@naylence/advanced-security 0.3.0

package/dist/esm/naylence/fame/security/signing/eddsa-envelope-verifier.js

@@ -0,0 +1,172 @@
+import { etc as edEtc, verify } from "@noble/ed25519";
+import { sha512 } from "@noble/hashes/sha2.js";
+import { SigningMaterial } from "@naylence/core";
+import { SigningConfigClass, secureDigest, } from "@naylence/runtime";
+import { canonicalJson, decodeBase64Url, frameDigest, immutableHeaders, } from "naylence-runtime/naylence/fame/security/signing/eddsa-signer-verifier.js";
+import { encodeUtf8 } from "naylence-runtime/naylence/fame/security/signing/eddsa-utils.js";
+import { JWKValidationError, validateSigningKey } from "@naylence/runtime";
+import { publicKeyFromX5c } from "../cert/util.js";
+function assertString(value, field) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`${field} must be a non-empty string`);
+    }
+    return value;
+}
+function isDataFrame(frame) {
+    return frame.type === "Data";
+}
+function encodeBase64Url(value) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(value)
+            .toString("base64")
+            .replace(/\+/gu, "-")
+            .replace(/\//gu, "_")
+            .replace(/=+$/u, "");
+    }
+    let binary = "";
+    for (const byte of value) {
+        binary += String.fromCharCode(byte);
+    }
+    if (typeof btoa === "function") {
+        return btoa(binary)
+            .replace(/\+/gu, "-")
+            .replace(/\//gu, "_")
+            .replace(/=+$/u, "");
+    }
+    throw new Error("No base64 encoder available in this environment");
+}
+function ensureNobleSha512Fallback() {
+    const etcPatch = edEtc;
+    if (!etcPatch.sha512) {
+        etcPatch.sha512 = (message) => sha512(message);
+    }
+    if (!etcPatch.sha512Sync) {
+        etcPatch.sha512Sync = (...messages) => {
+            if (messages.length === 1) {
+                return sha512(messages[0]);
+            }
+            const combined = edEtc.concatBytes(...messages);
+            return sha512(combined);
+        };
+    }
+}
+function normalizeCertificateKey(jwk, signingConfig) {
+    if (!Array.isArray(jwk.x5c) || jwk.x5c.length === 0) {
+        return null;
+    }
+    if (signingConfig.signingMaterial !== SigningMaterial.X509_CHAIN) {
+        throw new Error("Certificate keys are disabled by signing policy");
+    }
+    const trustStorePem = process.env.FAME_CA_CERTS;
+    if (!trustStorePem) {
+        throw new Error("FAME_CA_CERTS environment variable must be set to a PEM file containing trusted CA certs when using certificate-based verification");
+    }
+    const publicKey = publicKeyFromX5c(jwk.x5c, {
+        enforceNameConstraints: signingConfig.validateCertNameConstraints,
+        trustStorePem,
+    });
+    if (publicKey.length !== 32) {
+        throw new Error("Certificate public key must be 32 bytes for Ed25519");
+    }
+    return encodeBase64Url(publicKey);
+}
+async function loadPublicKey(jwk, signingConfig) {
+    const certificateKey = normalizeCertificateKey(jwk, signingConfig);
+    const candidate = certificateKey ??
+        (typeof jwk.x === "string"
+            ? jwk.x
+            : typeof jwk.crv_x === "string"
+                ? jwk.crv_x
+                : jwk.pub);
+    if (typeof candidate !== "string") {
+        throw new Error("JWK missing public key material");
+    }
+    return decodeBase64Url(candidate);
+}
+export class EdDSAEnvelopeVerifier {
+    constructor(keyProvider, options = {}) {
+        this.keyProvider = keyProvider;
+        this.signingConfig = options.signingConfig ?? new SigningConfigClass();
+        ensureNobleSha512Fallback();
+    }
+    async verifyEnvelope(envelope, options = {}) {
+        const signatureHeader = envelope.sec?.sig;
+        if (!signatureHeader) {
+            throw new Error("Missing envelope.sec.sig header");
+        }
+        const kid = assertString(signatureHeader.kid, "Signature header missing 'kid'");
+        const signatureValue = assertString(signatureHeader.val, "Signature header missing 'val'");
+        const jwk = (await this.keyProvider.getKey(kid));
+        if (!jwk) {
+            throw new Error(`Unknown key id: ${kid}`);
+        }
+        try {
+            validateSigningKey(jwk);
+        }
+        catch (error) {
+            if (error instanceof JWKValidationError) {
+                throw new Error(`Key ${kid} is not valid for signing: ${error.message}`);
+            }
+            throw error;
+        }
+        const checkPayload = options.checkPayload ?? true;
+        let trustedDigest;
+        if (isDataFrame(envelope.frame)) {
+            if (checkPayload) {
+                if (!envelope.frame.pd) {
+                    throw new Error("DataFrame missing payload digest (pd field)");
+                }
+                const payload = envelope.frame.payload ?? "";
+                const payloadString = payload === "" ? "" : canonicalJson(payload);
+                const actualDigest = secureDigest(payloadString);
+                if (actualDigest !== envelope.frame.pd) {
+                    throw new Error("Payload digest mismatch in DataFrame");
+                }
+                trustedDigest = actualDigest;
+            }
+            else {
+                if (!envelope.frame.pd) {
+                    throw new Error("DataFrame missing payload digest (pd field) for intermediate verification");
+                }
+                trustedDigest = envelope.frame.pd;
+            }
+        }
+        else {
+            trustedDigest = frameDigest(envelope.frame);
+        }
+        const sid = assertString(jwk.sid, "Signing key missing sid");
+        const immutable = canonicalJson(immutableHeaders(envelope));
+        const tbs = new Uint8Array(encodeUtf8(sid).length +
+            1 +
+            encodeUtf8(immutable).length +
+            1 +
+            encodeUtf8(trustedDigest).length);
+        const sidBytes = encodeUtf8(sid);
+        const immBytes = encodeUtf8(immutable);
+        const digestBytes = encodeUtf8(trustedDigest);
+        let offset = 0;
+        tbs.set(sidBytes, offset);
+        offset += sidBytes.length;
+        tbs[offset] = 0x1f;
+        offset += 1;
+        tbs.set(immBytes, offset);
+        offset += immBytes.length;
+        tbs[offset] = 0x1f;
+        offset += 1;
+        tbs.set(digestBytes, offset);
+        const signatureBytes = decodeBase64Url(signatureValue);
+        if (signatureBytes.length !== 64) {
+            throw new Error("Signature must be 64 bytes for Ed25519");
+        }
+        const publicKey = await loadPublicKey(jwk, this.signingConfig);
+        if (publicKey.length !== 32) {
+            throw new Error("Ed25519 public key must be 32 bytes");
+        }
+        const valid = await verify(signatureBytes, tbs, publicKey);
+        if (!valid) {
+            throw new Error("Envelope signature verification failed");
+        }
+        return true;
+    }
+}
+//# sourceMappingURL=eddsa-envelope-verifier.js.map

package/dist/esm/naylence/fame/security/signing/eddsa-envelope-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eddsa-envelope-verifier.js","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/signing/eddsa-envelope-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,IAAI,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,kBAAkB,EAClB,YAAY,GAEb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,gEAAgE,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAanD,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAA4B;IAC/C,OAAQ,KAA2B,CAAC,IAAI,KAAK,MAAM,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aACtB,QAAQ,CAAC,QAAQ,CAAC;aAClB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC;aAChB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,QAAQ,GAAG,KAGhB,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,QAAQ,CAAC,MAAM,GAAG,CAAC,OAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,QAAQ,CAAC,UAAU,GAAG,CAAC,GAAG,QAAsB,EAAc,EAAE;YAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;YAC9B,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC;YAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAAgB,EAChB,aAA4B;IAE5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,aAAa,CAAC,eAAe,KAAK,eAAe,CAAC,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAChD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,oIAAoI,CACrI,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAe,EAAE;QACtD,sBAAsB,EAAE,aAAa,CAAC,2BAA2B;QACjE,aAAa;KACd,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAgB,EAChB,aAA4B;IAE5B,MAAM,cAAc,GAAG,uBAAuB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAEnE,MAAM,SAAS,GACb,cAAc;QACd,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;YACxB,CAAC,CAAC,GAAG,CAAC,CAAC;YACP,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAC7B,CAAC,CAAC,GAAG,CAAC,KAAK;gBACX,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEjB,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAMD,MAAM,OAAO,qBAAqB;IAKhC,YACE,WAAwB,EACxB,UAAwC,EAAE;QAE1C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACvE,yBAAyB,EAAE,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,QAAsB,EACtB,UAAwD,EAAE;QAE1D,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;QAC1C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,GAAG,GAAG,YAAY,CACtB,eAAe,CAAC,GAAG,EACnB,gCAAgC,CACjC,CAAC;QACF,MAAM,cAAc,GAAG,YAAY,CACjC,eAAe,CAAC,GAAG,EACnB,gCAAgC,CACjC,CAAC;QAEF,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAuB,CAAC;QACvE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC;YACH,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,OAAO,GAAG,8BAA8B,KAAK,CAAC,OAAO,EAAE,CACxD,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;QAElD,IAAI,aAAqB,CAAC;QAC1B,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC7C,MAAM,aAAa,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACnE,MAAM,YAAY,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;gBACjD,IAAI,YAAY,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAC1D,CAAC;gBACD,aAAa,GAAG,YAAY,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;gBACJ,CAAC;gBACD,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CACxB,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM;YACpB,CAAC;YACD,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM;YAC5B,CAAC;YACD,UAAU,CAAC,aAAa,CAAC,CAAC,MAAM,CACnC,CAAC;QAEF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC;QAEZ,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC;QAEZ,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE7B,MAAM,cAAc,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QACvD,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/D,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/esm/naylence/fame/stickiness/aft-helper.js

@@ -0,0 +1,72 @@
+import { getLogger } from "@naylence/runtime";
+import { createAftSigner } from "./aft-signer.js";
+import { StickinessMode } from "./stickiness-mode.js";
+const logger = getLogger("naylence.fame.stickiness.aft_helper");
+export class AFTHelper {
+    constructor(options) {
+        this.signer = options.signer;
+        this.nodeSid = options.nodeSid;
+        this.maxTtlSec = options.maxTtlSec;
+    }
+    async requestStickiness(envelope, options = {}) {
+        const ttlSec = options.ttlSec ?? this.maxTtlSec;
+        const scope = options.scope ?? null;
+        const context = options.context ?? null;
+        let clientSid;
+        if (context?.stickySid) {
+            clientSid = context.stickySid;
+            logger.debug("client_sticky_sid_extracted", { client_sid: clientSid });
+        }
+        const signOptions = {
+            sid: this.nodeSid,
+            ttlSec,
+            scope,
+            clientSid: clientSid ?? null,
+        };
+        try {
+            const aftToken = await this.signer.signAft(signOptions);
+            if (!aftToken) {
+                return false;
+            }
+            if (!envelope.meta) {
+                envelope.meta = {};
+            }
+            let setMeta = envelope.meta.set;
+            if (!setMeta || typeof setMeta !== "object") {
+                setMeta = {};
+                envelope.meta.set = setMeta;
+            }
+            setMeta.aft = aftToken;
+            logger.debug("aft_instruction_added", {
+                envelope_id: envelope.id,
+                ttl_sec: ttlSec,
+                scope,
+                security_level: this.signer.securityLevel,
+            });
+            return true;
+        }
+        catch (error) {
+            logger.error("aft_generation_failed", {
+                envelope_id: envelope.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return false;
+        }
+    }
+    requestNodeStickiness(envelope, options = {}) {
+        return this.requestStickiness(envelope, { ...options, scope: "node" });
+    }
+    requestFlowStickiness(envelope, options = {}) {
+        return this.requestStickiness(envelope, { ...options, scope: "flow" });
+    }
+    requestSessionStickiness(envelope, options = {}) {
+        return this.requestStickiness(envelope, { ...options, scope: "sess" });
+    }
+}
+export function createAftHelper(options) {
+    const { nodeSid, maxTtlSec = 7200 } = options;
+    const signer = createAftSigner(options);
+    return new AFTHelper({ signer, nodeSid, maxTtlSec });
+}
+export const DEFAULT_STICKINESS_SECURITY_LEVEL = StickinessMode.SIGNED_OPTIONAL;
+//# sourceMappingURL=aft-helper.js.map

package/dist/esm/naylence/fame/stickiness/aft-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aft-helper.js","sourceRoot":"","sources":["../../../../../src/naylence/fame/stickiness/aft-helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG9C,OAAO,EAAE,eAAe,EAA+B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,MAAM,GAAG,SAAS,CAAC,qCAAqC,CAAC,CAAC;AAQhE,MAAM,OAAO,SAAS;IAKpB,YAAmB,OAIlB;QACC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAC5B,QAAsB,EACtB,UAAoC,EAAE;QAEtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QAExC,IAAI,SAA6B,CAAC;QAClC,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,WAAW,GAAmB;YAClC,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,MAAM;YACN,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAExD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnB,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;YACrB,CAAC;YAED,IAAI,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAA0C,CAAC;YACvE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,OAGnB,CAAC;YACJ,CAAC;YAEA,OAAmC,CAAC,GAAG,GAAG,QAAQ,CAAC;YAEpD,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBACpC,WAAW,EAAE,QAAQ,CAAC,EAAE;gBACxB,OAAO,EAAE,MAAM;gBACf,KAAK;gBACL,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;aAC1C,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBACpC,WAAW,EAAE,QAAQ,CAAC,EAAE;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEM,qBAAqB,CAC1B,QAAsB,EACtB,UAAmD,EAAE;QAErD,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAEM,qBAAqB,CAC1B,QAAsB,EACtB,UAAmD,EAAE;QAErD,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAEM,wBAAwB,CAC7B,QAAsB,EACtB,UAAmD,EAAE;QAErD,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;CACF;AAMD,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,cAAc,CAAC,eAAe,CAAC"}

package/dist/esm/naylence/fame/stickiness/aft-load-balancer-stickiness-manager-factory.js

@@ -0,0 +1,65 @@
+import { LOAD_BALANCER_STICKINESS_MANAGER_FACTORY_BASE_TYPE, LoadBalancerStickinessManagerFactory, } from "@naylence/runtime";
+import { AFTLoadBalancerStickinessManager } from "./aft-load-balancer-stickiness-manager.js";
+import { createAftVerifier } from "./aft-verifier.js";
+import { StickinessMode, normalizeStickinessMode } from "./stickiness-mode.js";
+export const FACTORY_META = {
+    base: LOAD_BALANCER_STICKINESS_MANAGER_FACTORY_BASE_TYPE,
+    key: "AFTLoadBalancerStickinessManager",
+};
+const DEFAULT_VALUES = {
+    enabled: true,
+    clientEcho: false,
+    defaultTtlSec: 30,
+    cacheMax: 100000,
+    securityLevel: StickinessMode.SIGNED_OPTIONAL,
+    maxTtlSec: 7200,
+};
+function toBoolean(value, fallback) {
+    return typeof value === "boolean" ? value : fallback;
+}
+function toNumber(value, fallback) {
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return value;
+    }
+    return fallback;
+}
+function normalizeConfig(config) {
+    const record = (config ?? {});
+    const normalizedSecurity = record.securityLevel
+        ? normalizeStickinessMode(record.securityLevel)
+        : DEFAULT_VALUES.securityLevel;
+    return {
+        ...record,
+        type: "AFTLoadBalancerStickinessManager",
+        enabled: toBoolean(record.enabled, DEFAULT_VALUES.enabled),
+        clientEcho: toBoolean(record.clientEcho, DEFAULT_VALUES.clientEcho),
+        defaultTtlSec: toNumber(record.defaultTtlSec, DEFAULT_VALUES.defaultTtlSec),
+        cacheMax: toNumber(record.cacheMax, DEFAULT_VALUES.cacheMax),
+        securityLevel: normalizedSecurity,
+        maxTtlSec: toNumber(record.maxTtlSec, DEFAULT_VALUES.maxTtlSec),
+    };
+}
+export class AFTLoadBalancerStickinessManagerFactory extends LoadBalancerStickinessManagerFactory {
+    constructor() {
+        super(...arguments);
+        this.type = "AFTLoadBalancerStickinessManager";
+        this.isDefault = false;
+    }
+    async create(config, keyProvider, verifier) {
+        const resolvedConfig = normalizeConfig(config);
+        let effectiveVerifier = verifier ?? null;
+        if (!effectiveVerifier && keyProvider) {
+            effectiveVerifier = createAftVerifier({
+                securityLevel: resolvedConfig.securityLevel ?? DEFAULT_VALUES.securityLevel,
+                keyProvider,
+                defaultTtlSec: resolvedConfig.defaultTtlSec ?? DEFAULT_VALUES.defaultTtlSec,
+            });
+        }
+        if (!effectiveVerifier) {
+            throw new Error("AFTLoadBalancerStickinessManagerFactory requires an AFT verifier or key provider");
+        }
+        return new AFTLoadBalancerStickinessManager(resolvedConfig, effectiveVerifier);
+    }
+}
+export default AFTLoadBalancerStickinessManagerFactory;
+//# sourceMappingURL=aft-load-balancer-stickiness-manager-factory.js.map

package/dist/esm/naylence/fame/stickiness/aft-load-balancer-stickiness-manager-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aft-load-balancer-stickiness-manager-factory.js","sourceRoot":"","sources":["../../../../../src/naylence/fame/stickiness/aft-load-balancer-stickiness-manager-factory.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kDAAkD,EAClD,oCAAoC,GAErC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAa/E,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,kDAAkD;IACxD,GAAG,EAAE,kCAAkC;CAC/B,CAAC;AAEX,MAAM,cAAc,GAAG;IACrB,OAAO,EAAE,IAAI;IACb,UAAU,EAAE,KAAK;IACjB,aAAa,EAAE,EAAE;IACjB,QAAQ,EAAE,MAAO;IACjB,aAAa,EAAE,cAAc,CAAC,eAAe;IAC7C,SAAS,EAAE,IAAI;CACP,CAAC;AAEX,SAAS,SAAS,CAAC,KAAc,EAAE,QAAiB;IAClD,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,QAAgB;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CACtB,MAGQ;IAER,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IAEzD,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa;QAC7C,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,aAAwC,CAAC;QAC1E,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC;IAEjC,OAAO;QACL,GAAG,MAAM;QACT,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;QAC1D,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC;QACnE,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,aAAa,CAAC;QAC3E,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;QAC5D,aAAa,EAAE,kBAAkB;QACjC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;KACtB,CAAC;AAC9C,CAAC;AAED,MAAM,OAAO,uCAAwC,SAAQ,oCAA4E;IAAzI;;QACkB,SAAI,GAAG,kCAAkC,CAAC;QAC1C,cAAS,GAAG,KAAK,CAAC;IAkCpC,CAAC;IAhCQ,KAAK,CAAC,MAAM,CACjB,MAGQ,EACR,WAAgC,EAChC,QAA6B;QAE7B,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,iBAAiB,GAAG,QAAQ,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,iBAAiB,IAAI,WAAW,EAAE,CAAC;YACtC,iBAAiB,GAAG,iBAAiB,CAAC;gBACpC,aAAa,EACX,cAAc,CAAC,aAAa,IAAI,cAAc,CAAC,aAAa;gBAC9D,WAAW;gBACX,aAAa,EACX,cAAc,CAAC,aAAa,IAAI,cAAc,CAAC,aAAa;aAC/D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,gCAAgC,CACzC,cAAc,EACd,iBAAiB,CAClB,CAAC;IACJ,CAAC;CACF;AAED,eAAe,uCAAuC,CAAC"}