nervur 0.23.0 → 0.24.0

package/dist/bodies/class-list.js

@@ -1,33 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Classes from a plain list, each kind from the one class that declares it.
-import { declarationOf } from '../being/being.js';
-export class ClassList {
-    #kinds = new Map();
-    #steward;
-    #public;
-    constructor({ steward, public: open, beings = [] }) {
-        const kindOf = (Class) => {
-            const kind = declarationOf(Class)?.kind;
-            if (typeof kind !== 'string')
-                throw new TypeError('a class in the list is not a class of Being.of');
-            const held = this.#kinds.get(kind);
-            if (held !== undefined && held !== Class)
-                throw new TypeError(`two classes claim the kind ${kind}`);
-            this.#kinds.set(kind, Class);
-            return kind;
-        };
-        this.#steward = kindOf(steward);
-        this.#public = open === undefined ? undefined : kindOf(open);
-        for (const Class of beings)
-            kindOf(Class);
-    }
-    async resolve({ kind }) {
-        return this.#kinds.get(kind);
-    }
-    steward() {
-        return this.#steward;
-    }
-    public() {
-        return this.#public;
-    }
-}

package/dist/bodies/joined-carry.d.ts

@@ -1,29 +0,0 @@
-import type { Carry, Sent } from '../foundation.ts';
-export declare class JoinedCarry implements Carry {
-    #private;
-    /** `carries` by scheme: `{ tcp: tcpCarry, https: webCarry }`. */
-    constructor(carries: Readonly<Record<string, Carry>>);
-    /** A ward's door, hooked to every carry here that listens. */
-    listen(options: {
-        ward: string;
-        door: (box: Uint8Array) => Promise<Uint8Array | null>;
-    }): Promise<void>;
-    /** A ward unhooked from every carry here that listens. */
-    unlisten(options: {
-        ward: string;
-    }): void;
-    send({ ward, at, box, wait }: {
-        ward: string;
-        at: readonly string[];
-        box: Uint8Array;
-        wait?: number;
-    }): Promise<Sent>;
-    at(options?: {
-        toward?: string;
-    }): readonly string[];
-    /** Every domain any carry here reads as vouching, each once, in the carries' order. */
-    vouched(options: {
-        ward: string;
-        at: readonly string[];
-    }): Promise<readonly string[]>;
-}

package/dist/bodies/joined-carry.js

@@ -1,48 +0,0 @@
-export class JoinedCarry {
-    #carries;
-    // Each carry once, where one serves two schemes, as the web serves http and https.
-    #each;
-    /** `carries` by scheme: `{ tcp: tcpCarry, https: webCarry }`. */
-    constructor(carries) {
-        this.#carries = new Map(Object.entries(carries));
-        this.#each = [...new Set(this.#carries.values())];
-    }
-    /** A ward's door, hooked to every carry here that listens. */
-    async listen(options) {
-        for (const carry of this.#each)
-            await carry.listen?.(options);
-    }
-    /** A ward unhooked from every carry here that listens. */
-    unlisten(options) {
-        for (const carry of this.#each)
-            carry.unlisten?.(options);
-    }
-    async send({ ward, at, box, wait }) {
-        const waiting = wait === undefined ? {} : { wait };
-        // A carry that listens for the ward hands it the box by pointer, and no address is dialled.
-        for (const carry of this.#each) {
-            const sent = await carry.send({ ward, at: [], box, ...waiting });
-            if (sent.reply !== null)
-                return sent;
-        }
-        for (const address of at) {
-            // A scheme is read in any case, as a URI's is.
-            const scheme = address.slice(0, Math.max(0, address.indexOf('://'))).toLowerCase();
-            const carry = this.#carries.get(scheme);
-            if (carry === undefined)
-                continue;
-            const sent = await carry.send({ ward, at: [address], box, ...waiting });
-            if (sent.reply !== null || sent.heard)
-                return sent;
-        }
-        return { reply: null, heard: false };
-    }
-    at(options = {}) {
-        return this.#each.flatMap((carry) => carry.at(options));
-    }
-    /** Every domain any carry here reads as vouching, each once, in the carries' order. */
-    async vouched(options) {
-        const each = await Promise.all(this.#each.map((carry) => carry.vouched(options)));
-        return [...new Set(each.flat())];
-    }
-}

package/dist/bodies/kept.d.ts

@@ -1,44 +0,0 @@
-import type { Memory, PlaceRead } from '../foundation.ts';
-import type { Unlock } from '../ground/ground.ts';
-/** Secrets as text by name, kept where the terrain keeps them. */
-export interface Secrets {
-    get(name: string): Promise<string | null>;
-    set(name: string, value: string): Promise<void>;
-}
-/** A store of text by key, with a swap that lands only where nothing moved. */
-export interface Store {
-    get(key: string): Promise<string | null>;
-    /** Every key that begins with `prefix`. */
-    keys(prefix: string): Promise<readonly string[]>;
-    /**
-     * Lands every write together, where every key in `expect` still holds
-     * what it names, `null` for absent; otherwise lands nothing. A write of
-     * `null` removes its key. Answers whether it landed.
-     */
-    swap(writes: Readonly<Record<string, string | null>>, expect: Readonly<Record<string, string | null>>): Promise<boolean>;
-}
-/** The ground's key among a terrain's secrets, drawn on first use. */
-export declare abstract class KeptUnlock implements Unlock {
-    #private;
-    constructor(secrets: Secrets);
-    key(): Promise<string>;
-}
-/**
- * Memory over a store, one memory for each name. Each place is one key,
- * its entries as hex beside its version. Versions come from one counter
- * for the memory, so a place removed and written again never shows a
- * version it showed before. A write reads every place it names and swaps
- * them all against what it read.
- */
-export declare abstract class KeptMemory implements Memory {
-    #private;
-    constructor(store: Store, name: string);
-    read({ place }: {
-        place: string;
-    }): Promise<PlaceRead>;
-    list(): Promise<readonly string[]>;
-    write({ writes, expect, }: {
-        writes: Readonly<Record<string, Readonly<Record<string, Uint8Array | null>>>>;
-        expect: Readonly<Record<string, string | null>>;
-    }): Promise<Readonly<Record<string, string | null>> | null>;
-}

package/dist/bodies/kept.js

@@ -1,91 +0,0 @@
-const NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/;
-const KEY = /^[0-9a-f]{64}$/;
-const hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
-const bytes = (text) => new Uint8Array(text.match(/../g)?.map((pair) => parseInt(pair, 16)) ?? []);
-/** The ground's key among a terrain's secrets, drawn on first use. */
-export class KeptUnlock {
-    #secrets;
-    #drawn;
-    constructor(secrets) {
-        this.#secrets = secrets;
-    }
-    key() {
-        // One key is drawn at a time, so two first uses never draw two.
-        this.#drawn ??= (async () => {
-            let key = await this.#secrets.get('nervur.key');
-            if (key === null) {
-                key = hex(crypto.getRandomValues(new Uint8Array(32)));
-                await this.#secrets.set('nervur.key', key);
-            }
-            if (!KEY.test(key))
-                throw new Error('the kept key is not sixty-four lowercase hex digits');
-            return key;
-        })();
-        this.#drawn.catch(() => (this.#drawn = undefined));
-        return this.#drawn;
-    }
-}
-/**
- * Memory over a store, one memory for each name. Each place is one key,
- * its entries as hex beside its version. Versions come from one counter
- * for the memory, so a place removed and written again never shows a
- * version it showed before. A write reads every place it names and swaps
- * them all against what it read.
- */
-export class KeptMemory {
-    #store;
-    #prefix;
-    constructor(store, name) {
-        if (!NAME.test(name))
-            throw new TypeError(`no memory is named ${name}`);
-        this.#store = store;
-        this.#prefix = `nervur/${name}/`;
-    }
-    #key(place) {
-        return `${this.#prefix}p/${place}`;
-    }
-    async read({ place }) {
-        const text = await this.#store.get(this.#key(place));
-        if (text === null)
-            return { entries: {}, version: null };
-        const held = JSON.parse(text);
-        return { entries: Object.fromEntries(Object.entries(held.e).map(([name, value]) => [name, bytes(value)])), version: String(held.v) };
-    }
-    async list() {
-        const places = `${this.#prefix}p/`;
-        return (await this.#store.keys(places)).map((key) => key.slice(places.length));
-    }
-    async write({ writes, expect, }) {
-        const places = [...new Set([...Object.keys(writes), ...Object.keys(expect)])];
-        const count = `${this.#prefix}count`;
-        const held = { [count]: await this.#store.get(count) };
-        for (const place of places)
-            held[this.#key(place)] = await this.#store.get(this.#key(place));
-        for (const place of places) {
-            const text = held[this.#key(place)];
-            const version = text === null ? null : String(JSON.parse(text).v);
-            if (!(place in expect) || expect[place] !== version)
-                return null;
-        }
-        let next = held[count] === null ? 0 : Number(held[count]);
-        const landing = {};
-        const versions = {};
-        for (const [place, entries] of Object.entries(writes)) {
-            const text = held[this.#key(place)];
-            const kept = { ...(text === null ? {} : JSON.parse(text).e) };
-            for (const [name, value] of Object.entries(entries)) {
-                if (value === null)
-                    delete kept[name];
-                else
-                    kept[name] = hex(value);
-            }
-            next += 1;
-            const empty = Object.keys(kept).length === 0;
-            landing[this.#key(place)] = empty ? null : JSON.stringify({ v: next, e: kept });
-            versions[place] = empty ? null : String(next);
-        }
-        landing[count] = String(next);
-        // What another writer moved since the read refuses the swap, as it would the versions.
-        return (await this.#store.swap(landing, held)) ? versions : null;
-    }
-}

package/dist/bodies/noble-crypto.d.ts

@@ -1,22 +0,0 @@
-import type { Crypto } from '../foundation.ts';
-export declare class NobleCrypto implements Crypto {
-    random(length: number): Uint8Array;
-    sha256(data: Uint8Array): Promise<Uint8Array>;
-    hkdf(ikm: Uint8Array, info: string, length: number): Promise<Uint8Array>;
-    seal(key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array, additional: Uint8Array): Promise<Uint8Array>;
-    open(key: Uint8Array, nonce: Uint8Array, ciphertext: Uint8Array, additional: Uint8Array): Promise<Uint8Array | null>;
-    signingPublic(secret: Uint8Array): Promise<Uint8Array>;
-    sign(secret: Uint8Array, message: Uint8Array): Promise<Uint8Array>;
-    verify(pk: Uint8Array, message: Uint8Array, signature: Uint8Array): Promise<boolean>;
-    agreePublic(secret: Uint8Array): Promise<Uint8Array>;
-    agree(secret: Uint8Array, pk: Uint8Array): Promise<Uint8Array | null>;
-    lockPair(seed: Uint8Array): Promise<{
-        encapsulation: Uint8Array;
-        decapsulation: Uint8Array;
-    }>;
-    encapsulate(encapsulation: Uint8Array): Promise<{
-        ciphertext: Uint8Array;
-        shared: Uint8Array;
-    } | null>;
-    decapsulate(decapsulation: Uint8Array, ciphertext: Uint8Array): Promise<Uint8Array>;
-}

package/dist/bodies/noble-crypto.js

@@ -1,88 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// The default crypto: Ed25519, X25519 and ML-KEM-768 from noble, SHA-256,
-// HKDF and AES-GCM from Web Crypto.
-import { ed25519, x25519 } from '@noble/curves/ed25519.js';
-import { ml_kem768 } from '@noble/post-quantum/ml-kem.js';
-const subtle = globalThis.crypto.subtle;
-const ascii = new TextEncoder();
-const view = (bytes) => new Uint8Array(bytes);
-export class NobleCrypto {
-    random(length) {
-        const out = new Uint8Array(length);
-        for (let at = 0; at < length; at += 65_536)
-            globalThis.crypto.getRandomValues(out.subarray(at, Math.min(length, at + 65_536)));
-        return out;
-    }
-    async sha256(data) {
-        return new Uint8Array(await subtle.digest('SHA-256', view(data)));
-    }
-    async hkdf(ikm, info, length) {
-        const key = await subtle.importKey('raw', view(ikm), 'HKDF', false, ['deriveBits']);
-        const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: ascii.encode(info) }, key, length * 8);
-        return new Uint8Array(bits);
-    }
-    async seal(key, nonce, plaintext, additional) {
-        const aes = await subtle.importKey('raw', view(key), 'AES-GCM', false, ['encrypt']);
-        return new Uint8Array(await subtle.encrypt({ name: 'AES-GCM', iv: view(nonce), additionalData: view(additional) }, aes, view(plaintext)));
-    }
-    async open(key, nonce, ciphertext, additional) {
-        if (ciphertext.length < 16)
-            return null;
-        const aes = await subtle.importKey('raw', view(key), 'AES-GCM', false, ['decrypt']);
-        try {
-            return new Uint8Array(await subtle.decrypt({ name: 'AES-GCM', iv: view(nonce), additionalData: view(additional) }, aes, view(ciphertext)));
-        }
-        catch {
-            return null;
-        }
-    }
-    async signingPublic(secret) {
-        return ed25519.getPublicKey(secret);
-    }
-    async sign(secret, message) {
-        return ed25519.sign(message, secret);
-    }
-    async verify(pk, message, signature) {
-        if (pk.length !== 32 || signature.length !== 64)
-            return false;
-        try {
-            // Strict decoding refuses a y at or above the prime and a non-canonical R.
-            if (ed25519.Point.fromBytes(pk, false).isSmallOrder())
-                return false;
-            return ed25519.verify(signature, message, pk, { zip215: false });
-        }
-        catch {
-            return false;
-        }
-    }
-    async agreePublic(secret) {
-        return x25519.getPublicKey(secret);
-    }
-    async agree(secret, pk) {
-        if (pk.length !== 32)
-            return null;
-        try {
-            const shared = x25519.getSharedSecret(secret, pk);
-            return shared.every((byte) => byte === 0) ? null : shared;
-        }
-        catch {
-            return null;
-        }
-    }
-    async lockPair(seed) {
-        const { publicKey, secretKey } = ml_kem768.keygen(seed);
-        return { encapsulation: publicKey, decapsulation: secretKey };
-    }
-    async encapsulate(encapsulation) {
-        try {
-            const { cipherText, sharedSecret } = ml_kem768.encapsulate(encapsulation);
-            return { ciphertext: cipherText, shared: sharedSecret };
-        }
-        catch {
-            return null;
-        }
-    }
-    async decapsulate(decapsulation, ciphertext) {
-        return ml_kem768.decapsulate(ciphertext, decapsulation);
-    }
-}

package/dist/bodies/seed-keys.d.ts

@@ -1,10 +0,0 @@
-import type { Crypto, Keys, WardKeys } from '../foundation.ts';
-export declare class SeedKeys implements Keys {
-    #private;
-    constructor(seed: string | undefined, crypto?: Crypto);
-    ward(): Promise<WardKeys>;
-    sign(message: Uint8Array): Promise<Uint8Array>;
-    agree(pk: Uint8Array): Promise<Uint8Array | null>;
-    decapsulate(ciphertext: Uint8Array): Promise<Uint8Array>;
-    derive(label: string, length: number): Promise<Uint8Array>;
-}

package/dist/bodies/seed-keys.js

@@ -1,42 +0,0 @@
-import { NobleCrypto } from './noble-crypto.js';
-const SEED = /^[0-9a-f]{64}$/;
-export class SeedKeys {
-    #seed;
-    #crypto;
-    #held;
-    constructor(seed, crypto = new NobleCrypto()) {
-        if (typeof seed !== 'string' || !SEED.test(seed))
-            throw new TypeError('a seed is sixty-four lowercase hex digits');
-        this.#seed = Uint8Array.from(seed.match(/../g), (pair) => Number.parseInt(pair, 16));
-        this.#crypto = crypto;
-    }
-    #keys() {
-        this.#held ??= (async () => {
-            const crypto = this.#crypto;
-            const signing = await crypto.hkdf(this.#seed, 'quo-ward-sign', 32);
-            const scalar = await crypto.hkdf(this.#seed, 'quo-ward-seal', 32);
-            // The lock is the kit's: one per ward, drawn from the seed under a label of Nervur's.
-            const lock = await crypto.lockPair(await crypto.hkdf(this.#seed, 'nervur-lock', 64));
-            const ward = Object.freeze({ signing: await crypto.signingPublic(signing), padlock: await crypto.agreePublic(scalar), lock: lock.encapsulation });
-            return { signing, scalar, decapsulation: lock.decapsulation, ward };
-        })();
-        return this.#held;
-    }
-    async ward() {
-        return (await this.#keys()).ward;
-    }
-    async sign(message) {
-        return this.#crypto.sign((await this.#keys()).signing, message);
-    }
-    async agree(pk) {
-        return this.#crypto.agree((await this.#keys()).scalar, pk);
-    }
-    async decapsulate(ciphertext) {
-        return this.#crypto.decapsulate((await this.#keys()).decapsulation, ciphertext);
-    }
-    async derive(label, length) {
-        if (label.startsWith('quo-'))
-            throw new TypeError('a label beginning quo- is Quo\'s');
-        return this.#crypto.hkdf(this.#seed, `nervur-derive:${label}`, length);
-    }
-}

package/dist/bodies/strict-tools.d.ts

@@ -1,10 +0,0 @@
-import type { Parsed, Tools } from '../foundation.ts';
-export declare class StrictTools implements Tools {
-    utf8(text: string): Uint8Array;
-    text(bytes: Uint8Array): string | null;
-    hex(bytes: Uint8Array): string;
-    bytes(hex: string): Uint8Array | null;
-    parse(text: string): Parsed | null;
-    canonical(value: unknown): string;
-    check(schema: unknown, value: unknown): string | null;
-}