@fungi.computer/seam 0.2.1 → 0.2.3

package/dist/index.d.ts

@@ -66,7 +66,24 @@ export type SeamReplayStore = Readonly<{
 export declare class SeamReplayGuard implements SeamReplayStore {
     #private;
     /** Record one nonce, refusing capacity rather than evicting live history. */
-    admit({ nonce, now, expiresAt }: SeamReplayRecord): SeamReplayAdmission;
+    admit(record: SeamReplayRecord): SeamReplayAdmission;
+}
+/**
+ * Process-local replay history split into independent bounded partitions, one
+ * per sender-controlled traffic source (for example one VM behind a shared
+ * host). A source that exhausts its own partition is refused there and never
+ * evicts or fills another partition. The partition key must be covered by the
+ * request signature: a partition is created only by `admit`, which
+ * {@link verifySeamRequest} calls after the signature verified, so unsigned
+ * traffic allocates nothing. Partitions whose history pruned to empty are
+ * dropped before a new one is refused at the partition ceiling.
+ */
+export declare class SeamReplayPartitions {
+    #private;
+    /** `maximumPartitions` is the number of distinct sources that may be live at once. */
+    constructor(maximumPartitions: number);
+    /** The replay store for one source; nothing is allocated before it admits. */
+    partition(key: string): SeamReplayStore;
 }
 /**
  * Verify one request's seam header. `digest` is the receiver's own digest of

package/dist/index.js

@@ -109,22 +109,68 @@ export async function signSeamRequest(signer, audience, method, url, digest, now
 export class SeamReplayGuard {
     #seen = new Map();
     /** Record one nonce, refusing capacity rather than evicting live history. */
-    admit({ nonce, now, expiresAt }) {
-        this.#prune(now);
-        if (this.#seen.has(nonce))
-            return "replayed";
-        if (this.#seen.size >= maximumNonces)
-            return "at-capacity";
-        this.#seen.set(nonce, expiresAt);
-        return "admitted";
+    admit(record) {
+        return admitNonce(this.#seen, record);
     }
-    #prune(now) {
-        for (const [seen, expires] of this.#seen) {
-            // Freshness accepts the boundary instant. Clock steps also mean Map
-            // insertion order need not be expiry order: inspect every bounded entry.
-            if (expires < now)
-                this.#seen.delete(seen);
+}
+/**
+ * Process-local replay history split into independent bounded partitions, one
+ * per sender-controlled traffic source (for example one VM behind a shared
+ * host). A source that exhausts its own partition is refused there and never
+ * evicts or fills another partition. The partition key must be covered by the
+ * request signature: a partition is created only by `admit`, which
+ * {@link verifySeamRequest} calls after the signature verified, so unsigned
+ * traffic allocates nothing. Partitions whose history pruned to empty are
+ * dropped before a new one is refused at the partition ceiling.
+ */
+export class SeamReplayPartitions {
+    #partitions = new Map();
+    #maximumPartitions;
+    /** `maximumPartitions` is the number of distinct sources that may be live at once. */
+    constructor(maximumPartitions) {
+        if (!Number.isSafeInteger(maximumPartitions) || maximumPartitions < 1)
+            throw new RangeError("Seam replay partitions need a positive ceiling");
+        this.#maximumPartitions = maximumPartitions;
+    }
+    /** The replay store for one source; nothing is allocated before it admits. */
+    partition(key) {
+        return { admit: (record) => this.#admit(key, record) };
+    }
+    #admit(key, record) {
+        let seen = this.#partitions.get(key);
+        if (seen === undefined) {
+            if (this.#partitions.size >= this.#maximumPartitions)
+                this.#dropEmpty(record.now);
+            if (this.#partitions.size >= this.#maximumPartitions)
+                return "at-capacity";
+            seen = new Map();
+            this.#partitions.set(key, seen);
         }
+        return admitNonce(seen, record);
+    }
+    #dropEmpty(now) {
+        for (const [key, seen] of this.#partitions) {
+            pruneNonces(seen, now);
+            if (seen.size === 0)
+                this.#partitions.delete(key);
+        }
+    }
+}
+function admitNonce(seen, { nonce, now, expiresAt }) {
+    pruneNonces(seen, now);
+    if (seen.has(nonce))
+        return "replayed";
+    if (seen.size >= maximumNonces)
+        return "at-capacity";
+    seen.set(nonce, expiresAt);
+    return "admitted";
+}
+function pruneNonces(seen, now) {
+    for (const [nonce, expires] of seen) {
+        // Freshness accepts the boundary instant. Clock steps also mean Map
+        // insertion order need not be expiry order: inspect every bounded entry.
+        if (expires < now)
+            seen.delete(nonce);
     }
 }
 function seamFields(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/seam",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "author": "Levi <levi@technomancy.dev>",
   "private": false,
   "description": "Ed25519 authentication between Fungi Hub and on-box hosts",
@@ -16,7 +16,7 @@
     }
   },
   "dependencies": {
-    "@fungi.computer/carrier": "0.2.1",
+    "@fungi.computer/carrier": "0.2.2",
     "effect": "4.0.2"
   },
   "license": "MIT",