ftown 0.20.9 → 0.24.0

package/dist/rotating-token-refresher.js

@@ -1,91 +0,0 @@
-import { UnauthorizedError } from 'centrifuge';
-const COOLDOWN_BASE_MS = 15_000;
-const COOLDOWN_MAX_MS = 600_000;
-/**
- * Owns the bridge's single-use refresh token.
- *
- * Token rotation is single-flight inside this process: if centrifuge-js asks
- * for a token twice concurrently, both callers share one exchange instead of
- * racing the same credential. If another process already rotated the token and
- * persisted its replacement, a rejected in-memory token gets one recovery
- * attempt from disk — the same state repair that previously required restart.
- *
- * Transient failures (network errors, 5xx) arm an exponential cooldown during
- * which getToken() rejects without calling the API, because centrifuge-js
- * retries a failed token fetch every 5-10 s with no growth. The cooldown error
- * is deliberately not an UnauthorizedError: centrifuge-js treats that as
- * permanent and stops retrying for good.
- */
-export class RotatingTokenRefresher {
-    options;
-    currentRefreshToken;
-    inFlight = null;
-    consecutiveFailures = 0;
-    cooldownUntil = 0;
-    now;
-    random;
-    constructor(options) {
-        this.options = options;
-        this.currentRefreshToken = options.initialRefreshToken;
-        this.now = options.now ?? (() => performance.now());
-        this.random = options.random ?? Math.random;
-    }
-    cooldownRemainingMs() {
-        return Math.max(0, this.cooldownUntil - this.now());
-    }
-    getToken() {
-        if (this.inFlight)
-            return this.inFlight;
-        const remaining = this.cooldownRemainingMs();
-        if (remaining > 0) {
-            return Promise.reject(new Error(`Token refresh cooling down for ${Math.ceil(remaining / 1000)}s after ${this.consecutiveFailures} failed attempts`));
-        }
-        const operation = this.refreshAndRotate().finally(() => {
-            if (this.inFlight === operation)
-                this.inFlight = null;
-        });
-        this.inFlight = operation;
-        return operation;
-    }
-    async refreshAndRotate() {
-        try {
-            const token = await this.exchange();
-            this.consecutiveFailures = 0;
-            this.cooldownUntil = 0;
-            return token;
-        }
-        catch (error) {
-            if (!(error instanceof UnauthorizedError))
-                this.armCooldown();
-            throw error;
-        }
-    }
-    armCooldown() {
-        this.consecutiveFailures++;
-        const base = Math.min(COOLDOWN_BASE_MS * 2 ** (this.consecutiveFailures - 1), COOLDOWN_MAX_MS);
-        this.cooldownUntil = this.now() + base * (0.8 + 0.4 * this.random());
-    }
-    async exchange() {
-        let refreshed;
-        try {
-            refreshed = await this.options.refresh(this.currentRefreshToken);
-        }
-        catch (error) {
-            if (!(error instanceof UnauthorizedError))
-                throw error;
-            const persistedToken = this.options.loadPersistedRefreshToken();
-            if (!persistedToken || persistedToken === this.currentRefreshToken) {
-                throw error;
-            }
-            // Another bridge process sharing this data directory completed a
-            // rotation first. Adopt its persisted token and retry exactly once.
-            this.currentRefreshToken = persistedToken;
-            this.options.onPersistedTokenRecovery?.();
-            refreshed = await this.options.refresh(this.currentRefreshToken);
-        }
-        this.currentRefreshToken = refreshed.refreshToken;
-        this.options.persistRefreshToken(this.currentRefreshToken);
-        return refreshed.token;
-    }
-}
-//# sourceMappingURL=rotating-token-refresher.js.map

package/dist/rotating-token-refresher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rotating-token-refresher.js","sourceRoot":"","sources":["../src/rotating-token-refresher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAgB/C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,sBAAsB;IAQJ;IAPrB,mBAAmB,CAAS;IAC5B,QAAQ,GAA2B,IAAI,CAAC;IACxC,mBAAmB,GAAG,CAAC,CAAC;IACxB,aAAa,GAAG,CAAC,CAAC;IACT,GAAG,CAAe;IAClB,MAAM,CAAe;IAEtC,YAA6B,OAAsC;QAAtC,YAAO,GAAP,OAAO,CAA+B;QACjE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAC9C,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,QAAQ;QACN,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,kCAAkC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,kBAAkB,CACnH,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACrD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC;gBAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CACnB,gBAAgB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC,EACtD,eAAe,CAChB,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,IAAI,SAA6B,CAAC;QAClC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAEvD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;YAChE,IAAI,CAAC,cAAc,IAAI,cAAc,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACnE,MAAM,KAAK,CAAC;YACd,CAAC;YAED,iEAAiE;YACjE,oEAAoE;YACpE,IAAI,CAAC,mBAAmB,GAAG,cAAc,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;YAC1C,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC,YAAY,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3D,OAAO,SAAS,CAAC,KAAK,CAAC;IACzB,CAAC;CACF"}

package/dist/security/account-crypto.d.ts

@@ -1,33 +0,0 @@
-import type { EndpointIdentity, EndpointPublic } from './protocol.js';
-import type { AccountCheckpoint, AccountEnrollmentBundle, AccountEnrollmentLink, AccountEnrollmentRequest, AccountErrorCode, AccountHistory, AccountOperation, AccountSigningIdentity, AccountTrustFailure, SignedAccountGenesis, SignedAccountTransition, VerifiedAccountTrust } from './account-protocol.js';
-export declare const ACCOUNT_TRUST_LIMITS: Readonly<{
-    maxHistoryBytes: 2097152;
-    maxTransitions: 1024;
-    maxDevices: 128;
-    maxBridges: 128;
-    enrollmentLifetimeMs: 300000;
-    refreshIntervalMs: 600000;
-    offlineGraceMs: 86400000;
-    maxFutureSkewMs: 30000;
-    maxLabelLength: 200;
-}>;
-/** No untrusted text, key material or underlying crypto error enters this error. */
-export declare class AccountTrustError extends Error implements AccountTrustFailure {
-    readonly code: AccountErrorCode;
-    readonly retryable: boolean;
-    constructor(code: AccountErrorCode);
-}
-export declare function parseAccountHistory(value: unknown): AccountHistory;
-export declare function generateAccountSigningIdentity(extractable?: boolean): Promise<AccountSigningIdentity>;
-export declare function generateAccountBridgeCandidate(bridgeId: string, extractable?: boolean): Promise<EndpointIdentity>;
-export declare function importAccountBridgeCandidate(value: EndpointPublic, privateKey: JsonWebKey, extractable?: boolean): Promise<EndpointIdentity>;
-export declare function createAccountGenesis(ownerId: string, value: EndpointPublic, signing: AccountSigningIdentity, name: string, now?: number): Promise<SignedAccountGenesis>;
-export declare function signAccountTransition(value: AccountCheckpoint, signerId: string, signing: AccountSigningIdentity, op: AccountOperation, now?: number): Promise<SignedAccountTransition>;
-export declare function verifyAccountHistory(history: AccountHistory, pinned: AccountCheckpoint | null, now?: number): Promise<AccountCheckpoint>;
-export declare function parseAccountEnrollmentRequest(value: unknown, now?: number): Promise<AccountEnrollmentRequest>;
-export declare function createAccountEnrollment(identity: EndpointIdentity, name: string, signing: AccountSigningIdentity | null, bridgeId: string | null, now?: number): Promise<AccountEnrollmentLink>;
-export declare function encodeAccountEnrollmentLink(link: AccountEnrollmentLink): string;
-export declare function parseAccountEnrollmentLink(value: unknown, now?: number): Promise<AccountEnrollmentLink>;
-export declare function accountComparisonCode(link: AccountEnrollmentLink): Promise<string>;
-export declare function sealAccountApproval(approver: EndpointIdentity, link: AccountEnrollmentLink, history: AccountHistory, now?: number): Promise<AccountEnrollmentBundle>;
-export declare function openAccountApproval(candidate: EndpointIdentity, link: AccountEnrollmentLink, bundle: AccountEnrollmentBundle, history: AccountHistory, now?: number): Promise<VerifiedAccountTrust>;