== binding.href || candidate.url !== binding.href)
+                    throw options.error();
+                const handle = Object.freeze({});
+                artifacts.set(handle, Object.freeze({ endpoint, innerArtifact }));
+                return handle;
+            }
+            catch {
+                throw options.error();
+            }
+        },
+        createLease(artifact, commitSpend, retireCleanup) {
+            const state = artifacts.get(artifact);
+            if (state === undefined)
+                throw options.error();
+            const handle = Object.freeze({});
+            leases.set(handle, { ...state, innerLease: createArtifactLeaseV3Internal(state.innerArtifact, commitSpend, retireCleanup) });
+            return handle;
+        },
+        unwrap(lease) {
+            const state = leases.get(lease);
+            if (state === undefined)
+                throw options.error();
+            return state;
+        },
+    };
+}

package/dist/browser/httpDirectV1.d.ts

@@ -0,0 +1,30 @@
+import type { RetryDispositionV3 } from "../v3/security.js";
+export declare const HTTP_DIRECT_PROFILE_V1 = "flowersec-http-direct/1";
+export declare class HTTPDirectArtifactV1 {
+    private readonly httpDirectArtifactBrand;
+    private constructor();
+}
+export declare class HTTPDirectArtifactLeaseV1 {
+    private readonly httpDirectLeaseBrand;
+    private constructor();
+}
+export declare class HTTPDirectArtifactErrorV1 extends Error {
+    readonly code = "invalid_artifact";
+    constructor();
+}
+export type HTTPDirectArtifactSourceResultV1 = Readonly<{
+    kind: "lease";
+    lease: HTTPDirectArtifactLeaseV1;
+}> | Readonly<{
+    kind: "failure";
+    code: string;
+    disposition: RetryDispositionV3;
+}>;
+export type HTTPDirectArtifactSourceV1 = Readonly<{
+    acquire(options: Readonly<{
+        signal: AbortSignal;
+    }>): Promise<HTTPDirectArtifactSourceResultV1>;
+}>;
+export declare const parseHTTPDirectArtifactV1: (input: string | Uint8Array) => HTTPDirectArtifactV1;
+export declare const createHTTPDirectArtifactLeaseV1: (artifact: HTTPDirectArtifactV1, commitSpend: (signal?: AbortSignal) => Promise<void>, retireCleanup?: (() => Promise<void>) | undefined) => HTTPDirectArtifactLeaseV1;
+export declare function validateHTTPDirectOriginV1(raw: string): string;

package/dist/browser/httpDirectV1.js

@@ -0,0 +1,52 @@
+import { createDirectWebSocketProfileV1 } from "./directWebSocketProfileV1.js";
+export const HTTP_DIRECT_PROFILE_V1 = "flowersec-http-direct/1";
+const DIRECT_PATH = "/flowersec/v3/direct";
+export class HTTPDirectArtifactV1 {
+    constructor() { }
+}
+export class HTTPDirectArtifactLeaseV1 {
+    constructor() { }
+}
+export class HTTPDirectArtifactErrorV1 extends Error {
+    code = "invalid_artifact";
+    constructor() { super("Flowersec HTTP direct artifact is invalid"); this.name = "HTTPDirectArtifactError"; }
+}
+const profile = createDirectWebSocketProfileV1({
+    profile: HTTP_DIRECT_PROFILE_V1, candidateID: "http-direct",
+    validateEndpoint: validateHTTPDirectEndpointV1, error: () => new HTTPDirectArtifactErrorV1(),
+});
+export const parseHTTPDirectArtifactV1 = profile.parse;
+export const createHTTPDirectArtifactLeaseV1 = profile.createLease;
+/** @internal Explicit public HTTP connector boundary. */
+export const unwrapHTTPDirectArtifactLeaseV1 = profile.unwrap;
+export function validateHTTPDirectOriginV1(raw) {
+    const url = new URL(raw);
+    if (raw !== url.origin || url.protocol !== "http:" || url.username || url.password)
+        throw new HTTPDirectArtifactErrorV1();
+    url.protocol = "ws:";
+    url.pathname = DIRECT_PATH;
+    validateHTTPDirectEndpointV1(url.href);
+    return raw;
+}
+function validateHTTPDirectEndpointV1(raw) {
+    const url = new URL(raw);
+    const port = url.port === "" ? 80 : Number(url.port);
+    if (url.href !== raw || url.protocol !== "ws:" || url.username || url.password || url.search || url.hash ||
+        raw.includes("%") || url.pathname !== DIRECT_PATH || !Number.isSafeInteger(port) || port < 1 || port > 65_535 ||
+        !allowedHost(url.hostname))
+        throw new HTTPDirectArtifactErrorV1();
+    return raw;
+}
+function allowedHost(host) {
+    if (host === "localhost")
+        return true;
+    if (host.startsWith("[")) {
+        return host !== "[::]" && !/^\[(?:ff|fe[89ab]|::ffff:)/i.test(host);
+    }
+    const parts = host.split(".");
+    if (parts.length !== 4 || !parts.every((part) => /^(0|[1-9][0-9]{0,2})$/.test(part) && Number(part) <= 255))
+        return false;
+    const octets = parts.map(Number);
+    return host !== "0.0.0.0" && host !== "255.255.255.255" &&
+        !(octets[0] >= 224 && octets[0] <= 239) && !(octets[0] === 169 && octets[1] === 254);
+}

package/dist/browser/index.d.ts

@@ -1,6 +1,9 @@
 export * from "../facade.js";
-export { connectV3 as connect, createConnectionControllerV3 as createConnectionController, connectPrivateLoopbackV1, createPrivateLoopbackConnectionControllerV1, } from "./connectSessionV3.js";
+export { connectV3 as connect, createConnectionControllerV3 as createConnectionController, connectPrivateLoopbackV1, connectHTTPDirectV1, createHTTPDirectConnectionControllerV1, createPrivateLoopbackConnectionControllerV1, } from "./connectSessionV3.js";
 export { PRIVATE_LOOPBACK_PROFILE_V1, PrivateLoopbackArtifactErrorV1, createPrivateLoopbackArtifactLeaseV1, parsePrivateLoopbackArtifactV1, } from "./privateLoopbackV1.js";
 export type { ConnectionControllerOptionsV3 as ConnectionControllerOptions, SessionOptionsV3 as SessionOptions, } from "./connectSessionV3.js";
 export type { PrivateLoopbackConnectionControllerOptionsV1, PrivateLoopbackSessionOptionsV1, } from "./connectSessionV3.js";
 export type { PrivateLoopbackArtifactLeaseV1, PrivateLoopbackArtifactSourceResultV1, PrivateLoopbackArtifactSourceV1, PrivateLoopbackArtifactV1, } from "./privateLoopbackV1.js";
+export { HTTP_DIRECT_PROFILE_V1, HTTPDirectArtifactErrorV1, parseHTTPDirectArtifactV1, createHTTPDirectArtifactLeaseV1, } from "./httpDirectV1.js";
+export type { HTTPDirectArtifactV1, HTTPDirectArtifactLeaseV1, HTTPDirectArtifactSourceV1, HTTPDirectArtifactSourceResultV1, } from "./httpDirectV1.js";
+export type { HTTPDirectSessionOptionsV1, HTTPDirectConnectionControllerOptionsV1 } from "./connectSessionV3.js";

package/dist/browser/index.js

@@ -1,3 +1,4 @@
 export * from "../facade.js";
-export { connectV3 as connect, createConnectionControllerV3 as createConnectionController, connectPrivateLoopbackV1, createPrivateLoopbackConnectionControllerV1, } from "./connectSessionV3.js";
+export { connectV3 as connect, createConnectionControllerV3 as createConnectionController, connectPrivateLoopbackV1, connectHTTPDirectV1, createHTTPDirectConnectionControllerV1, createPrivateLoopbackConnectionControllerV1, } from "./connectSessionV3.js";
 export { PRIVATE_LOOPBACK_PROFILE_V1, PrivateLoopbackArtifactErrorV1, createPrivateLoopbackArtifactLeaseV1, parsePrivateLoopbackArtifactV1, } from "./privateLoopbackV1.js";
+export { HTTP_DIRECT_PROFILE_V1, HTTPDirectArtifactErrorV1, parseHTTPDirectArtifactV1, createHTTPDirectArtifactLeaseV1, } from "./httpDirectV1.js";

package/dist/browser/privateLoopbackV1.d.ts

@@ -25,6 +25,6 @@ export type PrivateLoopbackArtifactSourceV1 = Readonly<{
         signal: AbortSignal;
     }>): Promise<PrivateLoopbackArtifactSourceResultV1>;
 }>;
-export declare function parsePrivateLoopbackArtifactV1(input: string | Uint8Array): PrivateLoopbackArtifactV1;
-export declare function createPrivateLoopbackArtifactLeaseV1(artifact: PrivateLoopbackArtifactV1, commitSpend: (signal?: AbortSignal) => Promise<void>, retireCleanup?: () => Promise<void>): PrivateLoopbackArtifactLeaseV1;
+export declare const parsePrivateLoopbackArtifactV1: (input: string | Uint8Array) => PrivateLoopbackArtifactV1;
+export declare const createPrivateLoopbackArtifactLeaseV1: (artifact: PrivateLoopbackArtifactV1, commitSpend: (signal?: AbortSignal) => Promise<void>, retireCleanup?: (() => Promise<void>) | undefined) => PrivateLoopbackArtifactLeaseV1;
 export declare function validatePrivateLoopbackOriginV1(raw: string): string;

package/dist/browser/privateLoopbackV1.js

@@ -1,13 +1,7 @@
-import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
-import { canonicalizeJCSV3 } from "../v3/jcs.js";
-import { preflightJSONV3 } from "../v3/jsonPreflight.js";
-import { decodeArtifactV3JSON } from "../v3/artifact.js";
-import { createArtifactLeaseV3Internal } from "../v3/artifactLease.js";
+import { createDirectWebSocketProfileV1 } from "./directWebSocketProfileV1.js";
 export const PRIVATE_LOOPBACK_PROFILE_V1 = "flowersec-private-loopback/1";
 const DIRECT_PATH = "/flowersec/v3/direct";
 const MIN_PRIVATE_LOOPBACK_PORT = 1024;
-const decoder = new TextDecoder("utf-8", { fatal: true });
-const encoder = new TextEncoder();
 export class PrivateLoopbackArtifactV1 {
     constructor() { }
 }
@@ -21,52 +15,16 @@ export class PrivateLoopbackArtifactErrorV1 extends Error {
         this.name = "PrivateLoopbackArtifactError";
     }
 }
-const artifacts = new WeakMap();
-const leases = new WeakMap();
-export function parsePrivateLoopbackArtifactV1(input) {
-    try {
-        const text = decodeBounded(input);
-        preflightJSONV3(text);
-        const value = JSON.parse(text);
-        if (!isRecord(value) || !hasExactKeys(value, ["artifact_b64u", "endpoint", "profile", "v"]) ||
-            value.v !== 1 || value.profile !== PRIVATE_LOOPBACK_PROFILE_V1 ||
-            typeof value.artifact_b64u !== "string" || typeof value.endpoint !== "string" ||
-            canonicalizeJCSV3(value) !== text) {
-            throw new Error("invalid private loopback envelope");
-        }
-        const innerBytes = base64urlDecode(value.artifact_b64u);
-        if (innerBytes.length === 0 || innerBytes.length > 65_536 || base64urlEncode(innerBytes) !== value.artifact_b64u) {
-            throw new Error("invalid nested artifact encoding");
-        }
-        const endpoint = validatePrivateLoopbackEndpointV1(value.endpoint);
-        const innerArtifact = decodeArtifactV3JSON(innerBytes);
-        validateNestedArtifact(innerArtifact, endpoint);
-        const handle = new PrivateLoopbackArtifactV1();
-        artifacts.set(handle, Object.freeze({ endpoint, innerArtifact }));
-        return Object.freeze(handle);
-    }
-    catch {
-        throw new PrivateLoopbackArtifactErrorV1();
-    }
-}
-export function createPrivateLoopbackArtifactLeaseV1(artifact, commitSpend, retireCleanup) {
-    const state = artifacts.get(artifact);
-    if (state === undefined)
-        throw new PrivateLoopbackArtifactErrorV1();
-    const lease = new PrivateLoopbackArtifactLeaseV1();
-    leases.set(lease, {
-        ...state,
-        innerLease: createArtifactLeaseV3Internal(state.innerArtifact, commitSpend, retireCleanup),
-    });
-    return Object.freeze(lease);
-}
+const profile = createDirectWebSocketProfileV1({
+    profile: PRIVATE_LOOPBACK_PROFILE_V1,
+    candidateID: "private-loopback",
+    validateEndpoint: validatePrivateLoopbackEndpointV1,
+    error: () => new PrivateLoopbackArtifactErrorV1(),
+});
+export const parsePrivateLoopbackArtifactV1 = profile.parse;
+export const createPrivateLoopbackArtifactLeaseV1 = profile.createLease;
 /** @internal Dedicated private-loopback connector boundary. */
-export function unwrapPrivateLoopbackArtifactLeaseV1(lease) {
-    const state = leases.get(lease);
-    if (state === undefined)
-        throw new PrivateLoopbackArtifactErrorV1();
-    return state;
-}
+export const unwrapPrivateLoopbackArtifactLeaseV1 = profile.unwrap;
 export function validatePrivateLoopbackOriginV1(raw) {
     let parsed;
     try {
@@ -102,19 +60,6 @@ function privateLoopbackPort(raw) {
     const port = Number(raw);
     return Number.isSafeInteger(port) && port >= MIN_PRIVATE_LOOPBACK_PORT && port <= 65_535;
 }
-function validateNestedArtifact(artifact, endpoint) {
-    if (artifact.path.kind !== "direct" || artifact.path.candidates.length !== 1) {
-        throw new PrivateLoopbackArtifactErrorV1();
-    }
-    const candidate = artifact.path.candidates[0];
-    const privateURL = new URL(endpoint);
-    privateURL.protocol = "wss:";
-    if (candidate.id !== "private-loopback" || candidate.carrier !== "websocket" || candidate.tls.mode !== "ca" ||
-        candidate.wire_profile !== "flowersec-direct/3" || candidate.normalized_url !== privateURL.href ||
-        candidate.url !== privateURL.href) {
-        throw new PrivateLoopbackArtifactErrorV1();
-    }
-}
 function numericLoopbackHostname(hostname) {
     if (hostname === "[::1]")
         return true;
@@ -123,19 +68,3 @@ function numericLoopbackHostname(hostname) {
     const octets = hostname.split(".").map(Number);
     return octets.every((value) => value >= 0 && value <= 255) && octets[0] === 127;
 }
-function decodeBounded(input) {
-    const bytes = typeof input === "string" ? encoder.encode(input) : input;
-    if (bytes.length === 0 || bytes.length > 100_000)
-        throw new PrivateLoopbackArtifactErrorV1();
-    const text = decoder.decode(bytes);
-    if (encoder.encode(text).length !== bytes.length)
-        throw new PrivateLoopbackArtifactErrorV1();
-    return text;
-}
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function hasExactKeys(value, expected) {
-    const keys = Object.keys(value).sort();
-    return keys.length === expected.length && keys.every((key, index) => key === expected[index]);
-}

package/dist/node/byteStreamDuplex.d.ts

@@ -0,0 +1,4 @@
+import { Duplex } from "node:stream";
+import type { ByteStream } from "../public/contract.js";
+/** A bounded Node stream that owns one application ByteStream, including half-close. */
+export declare function createByteStreamDuplex(stream: ByteStream, signal?: AbortSignal): Duplex;

package/dist/node/byteStreamDuplex.js

@@ -0,0 +1,69 @@
+import { Duplex } from "node:stream";
+/** A bounded Node stream that owns one application ByteStream, including half-close. */
+export function createByteStreamDuplex(stream, signal) {
+    const operations = new AbortController();
+    let reading = false;
+    let ended = false;
+    let duplex;
+    const abort = () => { duplex.destroy(new Error("Application stream canceled")); };
+    duplex = new Duplex({
+        allowHalfOpen: true,
+        readableHighWaterMark: 64 * 1024,
+        writableHighWaterMark: 64 * 1024,
+        read() {
+            if (reading || ended)
+                return;
+            reading = true;
+            void (async () => {
+                try {
+                    while (!duplex.destroyed) {
+                        const chunk = await stream.read({ signal: operations.signal });
+                        if (chunk === null) {
+                            ended = true;
+                            duplex.push(null);
+                            return;
+                        }
+                        if (chunk.byteLength && !duplex.push(chunk))
+                            return;
+                    }
+                }
+                catch {
+                    duplex.destroy(new Error("Application stream read failed"));
+                }
+                finally {
+                    reading = false;
+                }
+            })();
+        },
+        write(chunk, _encoding, callback) {
+            void (async () => {
+                try {
+                    for (let offset = 0; offset < chunk.byteLength;) {
+                        const part = chunk.subarray(offset, Math.min(offset + 64 * 1024, chunk.byteLength));
+                        const count = await stream.write(part, { signal: operations.signal });
+                        if (!Number.isSafeInteger(count) || count <= 0 || count > part.byteLength) {
+                            throw new Error("Invalid application stream write result");
+                        }
+                        offset += count;
+                    }
+                    callback();
+                }
+                catch {
+                    callback(new Error("Application stream write failed"));
+                }
+            })();
+        },
+        final(callback) {
+            void stream.closeWrite().then(() => callback(), () => callback(new Error("Application stream half-close failed")));
+        },
+        destroy(error, callback) {
+            signal?.removeEventListener("abort", abort);
+            operations.abort();
+            void (error ? stream.reset() : stream.close()).then(() => callback(error), () => callback(error ?? new Error("Application stream close failed")));
+        },
+    });
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted)
+        queueMicrotask(abort);
+    return duplex;
+}

package/dist/node/index.d.ts

@@ -15,3 +15,4 @@ export { HandlerRegistrationError, RPCHandlers, SessionHandlersV3 as SessionHand
 export type { NotificationHandler, RPCHandler, RPCHandlerResult, SessionHandlerOptions, } from "./acceptor.js";
 export { ProxyServer, ProxyServerError } from "./proxyServer.js";
 export type { ProxyServerOptions } from "./proxyServer.js";
+export { createByteStreamDuplex } from "./byteStreamDuplex.js";

package/dist/node/index.js

@@ -5,3 +5,4 @@ export * from "../facade.js";
 export { connectV3 as connect, createConnectionControllerV3 as createConnectionController, } from "./connectSessionV3.js";
 export { HandlerRegistrationError, RPCHandlers, SessionHandlersV3 as SessionHandlers, } from "./acceptor.js";
 export { ProxyServer, ProxyServerError } from "./proxyServer.js";
+export { createByteStreamDuplex } from "./byteStreamDuplex.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "5.0.5",
+  "version": "5.2.0",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {
@@ -53,7 +53,7 @@
     "postcss": "^8.5.23"
   },
   "scripts": {
-    "build": "node ./scripts/clean-dist.mjs && tsc -p tsconfig.build.json && node ./scripts/build-browser-vendor.mjs",
+    "build": "node ./scripts/clean-dist.mjs && node ./node_modules/@typescript/native/bin/tsc -p tsconfig.build.json && node ./scripts/build-browser-vendor.mjs",
     "bench": "vitest bench --run",
     "test": "npm run build && vitest run --exclude 'src/**/*.integration.test.ts'",
     "test:browser": "npm run test:browser:chromium",
@@ -64,7 +64,7 @@
     "ensure:browser:firefox": "node ./scripts/ensure-playwright-browsers.mjs firefox",
     "ensure:browser:webkit": "node ./scripts/ensure-playwright-browsers.mjs webkit",
     "test:coverage": "npm run build && node ../scripts/server-parity-native-addon.mjs --test-coverage",
-    "typecheck:native-integration": "tsc -p tsconfig.native-integration.json",
+    "typecheck:native-integration": "node ./node_modules/@typescript/native/bin/tsc -p tsconfig.native-integration.json",
     "lint": "eslint .",
     "verify:package": "node ./scripts/verify-package-exports.mjs",
     "prepack": "npm run build",
@@ -95,7 +95,7 @@
     "vitest": "4.1.11"
   },
   "optionalDependencies": {
-    "@floegence/flowersec-node-native": "5.0.5"
+    "@floegence/flowersec-node-native": "5.2.0"
   },
-  "flowersecSourceCommit": "9ce4dcaa09c33b7c07261575768ee78b3170bbec"
+  "flowersecSourceCommit": "352c13fd2c4f49ea7bd8c82528035731a97f6bca"
 }

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e3cc825d-1afc-5661-8afa-202f2c82d8b5",
+  "serialNumber": "urn:uuid:2640f883-27e2-57d5-8b16-38b58447d9f9",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "5.0.5",
-      "purl": "pkg:npm/%40floegence/flowersec-core@5.0.5",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@5.0.5"
+      "version": "5.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-core@5.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@5.2.0"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "f52ee88ce9361e3a5f87dfa29bbc3f70c025c20fb2a0b274cf90e88a5f773f50"
+        "value": "69cd3275173a1a61979bf3334070c164221b873f69ad24b3f8af6efeb7b6521e"
       }
     ]
   },
@@ -22,9 +22,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native",
-      "version": "5.0.5",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native@5.0.5",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.5",
+      "version": "5.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native@5.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native@5.2.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -50,9 +50,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-darwin-arm64",
-      "version": "5.0.5",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.5",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.5",
+      "version": "5.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.2.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -78,9 +78,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-darwin-x64",
-      "version": "5.0.5",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.5",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.5",
+      "version": "5.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.2.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -106,9 +106,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-linux-arm64-gnu",
-      "version": "5.0.5",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.5",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.5",
+      "version": "5.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.2.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -134,9 +134,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-linux-x64-gnu",
-      "version": "5.0.5",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.5",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.5",
+      "version": "5.2.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.2.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.2.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -330,9 +330,9 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@5.0.5",
+      "ref": "pkg:npm/%40floegence/flowersec-core@5.2.0",
       "dependsOn": [
-        "pkg:npm/%40floegence/flowersec-node-native@5.0.5",
+        "pkg:npm/%40floegence/flowersec-node-native@5.2.0",
         "pkg:npm/%40noble/ciphers@2.4.0",
         "pkg:npm/%40noble/curves@2.4.0",
         "pkg:npm/%40noble/hashes@2.4.0",
@@ -341,28 +341,28 @@
       ]
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.5",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native@5.2.0",
       "dependsOn": [
-        "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.5",
-        "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.5",
-        "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.5",
-        "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.5"
+        "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.2.0",
+        "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.2.0",
+        "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.2.0",
+        "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.2.0"
       ]
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.5",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.2.0",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.5",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.2.0",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.5",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.2.0",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.5",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.2.0",
       "dependsOn": []
     },
     {

package/sbom/spdx.json

@@ -3,9 +3,9 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "flowersec-ts",
-  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/f52ee88ce9361e3a5f87dfa29bbc3f70c025c20fb2a0b274cf90e88a5f773f50",
+  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/69cd3275173a1a61979bf3334070c164221b873f69ad24b3f8af6efeb7b6521e",
   "creationInfo": {
-    "created": "2026-09-07T04:29:43Z",
+    "created": "2026-09-16T01:48:35Z",
     "creators": [
       "Tool: flowersec-source-inventory-1"
     ]
@@ -13,26 +13,26 @@
   "packages": [
     {
       "name": "@floegence/flowersec-core",
-      "SPDXID": "SPDXRef-Package-453dd3dbe8557f33f1ac",
-      "versionInfo": "5.0.5",
+      "SPDXID": "SPDXRef-Package-961a9b9cd45c1251db0e",
+      "versionInfo": "5.2.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "NOASSERTION",
       "copyrightText": "NOASSERTION",
-      "comment": "Flowersec source inventory SHA-256: f52ee88ce9361e3a5f87dfa29bbc3f70c025c20fb2a0b274cf90e88a5f773f50",
+      "comment": "Flowersec source inventory SHA-256: 69cd3275173a1a61979bf3334070c164221b873f69ad24b3f8af6efeb7b6521e",
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@5.0.5"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@5.2.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native",
-      "SPDXID": "SPDXRef-Package-490a355ce8395380d6e7",
-      "versionInfo": "5.0.5",
+      "SPDXID": "SPDXRef-Package-ce1b6c3f8fa4fb3ed470",
+      "versionInfo": "5.2.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -42,14 +42,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native@5.0.5"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native@5.2.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-darwin-arm64",
-      "SPDXID": "SPDXRef-Package-2a8533025dcddb70e50f",
-      "versionInfo": "5.0.5",
+      "SPDXID": "SPDXRef-Package-2ba5a968067ba42b1fb7",
+      "versionInfo": "5.2.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -59,14 +59,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.5"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.2.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-darwin-x64",
-      "SPDXID": "SPDXRef-Package-7708f9d84a482ac3cb09",
-      "versionInfo": "5.0.5",
+      "SPDXID": "SPDXRef-Package-850fe5f6d4a4f6fd5c35",
+      "versionInfo": "5.2.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -76,14 +76,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.5"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.2.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-linux-arm64-gnu",
-      "SPDXID": "SPDXRef-Package-0cab5a1460c5399db58c",
-      "versionInfo": "5.0.5",
+      "SPDXID": "SPDXRef-Package-d81e516d1842f1c68491",
+      "versionInfo": "5.2.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -93,14 +93,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.5"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.2.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-linux-x64-gnu",
-      "SPDXID": "SPDXRef-Package-924889f967e0c3d57857",
-      "versionInfo": "5.0.5",
+      "SPDXID": "SPDXRef-Package-4dbe9883c5afe6a1dd81",
+      "versionInfo": "5.2.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -110,7 +110,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.5"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.2.0"
         }
       ]
     },
@@ -221,57 +221,57 @@
     {
       "spdxElementId": "SPDXRef-DOCUMENT",
       "relationshipType": "DESCRIBES",
-      "relatedSpdxElement": "SPDXRef-Package-453dd3dbe8557f33f1ac"
+      "relatedSpdxElement": "SPDXRef-Package-961a9b9cd45c1251db0e"
     },
     {
-      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
+      "spdxElementId": "SPDXRef-Package-961a9b9cd45c1251db0e",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-490a355ce8395380d6e7"
+      "relatedSpdxElement": "SPDXRef-Package-ce1b6c3f8fa4fb3ed470"
     },
     {
-      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
+      "spdxElementId": "SPDXRef-Package-961a9b9cd45c1251db0e",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-6cdb8b3664bfb0d67b6a"
     },
     {
-      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
+      "spdxElementId": "SPDXRef-Package-961a9b9cd45c1251db0e",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-e0e2cb449dffb239a794"
     },
     {
-      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
+      "spdxElementId": "SPDXRef-Package-961a9b9cd45c1251db0e",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-2e6e3840217975457b7a"
     },
     {
-      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
+      "spdxElementId": "SPDXRef-Package-961a9b9cd45c1251db0e",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-5b9d78698ec0a5c8f86f"
     },
     {
-      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
+      "spdxElementId": "SPDXRef-Package-961a9b9cd45c1251db0e",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-b779412f685822663496"
     },
     {
-      "spdxElementId": "SPDXRef-Package-490a355ce8395380d6e7",
+      "spdxElementId": "SPDXRef-Package-ce1b6c3f8fa4fb3ed470",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-2a8533025dcddb70e50f"
+      "relatedSpdxElement": "SPDXRef-Package-2ba5a968067ba42b1fb7"
     },
     {
-      "spdxElementId": "SPDXRef-Package-490a355ce8395380d6e7",
+      "spdxElementId": "SPDXRef-Package-ce1b6c3f8fa4fb3ed470",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-7708f9d84a482ac3cb09"
+      "relatedSpdxElement": "SPDXRef-Package-850fe5f6d4a4f6fd5c35"
     },
     {
-      "spdxElementId": "SPDXRef-Package-490a355ce8395380d6e7",
+      "spdxElementId": "SPDXRef-Package-ce1b6c3f8fa4fb3ed470",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-0cab5a1460c5399db58c"
+      "relatedSpdxElement": "SPDXRef-Package-d81e516d1842f1c68491"
     },
     {
-      "spdxElementId": "SPDXRef-Package-490a355ce8395380d6e7",
+      "spdxElementId": "SPDXRef-Package-ce1b6c3f8fa4fb3ed470",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-924889f967e0c3d57857"
+      "relatedSpdxElement": "SPDXRef-Package-4dbe9883c5afe6a1dd81"
     },
     {
       "spdxElementId": "SPDXRef-Package-e0e2cb449dffb239a794",