@forgezero/runtime 0.1.0

package/dist/finance/venues.js

@@ -0,0 +1,251 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/finance/money.ts
+class MoneyError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "MoneyError";
+  }
+}
+var ASSETS = [
+  { code: "USDT", decimals: 6 },
+  { code: "USDC", decimals: 6 },
+  { code: "BTC", decimals: 8 },
+  { code: "ETH", decimals: 18 },
+  { code: "BNB", decimals: 18 },
+  { code: "EUR", decimals: 2 },
+  { code: "USD", decimals: 2 }
+];
+var REGISTRY = new Map(ASSETS.map((asset) => [asset.code, asset]));
+function defineAsset(spec) {
+  if (spec.decimals < 0 || spec.decimals > 30 || !Number.isInteger(spec.decimals)) {
+    throw new MoneyError("UNKNOWN_ASSET", `${spec.code}: decimals must be an integer 0–30.`);
+  }
+  REGISTRY.set(spec.code, spec);
+}
+function assetSpec(code) {
+  const spec = REGISTRY.get(code);
+  if (!spec)
+    throw new MoneyError("UNKNOWN_ASSET", `Unknown asset "${code}". Call defineAsset first.`);
+  return spec;
+}
+var money = (units, asset) => {
+  assetSpec(asset);
+  return { units, asset };
+};
+var zero = (asset) => money(0n, asset);
+function parseAmount(value, asset) {
+  const spec = assetSpec(asset);
+  const text = value.trim();
+  if (!/^-?\d+(\.\d+)?$/.test(text)) {
+    throw new MoneyError("NOT_FINITE", `"${value}" is not a plain decimal amount.`);
+  }
+  const negative = text.startsWith("-");
+  const [whole, fraction = ""] = text.replace("-", "").split(".");
+  if (fraction.length > spec.decimals) {
+    throw new MoneyError("PRECISION_LOSS", `${asset} has ${spec.decimals} decimals; "${value}" has ${fraction.length}.`);
+  }
+  const padded = fraction.padEnd(spec.decimals, "0");
+  const units = BigInt(whole + padded);
+  return { units: negative ? -units : units, asset };
+}
+function formatAmount(amount, options = {}) {
+  const spec = assetSpec(amount.asset);
+  const negative = amount.units < 0n;
+  const digits = (negative ? -amount.units : amount.units).toString().padStart(spec.decimals + 1, "0");
+  const whole = digits.slice(0, digits.length - spec.decimals);
+  let fraction = spec.decimals === 0 ? "" : digits.slice(digits.length - spec.decimals);
+  if (options.trim && fraction)
+    fraction = fraction.replace(/0+$/, "");
+  return `${negative ? "-" : ""}${whole}${fraction ? `.${fraction}` : ""}`;
+}
+function sameAsset(a, b) {
+  if (a.asset !== b.asset) {
+    throw new MoneyError("ASSET_MISMATCH", `Cannot combine ${a.asset} and ${b.asset}.`);
+  }
+}
+function add(a, b) {
+  sameAsset(a, b);
+  return { units: a.units + b.units, asset: a.asset };
+}
+function subtract(a, b) {
+  sameAsset(a, b);
+  return { units: a.units - b.units, asset: a.asset };
+}
+var negate = (amount) => ({ units: -amount.units, asset: amount.asset });
+var abs = (amount) => ({
+  units: amount.units < 0n ? -amount.units : amount.units,
+  asset: amount.asset
+});
+var isZero = (amount) => amount.units === 0n;
+var isNegative = (amount) => amount.units < 0n;
+function compare(a, b) {
+  sameAsset(a, b);
+  return a.units < b.units ? -1 : a.units > b.units ? 1 : 0;
+}
+var equals = (a, b) => a.asset === b.asset && a.units === b.units;
+var ROUNDING = ["down", "up", "half-up"];
+function divideRounded(numerator, denominator, mode) {
+  if (denominator === 0n)
+    throw new MoneyError("DIVIDE_BY_ZERO", "Division by zero.");
+  const negative = numerator < 0n !== denominator < 0n;
+  const a = numerator < 0n ? -numerator : numerator;
+  const b = denominator < 0n ? -denominator : denominator;
+  const quotient = a / b;
+  const remainder = a % b;
+  if (remainder === 0n)
+    return negative ? -quotient : quotient;
+  let result = quotient;
+  if (mode === "up")
+    result += 1n;
+  else if (mode === "half-up" && remainder * 2n >= b)
+    result += 1n;
+  return negative ? -result : result;
+}
+function mulRate(amount, rate, mode = "down") {
+  if (!/^-?\d+(\.\d+)?$/.test(rate.trim())) {
+    throw new MoneyError("NOT_FINITE", `"${rate}" is not a plain decimal rate.`);
+  }
+  const [whole, fraction = ""] = rate.trim().replace("-", "").split(".");
+  const scale = 10n ** BigInt(fraction.length);
+  const scaled = BigInt(whole + fraction) * (rate.trim().startsWith("-") ? -1n : 1n);
+  return { units: divideRounded(amount.units * scaled, scale, mode), asset: amount.asset };
+}
+function convert(amount, to, rate, mode = "down") {
+  const from = assetSpec(amount.asset);
+  const target = assetSpec(to);
+  const asTarget = mulRate({ units: amount.units, asset: to }, rate, mode);
+  const shift = target.decimals - from.decimals;
+  if (shift === 0)
+    return asTarget;
+  if (shift > 0)
+    return { units: asTarget.units * 10n ** BigInt(shift), asset: to };
+  return { units: divideRounded(asTarget.units, 10n ** BigInt(-shift), mode), asset: to };
+}
+function allocate(amount, parts) {
+  if (parts < 1)
+    throw new MoneyError("NOT_FINITE", "Cannot allocate into fewer than one part.");
+  const each = divideRounded(amount.units, BigInt(parts), "down");
+  const allocated = Array.from({ length: parts }, () => each);
+  let remainder = amount.units - each * BigInt(parts);
+  const step = remainder < 0n ? -1n : 1n;
+  for (let index = 0;remainder !== 0n; index = (index + 1) % parts) {
+    allocated[index] += step;
+    remainder -= step;
+  }
+  return allocated.map((units) => ({ units, asset: amount.asset }));
+}
+function toStep(amount, step, mode = "down") {
+  const stepUnits = parseAmount(step, amount.asset).units;
+  if (stepUnits <= 0n)
+    throw new MoneyError("NOT_FINITE", "A step must be positive.");
+  return { units: divideRounded(amount.units, stepUnits, mode) * stepUnits, asset: amount.asset };
+}
+var VERSION = "0.1.0";
+
+// src/finance/venues.ts
+var MARKET_TYPES = ["spot", "margin", "futures"];
+var ORDER_SIDES = ["buy", "sell"];
+var ORDER_TYPES = ["market", "limit", "stop-limit"];
+var TIME_IN_FORCE = ["gtc", "ioc", "fok"];
+var VENUES = [
+  {
+    key: "binance",
+    label: "Binance",
+    markets: ["spot", "margin", "futures"],
+    rateLimit: { perMinute: 6000, counts: "weight" },
+    clientOrderIds: true,
+    note: "Publishes no AAAA records, so every endpoint is IPv4-only and the budget is per IP."
+  }
+];
+var venue = (key) => VENUES.find((entry) => entry.key === key);
+var venuesFor = (type) => VENUES.filter((entry) => entry.markets.includes(type));
+var symbolOf = (base, quote) => `${base.toUpperCase()}/${quote.toUpperCase()}`;
+function parseSymbol(symbol) {
+  const [base, quote] = symbol.toUpperCase().split("/");
+  if (!base || !quote)
+    throw new VenueError("BAD_SYMBOL", `"${symbol}" is not BASE/QUOTE.`);
+  return { base, quote };
+}
+
+class VenueError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "VenueError";
+  }
+}
+function notionalOf(request, market) {
+  const price = request.price;
+  if (!price)
+    return parseAmount("0", market.quote);
+  const quantity = Number(formatAmount(request.quantity));
+  const priceText = formatAmount(price);
+  return parseAmount((quantity * Number(priceText)).toFixed(0) === "NaN" ? "0" : String(quantity * Number(priceText)), market.quote);
+}
+function validateOrder(request, market) {
+  const spec = venue(request.venue);
+  if (!spec)
+    throw new VenueError("UNKNOWN_VENUE", `Unknown venue "${request.venue}".`);
+  if (!spec.markets.includes(request.type)) {
+    throw new VenueError("MARKET_UNSUPPORTED", `${spec.label} does not offer ${request.type}.`);
+  }
+  if (market.venue !== request.venue || market.type !== request.type || market.symbol !== request.symbol) {
+    throw new VenueError("UNKNOWN_MARKET", "The market does not describe this order.");
+  }
+  if (request.orderType !== "market" && !request.price) {
+    throw new VenueError("PRICE_REQUIRED", `A ${request.orderType} order needs a price.`);
+  }
+  const snapped = toStep(request.quantity, market.lotStep);
+  if (compare(snapped, request.quantity) !== 0) {
+    throw new VenueError("LOT_STEP", `Quantity ${formatAmount(request.quantity, { trim: true })} is not a multiple of ${market.lotStep}.`);
+  }
+  if (request.price) {
+    const onTick = toStep(request.price, market.tickStep);
+    if (compare(onTick, request.price) !== 0) {
+      throw new VenueError("TICK_STEP", `Price ${formatAmount(request.price, { trim: true })} is not a multiple of ${market.tickStep}.`);
+    }
+    const notional = notionalOf(request, market);
+    if (compare(notional, parseAmount(market.minNotional, market.quote)) < 0) {
+      throw new VenueError("MIN_NOTIONAL", `Order is worth ${formatAmount(notional, { trim: true })} ${market.quote}; the minimum is ${market.minNotional}.`);
+    }
+  }
+  if (request.leverage !== undefined) {
+    if (request.type === "spot" || market.maxLeverage === undefined) {
+      throw new VenueError("LEVERAGE_UNSUPPORTED", `${request.type} markets have no leverage.`);
+    }
+    if (request.leverage < 1 || request.leverage > market.maxLeverage) {
+      throw new VenueError("LEVERAGE_TOO_HIGH", `Leverage ${request.leverage}× exceeds the ${market.maxLeverage}× maximum on this market.`);
+    }
+  }
+}
+async function submitOrder(adapter, request, market) {
+  validateOrder(request, market);
+  return adapter.placeOrder(request, market);
+}
+var VERSION2 = "0.1.0";
+export {
+  venuesFor,
+  venue,
+  validateOrder,
+  symbolOf,
+  submitOrder,
+  parseSymbol,
+  notionalOf,
+  VenueError,
+  VERSION2 as VERSION,
+  VENUES,
+  TIME_IN_FORCE,
+  ORDER_TYPES,
+  ORDER_SIDES,
+  MARKET_TYPES
+};

package/dist/identity.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Node identity — hybrid Ed25519 + ML-DSA-65 signatures.
+ *
+ * A node key is long-lived and its signatures are recorded, which is exactly the
+ * harvest-now-verify-later shape: an adversary who breaks Ed25519 in ten years
+ * can forge today's traffic retroactively. ML-DSA-65 (FIPS 204) closes that.
+ *
+ * HYBRID, not pure post-quantum. Both signatures must verify. Lattice schemes
+ * are young; Ed25519 is not. Requiring both means a break in either one leaves
+ * the other standing, and the cost is a few hundred bytes per request.
+ *
+ * This is the one place ForgeZero uses asymmetric post-quantum crypto. Custody
+ * needs none — it is symmetric and Shamir throughout — but a node signature is
+ * genuinely a signature, so there is a Shor target here and nowhere else.
+ *
+ * ## Where the primitives come from
+ *
+ * Two sources, and `node:crypto` is not one of them. It was, and it made this
+ * the single module in the package set that could not run in a browser, an edge
+ * worker or a Cloudflare Worker — for SHA-256 and HKDF, which Web Crypto and
+ * noble both provide.
+ *
+ *   Web Crypto   randomness, and the base64url helpers in access/security
+ *   noble        SHA-256, HKDF, Ed25519, ML-DSA-65
+ *
+ * Noble rather than `crypto.subtle` for the hashes because everything here is
+ * synchronous and `subtle.digest` is not; making `canonicalString` async to
+ * avoid one dependency the module already carries would be a worse trade.
+ */
+export interface NodeKeyPair {
+    ed25519: {
+        publicKey: string;
+        secretKey: string;
+    };
+    mlDsa: {
+        publicKey: string;
+        secretKey: string;
+    };
+}
+export interface NodePublicKeys {
+    ed25519: string;
+    mlDsa: string;
+}
+/**
+ * Derive a key pair DETERMINISTICALLY from a seed.
+ *
+ * This is what makes an API key work as a credential without our database
+ * holding anything authenticable: the key handed to a customer IS the seed, the
+ * client re-derives the same pair on every start, and we store only the public
+ * halves. A dump of `api_keys` yields nothing that can sign.
+ *
+ * The two algorithms get SEPARATE subkeys via HKDF rather than sharing the seed
+ * bytes. Feeding identical material to an Ed25519 secret and an ML-DSA keygen
+ * would tie the two schemes together — the hybrid is only worth its bytes if a
+ * break in one leaves the other genuinely independent.
+ */
+export declare function deriveKeysFromSeed(seed: Uint8Array): NodeKeyPair;
+/** Generate a node key pair. The secret halves never leave the caller. */
+export declare function generateNodeKeys(): NodeKeyPair;
+export interface SignedEnvelope {
+    nodeKey: string;
+    timestamp: number;
+    nonce: string;
+    edSignature: string;
+    mlDsaSignature: string;
+}
+/**
+ * The bytes that get signed.
+ *
+ * Method and path are included so a valid signature cannot be replayed against
+ * a different endpoint. The BODY DIGEST is signed rather than the body itself,
+ * so a proxy may re-frame the request but may not alter its content — and so a
+ * large upload does not have to be buffered twice.
+ */
+export declare function canonicalString(args: {
+    method: string;
+    path: string;
+    query: string;
+    timestamp: number;
+    nonce: string;
+    body: string | Uint8Array;
+}): string;
+export declare function signRequest(keys: NodeKeyPair, nodeKey: string, args: {
+    method: string;
+    path: string;
+    query?: string;
+    body: string | Uint8Array;
+}): SignedEnvelope;
+export type VerifyFailure = 'timestamp_out_of_window' | 'ed25519_invalid' | 'ml_dsa_invalid' | 'malformed';
+/** Requests older or newer than this are refused before any signature work. */
+export declare const CLOCK_SKEW_SECONDS = 300;
+/**
+ * Verify both signatures over the canonical string.
+ *
+ * The timestamp window is checked FIRST and cheaply. Two reasons: it bounds how
+ * long the replay-nonce table has to remember anything, and it means an attacker
+ * cannot make the server do lattice verification work for free.
+ *
+ * BOTH signatures must pass. Accepting either alone would silently reduce the
+ * scheme to whichever is weaker.
+ */
+export declare function verifyRequest(args: {
+    envelope: SignedEnvelope;
+    publicKeys: NodePublicKeys;
+    method: string;
+    path: string;
+    query?: string;
+    body: string | Uint8Array;
+    nowSeconds?: number;
+}): {
+    verified: true;
+} | {
+    verified: false;
+    reason: VerifyFailure;
+};

package/dist/identity.js

@@ -0,0 +1,111 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/identity.ts
+import { toBase64Url, fromBase64Url } from "@forgezero/access/security";
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { hkdf } from "@noble/hashes/hkdf.js";
+var ENCODER = new TextEncoder;
+var b64 = toBase64Url;
+var un64 = fromBase64Url;
+var randomBytes = (length) => crypto.getRandomValues(new Uint8Array(length));
+function deriveKeysFromSeed(seed) {
+  if (seed.length < 32)
+    throw new Error("identity: seed must be at least 32 bytes");
+  const sub = (label) => hkdf(sha256, seed, undefined, ENCODER.encode(label), 32);
+  const edSecret = sub("forgezero/identity/ed25519/v1");
+  const mlSeed = sub("forgezero/identity/ml-dsa-65/v1");
+  const edPublic = ed25519.getPublicKey(edSecret);
+  const mlKeys = ml_dsa65.keygen(mlSeed);
+  mlSeed.fill(0);
+  return {
+    ed25519: { publicKey: b64(edPublic), secretKey: b64(edSecret) },
+    mlDsa: { publicKey: b64(mlKeys.publicKey), secretKey: b64(mlKeys.secretKey) }
+  };
+}
+function generateNodeKeys() {
+  const edSecret = ed25519.utils.randomSecretKey();
+  const edPublic = ed25519.getPublicKey(edSecret);
+  const seed = randomBytes(32);
+  const mlKeys = ml_dsa65.keygen(seed);
+  seed.fill(0);
+  return {
+    ed25519: { publicKey: b64(edPublic), secretKey: b64(edSecret) },
+    mlDsa: { publicKey: b64(mlKeys.publicKey), secretKey: b64(mlKeys.secretKey) }
+  };
+}
+function canonicalString(args) {
+  const body = typeof args.body === "string" ? ENCODER.encode(args.body) : args.body;
+  const digest = Array.from(sha256(body), (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return [
+    args.method.toUpperCase(),
+    args.path,
+    args.query ?? "",
+    String(args.timestamp),
+    args.nonce,
+    digest
+  ].join(`
+`);
+}
+function signRequest(keys, nodeKey, args) {
+  const timestamp = Math.floor(Date.now() / 1000);
+  const nonce = b64(randomBytes(16));
+  const message = ENCODER.encode(canonicalString({ ...args, query: args.query ?? "", timestamp, nonce }));
+  return {
+    nodeKey,
+    timestamp,
+    nonce,
+    edSignature: b64(ed25519.sign(message, un64(keys.ed25519.secretKey))),
+    mlDsaSignature: b64(ml_dsa65.sign(message, un64(keys.mlDsa.secretKey)))
+  };
+}
+var CLOCK_SKEW_SECONDS = 300;
+function verifyRequest(args) {
+  const now = args.nowSeconds ?? Math.floor(Date.now() / 1000);
+  if (Math.abs(now - args.envelope.timestamp) > CLOCK_SKEW_SECONDS) {
+    return { verified: false, reason: "timestamp_out_of_window" };
+  }
+  let message;
+  try {
+    message = ENCODER.encode(canonicalString({
+      method: args.method,
+      path: args.path,
+      query: args.query ?? "",
+      timestamp: args.envelope.timestamp,
+      nonce: args.envelope.nonce,
+      body: args.body
+    }));
+  } catch {
+    return { verified: false, reason: "malformed" };
+  }
+  try {
+    if (!ed25519.verify(un64(args.envelope.edSignature), message, un64(args.publicKeys.ed25519))) {
+      return { verified: false, reason: "ed25519_invalid" };
+    }
+  } catch {
+    return { verified: false, reason: "ed25519_invalid" };
+  }
+  try {
+    if (!ml_dsa65.verify(un64(args.envelope.mlDsaSignature), message, un64(args.publicKeys.mlDsa))) {
+      return { verified: false, reason: "ml_dsa_invalid" };
+    }
+  } catch {
+    return { verified: false, reason: "ml_dsa_invalid" };
+  }
+  return { verified: true };
+}
+export {
+  verifyRequest,
+  signRequest,
+  generateNodeKeys,
+  deriveKeysFromSeed,
+  canonicalString,
+  CLOCK_SKEW_SECONDS
+};

package/dist/importers.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Reading secrets out of the tools people are leaving.
+ *
+ * Adoption is the whole reason this exists. Somebody with three hundred
+ * credentials in 1Password will not retype them, and an import that mangles
+ * twenty of those three hundred is worse than none — they will not find out
+ * which twenty until something fails in production.
+ *
+ * So every parser here is built around the same three rules:
+ *
+ *   NOTHING IS GUESSED. A row that cannot be understood is reported as skipped
+ *   with a reason, never imported under a name the parser invented.
+ *
+ *   NO VALUE IS EVER IN AN ERROR. Every message names the LINE or the ITEM, and
+ *   the one thing a parse error must not do is put a password in a log.
+ *
+ *   NAMES ARE NORMALISED THE SAME WAY EVERY TIME, so re-running an import
+ *   updates what it created rather than producing a second copy under a
+ *   slightly different name.
+ */
+export interface ImportedSecret {
+    /** Normalised. `DATABASE_URL`, not `Database URL`. */
+    name: string;
+    value: string;
+    /** Where it came from, for a review screen. Never the value. */
+    source: string;
+    note?: string;
+}
+export interface Skipped {
+    /** A line number, an item title — something a human can find. */
+    at: string;
+    reason: string;
+}
+export interface ImportResult {
+    secrets: readonly ImportedSecret[];
+    skipped: readonly Skipped[];
+}
+/**
+ * `Database URL` and `database-url` become `DATABASE_URL`.
+ *
+ * One rule, applied everywhere, because the alternative is an import that
+ * creates `DATABASE_URL` on Monday and `DATABASE__URL` on Tuesday and leaves a
+ * developer with two entries that look identical in a list.
+ */
+export declare function normaliseName(raw: string): string;
+/**
+ * A `.env` file.
+ *
+ * Handles what real files contain: `export` prefixes, quoted values,
+ * `#` comments, blank lines, and values containing `=`. It does NOT expand
+ * `${OTHER}` references — an expansion done here would bake today's value of
+ * another variable into a stored secret, and the point of a vault is that the
+ * value is resolved when it is read.
+ */
+export declare function parseEnv(text: string): ImportResult;
+/**
+ * A CSV export.
+ *
+ * The header decides which column holds what, and a file whose header names no
+ * recognisable value column is REFUSED rather than guessed at — importing
+ * column two because it looked passwordy is how a set of usernames ends up
+ * stored as secrets.
+ */
+export declare function parseCsv(text: string): ImportResult;
+/**
+ * A Bitwarden JSON export.
+ *
+ * Folders and cards are ignored deliberately: a card number is not a secret an
+ * application reads at runtime, and importing one puts a payment instrument in
+ * a place designed for machine credentials. Logins and secure notes are what
+ * belong here.
+ *
+ * An ENCRYPTED export is refused with the reason, because the alternative is a
+ * parse that "succeeds" and imports a list of ciphertext blobs.
+ */
+export declare function parseBitwarden(text: string): ImportResult;
+/**
+ * A 1Password `.1pux` item list, or its CSV export.
+ *
+ * The CSV path reuses `parseCsv` — 1Password's CSV header already uses `title`
+ * and `password`, which that parser recognises. This handles the JSON form,
+ * where the value lives in a field list rather than a fixed column.
+ */
+export declare function parseOnePassword(text: string): ImportResult;
+export declare const IMPORT_FORMATS: readonly ["env", "csv", "bitwarden", "1password"];
+export type ImportFormat = (typeof IMPORT_FORMATS)[number];
+export declare function parseImport(format: ImportFormat, text: string): ImportResult;