wt/LumaWeb
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: wt/LumaWeb:522311022f9cec1d13de3551e46b181d3ac005de
wt/LumaWeb:main
...
compare: wt/LumaWeb:main
wt/LumaWeb:main
78 Commits
522311022f ... main
Author SHA1 Message Date
wt c0ce1bd026 status
Foundation checks / foundation (push) Failing after 2m49s
Details
2026-10-15 18:43:29 +07:00
wt ce4d994598 S00-005: Approve storage design after independent transaction checks 
Changes: Accept ADR 0004 and record independent S00-005 review, experiment status and handoff; preserve explicit native browser and durability limitations.
Validation: Fresh-cache npm ci and npm run check passed on Node 24.21.0/npm 11.19.0; exact lock pins, HTTPS/SHA512, installed license texts and runtime refusal checks passed. make check passed 72 tooling tests. Scoped diff and whitespace reviewed; native browser quota and process restart were not tested.

Task: S00-005
Agent: auto-qa-4078580caf39
Role: qa
Action: review
Status: done

Task title: Выбрать IndexedDB wrapper и migration policy
 2026-10-15 18:38:02 +07:00
wt 0e2b3098df S00-005: Select idb and verify transactional storage failure policies 
Changes: Propose ADR 0004 comparing native IndexedDB, idb and Dexie; select idb 8.0.4 with account, transaction, quota, upgrade and key ownership policy. Repair rollback and add injected quota/blocked upgrade checks, exact wrapper lock, runtime guard, license texts and reproduction notes. Preserve historical recovery artifacts.
Validation: Fresh-cache npm ci and npm run check passed on Node 24.21.0/npm 11.19.0; manifest, HTTPS/SHA512 and license checks passed. make check passed 72 tooling tests; tasks.py validate and git diff --check passed. Native browser quota, disk durability and process restart were not tested; ADR remains proposed for independent QA.

Task: S00-005
Agent: auto-storage-0ce544ac4b40
Role: storage
Action: claim
Status: review

Task title: Выбрать IndexedDB wrapper и migration policy
 2026-10-15 18:33:15 +07:00
wt 8f918bc040 S00-003: Approve bounded XMPP selection after independent WSS and SCRAM checks 
Changes: Accept ADR 0002 for pinned Stanza with mandatory bounded transport, verified SASL and SHA512 composition; record independent review findings and handoff with external limits retained.
Validation: Fresh-cache pinned npm ci and browser build succeeded; all 112 tests passed. Verified 51 locked entries, 26 installed notices and 340 unchanged vendor files; six offer permutations and six adversarial XML checks passed; make check passed 72 tooling tests. No actual browser, independent full XMPP server/client, OMEMO or release readiness acceptance.

Task: S00-003
Agent: auto-qa-d49749753ac6
Role: qa
Action: review
Status: done

Task title: Проверить XMPP WSS/auth библиотеку
 2026-10-15 18:26:01 +07:00
wt 51a414d386 S00-003: Evaluate Stanza with verified SCRAM and bounded WSS ingress 
Changes: Propose the pinned XMPP library decision and add an isolated browser-built selection spike combining reviewed public SASL, SHA-512 and parser seams. Exercise TLS/xmpp handshake, strongest compatible non-PLUS authentication, rejected unsafe paths and extension mappings; document duplicate-body export projection and remaining limits. Preserve dependency notices, evidence and QA handoff.
Validation: Clean-cache pinned npm ci succeeded; npm test passed 112 checks; check-dependencies.py verified 51 locked entries, 26 installed packages and 340 unchanged vendor files; make check passed 72 tooling tests. No actual browser runtime, independent full XMPP server/client or production encryption/release readiness claim.

Task: S00-003
Agent: auto-protocol-f474114f0168
Role: protocol
Action: claim
Status: review

Task title: Проверить XMPP WSS/auth библиотеку
 2026-10-15 18:20:05 +07:00
wt e08c0ab590 S00-023: Approve the interrupted storage experiment recovery checkpoint 
Changes: Accept S00-023 recovery readiness and record independent QA evidence and handoff; preserve unfinished S00-005 storage acceptance.
Validation: Inspect implementation and prior checkpoint diffs/messages; verify inventory, pins and matching hashes; repeat both node syntax checks and tasks.py validate, exit 0. No storage runtime or browser checks performed.

Task: S00-023
Agent: auto-qa-2de51e85c611
Role: qa
Action: review
Status: done

Task title: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 2026-10-15 18:09:39 +07:00
wt 30ee500054 S00-023: Document the interrupted storage experiment restart point 
Changes: Preserve existing storage artifacts and add a scoped recovery inventory with missing outputs, unfinished rollback logic and next steps for S00-005; record recovery evidence and handoff.
Validation: Assignment/packet, manifest-lock inventory assertions, both node --check commands and tasks.py validate passed. Storage runtime, quota and browser behavior were not tested; original storage task remains unaccepted.

Task: S00-023
Agent: auto-storage-e6946c6f94e3
Role: storage
Action: claim
Status: review

Task title: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 2026-10-15 18:06:23 +07:00
wt 6ac04950bf S00-025: Approve launcher recovery after independent argument checks 
Changes: Accept bounded S00-025 launcher remediation; record independent QA evidence and handoff without accepting parent storage work.
Validation: Reproduced conflicting arguments with expected exit 2; active argv help and Codex 0.159.0 checks exit 0; tasks.py validate and git diff --check pass. Inspected executor diff/message and accepted dependency evidence. No model, browser, sandbox or storage test rerun.

Task: S00-025
Agent: auto-qa-27d3befe5097
Role: qa
Action: review
Status: done

Task title: Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 2026-10-15 18:02:07 +07:00
wt 43610f3356 S00-025: Verify storage recovery launcher after argument repair 
Changes: Record reproduction of the S00-023 argument conflict and verification of the active reviewed S00-028 invocation; replace blocked S00-025 handoff with bounded QA instructions. Preserve all storage source artifacts.
Validation: Conflicting invocation returns expected exit 2; current argv help and version checks return 0; tasks.py validate passes. No model, storage or browser correctness test performed.

Task: S00-025
Agent: auto-storage-8b47cee148df
Role: storage
Action: claim
Status: review

Task title: Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 2026-10-15 17:59:38 +07:00
wt 0d29bdb3ed S00-028: Approve the compatible Codex launcher after independent sandbox checks 
Changes: Accept S00-028 launcher documentation and bounded verification; record independent QA evidence and handoff. Preserve source and local configuration.
Validation: Inspected implementation diff/message and exact active argv; bounded CLI help and approved host wrapper with inner workspace-write probe exited 0. Project write/read/remove passed; outside write denied EROFS30. make check passed 72 tests in 18.544s. No additional model or storage task ran.

Task: S00-028
Agent: auto-qa-2160ddeb5c08
Role: qa
Action: review
Status: done

Task title: Repair conflicting Codex harness sandbox arguments
 2026-10-15 17:55:20 +07:00
wt ff99ee7b62 S00-028: Document and verify the compatible Codex runner invocation 
Changes: Document the coordinator-selected Codex 0.159.0 argv without conflicting sandbox flags; record parser and filesystem evidence plus QA handoff. Preserve existing local configuration and portable example.
Validation: Exact active argv help and approved host wrapper with inner workspace-write probe exited 0; project write/read/remove passed and outside write denied EROFS30. Final make check passed 72 tests after shortening the documentation to meet prompt budgets. No additional model or storage work ran.

Task: S00-028
Agent: auto-ci-cd-e3a716a94424
Role: ci-cd
Action: claim
Status: review

Task title: Repair conflicting Codex harness sandbox arguments
 2026-10-15 17:52:47 +07:00
wt ff5a89647a S00-030: Approve the bounded host-context sandbox diagnostic 
Changes: Record independent S00-030 QA acceptance and append the verified result to its handoff.
Validation: Inspected executor diff/message and probe hash; approved host wrapper and inner workspace-write probe exit 0, project write/read/remove passed and outside write denied EROFS 30. make check exit 0 with 72 tests; git diff --check exit 0. No additional model/storage task ran; acceptance is limited to this host/version and one filesystem boundary.

Task: S00-030
Agent: auto-qa-a9442b15e749
Role: qa
Action: review
Status: done

Task title: Provide a valid Codex sandbox app-server socket directory
 2026-10-15 17:49:22 +07:00
wt b4a27f2354 S00-030: Confirm the host-context sandbox diagnostic for socket recovery 
Changes: Clarify S00-030 host execution guidance in docs/AUTOMATION.md and record the successful bounded diagnostic with QA handoff.
Validation: Approved host wrapper and inner workspace-write probe exit 0; project write/read/remove passed, outside write denied EROFS 30. make check exit 0 with 72 tooling tests; git diff --check exit 0. No additional model or storage task ran; app readiness is outside scope.

Task: S00-030
Agent: auto-ci-cd-8c7bc1551426
Role: ci-cd
Action: claim
Status: review

Task title: Provide a valid Codex sandbox app-server socket directory
 2026-10-15 17:46:48 +07:00
wt 263d365640 S00-031: Approve the independently verified Codex host sandbox diagnostic 
Changes: Accept S00-031 with independent QA evidence and handoff; confirm the automation guidance matches the bounded host-context diagnostic.
Validation: Approved host stat verified uid1000/mode0700; inner workspace-write probe exited 0 with project write/read/remove and outside write denial EROFS30. make check passed 72 tests; scope, executor message and git diff --check passed. No model or storage task ran; acceptance covers this host/version and one filesystem boundary.

Task: S00-031
Agent: auto-qa-56c26814c30b
Role: qa
Action: review
Status: done

Task title: Supply a verified private Codex app-server socket environment
 2026-10-15 17:44:13 +07:00
wt ace4f674d5 S00-031: Document verified host context for the Codex sandbox probe 
Changes: Add host-specific socket mask diagnosis and bounded inner workspace-write invocation to automation guidance; record independent evidence and QA handoff.
Validation: Approved host stat confirmed uid1000/mode0700; no-model inner sandbox exited 0 with project write/read/remove and outside write denial EROFS30. Final make check passed 72 tests and git diff --check passed. Initial verbose draft exceeded prompt budgets; compacted guidance passed the rerun. No storage task or model executed.

Task: S00-031
Agent: auto-ci-cd-d45ccd3ee7d6
Role: ci-cd
Action: claim
Status: review

Task title: Supply a verified private Codex app-server socket environment
 2026-10-15 17:42:02 +07:00
wt 865f1e7a72 S00-031: Record newly available external input for independent verification 
Changes: Release external waiting state for S00-031 through tasks.py. Input: New verified root cause and supported host execution context supplied in state/handoffs/S00-031.md. Actual host /tmp/codex-daemon-1000 uid1000/mode0700 is valid; outer sandbox deliberately masks it read-only mode000. Installed-version primary source confirms this design; TMPDIR/no-daemon cannot fix nested guard. Approved OUTER HOST EXECUTION of bounded no-model inner codex workspace-write probe passes project write/read/remove and denies outside write EROFS30, no outside file created. No socket mutation or broader roots. Fresh executor/QA must read handoff, request approved outer host execution and independently repeat, document and review; no task acceptance claimed.
Validation: External input availability checked; tasks.py release-external succeeded. Acceptance and dependent tasks remain unverified pending fresh executor and independent review.

Task: S00-031
Agent: coordinator-input-s00-031
Role: orchestrator
Action: release-external
Status: todo

Task title: Supply a verified private Codex app-server socket environment
 2026-10-15 17:38:03 +07:00
wt 0bf7504900 S00-030: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-030. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-030 no-model sandbox diagnostic still exits 1 before execution with the original socket directory ownership/mode guard, despite XDG_RUNTIME_DIR being user-owned mode 0700. Actual socket directory repair requires host owner input.
Automatic blocker limit reached; explicit external resolution required.

Task: S00-030
Agent: auto-ci-cd-d37c9faf28f3
Role: ci-cd
Action: claim
Status: blocked

Task title: Provide a valid Codex sandbox app-server socket directory
 2026-10-15 17:32:24 +07:00
wt 176149b832 S00-030: Record newly available external input for independent verification 
Changes: Release external waiting state for S00-030 through tasks.py. Input: Coordinator confirms valid host-side sandbox execution without modifying socket ownership/mode: codex -c sandbox_mode='"workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-filesystem-sandbox-probe.py, launched via approved host tool execution (outer require_escalated), exit 0. Inside actual Codex workspace-write sandbox synthetic project write/read/remove passed, unique /home/tola outside-project write denied EROFS (errno 30), no outside file created, uid 1000. Public diagnostic state/runs/coordinator-sandbox/output.log; synthetic probe script /tmp/luma-filesystem-sandbox-probe.py. Failure occurred when invoking nested sandbox from restricted context, not in this approved host context. Fresh S00-030 executor/QA should request approved outer host execution of the bounded inner sandbox diagnostic, retaining inner workspace-write and proxy/TLS settings. Do not chmod global sockets or weaken policy. Host input now supplied and verified; task implementation/docs and independent review remain unaccepted.
Validation: External input availability checked; tasks.py release-external succeeded. Acceptance and dependent tasks remain unverified pending fresh executor and independent review.

Task: S00-030
Agent: coordinator-input-s00-030
Role: orchestrator
Action: release-external
Status: todo

Task title: Provide a valid Codex sandbox app-server socket directory
 2026-10-15 17:30:32 +07:00
wt a53f0f1a14 S00-028: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-028. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-028 cannot independently validate project filesystem sandbox: installed Codex sandbox exits before command execution because the app-server socket directory must be user-owned with mode 0700. Host socket repair is outside launcher arguments scope.
Automatic blocker limit reached; explicit external resolution required.

Task: S00-028
Agent: auto-ci-cd-211cf3a2bd08
Role: ci-cd
Action: claim
Status: blocked

Task title: Repair conflicting Codex harness sandbox arguments
 2026-10-15 17:26:50 +07:00
wt 28320ff35a S00-022: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-022. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Pinned libomemo.js@3.0.0 supplies real embedded WASM but is a different unaudited ratchet and excludes consumer SCE; no approved decision reconciles it with S00-022 retained audited engine/persistence requirement.

Task: S00-022
Agent: auto-crypto-bcd7f2a71667
Role: crypto
Action: claim
Status: blocked

Task title: Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
 2026-10-15 17:17:19 +07:00
wt 8bfaa06e64 S00-027: Approve registry connectivity after independent HTTPS checks 
Changes: Accept the bounded S00-027 connectivity record and add independent security review evidence and handoff.
Validation: Fresh-cache control, candidate and pinned npm queries exited 0; fresh HTTPS artifact SHA512 SRI, size and SHA256 matched. make check exited 0 with 72 tests; executor patch/message, owner confirmation, scope and whitespace checked. No crypto/backend or distribution acceptance.

Task: S00-027
Agent: auto-security-ccce71646176
Role: security
Action: review
Status: done

Task title: Restore approved npm registry connectivity for the OMEMO2 backend investigation
 2026-10-15 17:14:47 +07:00
wt 0b60f3d84e S00-027: Document verified HTTPS npm registry connectivity 
Changes: Add the bounded S00-027 connectivity record with owner confirmation, fresh registry responses, pinned libomemo.js artifact integrity and independent review handoff.
Validation: Both live metadata queries and pinned metadata query exited 0; HTTPS archive SHA512 matched registry SRI without executing scripts. make check exited 0 with 72 tests; whitespace and scope inspected. No crypto/backend acceptance or application build claimed.

Task: S00-027
Agent: auto-ci-cd-40ae46e8efe7
Role: ci-cd
Action: claim
Status: review

Task title: Restore approved npm registry connectivity for the OMEMO2 backend investigation
 2026-10-15 17:12:33 +07:00
wt 8db4e4ef35 S00-020: Approve pinned Linux XMPP toolchain restoration 
Changes: Accept S00-020 with independent QA evidence and handoff; refresh scoped runtime/cache result paths after fresh retrieval and installation.
Validation: verify.py passed official HTTPS checksum, Node 24.21.0/npm 11.19.0, isolated strict npm ci and Stanza import. Independent archive/input/eight-version/strict-setting assertions, tasks.py validate and diff/scope checks passed. Browser/WSS and product readiness remain untested.

Task: S00-020
Agent: auto-qa-9e1e289654ba
Role: qa
Action: review
Status: done

Task title: Restore access to the pinned Linux XMPP experiment toolchain
 2026-10-15 17:09:30 +07:00
wt ae00f3502e S00-020: Verify pinned Linux XMPP toolchain restoration 
Changes: Refresh the environment-access result and document S00-020 restoration, accepted prerequisites and independent QA handoff; preserve probe code and parent dependency graph.
Validation: verify.py passed official HTTPS vendor checksum, Node 24.21.0/npm 11.19.0, fresh-cache strict npm ci and Stanza import. Separate artifact/input/version/strict-setting assertions and tasks.py validate passed. No browser/WSS or product readiness check performed.

Task: S00-020
Agent: auto-ci-cd-2a0186c54ce9
Role: ci-cd
Action: claim
Status: review

Task title: Restore access to the pinned Linux XMPP experiment toolchain
 2026-10-15 17:07:16 +07:00
wt 3b92736a99 S00-024: Approve restored Linux toolchain continuation checkpoint 
Changes: Accept the bounded S00-024 restoration checkpoint, add independent QA evidence and handoff, and refresh successful probe runtime/cache paths.
Validation: Independently reran verify.py with official HTTPS checksum, Node 24.21.0/npm 11.19.0, fresh-cache locked npm ci and Stanza import; archive/input/installed-version/strict-config assertions, tasks.py validate and diff/scope/whitespace checks passed. Browser/WSS, interoperability and product readiness remain unverified.

Task: S00-024
Agent: auto-qa-e19cd93db255
Role: qa
Action: review
Status: done

Task title: Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain
 2026-10-15 17:04:44 +07:00
wt 4bad1f228e S00-024: Verify restored pinned Linux XMPP environment access 
Changes: Add the S00-024 continuation checkpoint, refresh verified runtime/cache paths, and replace the blocked handoff with QA and S00-020 restart instructions.
Validation: Existing verify.py passed official HTTPS/checksum retrieval, Node 24.21.0/npm 11.19.0, fresh-cache locked npm ci and Stanza import. Independent archive/input/version/config assertions, tasks.py validate and diff/scope/whitespace checks passed. Browser/WSS and product readiness remain unverified.

Task: S00-024
Agent: auto-ci-cd-49907d48a6d1
Role: ci-cd
Action: claim
Status: review

Task title: Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain
 2026-10-15 17:02:37 +07:00
wt ca20031bf9 S00-026: Approve pinned Linux artifact access after independent verification 
Changes: Accept the bounded S00-026 access probe; add independent QA evidence and refresh successful result runtime/cache paths. Preserve parent task incompleteness.
Validation: Repeat verify.py successfully with fresh official HTTPS downloads, matching vendor SHA256, exact Node 24.21.0/npm 11.19.0, eight locked packages and actual Stanza import. Independently check copied input bytes, installed versions, integrity and strict npm settings. tasks.py validate and git diff --check pass. Inspect executor patch/message and coordinator access confirmation. Browser/WSS and detached signature/provenance audits remain outside this review.

Task: S00-026
Agent: auto-qa-7d3de2e3c758
Role: qa
Action: review
Status: done

Task title: Provide approved access to the pinned Linux experiment artifacts
 2026-10-15 17:00:17 +07:00
wt 2af4f143d8 S00-026: Verify pinned Linux runtime and isolated locked dependency access 
Changes: Add a bounded reproducible HTTPS/checksum/runtime probe under environment-access, vendor checksums, unchanged parent manifest/lock copies, strict npm settings, result and reproduction notes. Record evidence and QA handoff; submit S00-026 without completing parent tasks.
Validation: Run verify.py twice successfully: vendor Linux archive SHA256 matched, Node 24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed eight integrity-locked packages with scripts disabled, parent bytes stayed unchanged and Stanza import passed. tasks.py validate, git diff --check and scoped file whitespace checks passed. No browser/WSS, detached signature or provenance audit performed.

Task: S00-026
Agent: auto-ci-cd-4255c34da227
Role: ci-cd
Action: claim
Status: review

Task title: Provide approved access to the pinned Linux experiment artifacts
 2026-10-15 16:57:59 +07:00
wt bac7706480 S00-028: Record newly available external input for independent verification 
Changes: Release external waiting state for S00-028 through tasks.py. Input: Coordinator supplies the active compatible argv from runner.local.json: codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -. Explicit --sandbox was removed before the S00-024/S00-022/S00-025 fresh agent launches. --approve-for-me retains workspace-write per installed CLI help; no danger-full-access or bypass option. Actual subsequent run state/runs/auto-storage-ae5930b6fbdf/run.json shows the fresh harness executed tools and reached its own escalate, unlike the original immediate CLI exit 2. Installed CLI bounded help check codex exec --approve-for-me --ephemeral --help exited 0. Outbound network config retains existing proxy and TLS, independently probed via codex -c sandbox_mode='"workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0; state/runs/coordinator-network/output.log. Fresh S00-028 executor/QA must verify supported argv and filesystem scope; no storage task completion or launcher repair acceptance claimed.
Validation: External input availability checked; tasks.py release-external succeeded. Acceptance and dependent tasks remain unverified pending fresh executor and independent review.

Task: S00-028
Agent: coordinator-input-s00-028
Role: orchestrator
Action: release-external
Status: todo

Task title: Repair conflicting Codex harness sandbox arguments
 2026-10-15 16:54:15 +07:00
wt 3fd75a818f S00-025: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-025. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-023 harness exited before task execution: codex exec rejected mutually exclusive --approve-for-me and --sandbox flags. Repairing coordinator argv is outside S00-025 storage-only scope.

Task: S00-025
Agent: auto-storage-ae5930b6fbdf
Role: storage
Action: claim
Status: blocked

Task title: Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 2026-10-15 16:47:40 +07:00
wt 927728daf1 S00-027: Record newly available external input for independent verification 
Changes: Release external waiting state for S00-027 through tasks.py. Input: Approved agent sandbox outbound network enabled with documented sandbox_workspace_write.network_access=true in runner.local.json, retaining workspace-write filesystem restrictions, configured proxy and TLS. Verified with installed CLI: codex -c sandbox_mode='"workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0. Both npm metadata queries returned actual values (@signalapp/libsignal-client 0.105.0; libomemo.js 3.0.0 GPL-3.0). Official pinned candidate artifact downloaded, SHA512 SRI matched; no package scripts executed. Public verification and commands: state/runs/coordinator-network/verification.json and output.log. Supplied metadata/archive also in /tmp/luma-approved-registry/. Fresh S00-027 executor and independent security reviewer must reproduce checks under their session, no crypto/backend acceptance claimed.
Validation: External input availability checked; tasks.py release-external succeeded. Acceptance and dependent tasks remain unverified pending fresh executor and independent review.

Task: S00-027
Agent: coordinator-input-s00-027
Role: orchestrator
Action: release-external
Status: todo

Task title: Restore approved npm registry connectivity for the OMEMO2 backend investigation
 2026-10-15 16:45:59 +07:00
wt 0d97f48929 S00-022: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-022. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: All ten live npm metadata queries fail with EAI_AGAIN resolving the configured proxy, including the known libsignal-client control. Required release and artifact verification for S00-022 cannot proceed; failures are not E404 evidence.

Task: S00-022
Agent: auto-crypto-316a193d6c3e
Role: crypto
Action: claim
Status: blocked

Task title: Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
 2026-10-15 16:41:17 +07:00
wt a338d3a1dd S00-022: Record newly available external input for independent verification 
Changes: Release external waiting state for S00-022 through tasks.py. Input: New primary-source candidate supplied: libomemo.js@3.0.0 https://github.com/conversejs/libomemo.js declares legacy OMEMO and OMEMO2 0.9.1 urn:xmpp:omemo:2, WASM and browser worker-client; Converse 14 source uses this dependency and encryptSCE/decryptSCE. Source links and limitations in state/runs/coordinator-research/omemo2-sources.md. Previous npm E404 queries did not include libomemo.js. Upstream explicitly lacks third-party security audit; GPL-3.0 compatibility, actual target tests, preservation of accepted verified engine/persistence and security review remain mandatory. New candidate is sourcing input only, not permission to replace an accepted engine, waive audit/requirements, or claim acceptance. Fresh task executor must evaluate this candidate under the existing card and escalate any unresolved bounded requirement.
Validation: External input availability checked; tasks.py release-external succeeded. Acceptance and dependent tasks remain unverified pending fresh executor and independent review.

Task: S00-022
Agent: coordinator-input-s00-022
Role: orchestrator
Action: release-external
Status: todo

Task title: Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
 2026-10-15 16:38:43 +07:00
wt 956d9459a6 S00-026: Record newly available external input for independent verification 
Changes: Release external waiting state for S00-026 through tasks.py. Input: Approved external artifact preparation completed through configured HTTPS proxy with TLS verification, without changing system tools or project sources. Authentic local supply: /tmp/luma-approved-toolchain/SHASUMS256.txt, node-v24.21.0-linux-x64.tar.xz, npm-11.19.0.tgz; provenance and SHA256/SRI in /tmp/luma-approved-toolchain/verification.json. Exact Node v24.21.0/npm 11.19.0 execute. Unchanged copied parent lock installed with npm ci --ignore-scripts --engine-strict and Stanza 12.22.1, exit 0; /tmp/luma-approved-toolchain/dependency-verification.json and npm-ci.log. Cache /tmp/luma-approved-toolchain/npm-cache permits fresh offline npm ci without proxy access. Fresh executor must independently verify supplied archives/checksums and repeat installation inside its environment-access scope; no task acceptance claimed.
Validation: External input availability checked; tasks.py release-external succeeded. Acceptance and dependent tasks remain unverified pending fresh executor and independent review.

Task: S00-026
Agent: coordinator-input-s00-026
Role: orchestrator
Action: release-external
Status: todo

Task title: Provide approved access to the pinned Linux experiment artifacts
 2026-10-15 16:38:33 +07:00
wt 6f0b4029c4 S00-024: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-024. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-024 cannot establish readiness for S00-020: official checksum retrieval fails with configured proxy DNS error and host Node/npm differ from accepted pins; no partial environment-access artifacts exist.

Task: S00-024
Agent: auto-ci-cd-988167c541cf
Role: ci-cd
Action: claim
Status: blocked

Task title: Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain
 2026-10-15 16:35:52 +07:00
wt a971d3cf4b S00-023: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-023. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Agent exited with code 2

Task: S00-023
Agent: auto-storage-87486895c792
Role: storage
Action: claim
Status: blocked

Task title: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 2026-10-15 16:33:42 +07:00
wt 7afc642a9f S00-020: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-020. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Previous runner session was interrupted before submit/escalate; processes stopped. User now explicitly requests resuming development. Preserve partial artifacts, verify them in a fresh bounded remediation, and return original to a new executor only after independent review.

Task: S00-020
Agent: auto-ci-cd-5a18c8aa1b42
Role: ci-cd
Action: claim
Status: blocked

Task title: Restore access to the pinned Linux XMPP experiment toolchain
 2026-10-15 16:33:21 +07:00
wt 5f4d044444 S00-005: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-005. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Previous runner session was interrupted before submit/escalate; processes stopped. User now explicitly requests resuming development. Preserve partial artifacts, verify them in a fresh bounded remediation, and return original to a new executor only after independent review.

Task: S00-005
Agent: auto-storage-88c3286c6641
Role: storage
Action: claim
Status: blocked

Task title: Выбрать IndexedDB wrapper и migration policy
 2026-10-15 16:32:52 +07:00
wt 55d9c69a21 S00-004: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-004. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-004 acceptance requires establishing legacy/OMEMO2 AND worker/wasm AND persistence without a homegrown ratchet. Reproduced (this run) probes and live public-registry queries confirm only the audited session/ratchet engine + persistence are verified (@signalapp/libsignal-client@0.105.0, Node native addon, zero .wasm). The browser/worker/WASM deployment and the OMEMO/OMEMO2 wire layer are not available from any maintained package on the reachable registry (@signalapp/libsignal, @converse/omemo, @xmpp/omemo, omemo2, omemo-js, omemo-client, omemo-top, omemo-wasm all E404). ENC-009 forbids a homegrown algorithm/ratchet and ENC-011 forbids substituting media AES-GCM for the OMEMO2 wire format, so the spike cannot synthesize a browser backend inside S00-004 scope.

Task: S00-004
Agent: auto-crypto-fe1c81c17ded
Role: crypto
Action: claim
Status: blocked

Task title: Проверить browser OMEMO backend
 2026-10-15 15:42:43 +07:00
wt a02412d7c7 S00-021: Approve S00-021: independently verified browser OMEMO blocker 
Changes:
- Wrote state/evidence/S00-021-review.md recording independent re-checks of the
  executor's remediation for S00-004's interruption ("Agent timed out before
  escalation").
- Reproduced both committed probes unchanged: smoke.mjs exit 0 (SMOKE_PASS,
  631-byte session record byte-for-byte reload) and wasm-unsupported.mjs exit 2
  (wasmFiles 0, native-only prebuilds), matching executor evidence exactly.
- Independently re-queried npm registry: @signalapp/libsignal (browser WASM) E404;
  @signalapp/libsignal-client 0.105.0 (native, AGPL-3.0) exists; confirms the
  browser/worker/WASM + OMEMO2 wire-layer blocker is genuine.
- Audited scope via git: commit 30f7f22 touches only the in-scope ADR
  docs/decisions/0003-crypto-library.md plus workflow metadata; experiments/**
  unchanged; working tree clean. No requirement bypass: S00-004 remains blocked,
  ADR 0003 records the honest blocker and forbids done on persistence+Ratchet alone.

Validation:
- make check: 72 tooling tests OK.
- Both probes reproduced, exit codes and output match evidence.
- Acceptance met: interruption repro row exists for next executor; original not
  declared done via bypass.

Task: S00-021
Reviewer agent: auto-security-5d2ae592b569
Role: security
Action: approve

Task: S00-021
Agent: auto-security-5d2ae592b569
Role: security
Action: review
Status: done

Task title: Устранить прерывание: Проверить browser OMEMO backend
 2026-10-15 15:40:32 +07:00
wt 30f7f222d2 S00-021: Record verified browser OMEMO backend blocker for S00-004 
Changes:
- Re-ran both committed probes unchanged (smoke exit 0 SMOKE_PASS; wasm-unsupported exit 2 UNSUPPORTED_BLOCKER) and recorded actual outputs in state/evidence/S00-021-auto-crypto-fcef9b6781bf.md.
- Verified on the reachable npm proxy that no maintained browser/WASM-capable OMEMO2 package exists: @signalapp/libsignal-client 0.105.0 is native-only (zero .wasm); @signalapp/libsignal, omemo-client, omemo-top, omemo-wasm, @converse/omemo are all E404.
- Wrote docs/decisions/0003-crypto-library.md (proposed) documenting the verified audited session/ratchet + persistence capability and the honest blocker for the browser/worker/WASM endpoint and OMEMO2 wire layer, with traceable primary sources.
- Wrote state/handoffs/S00-021.md with the reproducible next step for the S00-004 continuation.

Validation:
- smoke.mjs -> exit 0 (SMOKE_PASS, 631-byte record byte-for-byte reload).
- wasm-unsupported.mjs -> exit 2 (wasmFiles 0, native prebuilds only).
- npm view E404s confirmed against the same proxy that returns @signalapp/libsignal-client 0.105.0, so responses are genuine.
- make check: 72 tooling tests passed (OK).
- No source changes outside scope: experiments/** unchanged; only state/tasks.json (workflow metadata) plus the in-scope ADR. S00-004 stays blocked (honest blocker), not bypassed.

Task: S00-021
Agent: auto-crypto-fcef9b6781bf
Role: crypto
Action: claim
Status: review

Task title: Устранить прерывание: Проверить browser OMEMO backend
 2026-10-15 15:38:49 +07:00
wt 71675b1cc0 S00-004: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-004. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Agent timed out; process terminated before escalation

Task: S00-004
Agent: auto-crypto-8bf3dcf711b9
Role: crypto
Action: claim
Status: blocked

Task title: Проверить browser OMEMO backend
 2026-10-15 15:32:48 +07:00
wt 3784fa7b99 Claim S00-020 environment toolchain access task by interrupted runner 2026-10-15 15:02:32 +07:00
wt 0d3dc123b5 Record coordinator network release commit message artifact 2026-10-15 14:26:38 +07:00
wt 19474445f0 S00-020: Release environment remediation for verified network access 
Changes: Release S00-020 external wait through tasks.py after approved HTTPS probes. The local ignored runner configuration now uses automatic approval review with the workspace-write sandbox retained. S00-003 remains blocked until remediation implementation and independent review.
Validation: Official Node v24.21.0 SHASUMS256.txt and npm Stanza registry HEAD requests returned HTTPS 200 through the configured proxy in approved host execution. tasks.py release-external succeeded; runner --dry-run selects S00-020 with configuration_required=false. Pinned runtime execution, locked installation and integrity verification have not been performed.
 2026-10-15 14:26:06 +07:00
wt 452ec2fc08 S00-003: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-003 cannot reproduce accepted Node 24.21.0/npm 11.19.0 or install locked Stanza: host tools are 24.1.0/11.3.0, parent node_modules is absent, and normal official HTTPS retrieval fails with unresolved configured proxy.

Task: S00-003
Agent: auto-protocol-59f4d359b339
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку
 2026-10-15 11:14:13 +07:00
wt e39724f215 S00-019: Approve pinned browser SCRAM-SHA-512 after independent verification
Foundation checks / foundation (push) Successful in 46s
Details 
Changes: Accept the bounded SHA-512 experiment and ADR, record independent security findings and review handoff, and retain all browser-runtime, WSS, parent-integration and production limitations.
Validation: Fresh-cache npm ci and browser build pass; 87 focused tests and 10 additional signature, verifier-flag and malformed-first checks pass. Newly installed hashed Scramp oracle verifies all three fixed exchanges. Dependency checks confirm 49 locked entries, 25 installed pins/notices and 340 unchanged Stanza files with matching artifact hashes. Canonical RFC digests and installed oracle notices agree; make check passes 72 tooling tests. Actual browser, WSS/live interoperability and release readiness remain untested.

Task: S00-019
Agent: auto-security-f465a677e48f
Role: security
Action: review
Status: done

Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
 2026-10-15 02:52:28 +07:00
wt 07c9967d02 S00-019: Validate browser SCRAM-SHA-512 through public mechanism composition 
Changes: Add an isolated pinned mechanism wrapper using Stanza's public constructor and factory APIs, preserve the SCRAM-SHA-512 wire name and fail-closed final guard, and document the proposed ADR, browser bundle evidence, independent Scramp vectors, notices and limits. Leave parent selection, dependency experiments, specs and shared contracts unchanged.
Validation: Fresh-cache npm ci and Vite browser build pass; 87 focused tests pass, including RFC HMAC vectors, original defect reproduction, independent full SHA-512 exchanges and rejected invalid finals/order/reset paths. Hashed Scramp oracle fixture comparison passes. Dependency check verifies 49 locked entries, 25 installed pins/licenses and 340 unmodified Stanza files. make check passes 72 tooling tests. Native browsers, WSS/live server interoperability and production readiness are untested; independent security review remains pending.

Task: S00-019
Agent: auto-crypto-c68801170fa4
Role: crypto
Action: claim
Status: review

Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
 2026-10-15 02:48:39 +07:00
wt e69372c6db S00-003: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Stanza 12.22.1 browser HMAC sha-512 fails RFC 4231 Test Case 1: wrong 64-byte block selection. SCRAM-SHA-512 derives that hyphenated algorithm; private algorithm mutation/vendor patches are unsupported. Parent cannot attest browser strongest-mechanism compatibility from Node-only success.

Task: S00-003
Agent: auto-protocol-dcdf92cd067e
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку
 2026-10-15 02:38:42 +07:00
wt 74e1fd87d9 S00-018: Approve bounded XML ingress after independent framing checks 
Changes: Accept the isolated S00-018 ingress experiment and bounded ADR; record independent security findings and review handoff. Preserve all browser, live WSS, interoperability and production resource limitations.
Validation: Fresh-cache npm ci and all 55 integrated tests passed on Node 24.21.0/npm 11.19.0; six additional adversarial documents rejected before real JXT.parse with stale callback/fresh attempt checks. Verified ten dependency licenses/integrities, 340 unchanged Stanza files, upstream saxes license bytes and matching digests. Stock defects reproduced; make check passed 72 tooling tests. Initial getter-only tracing attempt failed and is recorded separately. Scope/whitespace inspected; no browser or live WSS test.

Task: S00-018
Agent: auto-security-64dc2d9fa232
Role: security
Action: review
Status: done

Task title: Validate bounded standalone XML ingress for the XMPP candidate
 2026-10-15 02:35:56 +07:00
wt e2b4dbdb76 S00-018: Bound standalone XML ingress before Stanza parsing and import 
Changes: Add an isolated public transport integration with finite byte, depth, element and attribute budgets; validate complete text XML with pinned saxes before real JXT parsing/import. Add adversarial and boundary fixtures, terminal cleanup tests, dependency notices and a proposed parser ADR.
Validation: Fresh-cache npm ci and npm test passed all 55 tests with Node 24.21.0/npm 11.19.0. Reproduced three stock parser failures, checked ten exact dependency licenses/integrities and 340 unchanged Stanza files; make check passed 72 tooling tests. Scope and whitespace inspected. Browser runtime, live WSS and interoperability were not tested.

Task: S00-018
Agent: auto-protocol-89fe6563092c
Role: protocol
Action: claim
Status: review

Task title: Validate bounded standalone XML ingress for the XMPP candidate
 2026-10-15 02:31:33 +07:00
wt f556fc0deb S00-003: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages.

Task: S00-003
Agent: auto-protocol-902594b44429
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку
 2026-10-15 02:24:00 +07:00
wt 1850dbc39f S00-017: Approve fail-closed SCRAM validation after independent integration checks 
Changes: Accept the bounded S00-017 fixture experiment and ADR; record independent security review and handoff with remaining browser, WSS, mechanism-policy and timing limits.
Validation: Fresh-cache npm ci and npm test passed on Node 24.21.0/npm 11.19.0 with 44 integrated tests. Verify exact installed pins, eight MIT notices, HTTPS/integrity and unchanged vendor files. make check passed 72 tooling tests; inspect executor scope/message and review metadata whitespace. No browser/server interoperability or constant-time assurance claimed.

Task: S00-017
Agent: auto-security-9ab954f6e021
Role: security
Action: review
Status: done

Task title: Establish fail-closed SCRAM server-final validation
 2026-10-15 02:20:57 +07:00
wt 493fbaebe7 S00-017: Validate SCRAM server-final before authenticated SASL completion 
Changes: Add an isolated Stanza 12.22.1 SASL feature replacement using existing SCRAM crypto, exact dependency lock and MIT notices, 44 integrated fixture checks, proposed ADR and review handoff. Leave production adapters and the original library experiment unchanged.
Validation: Fresh-cache npm ci and npm test passed on Node 24.21.0/npm 11.19.0; 44 tests cover RFC SHA-1/SHA-256 proofs and verified finals, stock defect reproduction, invalid/premature finals and async cleanup. make check passed 72 tooling tests. Pins/licenses/notices, unchanged vendor source and whitespace verified. Browser/WSS/server interoperability and constant-time assurance remain unverified; independent security review is pending.

Task: S00-017
Agent: auto-protocol-599343cd9e3f
Role: protocol
Action: claim
Status: review

Task title: Establish fail-closed SCRAM server-final validation
 2026-10-15 02:17:46 +07:00
wt c73d9cef45 S00-003: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.

Task: S00-003
Agent: auto-protocol-826aa6bc12ef
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку
 2026-10-15 02:09:23 +07:00
wt f12a71df49 S00-002: Approve the pinned UI stack after independent clean build checks 
Changes: Accept ADR 0001 for the bounded React/TypeScript/Vite and Node/npm choice; record independent security findings and update S00-002 handoff. Preserve browser interaction and release/interoperability limits.
Validation: Fresh-cache npm ci and strict npm run build passed on Node 24.21.0/npm 11.19.0; lock and artifact SHA256 matched executor evidence. Verified exact pins, 67 locked license/integrity entries and installed runtime license notices. HTTP preview matched built HTML/JS; make check passed 72 tooling tests; scoped diff and whitespace checked. No DOM interaction, vulnerability/provenance or product readiness acceptance is claimed.

Task: S00-002
Agent: auto-security-bd73f4f80779
Role: security
Action: review
Status: done

Task title: Выбрать framework и build runtime
 2026-10-15 02:06:24 +07:00
wt e4defcd371 S00-012: Approve complete runner prompt delivery after lifecycle checks 
Changes: Accept the preserved S00-012 stdin correction and descendant regressions; record independent QA evidence. No source changes.
Validation: Reproduced the legacy 140000-byte delayed-reader timeout and reaped the child. All 28 automation tests and 72 make check tests passed, including complete UTF-8/EOF, submit/timeout descendant cleanup, fresh sessions, scope and snapshots. Reviewed executor message and cumulative patches; git diff --check passed. No Windows, live model or application readiness claim.

Task: S00-012
Agent: auto-qa-04bdb7324ecc
Role: qa
Action: review
Status: done

Task title: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 02:03:50 +07:00
wt 6ec97125ae S00-015: Approve interruption recovery after independent readiness checks 
Changes: Accept only S00-015 observed provider recovery and readiness for a fresh S00-012 review; add independent QA evidence. No source or harness changes; parent implementation acceptance remains separate.
Validation: Four focused automation tests passed in 4.585s; tasks.py validate passed at revision 33 for 281 tasks. Verified original capacity failure, committed recovered executor/QA transitions, five distinct shared-model sessions, scoped executor patch/message and unaccepted parents. Whitespace checks passed. Future provider capacity is not guaranteed.

Task: S00-015
Agent: auto-qa-1d6e76a1728f
Role: qa
Action: review
Status: done

Task title: Устранить прерывание: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 02:01:28 +07:00
wt 18442e9522 S00-015: Verify recovered execution path for interrupted review 
Changes: Record S00-015 readiness after independently reviewed S00-016 provider recovery; replace blocked handoff with concrete QA next steps. No runner or test source changes; parent acceptance remains separate.
Validation: Four focused automation tests passed in 4.560s; tasks.py validate passed for 281 tasks at revision 32. Read-only assertions verified the original capacity failure, committed successful resolver/QA transitions, fresh shared-model sessions and unaccepted parents. Git diff whitespace and scope checks passed. Future provider capacity and parent implementation acceptance are not guaranteed.

Task: S00-015
Agent: auto-ci-cd-84e209103f24
Role: ci-cd
Action: claim
Status: review

Task title: Устранить прерывание: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 02:00:06 +07:00
wt 944f399c95 S00-016: Approve recovered reviewer availability after fresh QA tool checks 
Changes: Accept only S00-016 readiness and add independent QA evidence after verifying coordinator release, executor patch and fresh reviewer tool use.
Validation: Read-only readiness assertions passed; tasks.py validate passed for 281 tasks at revision 30; git diff --check passed. Verified distinct same-model sessions and preserved parent acceptance boundaries. Future provider capacity and parent implementation reviews remain separate.

Task: S00-016
Agent: auto-qa-309d45d4fd4b
Role: qa
Action: review
Status: done

Task title: Restore reviewer model availability after provider capacity failure
 2026-10-15 01:58:04 +07:00
wt 83404f9c8a S00-016: Record recovered fresh reviewer execution path 
Changes: Document coordinator-authorized external readiness and successful post-release tool use through the shared reviewer/executor harness; add S00-016 evidence and handoff. No source or harness configuration changes.
Validation: Read-only readiness assertions passed with exit 0; tasks.py validate passed for 281 tasks at revision 29; git diff --check passed. Parent tasks remain blocked and unaccepted. Future provider capacity and S00-012 acceptance require separate fresh review.

Task: S00-016
Agent: auto-ci-cd-351a0cbbabef
Role: ci-cd
Action: claim
Status: review

Task title: Restore reviewer model availability after provider capacity failure
 2026-10-15 01:56:00 +07:00
wt b282b0b367 S00-016: Release recovered model capacity for fresh verification 
Changes: Release the transient provider wait after a later fresh session successfully used the same model and CLI. Preserve parent blocking and independent review.
Validation: Compared failed capacity log with later successful tool execution in state/runs/auto-ci-cd-5475930af078/output.log; no role command overrides are configured. Future availability and parent acceptance remain unverified.

Task: S00-016
Agent: coordinator-capacity-b12fb7abdd2d
Role: orchestrator
Action: release-external
Status: todo

Task title: Restore reviewer model availability after provider capacity failure
 2026-10-15 01:54:04 +07:00
wt c35046a675 S00-015: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-015. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-012 fresh reviewer exited before review because its execution provider returned HTTP 503 and Selected model is at capacity. Provider availability or operator-authorized local harness model configuration is external to S00-015 source scope.

Task: S00-015
Agent: auto-ci-cd-5475930af078
Role: ci-cd
Action: claim
Status: blocked

Task title: Устранить прерывание: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 01:52:29 +07:00
wt d80f20e650 S00-012: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-012. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Agent exited with code 1

Task: S00-012
Agent: auto-qa-98b05bd56c25
Role: qa
Action: review
Status: blocked

Task title: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 01:51:14 +07:00
wt adb152fdd0 S00-012: Verify runner prompt delivery and lifecycle regressions 
Changes: Record verification evidence and replace the blocked S00-012 handoff with independent QA review instructions. Retain the existing stdin implementation and regressions from prior checkpoints; no new source changes.
Validation: Reproduced the legacy partial stdin timeout on Python 3.9.6 and reaped the child. All 28 automation tests passed, including exact 140024-byte UTF-8/EOF and timeout/submit descendant cleanup. make check passed all 72 tests; git diff --check passed. No live model, application readiness or Windows cleanup check is claimed.

Task: S00-012
Agent: auto-ci-cd-f101e40d9902
Role: ci-cd
Action: claim
Status: review

Task title: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 01:50:53 +07:00
wt bdfde480d4 S00-014: Approve runner cleanup idempotence after independent lifecycle checks 
Changes: Accept the bounded S00-014 cleanup correction and record independent QA evidence and handoff; no reviewer source changes.
Validation: Four focused signal/descendant tests and make check passed (72 tests); prior function independently fails the injected repeated-signal regression in memory. Inspected executor patch/message and scope; git diff --check passed. Natural EPERM, Windows and parent-task acceptance are not claimed.

Task: S00-014
Agent: auto-qa-0c2d58e2382e
Role: qa
Action: review
Status: done

Task title: Fix repeated runner cleanup after a submitted parent is reaped
 2026-10-15 01:48:36 +07:00
wt 7a737eeb49 S00-014: Make successful runner process-tree cleanup idempotent 
Changes: Record completed termination on the Popen instance after all cleanup steps succeed; avoid repeated signals to the reaped group. Add deterministic repeated-EPERM and failed-descendant-kill retry regressions without suppressing permission errors.
Validation: Four focused cleanup tests passed; make check passed 72 tests and plan/snapshot validation. git diff --check passed. Natural prior EPERM did not recur; injected EPERM reproduced the pre-fix failure. No application or parent-task acceptance is claimed.

Task: S00-014
Agent: auto-ci-cd-14343249da62
Role: ci-cd
Action: claim
Status: review

Task title: Fix repeated runner cleanup after a submitted parent is reaped
 2026-10-15 01:47:20 +07:00
wt 49c054aaf9 S00-012: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-012. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Submit-transition descendant regression fails: repeated stop_process_tree after parent reap raises EPERM at os.killpg; launch OSError handling then attempts invalid escalation from review state.

Task: S00-012
Agent: auto-ci-cd-28868645424b
Role: ci-cd
Action: claim
Status: blocked

Task title: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 01:45:17 +07:00
wt b6691d9c8b S00-013: Approve bounded runner prompts after independent context checks 
Changes: Accept S00-013 with an independent QA report and review handoff; no source edits. Confirm exact packets and mandatory supplementary reads remain available within the unchanged prompt budget.
Validation: make check passed all 68 tests, including UTF-8 stdin/EOF, timeout and terminal-transition regressions. Independently checked all 556 prompts: maximum 77693 characters; S21-006 retains 26 exact UI sections. Root escape and oversized-budget rejection checks passed; git diff --check passed. No application or parent-task acceptance claimed.

Task: S00-013
Agent: auto-qa-869b22acd478
Role: qa
Action: review
Status: done

Task title: Bound oversized S21-006 runner context without truncating requirements
 2026-10-15 01:42:03 +07:00
wt b1014f36c9 S00-013: Bound runner prompts with explicit required task input reads 
Changes: Keep startup instructions and exact context packets inline while listing supplementary task inputs as mandatory project reads. Preserve root containment, missing-artifact guidance and budget failures. Add S21-006 exact UI context regression and cover claim/review budgets for all tasks; leave stdin delivery unchanged.
Validation: make check passed all 68 tests, including delayed UTF-8 stdin/EOF, timeout and terminal-transition checks. All 556 current prompts fit 80000 characters; largest 77693. git diff --check passed. Foundation checks do not establish application readiness.

Task: S00-013
Agent: auto-ci-cd-5f68f03dd33b
Role: ci-cd
Action: claim
Status: review

Task title: Bound oversized S21-006 runner context without truncating requirements
 2026-10-15 01:40:32 +07:00
wt c28412ae8f S00-012: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-012. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Required automation suite fails in existing all-prompts budget test: S21-006 exceeds even a diagnostic 90000-character prompt limit. This blocks verification of the stdin remediation; production limit remains 80000.

Task: S00-012
Agent: manual-ci-cd-stdin-20261015b
Role: ci-cd
Action: escalate
Status: blocked

Task title: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 01:37:36 +07:00
wt 59b9ff62fe S00-002: Propose a pinned React stack with a reproducible rendering spike 
Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review.
Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed.

Task: S00-002
Agent: auto-orchestrator-68a05c587e33
Role: orchestrator
Action: claim
Status: review

Task title: Выбрать framework и build runtime
 2026-10-15 01:18:53 +07:00
wt 06f353b214 S00-011: Approve verified npm access after independent TLS and integrity checks 
Changes: Accept the bounded S00-011 registry remediation; record independent security evidence and review handoff. Source probe and stack remain unchanged by review.
Validation: Original npm view and fresh-cache verify.py returned exit 0; 26394-byte react@19.3.1 matched registry SHA-512. Disabled TLS was refused with exit 1. make check passed 66 tests; executor patch/message, scope, ignore rules and whitespace checked. App build, provenance and future harness connectivity remain unverified.

Task: S00-011
Agent: auto-security-1e9200de1765
Role: security
Action: review
Status: done

Task title: Restore verified npm registry access for the stack spike
 2026-10-15 01:11:33 +07:00
wt e4672fba91 S00-011: Verify public npm access and exact-version tarball integrity 
Changes: Add a scoped fresh-cache registry probe, safe reproduction instructions and artifact ignore rule; record actual TLS-enabled metadata/download results and review handoff without selecting a stack or changing the harness.
Validation: Original npm view command and verify.py returned exit 0; react@19.3.1 tarball (26394 bytes) matched registry SHA-512. make check passed validation and 66 tooling tests. git diff --check passed. App install/build and different-harness connectivity remain unverified.

Task: S00-011
Agent: auto-ci-cd-d105e8027730
Role: ci-cd
Action: claim
Status: review

Task title: Restore verified npm registry access for the stack spike
 2026-10-15 01:10:10 +07:00
wt b8afc70e5f S00-011: Release the npm access remediation for independent verification 
Changes: Record user-authorized network configuration and release S00-011 external wait. Keep S00-002 blocked pending resolver implementation and independent security review.
Validation: Public npm metadata returned React 19.3.1 and MIT over TLS in a Codex sandbox allowing project and temporary writes plus network access. Actual runner connectivity and tarball integrity remain S00-011 acceptance checks.

Task: S00-011
Agent: coordinator-network-0bc0fcf09c86
Role: orchestrator
Action: release-external
Status: todo

Task title: Restore verified npm registry access for the stack spike
 2026-10-15 01:07:56 +07:00
wt f1d707264e S00-002: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-002. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-002 cannot verify versions/licenses or run its required clean install/build: local npm lookup fails with getaddrinfo ENOTFOUND registry.npmjs.org. Restricted network and never-approval execution policy cannot be changed by this agent. External owner must supply registry-capable execution while preserving TLS validation and project-only writes.

Task: S00-002
Agent: auto-orchestrator-3a4f07103316
Role: orchestrator
Action: claim
Status: blocked

Task title: Выбрать framework и build runtime
 2026-10-15 01:05:01 +07:00
wt d91103ea1c S00-001: Approve the Web scope passport after independent security review 
Changes: Accept ADR 0000 and record the independent reviewer, acceptance findings and handoff. Confirm native exclusion reasons, retained Web obligations, conditional push lifecycle and provider secret/metadata boundaries; transition S00-001 through the review CLI.
Validation: Reviewed executor commit d5ed7eaaed and its message against scope and evidence. python3 experiments/0000-scope/check.py passed ten IDs, seven states and four negative mutations. make check passed validation and all 66 tooling tests. No live browser/provider integration or crypto implementation was tested or accepted.

Task: S00-001
Agent: auto-security-bff4cfd4d38e
Role: security
Action: review
Status: done

Task title: Утвердить Web-профиль
 2026-10-15 01:03:56 +07:00
wt d5ed7eaaed S00-001: Define the Web scope passport and native exclusion boundaries 
Changes: Add proposed scope ADR with reasons for all ten excluded IDs, retained Web obligations, lifecycle limits, external provider roles and deferred decisions. Add a document coverage/lifecycle checker with four negative mutations and executor evidence/handoff for security review.
Validation: python3 experiments/0000-scope/check.py passed for ten excluded IDs and seven lifecycle scenarios; all four negative mutations were rejected. make check passed validation and 66 tooling tests. Whitespace and allowed source paths checked. No live browser or provider integration was tested; ADR awaits independent review.

Task: S00-001
Agent: auto-orchestrator-48aab142ecde
Role: orchestrator
Action: claim
Status: review

Task title: Утвердить Web-профиль
 2026-10-15 01:01:57 +07:00
339 changed files with 29544 additions and 60 deletions
Expand all files Collapse all files

No files matched your search

docs/AUTOMATION.md
+43
View File
@@ -18,6 +18,19 @@ Harness обязан запускать новую conversation/session для
Автоматические commits включены по умолчанию. Перед первым реальным запуском foundation должна быть сохранена начальным commit в Git checkout с активной веткой, настроенной identity и чистым index/working tree. Каждый agent transition заканчивается отдельным осмысленным commit перед следующим процессом. Executor и reviewer заранее пишут сообщения; Git выполняет runner. Правила, примеры и восстановление — `docs/GIT_WORKFLOW.md`.
## Codex 0.159.0: argv (S00-028)
Coordinator выбрал из project root:
```sh
codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -
```
`--approve-for-me` включает workspace-write/auto-review и конфликтует с `--sandbox`.
`-` читает fresh prompt из stdin; resume/fork не использовать. Проверки без модели:
argv + `--help` и sandbox probe ниже, timeout20, exit0; project write passed,
outside denied EROFS30. Полное evidence: `state/evidence/S00-028-auto-ci-cd-e3a716a94424.md`.
## Запуск
```sh
@@ -65,6 +78,36 @@ Release только делает resolver готовым к проверяем
Журналы: `state/runs/<agent-id>/run.json`, `prompt.md`, `output.log`; хранить без secrets. Каждый report содержит task/role, exit/status, timeout/violation и результат, не включает private command environment.
## Вложенный sandbox: проверенный host context (S00-031)
На этом Linux host с Codex 0.159.0 `/tmp/codex-daemon-1000` имеет uid 1000,
mode 0700; внутри workspace sandbox тот же путь виден с mode 000.
Ошибка вложенного запуска `app-server socket directory must be a user-owned directory
with mode 0700` сама по себе не доказывает неверные host permissions. Для S00-030
использовать проверенный ниже host context; исправление mode на host не требуется.
Проверенный способ: одобренный внешний host execution
(`sandbox_permissions: require_escalated`) запускает **внутренний workspace-write sandbox**
из корня проекта, с timeout 20 секунд:
```sh
codex -c 'sandbox_mode="workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-filesystem-sandbox-probe.py
```
До запуска проверить host `stat`: directory, owner=current uid, mode 0700.
Script содержит только synthetic project write/read/remove и exclusive-create вне
проекта с обязательным отказом EROFS/EACCES/EPERM. Его полный текст и воспроизводимая
команда сохранены в `state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md`;
временный `/tmp` script нужно сначала прочитать или восстановить из evidence.
Executor получил exit 0: project probe passed, outside write denied EROFS 30,
outside file не создан. Ни модель, ни storage task не запускались.
Не менять socket permissions/mask, writable roots или environment location.
Если approved host execution недоступен, выполнить blocker protocol.
Результат относится к этому host/version и одной filesystem boundary; QA повторяет
проверку независимо. Это не app readiness. Общие понятия:
[официальная документация OpenAI](https://developers.openai.com/codex/security).
## Гарантии инструмента
Dependency/role guards, retired reporter, recovery journal definitions+state, fresh subprocess IDs, bounded prompts, separate reviewer, automatic unblocking only after done и stop на внешнем blocker. Истинность evidence/качество модели/OS sandbox обеспечиваются реальным harness и review, а не названием роли.
docs/decisions/0000-scope.md
+94
View File
@@ -0,0 +1,94 @@
# ADR 0000: Паспорт scope Luma Web
- Status: accepted — независимое security review S00-001; evidence: `state/evidence/S00-001-review.md`.
- Task: S00-001
- Date: 2026-10-15
- Decision owner: auto-orchestrator-48aab142ecde, orchestrator
- Reviewer: auto-security-bff4cfd4d38e, security, 2026-10-15
## Вход, результат и критерии
Вход: неизменяемые `specs/tz_clear.md` (§3, §20, §21, §27; GEN-005, GEN-006, WEB-002), `specs/uikit_clear.md`, applicability из `planning/requirements.json` и Web-профиль основы. Результат: один паспорт Web-scope с причинами исключений и перечнем внешних сервисов. Проверка: исключённые ID полностью совпадают с реестром, у каждого есть содержательная причина, lifecycle не обещает closed-tab XMPP или постоянное медиа через push. Прямых зависимостей и ранее принятых ADR нет; schemas из S01 пока не приняты.
## Решение и объём
Реализуется браузерное приложение для телефона и компьютера: compact navigation и wide sidebar/detail, keyboard/IME, accessibility, safe areas и адаптивный UI Kit. Desktop native package, Android native package, tray, foreground services, APNs/Android SDK и companion/Watch не входят в эту основу. Браузер на Android относится к Web и сохраняет Web-ограничения.
Из 221 ID реестр относит 211 к Web и 10 к out_of_scope. Все 211 остаются обязательствами плана, а не отчётом о готовности. Общие cross-platform требования применяются в Web-контексте; native-примеры UI Kit не исключают общую семантику, accessibility, tokens или touch-сценарии.
Базовый Web-объём сохраняет несколько конфигураций аккаунтов и один активный XMPP-контекст; login/logout/switch, контакты/presence, личные чаты/self-chat, MUC, текст/replies/reactions/correction/retraction/local deletion, selection/forwarding, OMEMO legacy и OMEMO 2 с доверием устройствам, файлы/фото/видео/музыку/voice/video notes/геоточки, локальную историю/MAM/Carbons/receipts/read state, личные аудио-/видеозвонки и их историю, аватары, уведомления/app lock, доступную защищённую биометрию и диагностику сервера.
За базовым объёмом остаются регистрация XMPP-аккаунтов, восстановление серверного пароля, групповые звонки, MIX/каналы, боты, платежи, истории, live location, полнотекстовый поиск всей истории и обязательная одновременная online-сессия всех аккаунтов (§3.2). Развёртывание XMPP-провайдера не является функцией клиента; необходимый push/relay — отдельный поставляемый либо явно подключённый компонент решения.
### Исключённые ID и сохранённые Web-обязательства
| Excluded ID | Причина исключения из этой основы | Web-замена / сохранённая часть |
| --- | --- | --- |
| ACC-003 | Настройка native TCP host/port, STARTTLS/direct TLS и native discovery не является браузерным транспортом. | ACC-004/005: WSS endpoint с видимым доменом и явным выбором неизвестного сервера. |
| NET-002 | Native DNS discovery и ручные параметры транспорта исключены. ID реестра исключён целиком, но его Web-оговорка остаётся обязательной. | WSS endpoint утверждается для выбранного сервера; ACC-004 и NET-001 сохраняются. |
| DESK-001 | Tray, native автозапуск и различие native hide/window quit относятся к устанавливаемому Desktop. | WEB-001/002: различать активную, скрытую и закрытую страницу. |
| DESK-002 | Живой native фоновый процесс и его incoming calls не поставляются браузерной основой. | WEB-002/003: уведомление и открытие страницы с проверкой актуальности вызова. |
| DESK-003 | Native sleep/wake и tray call icon не являются Web-интеграцией. | Web reconnect и push logout/revoke остаются по NET, PUSH и WEB; tray отсутствует. |
| AND-001 | Native Android push/call delivery и выбор системного provider требуют Android-приложения. | Browser Web Push с permission, gateway и проверенной регистрацией. |
| AND-002 | Native lifecycle/permissions и системный фоновый режим Android находятся вне Web-target. | WEB-001/002: скрытая страница может быть приостановлена; фонового socket SLA нет. |
| AND-003 | Android foreground/call service и управление ongoing call из native notification не поставляются. | Звонок в живой Web-сессии при доступных media permissions, без гарантии closed-tab call. |
| AND-004 | Force stop и native battery lifecycle проверяются у Android-приложения, не у этой основы. | Denied permissions, offline, browser termination и sleep требуют честной Web-деградации. |
| STORE-002 | Native secure vault и device key wrapping не предоставляются браузерным storage. | STORE-003/004: password в памяти, повторный вход, отдельное решение crypto unlock и честные quota/eviction. |
## Lifecycle и честные capability states
Закрытая страница не считается постоянно подключённой XMPP-сессией. Service worker notification не гарантирует непрерывный microphone, медиазвонок или автоматический показ полноэкранного incoming UI (WEB-002). Установленная PWA сохраняет эти ограничения. Скрытая страница может быть заморожена или выгружена; состояние connection/call после возвращения сверяется с реальностью (WEB-001). Push может вызвать обработку события/уведомление, но не заменяет постоянно живой socket. После перехода из уведомления выполняются unlock/login при необходимости, синхронизация и проверка срока/состояния вызова (WEB-003).
Таблица ниже — нормативные пределы обещаний, не результаты browser/runtime тестов. `conditional` означает только возможность после проверки prerequisites; `not-guaranteed` запрещает гарантию непрерывности; `none` означает отсутствие соответствующего пути.
| State | XMPP session | Push notification | Continuous media | Automatic fullscreen incoming |
| --- | --- | --- | --- | --- |
| foreground | conditional | conditional | conditional | not-guaranteed |
| hidden | not-guaranteed | conditional | not-guaranteed | not-guaranteed |
| closed-tab | none | conditional | none | none |
| browser-terminated | none | not-guaranteed | none | none |
| permission-denied | conditional | none | none | none |
| offline | none | not-guaranteed | none | none |
| logged-out | none | none | none | none |
Строка permission-denied предполагает отказ и notification, и media permissions; XMPP не требует этих разрешений. Logged-out требует disable/revoke регистрации, поздние события не восстанавливают аккаунт. Offline push может быть отложен/истечь, browser termination зависит от ОС/provider; доставки не обещаем. Реальные проверки foreground/hidden/closed-tab/denied/sleep/rotation/logout/stale notification относятся к будущей приёмке интеграции (§20.4).
GEN-005: различать advertised capability, configured integration и verified usable state. Если сервис/permission/registration недоступен, отключать только зависимую функцию с причиной, сохраняя остальные сценарии. Например, отсутствие TURN ограничивает достижимость звонка, upload — вложения, push — фоновые уведомления; наличие server feature само по себе не доказывает работу интеграции.
GEN-006: не обещать гарантированные delivery/read, отзыв чужих копий, работу закрытого процесса или скрытие metadata. TLS, OMEMO payload, file encryption, DTLS-SRTP, local protection и UI lock имеют разные границы. Gateway не получает decrypted messages или file keys; plaintext fallback, decrypting proxy и обход TLS/CORS недопустимы.
## Внешние providers и границы данных
Ни vendor, ни рабочий URL, ни SLA здесь не выбраны. Это обязательный inventory для topology S00-008 и последующей интеграции; наличие строки не означает подключённый сервис.
| Сервис / provider | Требуемая роль и публичная конфигурация | Данные / секреты и деградация |
| --- | --- | --- |
| HTTPS hosting / origin | Поставка Web assets и service worker через доверенный origin. | Видит сетевые metadata; не получает пароль/ключи через analytics. Hosting и release channels ещё не утверждены. |
| XMPP provider + WSS endpoint | Auth, stanza routing, capability discovery, MUC/MAM/Carbons и поддержанные XEP. Домен endpoint виден пользователю. | Пароль используется только выбранным transport auth; OMEMO plaintext серверу недоступен. Сервер видит routing metadata. При отсутствии WSS соединение недоступно. |
| HTTPS upload provider | Upload slot, разрешённые origin/CORS, size/expiry policy. | Encrypted attachment bytes; file key передаётся в защищённом сообщении. Ошибка/quota отключает upload с объяснением. |
| STUN/TURN provider | NAT traversal/relay для WebRTC; публичные server URLs в runtime config. | IP/время/объём relay видимы provider; TURN secrets отдельно, без committed примеров. Недоступность не выдаётся за успешный звонок. |
| XMPP push service / gateway | Связать XMPP enable/disable с браузерной subscription, update/expiry/logout/revoke. | Минимальные registration metadata; без body/file key/password. Gateway private credentials и VAPID private key вне repo/logs. |
| Browser-selected Web Push service | Доставка к user agent, permission и subscription endpoint; это отдельная роль от gateway. | Timing/size metadata видимы provider; subscription — чувствительные данные, не public config. Без permission/registration нет «Push работает». |
| Maps / tiles / geocoding provider | Явно подключённые карты для геоточек, утверждённые endpoints и политика доступа. | Coordinates/IP могут раскрыться provider, требуется минимизация/объяснение; live location исключён. При отсутствии сервиса не выдавать карту за загруженную. |
Публичные URLs и несекретные capabilities идут в runtime config. Password только в памяти; постоянный login/crypto unlock остаётся отдельным ADR S00-007. Browser quota/очистка не эквивалентны hardware-backed vault. Secrets, реальные JID, subscriptions и переписки не входят в fixtures/evidence/environment examples.
## Рассмотренные варианты и первичные источники
Проверено 2026-10-15; sources подтверждают границы механизма, не совместимость конкретных браузеров.
- Выбранный WSS путь: [RFC 7395, §3 и §6](https://www.rfc-editor.org/rfc/rfc7395.html) определяет XMPP WebSocket binding и защиту endpoint через TLS. Native TCP не переносится в Web controls. Браузер проверяет TLS; обход сертификатов не разрешён.
- Альтернатива HTTPS BOSH: [XEP-0206](https://xmpp.org/extensions/xep-0206.html) описывает XMPP поверх BOSH. В этом профиле не требуется и не включается; возможное включение требует отдельного решения по ACC-004.
- Event-driven push: [W3C Push API, introduction и §4](https://www.w3.org/TR/2026/WD-push-api-20261005/) описывает push service, delivery к worker и видимые provider metadata. Working Draft не является обещанием поддержки всех browser features.
- Предел worker lifetime: [W3C Service Workers, §2.1.1](https://www.w3.org/TR/2026/CRD-service-workers-20260917/#service-worker-lifetime) связывает lifetime с обработкой событий и допускает прекращение worker. Вывод для профиля: worker нельзя считать непрерывной XMPP/media-сессией.
- Раздельные push роли: [XEP-0357, §2 и §5](https://xmpp.org/extensions/xep-0357.html) описывает XMPP push service и внешнюю delivery service с отдельным enable. Одного advertised XMPP feature недостаточно.
Отклонены обещание native transport в браузере, «вечная» PWA socket/media-сессия и автоматически подключённые providers. Повод пересмотра — новая утверждённая версия требований или проверяемая platform integration через отдельный ADR/plan change; исходные snapshots сохраняются.
## Проверка, ограничения и следующие решения
Focused experiment: `python3 experiments/0000-scope/check.py` проверяет полное покрытие excluded IDs по canonical registry/specs, содержательные причины и нормативные lifecycle limits; отрицательные мутации подтверждают обнаружение пропуска/ложной closed-tab гарантии. Это проверка паспорта, без сетевой интеграции, browser spike или runtime implementation.
Новых dependencies и library licenses нет. Выбор framework/runtime и проверка лицензий — S00-002; XMPP и crypto libraries/interoperability — S00-003/004; IndexedDB — S00-005; browser/reference matrix и PWA mode — S00-006; unlock — S00-007; конкретная topology/providers — S00-008; совместный gate — S00-009/010. До их принятия отсутствуют browser versions, file/cache/pending limits, performance reference devices, server/client wire-format evidence и release hosting/update policy. Их отсутствие явно ограничивает текущий паспорт и запрещает обещать готовность релиза; для bounded S00-001 эти решения не выбираются.
Shared contracts из реестра остаются задачами S01. Этот паспорт не задаёт новые поля интерфейсов и не меняет план/applicability. Security reviewer проверяет причины, lifecycle, provider data boundaries, scope и evidence перед принятиями coordinator workflow.
docs/decisions/0001-stack.md
+81
View File
@@ -0,0 +1,81 @@
# ADR 0001: Framework and build runtime for Luma Web
- Status: accepted — independent security review of S00-002; evidence: `state/evidence/S00-002-review.md`.
- Task / requirement: S00-002 / NFR-007.
- Date: 2026-10-15.
- Decision owner: auto-orchestrator-68a05c587e33 (orchestrator).
- Reviewer: auto-security-bd73f4f80779 (security), 2026-10-15.
## Context and required capabilities
Input: immutable NFR-007, accepted ADR 0000, architecture/contract registry and reviewed S00-011 registry remediation. Output: this bounded stack decision and one isolated rendering spike in `experiments/0001-stack`. Acceptance is exact versions, lockfile, actual clean install/build and documented license/runtime/browser limits. This selects browser UI and its build tooling, without selecting XMPP/OMEMO/media libraries, backend providers, routing/state libraries or shared schemas.
Luma needs a client-rendered UI, typed application/adapter boundaries, static deployment and eventual browser workers. An SSR application server is unnecessary for this experiment: secrets and OMEMO remain in their separately defined client boundaries. A UI library does not validate those boundaries or guarantee encrypted interoperability. S01 still owns exact contracts; S00-003…010 retain their existing decisions.
## Candidates and primary sources
Primary documentation and public registry metadata read on 2026-10-15. Versions below were retrieved with `npm view`; only the selected stack was installed/built. No performance comparison is claimed.
| Criterion | React + TypeScript + Vite | Vue + TypeScript + Vite |
| --- | --- | --- |
| Candidate UI | React / React DOM 19.3.1, MIT | Vue 3.5.44, MIT |
| Typed UI | TSX, `react-jsx`, native TypeScript JSX checking; React types 19.3.0 | Composition API / SFC; official Vite plugin 6.0.10 and vue-tsc 3.3.13, both MIT |
| Build / language | Vite 8.3.4, TypeScript 7.0.2 | Same Vite/TypeScript candidates; plugin peer range includes Vite 8 and Vue 3.5 |
| Application model | Explicit state updates and render functions; suitable for future typed commands/view models | Reactive refs and templates; also compatible with the architecture |
| Tooling tradeoff | One TypeScript checker for `.ts` and `.tsx`; plain Vite can build this spike without a React plugin | SFC compilation and template checking add separate tooling; Vue can also use render functions |
| Static hosting | Client bundle, no runtime Node server required | Client bundle, no runtime Node server required |
| Browser limits | Modern ESM browser target inherited from Vite; API support needs feature checks | Vue 3 targets modern browsers and excludes IE11; Vite limits also apply |
| Actual experiment | Clean install and strict typecheck/production build completed | Documentation/metadata comparison only; not installed or benchmarked |
Sources:
- [React's from-scratch setup](https://react.dev/learn/build-a-react-app-from-scratch) documents Vite as a build option and the additional application responsibilities of that approach. [createRoot](https://react.dev/reference/react-dom/client/createRoot) defines the DOM mounting API used here.
- [Vue quick start](https://vuejs.org/guide/quick-start.html) documents a Vite-based SPA, SFCs and optional TypeScript. [Vue FAQ](https://vuejs.org/about/faq.html) covers MIT licensing and modern-browser constraints. [Vue TypeScript tooling](https://vuejs.org/guide/typescript/overview.html) describes vue-tsc/template checking.
- [TypeScript JSX](https://www.typescriptlang.org/docs/handbook/jsx.html) defines TSX and automatic JSX runtime/type checking.
- [Vite getting started](https://vite.dev/guide/) documents framework templates and Node requirements. [Production build](https://vite.dev/guide/build.html) documents static output, browser targets and absence of automatic API polyfills.
- [Node release lifecycle](https://nodejs.org/en/about/previous-releases) identifies Node 24 as LTS and Node 26 as Current on this date. [Official Node 24.21.0 distribution](https://nodejs.org/dist/v24.21.0/) supplies runtime and checksums.
- [npm ci](https://docs.npmjs.com/cli/v11/commands/npm-ci/) defines lockfile-based clean installation, mismatch failure and removal of existing node_modules.
- Exact primary registry records: [React](https://registry.npmjs.org/react/19.3.1), [React DOM](https://registry.npmjs.org/react-dom/19.3.1), [Vue](https://registry.npmjs.org/vue/3.5.44), [Vite](https://registry.npmjs.org/vite/8.3.4), [TypeScript](https://registry.npmjs.org/typescript/7.0.2), [npm](https://registry.npmjs.org/npm/11.19.0), [Vue plugin](https://registry.npmjs.org/@vitejs%2fplugin-vue/6.0.10), [vue-tsc](https://registry.npmjs.org/vue-tsc/3.3.13). React type packages are pinned and their licenses recorded in the inventory.
## Decision
Select React 19.3.1 / React DOM 19.3.1, TypeScript 7.0.2 and Vite 8.3.4, built with Node 24.21.0 LTS and its bundled npm 11.19.0. Use `.ts` for non-UI typed modules and `.tsx` for React UI; ESM imports and strict TypeScript checking. This is a project engineering choice, not a requirement imposed by the product specification. TSX keeps ordinary typed module imports and UI checks on the same compiler path, fitting the existing domain/application/ports boundaries. Vue is viable; no claim of React performance/security superiority is made.
The six direct dependencies have exact versions, with no range operators. `package-lock.json` version 3 locks transitive/optional platform packages with registry URLs and integrity. `.nvmrc`, exact engines, packageManager and the build runtime guard establish tool pins; `.npmrc` requires strict engines and verified HTTPS. Node and npm are build tools; they are not a browser runtime or a selected push gateway stack. Lockfile updates require explicit review, not automatic floating upgrades.
No React Compiler, Babel, React refresh plugin, router, state store, service worker or polyfill is introduced. Vite's built-in TSX transform is sufficient for this spike, as verified by the build. Production development tooling and CI are subsequent scoped tasks; adding plugins requires license/API/browser checks. TypeScript 7 installs a platform compiler package; unsupported build-host platforms need a separate verified runtime/tooling decision.
## Focused experiment and actual result
The spike mounts a heading, an explicit local-experiment notice, an Increment button and a live counter through createRoot/useState. It contains no account fixture or transport and has no external runtime asset/CDN requests. See its README for exact reproduction and manual browser procedure.
Verified on macOS ARM64 using the official Node tarball downloaded over normal HTTPS and matched against SHASUMS256.txt. The tarball SHA-256 is `bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057`. This is checksum verification against the same vendor HTTPS origin, not detached-signature verification. Node was unpacked only under `/private/tmp`; system tools/configuration were unchanged.
- `npm install --ignore-scripts --no-audit --no-fund` generated the lockfile (24 installed packages).
- `npm ci --ignore-scripts --no-audit --no-fund` with a new empty cache performed the actual clean install; exit 0, 24 packages. Existing node_modules was replaced by npm ci. Optional native packages supplied prebuilt binaries; lifecycle scripts stayed disabled.
- `npm run build` with the exact pinned tools performed strict `tsc --noEmit` and Vite production build; exit 0 before and after clean install. Output: 14 transformed modules; index HTML 0.29 kB, JavaScript 219.87 kB (68.75 kB gzip). These sizes describe this spike, not a product budget.
- The two build outputs and lockfile had identical SHA-256 hashes on this host. This demonstrates a local repeated build, not cross-OS bit-for-bit reproducibility.
- Loopback `npm run preview` served HTML and the byte-matching JavaScript artifact with HTTP 200; this was an HTTP smoke check, not browser execution. The preview process was stopped.
- `make check`: exit 0, 276 tasks / 22 stages / 221 requirements / 211 Web requirements; 66 tooling tests passed. It verifies the foundation, not the application.
No browser was available: in-app browser creation returned unavailable and browser inventory was empty. Interactive DOM rendering/click behavior is therefore an external check, not reported as passed. The card's mandatory clean install/build checks passed; release browser functionality still needs actual browser evidence in its assigned tasks. No XMPP/crypto/media/provider interoperability is implied.
## License / security / browser constraints
React, React DOM, their type packages and Vite use MIT; TypeScript uses Apache-2.0; Node uses MIT with bundled third-party notices; npm uses Artistic-2.0 with its own dependency licenses. React DOM requires React ^19.3.1; the selected exact version satisfies it. Vite 8.3.4 requires Node ^20.19.0 or >=22.12.0, TypeScript requires >=16.20.0, and npm 11.19.0 requires ^20.17.0 or >=22.9.0. Node 24.21.0 meets all selected requirements; do not choose EOL Node 20 merely because an engine range permits it.
The full locked inventory is in `experiments/0001-stack/LICENSE_INVENTORY.md`, including uninstalled optional platforms. Transitives include ISC, BSD-3-Clause, Apache-2.0 and MPL-2.0 (Lightning CSS build-time binaries). Build tools are not browser runtime dependencies; modified MPL-covered files would require their applicable source obligations on distribution. Browser-bundled React/React DOM/Scheduler copyright/license texts are preserved in `THIRD_PARTY_NOTICES.md`. Runtime distributions retain their original Node/npm notices. Future release packaging must collect notices for its actual full dependency graph; this inventory is not a license approval for future libraries.
The explicit syntax target is Chrome/Edge 111, Firefox 114, Safari 16.4, matching the documented Vite 8 baseline. These are compiler floors, not the accepted product test matrix (S00-006). There are no API polyfills: ESM/dynamic import/import.meta, DOM and appropriate JS built-ins must be available. WebCrypto/IndexedDB/WebRTC/notifications/permissions/storage quota must be checked independently; HTTPS/WSS and secure contexts remain mandatory in deployed use. Neither UI library makes closed-tab sockets or continuous media possible.
The loopback HTTP dev/preview server serves only this synthetic local UI. It does not connect to production endpoints and is not a workaround for TLS, certificates, crypto or CORS. No unsafe HTML insertion, secrets, environment credentials, analytics or real conversation data is present. Lock integrity does not prove provenance or absence of vulnerabilities; dependency monitoring/advisory review remains a continuing release responsibility.
## Consequences and migration triggers
After separate acceptance, downstream tasks may create stack-specific `.ts`/`.tsx` modules within their own cards, establish application CI/build and implement reviewed S01 contracts. No other module, plan definition, requirement snapshot or shared contract is changed here. The reviewed registry-access probe is retained unchanged.
A need for validated older browsers, unavailable native build-host packages, an incompatible required crypto/protocol dependency, or unacceptable measured UI behavior triggers a new bounded ADR/plan change and experiment. Do not replace this stack or introduce plaintext/stub fallbacks silently. A future revision may select Vue after real evidence; the unbuilt candidate is not represented as tested. Reviewer should verify exact pins/lock integrity/license notices, reproduce clean install/build, assess stated limits and record acceptance before consumers treat this ADR as accepted.
## Independent acceptance
Security reviewer auto-security-bd73f4f80779 repeated fresh-cache npm ci and strict typecheck/build on Node 24.21.0/npm 11.19.0, verified manifest/lock pins, all 67 locked license/integrity entries and runtime notice texts, and matched executor artifact hashes. Loopback preview served identical HTML/JS; make check passed 72 tooling tests. The bounded stack decision is accepted. DOM interaction was not executed in this review; product browser matrix, interoperability, vulnerability/provenance assessment and release readiness remain outside this acceptance. Review evidence records commands and limits; coordinator owns the review commit.
docs/decisions/0002-xmpp-library.md
+145
View File
@@ -0,0 +1,145 @@
# ADR 0002: XMPP library and required browser integration seams
- Status: accepted for bounded S00-003 library selection; independent QA: `state/evidence/S00-003-review.md`.
- Date: 2026-10-15. Owner: auto-protocol-f474114f0168 (protocol).
- Reviewer: auto-qa-d49749753ac6 (qa), 2026-10-15.
- Requirements: ACC-004, NET-003, NET-004.
- Prerequisites: accepted scope/stack ADRs and bounded SASL, parser, SHA-512
experiments (S00-017/018/019); independently reviewed Linux environment S00-020.
## Question and decision
Select Stanza 12.22.1 (MIT), with the three reviewed public integration seams
mandatory before connect: bounded transport, fail-closed SASL feature, and the
SHA-512 mechanism composition. Stock Stanza alone is unsuitable for this profile.
Its stock SASL handler does not verify server-final, its browser hyphenated
SHA-512 HMAC is wrong, and its persistent parser has no finite resource budgets.
The accompanying spike proves the composed candidate; it creates no production
adapter, shared contract, crypto implementation or provider deployment.
| Option | Evidence and tradeoff |
| --- | --- |
| Stanza 12.22.1 plus reviewed extensions | Selected: actual browser bundle, public Client/Factory/Registry/Transport APIs, verified fixed SCRAM transcripts, loopback WSS and extension fixtures. JSON models and built-in MAM/MUC/Jingle/upload mappings fit the planned adapter boundary. Exact-version alias and replacement plugins require regression checks on upgrades. |
| Stock Stanza | Rejected: the accepted remediation experiments reproduce security/framing defects. Installing the package alone does not meet this decision. |
| xmpp.js | Viable alternative with browser WebSocket and modular packages; its primary README documents MIT and client/component modules. Not installed or executed here; no superiority/security finding or exact pin is claimed. It would require a separate equivalent integration experiment, rather than assuming its SASL/parser meet the profile. |
## One runnable selection experiment
`experiments/0002-xmpp-library/selection-spike` combines unchanged reviewed
bounded-ingress and SHA-512 alias source with the ordering guard extended to
non-PLUS SHA-512/256/1. Existing library crypto implements all hashes, HMAC,
SCRAM and SASLprep. No vendor file, private field or primitive is changed.
The real Client.connect, XML registry, feature dispatcher, queue and browser
SCRAM backend run against a synthetic loopback HTTPS/WebSocket peer. Its
self-signed certificate is generated temporarily by OpenSSL, trusted explicitly
by the test socket only, and hostname/certificate checks remain enabled. No
system trust store is changed. An uninjected native WebSocket rejects the same
untrusted certificate; a plaintext endpoint is rejected before a socket exists.
The trusted peer observes TLS plus the xmpp subprotocol, framing open, exact
proof and a second open only after a valid server-final. Forged/premature finals
never authenticate or restart. This is a real WSS handshake with a fixture peer,
not interoperability with a deployed independent XMPP server.
Mechanism policy filters PLUS because browser TLS binding is unavailable,
selects SHA-512 then SHA-256 then SHA-1 independent of offer order, and disables
all other fallbacks. NET-003 permits a configured protected fallback; this
selection enables none. PLUS-only/PLAIN-only/empty offers fail. Diagnostics
contain selected mechanism, `channelBinding: unavailable`, and disabled fallback;
no credential, nonce, proof or peer payload. Synthetic tlsUnique is rejected.
GS2 n,, and c=biws are verified. A future platform with real binding must add a
separately reviewed implementation before offering PLUS.
Parser experiment ceilings are preserved: 4096 UTF-8 bytes, depth 8, 32 elements,
16 attributes, 1024 aggregate attribute units, 128 name units and 256 attribute
value units. Standalone complete text XML is preflighted by saxes before JXT
import. Oversized and split XML fail on the actual WSS path. These numbers are
local experiment limits, not a production message/media-size contract.
Registry fixtures import/export MAM forwarded IDs, MUC join, Jingle terminate,
HTTP upload URLs and legacy opaque OMEMO bytes. An explicitly invented opaque
namespace demonstrates Client.use/Registry.define extension and namespace
isolation. It is not an OMEMO2 implementation or encrypted messaging claim.
Imported messages expose both selected `body` and `alternateLanguageBodies`;
exporting both concatenates text in this version. A regression records it;
the MAM fixture exports only the language collection. Future adapters must
construct deliberate outbound shapes rather than echo imported objects.
## Reproduction, versions and licenses
Follow the experiment README. Exact Node 24.21.0/npm 11.19.0 and Vite 8.3.4 remain
from accepted ADR 0001. Stanza 12.22.1, saxes 6.0.0, events 3.3.0 and test peer
ws 8.22.0 have exact direct pins; lock v3 includes all optional hosts. These are
already reviewed package families, not a new stack. MIT/ISC runtime notices,
Stanza bundled ancestry, and build MIT/ISC/BSD/Apache/MPL notices are preserved
in inventory/notices; saxes' omitted package license is preserved from the
reviewed versioned upstream copy. MPL build code is unmodified. Dependency
monitoring, provenance and advisory clearance remain continuing release work.
Browser syntax floors are the accepted Chrome/Edge 111, Firefox 114, Safari 16.4
build targets, not a product support certification. Bundle graph excludes Node
platform/crypto and unresolved builtins; events is explicitly bundled. Native
WebSocket, secure RNG, URL and TextEncoder are required. Server/test tooling
Node crypto is only an independent oracle; it does not replace browser crypto.
## Primary sources inspected on 2026-10-15
- [RFC 7395](https://www.rfc-editor.org/rfc/rfc7395.html), sections 3.1–3.4,
3.7 and 3.9: subprotocol, complete text XML, framing, restart and TLS.
- [RFC 5802](https://www.rfc-editor.org/rfc/rfc5802.html#section-5) and
[RFC 7677](https://www.rfc-editor.org/rfc/rfc7677.html#section-3): fixed SHA-1/256
exchange vectors and server verification. SHA-512 independent Scramp fixtures
and RFC 4231 primitive vectors retain their accepted S00-019 provenance.
- [Stanza upstream](https://github.com/legastero/stanza) and
[xmpp.js upstream](https://github.com/xmppjs/xmpp.js): candidate APIs, browser
positioning and licenses. Exact installed Stanza 12.22.1 Client.d.ts/.js,
lib/sasl, plugins/features, jxt/Registry and protocol modules are authoritative
for shipped extension behavior; all 340 files match the independently installed
S00-020 vendor graph. Upstream branches do not establish version guarantees.
- [XEP-0313](https://xmpp.org/extensions/xep-0313.html),
[XEP-0045](https://xmpp.org/extensions/xep-0045.html),
[XEP-0166](https://xmpp.org/extensions/xep-0166.html),
[XEP-0363](https://xmpp.org/extensions/xep-0363.html): fixture namespaces and
envelope/extension shapes. Shipped protocol comments identify older revisions;
a passing simple fixture does not establish complete current-XEP coverage.
## Consequences, limits and review
The spike is sufficient input for bounded selection review. Production still
requires S01 contracts and its own implementations/tests. The minimal transport
omits complete stream sequencing, error/close negotiation, redirect and keepalive
policies. Queue/rate/network-allocation bounds, worker/CPU performance, timeout,
full SASL extensions/final-challenge compatibility and constant-time verifier
assurance are not established. Library verifier uses string equality. Strict
success-only final layout and conservative send-race rejection reduce availability.
No Chrome/Firefox/Safari runtime execution, independent XMPP server/client,
real account, OMEMO encryption, production feature semantics, full browser matrix
or release readiness was verified. Browser-built code runs in Node with host web
APIs; socket injection adds fixture CA trust, not a browser channel-binding API.
Old accepted experiment source is unchanged; shared interfaces/specs/stack and
network/TLS/CORS policies remain unchanged. Any API incompatibility on upgrade
requires a new bounded decision, not a private patch or silent downgrade.
QA should reproduce clean install/build/tests and dependency checks, inspect the
stock defect controls, explicit extension projection and scope, then record an
independent decision. Evidence: `state/evidence/S00-003-auto-protocol-f474114f0168.md`.
Coordinator owns transition commits; independent acceptance is recorded below.
## Independent acceptance
QA reviewer auto-qa-d49749753ac6 accepts this exact-version library selection
with all three integration seams mandatory. Fresh-cache locked installation,
browser bundle and all 112 tests passed on reviewed Linux Node 24.21.0/npm
11.19.0; 51 locked entries, 26 installed package notices and 340 unchanged vendor
files verified. Lock, guard and bundle hashes match executor evidence. Additional
six offer permutations selected SHA-512; six adversarial XML documents rejected
before registry access and a valid body imported. make check passed 72 tooling
tests. Public shipped APIs, composed guard diff, fixture trust boundary and
extension projection were inspected. Report: `state/evidence/S00-003-review.md`.
Acceptance covers the bounded combined spike and selection only. All native
browser, independent server/client, OMEMO, aggregate resource, lifecycle,
timeout/timing and release limitations above remain. Stock Stanza without the
required seams is not accepted. Coordinator must commit the review transition
before any subsequent fresh task session.
docs/decisions/0002-xmpp-parser-validation.md
+116
View File
@@ -0,0 +1,116 @@
# ADR 0002 parser remediation: bounded standalone XML ingress
- Status: accepted for the bounded S00-018 fixture experiment; independent review: `state/evidence/S00-018-review.md`.
- Task: S00-018 (remediation of S00-003).
- Date: 2026-10-15.
- Owner: auto-protocol-89fe6563092c (protocol).
- Reviewer: auto-security-64dc2d9fa232 (security), 2026-10-15.
Input: reviewed scope/stack/SASL ADRs, S00-003 parser blocker and bounded probe,
shipped Stanza parser/transport declarations and RFC 7395. Output: one isolated
runnable ingress experiment in experiments/0002-xmpp-library/parser-validation.
It does not select Stanza for the product, define production limits/shared
contracts, change authentication, or replace remaining S00-003 evidence.
The stock 12.22.1 transport keeps a StreamParser across WebSocket messages and
converts payloads to text. The finite diagnostic reproduced a 1 MiB body, depth
256 and 18 separate writes forming one 64 KiB body without errors. StreamParser
has no supported resource-budget options. The standalone-frame obligation is
[RFC 7395 §3.2/3.3.3](https://www.rfc-editor.org/rfc/rfc7395.html#section-3.3.3).
Inference from the shipped transport: stock parser reassembly violates that
obligation when each probe write represents a separate WebSocket message.
The RFC does not prescribe our numerical limits.
Propose a new public Client.transports constructor registration, selected alone
through config. The public Transport interface lists connect/disconnect/restart/
send; Client.connect instantiates the registered constructor with Client,
StreamManagement and Registry. This is a supported shipped integration surface,
not a private subclass override or ignored vendor patch. Exact shipped API:
node_modules/stanza/Client.d.ts, index.d.ts, Client.js, jxt/index.d.ts,
jxt/Parser.js and jxt/Registry.js. Upstream [Client source](https://github.com/legastero/stanza/blob/master/src/Client.ts)
is supporting context; installed 12.22.1 declarations/behavior are authoritative
for this experiment. Future stability is not promised.
Before any JXT tree/import, require text and finite bytes, then use a new
namespace-aware saxes XML 1.0 document parser and close it for completeness.
Throw on malformed input or exceeded event counters, reject restricted constructs,
and only then run the actual JXT.parse and Registry.import. Local ceilings:
| Resource | Maximum, inclusive | Enforcement |
| --- | --- | --- |
| Encoded message | 4096 UTF-8 bytes | Unit precheck, bounded TextEncoder, before SAX |
| Depth including root | 8 | SAX opentagstart |
| Elements including root | 32 | SAX opentagstart |
| Attributes including xmlns | 16 total/document | SAX attribute |
| Attribute name+decoded value units | 1024 total/document | SAX attribute |
| Element/attribute name units | 128 each | SAX event |
| Decoded attribute value units | 256 each | SAX attribute |
SAX itself stores tokens/namespaces before callbacks; their worst-case source
is capped by bytes first. No handwritten XML security parser or regex syntax
approximation is introduced. XML declarations, comments, PI and DTDs are
conservatively rejected; CDATA/built-in/numeric entities work. No entity fetch
or expansion extension is enabled. The entire document is validated before
any earlier root can emit. Incomplete documents/multiple roots/binary messages
are terminal and cannot be completed by subsequent messages. Close detaches
callbacks, clears attempt stream/config state and rejects stale callbacks.
Fresh connect creates a fresh transport. No payload is logged or raw-evented.
Alternatives rejected: post-import counters (too late), stock persistent parser
(no budgets/framing), regex or custom security parser (incorrect/unvetted),
DOMParser (tree allocated before structural checks), private source patches
(unsupported integration). A strict event parser plus byte ceiling provides a
bounded preflight without authoring XML syntax. Double parsing retains actual
candidate behavior, with bounded cost; complete normalization equivalence is
not established and is not claimed.
New exact dependencies: saxes 6.0.0 (ISC), xmlchars 2.2.0 (MIT); Stanza remains
12.22.1 (MIT). Ten exact installed packages are locked with HTTPS registry URLs,
SHA512 integrity, full license inventory and notices. Saxes published tarball
omits LICENSE; preserved upstream [v6.0.0 license](https://raw.githubusercontent.com/lddubeau/saxes/v6.0.0/LICENSE)
includes ISC lineage and an historical MIT notice. Public API/browser constraints
were checked against [versioned saxes README](https://raw.githubusercontent.com/lddubeau/saxes/v6.0.0/README.md)
and installed saxes.d.ts/source, not assumptions about a parser's strict mode.
Sources inspected 2026-10-15. Saxes has an older release; maintenance/advisory
clearance is not inferred from version pinning. README conformance claims are
upstream claims; our evidence is the bounded tests.
Verification: pinned Node 24.21.0/npm 11.19.0, fresh-cache npm ci, 55 integrated
tests passing; aggregate boundary document and Unicode boundary actually
import; all original failure categories and adversarial cases reject without
stanza emission/late revival. Registry tracing calls the real import. All 340
installed Stanza files byte-match the original candidate; no vendor edits.
make check passes 72 tooling tests (foundation only). Commands and setup details
are in the experiment README and state/evidence/S00-018-auto-protocol-89fe6563092c.md.
Browser use requires a CommonJS-capable bundler, native WebSocket/URL/TextEncoder
and private fields. Default uses browser WebSocket, fixture injection captures
socket effects only; actual Client.connect and its queue/registry/parser execute.
No browser build/runtime, actual WSS/TLS handshake, independent server/client
interoperability or exhaustion benchmark was run. Byte checks begin after
browser message allocation, and do not bound aggregate traffic/Client queues or
downstream work. This minimal transport does not implement all error reporting,
close negotiation, redirect, keepalive, language inheritance or XMPP sequencing.
No TLS/CORS bypass, invented channel binding, crypto primitive, production policy
or shared contract is added. ACC-004/NET-003/NET-004 remain obligations of the
original selection/product work; existing accepted SASL experiment is unchanged.
Independent security reviewer must inspect enforcement order/API integration,
repeat clean install/tests/license/vendor checks and record acceptance before
this ADR or S00-018 is accepted. Coordinator alone commits/launches further work.
## Independent acceptance
Security reviewer auto-security-64dc2d9fa232 independently repeated fresh-cache
npm ci and all 55 integrated tests on Node 24.21.0/npm 11.19.0. Ten exact
installed dependency licenses/integrities and all 340 unchanged Stanza files
were checked; the preserved saxes license byte-matches the versioned upstream
HTTPS source. Additional six adversarial inputs rejected before traced real
JXT.parse, all four stale socket callbacks left fresh attempts unaffected, and
fresh attempts imported the exact aggregate-boundary body. make check passed
72 tooling tests. Public shipped constructor/Transport APIs and enforcement
order were inspected. The bounded experiment is accepted; every browser,
WSS/interoperability, aggregate resource, sequencing and production-policy
limitation above remains. Report records commands and the failed initial tracing
attempt. Coordinator owns the review commit and subsequent fresh assignment.
docs/decisions/0002-xmpp-sasl-validation.md
+124
View File
@@ -0,0 +1,124 @@
# ADR 0002-SASL: Fail-closed SCRAM server-final experiment
- Status: accepted for the bounded S00-017 fixture experiment; independent review: `state/evidence/S00-017-review.md`.
- Task: S00-017, remediation for S00-003.
- Date: 2026-10-15.
- Owner: auto-protocol-599343cd9e3f (protocol).
- Reviewer: auto-security-9ab954f6e021 (security), 2026-10-15.
- Requirements: ACC-004, NET-003, NET-004; accepted ADR 0000/0001 preserved.
## Question and bounded result
Can the pinned StanzaJS candidate validate SCRAM server authentication before
emitting success/restarting without modifying vendor source or implementing
cryptographic primitives? Output is one isolated, runnable feature experiment,
not selection of Stanza as the production library. S01 shared contracts remain
unaccepted; no application adapter or interface is created here.
The original blocker is reproducible in 12.22.1: its SASL success branch marks
negotiation/transport authenticated, emits auth:success and requests restart
without processing additional-data or calling the SCRAM verifier. Empty and
forged success before challenge/proof are accepted. The isolated tests retain
this baseline reproduction and exercise the replacement through the real XML
registry and feature dispatcher.
## Options and proposed decision
1. **Replace the named SASL feature through public APIs.** Chosen for this bounded
experiment. `Client.use` and `registerFeature` are exposed in installed package
declarations; the registry assigns handlers by name. SCRAM already exposes
`processSuccess` and `finalize`. Keep all crypto in that existing implementation
and add fail-closed ordering, strict fixture-profile input and cleanup.
2. **Patch ignored vendor code or intercept success after emission.** Rejected:
ignored patches are not reproducible deliverables, and a post-success listener
cannot prevent earlier authenticated effects. No upstream patch is required.
3. **Replace the entire client/mechanism stack.** Deferred to S00-003. The original
evidence's xmpp.js source comparison also lacked server-final processing;
no installed/tested alternative or maintenance/security superiority is claimed.
Install the proposed plugin on a fresh Client before connect/feature events;
never permit the stock SASL handler to start first. The named registration
replaces its callback without editing registry internals. The API appends an
order entry; the actual dispatcher exits on restart/disconnect, with tests
confirming one completion and successful later negotiation after reset.
Only after proof send completes does success data reach library `processSuccess`
and `finalize`; both authenticated and mutuallyAuthenticated must be true before
any authenticated flag, event or restart. Missing, forged, erroneous, duplicated,
malformed or premature final is terminal failure. Reset removes attempt listeners
and cancels asynchronous continuation. Proof/credential/send exceptions fail
without logging credentials, peer data or crypto state. No cache is persisted.
## Sources, pins and licenses
Primary sources inspected on 2026-10-15:
- [RFC 5802 §5](https://www.rfc-editor.org/rfc/rfc5802.html#section-5): mutual
authentication and SHA-1 exchange; the public user/pencil fixture is copied as
test data, not used as an account. Invalid verifier must fail the exchange.
- [RFC 7677 §3](https://www.rfc-editor.org/rfc/rfc7677.html#section-3): SHA-256
exchange used as a second fixed primary-spec transcript.
- [Stanza 12.22.1 registry record](https://registry.npmjs.org/stanza/12.22.1):
exact package provenance location/license and locked tarball. Installed shipped
`Client.js/.d.ts`, `plugins/features.js/.d.ts`, `plugins/sasl.js` and
`lib/sasl/index.js/.d.ts` are the exact API/implementation evidence. Upstream
[Client source](https://github.com/legastero/stanza/blob/master/src/Client.ts)
corroborates plugin usage, but is not version-pinned acceptance evidence.
Dependency: stanza 12.22.1, MIT. Exact transitive pins: @types/node 22.20.5,
@types/punycode 2.1.4, @types/ws 8.18.2, punycode 2.3.1, sdp 3.2.2,
undici-types 6.21.0, ws 8.22.0; all MIT. Separate manifest/lock under
`experiments/0002-xmpp-library/sasl-validation` does not alter the parent's
unaccepted exploratory graph. Every locked package has HTTPS registry URL,
SHA512 integrity and inspected installed license text; inventory and notices
are preserved. Runtime stays Node 24.21.0/npm 11.19.0 from accepted ADR 0001.
No new crypto dependency, crypto primitive or vendor-source edit is introduced.
## Runnable evidence and constraints
See experiment README and `state/evidence/S00-017-auto-protocol-599343cd9e3f.md`.
Clean npm ci with an empty cache and npm test passed: 44 tests, including two
RFC client proofs/verified finals, original insecure baseline, missing/forged/
premature rejection, duplicate/out-of-order inputs, send/credential failure,
asynchronous reset and replay rejection. Tests observe real feature-dispatcher
restart/disconnect calls and transport/negotiation flags; they are local parsed
XML integration tests with captured outbound effects, not WSS/server tests.
The experiment accepts only non-PLUS SHA-256/SHA-1, selecting the strongest of
those offered and failing if neither is available. No plaintext fallback or
invented browser TLS binding. SHA-512, complete mechanism policy and compatibility
remain S00-003. Server-final is accepted only as success additional-data; separate
final challenge, SCRAM extensions and extra challenge round trips are rejected.
Decoded-data and iteration bounds (4096 bytes / 100000) are local experiment
limits. A success racing a pending send is conservatively rejected. These
restrictions can reduce availability and need explicit future integration review.
Node exercises Stanza's SCRAM composition and Node crypto primitives. Browser
Stanza uses bundled synchronous hashing/HMAC, global crypto RNG, WebSocket and
fetch; its backend/build is not tested in this task. No browser support matrix,
constant-time comparison guarantee (Stanza compares verifier strings), advisory/
provenance clearance, WSS/TLS/channel-binding test, independent-client/server
interoperability or production readiness is implied. No live credentials,
network authentication, certificate/CORS bypass or persisted secrets are used.
## Handoff and consequences
Independent security reviewer must reproduce the integrated positive/negative
cases and assess extension API, cleanup, license/pin evidence and the stated
restrictions. This ADR stays proposed until review. Reviewed acceptance permits
a fresh S00-003 executor to evaluate this approach in its own experiment; it does
not implement that original task or change the accepted stack/shared contracts.
Any required broader policy/interface or vendor replacement is a separately
scoped plan decision. Coordinator owns transition commits and fresh processes.
## Independent acceptance
Security reviewer auto-security-9ab954f6e021 independently repeated fresh-cache
npm ci and all 44 integrated tests on Node 24.21.0/npm 11.19.0. Exact installed
pins, all eight MIT notices, HTTPS/integrity entries, shipped public extension
APIs and unchanged vendor files were verified. RFC proofs/finals match primary
examples; forged/missing/premature final cannot authenticate in the demonstrated
handler. make check passed 72 tooling tests. This bounded experiment is accepted;
Stanza selection, complete mechanism policy, browser crypto/build, WSS/server
interoperability, parser certification, timeout and constant-time assurance remain
unverified. S00-003 must evaluate integration in a new assigned session.
docs/decisions/0002-xmpp-sha512-validation.md
+142
View File
@@ -0,0 +1,142 @@
# ADR 0002 SHA-512 remediation: public mechanism composition
- Status: accepted — independent security review of bounded S00-019; evidence: `state/evidence/S00-019-review.md`.
- Task: S00-019, remediation of S00-003.
- Date: 2026-10-15.
- Owner: auto-crypto-c68801170fa4 (crypto).
- Reviewer: auto-security-f465a677e48f (security), 2026-10-15.
- Requirements: ACC-004, NET-003, NET-004.
Input: original SHA-512 blocker, accepted scope/stack/SASL/parser decisions,
exact pinned Stanza browser source/public declarations and primary vectors.
Output is one isolated runnable experiment in
experiments/0002-xmpp-library/sha512-validation. No production library selection,
parent WSS work, shared contract, stack change or original spec change.
## Defect and options
The built Stanza 12.22.1 browser backend reproduces the RFC 4231 case 1 failure
for createHmac('sha-512'). Source chooses 128-byte blocks only for sha512;
SCRAM's normal wire name derives sha-512. The browser digest implementation
already accepts both spellings; HMAC does not normalize the hyphen. Direct
public SCRAM('SCRAM-SHA-512') produces the wrong full client proof as well.
1. Compose the existing exported SCRAM through its public constructor with the
working algorithm alias, expose the correct independent wire name, and
register the wrapper through public Factory APIs. Proposed for this exact
version, with complete browser-backend vectors guarding the alias behavior.
2. Replace crypto or the complete mechanism with another library. Not needed
for this outcome: introduces new runtime crypto/dependency/API assumptions.
Scramp is used only as an independent test oracle, not a browser candidate.
3. Patch private algorithm/vendor HMAC, mutate vendor prototypes, rewrite imports
to a replacement crypto backend, rename the wire mechanism or downgrade.
Rejected; no such patch/workaround is used.
## Proposed integration
Sha512Mechanism implements the shipped public Mechanism interface and delegates
all crypto to a new public SCRAM('SCRAM-SHA512'). Constructor typing accepts a
string; exact shipped source derives sha512, supported by createHash/Hmac. The
wrapper exposes SCRAM-SHA-512 on the wire and never accesses/changes a Stanza
private field. The delegate retains its internal alias name throughout. This
uses documented public constructor/method signatures and version-inspected alias
behavior, not an upstream promise of a named SCRAM-SHA512 wire mechanism.
Future upgrades must revalidate this composition; an incompatible API is a new
blocker, not permission for a private patch.
Public Factory.disable/register replaces SHA-512 before negotiation; fresh
Client.use installs the isolated S00-017 guard copy. Guard is narrowed to SHA-512
and its 88-character verifier, while preserving strict validation, ordering,
mutual authentication, cancellation and no-success-on-error behavior. Delegate
processSuccess/finalize must confirm both flags before auth event/flags/restart.
Library-derived keys remain attempt-local, getCacheableCredentials returns null;
no storage/cache update path is added. Crypto primitives, SCRAM composition,
SASLprep and verifier remain entirely existing library code.
Only non-PLUS SHA-512 is permitted by this fixture profile. PLUS-only/plaintext/
unsupported offers fail; compatible mixed offers select SHA-512. tlsUnique input
fails. GS2 n,, and c=biws reflect no channel binding. Full NET-003 fallback policy
and real WSS ACC-004 stay with S00-003; this experiment makes no complete product
requirement or library-selection claim.
## Pins, public API and sources
Inspected primary sources on 2026-10-15:
- [RFC 4231 sections 4.2–4.8](https://www.rfc-editor.org/rfc/rfc4231.html#section-4.2)
supplies seven fixed HMAC-SHA-512 cases, including 131-byte keys and truncation.
- [RFC 6234 test driver](https://www.rfc-editor.org/rfc/rfc6234.html#section-8.5)
supplies SHA-512 abc digest. No primitive code is copied from the RFC.
- [Stanza source](https://github.com/legastero/stanza/blob/master/src/lib/sasl/index.ts)
supplies public API context; exact shipped 12.22.1 lib/sasl/index.d.ts/.js,
Client.d.ts/.js, plugins/features.d.ts/.js and platform/browser/crypto files
are authoritative version-specific evidence. Factory accepts a constructor;
wrapper calls only declared public methods. Stanza license is MIT with bundled
browser crypto ancestry notices preserved.
- [events upstream](https://github.com/browserify/events) documents browser
EventEmitter API, ES5 support, MIT license and limited maintainer resources.
events 3.3.0 supplies the explicit polyfill required by Stanza's browser graph.
- [Vite build](https://vite.dev/guide/build.html) supports library output/browser
targets; accepted Vite 8.3.4 is reused, not a new stack selection.
- [Scramp 1.4.6 API](https://pypi.org/project/scramp/1.4.6/) documents SHA-512
and public client/server methods. Test oracle pins Scramp 1.4.6 (MIT-0) and
asn1crypto 1.5.1 (MIT), exact wheel SHA256 hashes, Python >=3.8. Version selected
for available Python 3.9 host compatibility; not a latest-version/audit claim.
Direct npm pins: stanza 12.22.1, events 3.3.0 (MIT), Vite 8.3.4 (MIT, build only).
49 exact locked entries, 25 installed on this macOS ARM64 host. All lock entries
have HTTPS registry URL, SHA512 integrity and license inventory; installed
notices include Stanza NOTICE browser code lineage and build third-party texts.
Native rolldown binding omits a license file; owning rolldown MIT/third-party
licenses preserved. Optional platform entries are inventory-only. Build graph
includes MIT/ISC/BSD/Apache/MPL packages; no modified covered vendor source.
Neither pins nor these checks certify advisory/provenance/security clearance.
Runtime remains accepted Node 24.21.0/npm 11.19.0. Normal HTTPS, strict engines,
disabled install scripts; no global configuration change. Browser bundle uses
package browser mapping and explicit events alias, with no Node crypto/backend
or external builtin. Build graph assertions and executed artifact supply backend
evidence; Node crypto appears only as the separate primitive oracle in tests.
## Actual validation and limits
Fresh-cache npm ci, browser library build and 87 tests passed. All seven fixed
RFC HMAC cases match sha512/SHA512; SHA digest aliases match abc, varied HMAC keys
0..256 bytes match independent Node crypto. Stock hyphenated HMAC/full SCRAM
failures reproduce. Three full fixed SHA-512 exchanges match independent Scramp
client/server output (ordinary/131-byte/Unicode passwords). Scramp regeneration
verifies client proof and server-final independently before comparing fixtures.
Actual browser-built Client, XML registry, feature dispatcher and mechanism run
positive and missing/forged/premature/malformed/duplicate/racing-final checks.
Fixture send/transport effects are captured explicitly; crypto is never stubbed.
Fail never authenticates/restarts; reset/error/replay cannot revive it. Server
silence after proof remains unauthenticated until external reset. All 340 Stanza
files byte-match original pinned candidate. Detailed commands, checks and hashes
are in README and executor evidence; independent review remains mandatory.
Bundle execution host is Node, using browser backend and host native web APIs.
Actual Chrome/Firefox/Safari runtime, WSS/TLS, live independent server/client,
parent parser integration, workers/performance and production readiness are not
claimed. Targets Chrome/Edge 111, Firefox 114, Safari 16.4 are accepted build
floors, not a certified product matrix; native crypto RNG/fetch/WebSocket needed.
Synchronous SCRAM derivation can block UI; no constant-time verifier guarantee
(Stanza compares strings), timeout or exhaustive SASLprep claim. Only success
additional-data final, extension-free syntax, 4096 decoded bytes/100000 iteration
fixture limits; separate final challenge conservatively rejects. Accepted
S00-017/S00-018 source is untouched. Independent security reviewer must assess
public alias composition and all limits, repeat commands and record acceptance
before the coordinator resumes the parent in another fresh process.
## Independent acceptance
Security reviewer auto-security-f465a677e48f accepts this pinned, isolated public
mechanism composition after independent fresh-cache install, browser build and
87 tests, hashed Scramp oracle recreation, dependency/notice/vendor checks and
10 additional adversarial guard tests. Both authentication flags are required;
modified signatures and malformed first messages fail before success/restart.
Public constructor alias use is acceptable for this exact inspected version;
it is not a future upstream alias guarantee. All browser-runtime/WSS/parent
integration, timing, timeout and release limitations above remain. No production
library selection or complete ACC/NET product acceptance is granted here.
Coordinator must commit this review before launching any fresh parent process.
docs/decisions/0003-crypto-library.md
+141
View File
@@ -0,0 +1,141 @@
# ADR 0003: OMEMO session/ratchet engine and browser backend feasibility
- Status: proposed
- Task: S00-004, remediation S00-021.
- Date: 2026-10-15.
- Decision owner: auto-crypto-fcef9b6781bf (crypto).
- Reviewer: security (separate agent for S00-021 review).
- Requirements: ENC-003, ENC-009, ENC-011.
## Context and required capabilities
Input: immutable ENC-003 (legacy OMEMO and OMEMO 2 wire formats with compatible
device lists/bundles and identity/session lifecycle), ENC-009 (encryption runs in
the client endpoint with proven implementations and compatible vectors; no
homegrown algorithm, no server-side decryption, no treating shared storage as
proven interoperability), and ENC-011 (OMEMO 2 wire format by an approved
compatible revision with SCE and payload/key/MAC rules; not replaced by media
AES-GCM). Also the accepted scope (ADR 0000), stack (ADR 0001) and reviewer
decisions S00-001/S00-002, plus the S00-004 blocker report and handoff.
Output is one focused probe record and this ADR (proposed) establishing what is
verifiably feasible today for a Web client: an audited session/ratchet engine
with secure session-record persistence, and the honest boundary for the
browser/worker/WASM endpoint and the OMEMO2 wire layer. Acceptance requires a
real library/backend, verified vectors, no homegrown ratchet, and any unsupported
format recorded as a blocker (not success).
## Candidates and primary sources
Primary public sources and exact reachable-registry records retrieved
2026-10-15 via the configured npm proxy. These sources establish library and
distribution boundaries; none of them is treated as a tested product
integration.
| Candidate | Reachable registry | License | Browser/WASM reality |
| --- | --- | --- | --- |
| `@signalapp/libsignal-client@0.105.0` | exists | AGPL-3.0-only | Node native addon (`dist/Native.js` uses `node-gyp-build`; `prebuilds/*/*.node`). No `.wasm` asset ships; cannot execute in a browser worker. |
| `@signalapp/libsignal` | 404 Not Found | — | Signal's TypeScript/WASM web distribution is not published to the reachable npm registry; `npm view @signalapp/libsignal version` returns E404. |
| `omemo-client` | 404 Not Found | — | not on reachable registry |
| `omemo-top` | 404 Not Found | — | not on reachable registry |
| `omemo-wasm` | 404 Not Found | — | not on reachable registry |
| `@converse/omemo` | 404 Not Found | — | not on reachable registry |
Sources:
- [`signalapp/libsignal` repository `package.json`](https://github.com/signalapp/libsignal/blob/main/node/package.json) defines the Node distribution of the libsignal client (native bridge).
- Signal documentation on libsignal WASM/web: the library is compiled to WebAssembly for Signal's browser clients, but that artifact is produced from source into the Signal client builds; it is not shipped as a maintained standalone `@signalapp/libsignal` npm package on the reachable registry (E404, queried 2026-10-15).
- The exact registry records were queried with `npm view <pkg> version`; results (version or E404) are captured in evidence: `state/evidence/S00-021-auto-crypto-fcef9b6781bf.md`.
## Focused experiment and actual result
The previously committed probes inside
`experiments/0003-crypto-library/session-probe/` were reproduced unchanged from
the S00-004 handoff (this run re-ran both, actual exit codes recorded below):
1. `node experiments/0003-crypto-library/session-probe/smoke.mjs` — exit 0,
`SMOKE_PASS`. A real A/B pair using
`@signalapp/libsignal-client` sealed-sender APIs established a PreKey session,
round-tripped the known plaintext `known vector: OMEMO session smoke`, stored a
631-byte session record and reloaded it byte-for-byte. This verifies an audited
session/ratchet engine and session-record persistence without any homegrown
ratchet; it mirrors Signal canonical in-memory store semantics.
2. `node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs` —
exit 2. Inspects the installed package: `wasmFiles: 0`; `prebuilds` are
`darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64`
native `*.node` files; `dist/Native.js` loads via `node-gyp-build`. This
confirms that the shipped artifact cannot run in a browser worker/WASM
endpoint, and the distribution ships no `.wasm` asset.
Result: the audited session/ratchet engine and persistence are verified; the
browser/worker/WASM deployment and the OMEMO/OMEMO2 XMPP wire layer are **not**
established by any maintained package on the reachable registry. Per focused
check "unsupported format recorded blocker, not success", this is recorded as a
blocker, not as an achieved capability.
## Decision
Adopt `@signalapp/libsignal-client` **only** as the audited session/ratchet
engine and session-record persistence primitive for the Node-side spike and
downstream adapters that can run a native/external environment, and keep it as
the verified evidence that an audited library (not a homegrown ratchet) supplies
the whistler/session layer and durable session-records.
Record as a blocker on S00-004 that the browser/worker/WASM endpoint and the
OMEMO2 wire-format layer are not available from any maintained package on the
reachable registry, and that `@signalapp/libsignal` (the WASM distribution) is
not published there. This remediation does **not** replace the missing browser
backend with a homemade ratchet, does not reuse the shared Node session store as
if it proved browser interoperability (ENC-009), and does not pretend the
unsupported OMEMO2 wire layer is complete. The correct next step for S00-004's
continued execution is: (a) obtain a verified browser/WASM-capable OMEMO2
backend (a distribution with a real `.wasm`/web build and an OMEMO2/S
ce-format mapping) or (b) escalate with traceable upstream primary sources
resolving ENC-009/ENC-011 client-endpoint encryption for the browser transport.
## License / security / browser constraints
`@signalapp/libsignal-client` is AGPL-3.0-only. Its AGPL-3.0 obligations apply if
the library (or modified copies) is distributed. Its official notices and license
are bundled in `node_modules/@signalapp/libsignal-client` and its
`acknowledgments`; the reader is referred to the package license text and the
Signal acknowledgments file before any redistribution. AGPL compatibility with
the eventual product distribution decision is a separate review item for the
accepted stack/licensing tasks.
Browser constraints (from the accepted stack ADR 0001 and Web profile): the
absent WASM distribution is a hard capability boundary here — no `.wasm` asset to
instantiate in a worker. No plaintext fallback, no spy/`decrypt` bypass, and no
server-side decryption path is introduced. Any real OMEMO2 wire mapping must be
produced from approved primary sources and preserve ENC-009/ENC-011 client-endpoint
encryption; media/transport AES-GCM alone does not satisfy ENC-011.
## Consequences and downstream contract
- S00-004's acceptance requires legacy/OMEMO2 AND worker/wasm AND persistence.
Two of the three (browser/WASM and the OMEMO2 wire layer) remain unresolved and
are recorded here as a blocker; only persistence + audited ratchet/session are
established. A new executor of S00-004 must not declare it done on this basis
(it would bypass the requirements).
- Any crypto boundary contract (planned `docs/contracts/crypto.md`, S12 tasks)
must key off a verified, maintained library and real vectors; it must not
assume a browser/WASM OMEMO2 primitive that is still absent.
- No shared contract, plan definition, requirement snapshot or spec file is
changed by this ADR.
## Rejected alternatives and migration trigger
1. Hand-write the Double Ratchet or OMEMO2 wire format. Rejected: forbidden by
ENC-009 (no homegrown algorithm/primitive replacement) and the crypto role
constraints.
2. Reuse the Node session store as "interoperability". Rejected: ENC-009 forbids
treating shared session storage as proof of interoperability; it is a
persistence spike only.
3. Declare `@signalapp/libsignal-client` a full browser backend. Rejected:
verified native-only, zero `.wasm`; would be a false success.
Migration/continuation trigger: a verified browser/WASM-capable OMEMO2 package or
a resolved, traceable upstream path that satisfies ENC-009/ENC-011 becomes
available; then S00-004 (or its assigned continuation) may be re-run and the
browser-capable backend validated with known vectors in the web target before
acceptance.
docs/decisions/0003-registry-connectivity.md
+62
View File
@@ -0,0 +1,62 @@
# S00-027: Approved npm registry connectivity record
- Status: accepted — independent security review S00-027; evidence: `state/evidence/S00-027-review.md`.
- Reviewer: auto-security-ccce71646176 (security), 2026-10-15.
- Executor: auto-ci-cd-40ae46e8efe7 (ci-cd), 2026-10-15.
- Input: S00-027 card, S00-022/S00-027 blockers, accepted ADR 0000/0001 and direct dependency evidence.
- Output: connectivity evidence only for resuming the separate OMEMO2 investigation.
## Environment-owner confirmation
Canonical `state/tasks.json` history revision 74 records coordinator-input-s00-027 releasing the external wait on 2026-10-15T09:45:53+00:00. The confirmation explicitly enables sandbox outbound network while retaining workspace-write restrictions, configured proxy and TLS. It reports successful prior probes and requires fresh executor and reviewer verification. This session reproduced access; it did not alter proxy, DNS, TLS, runner configuration or system tools. No credentials or private proxy values are recorded.
## Actual commands and responses
All commands ran from project root. A fresh directory was created with Python `tempfile.mkdtemp(prefix='luma-s00-027-')`: `/tmp/luma-s00-027-kdeu0fv9`. Its cache was empty before the first query. Existing coordinator metadata, archive and cache were not used.
| Command | Exit | Actual response |
| --- | --- | --- |
| `node --version` | 0 | v24.1.0 |
| `npm --version` | 0 | 11.3.0 |
| `npm config get strict-ssl` | 0 | true |
| `npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache` | 0 | `"0.105.0"` |
| `npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache` | 0 | 3.0.0; GPL-3.0; integrity and URL below |
| `npm view libomemo.js@3.0.0 version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/pinned-cache --registry=https://registry.npmjs.org/ --strict-ssl=true` | 0 | Same fields, fresh second cache |
No EAI_AGAIN or E404 occurred. npm emitted an update notice on the control query; no update was performed. Host runtime versions are explicitly recorded; these metadata/download-only probes do not build the application or replace ADR 0001 tool pins.
Pinned public artifact: [libomemo.js 3.0.0 tarball](https://registry.npmjs.org/libomemo.js/-/libomemo.js-3.0.0.tgz). Primary metadata source: [versioned registry record](https://registry.npmjs.org/libomemo.js/3.0.0).
Registry integrity and independently computed SHA512 SRI both equal:
```text
sha512-B4he9DOS+1LQrut+b2xjOjuSkKMAkZGes7ckB5JgVk/EHVNyxLIHx6NvQ3eJVaT1XeNJaWZBonXw3Nl5YKEbig==
```
## Artifact retrieval and integrity verification
An inline Python wrapper ran the pinned command above with `subprocess.run(..., capture_output=True, text=True)`, required exit 0, parsed its JSON into `meta`, and asserted `meta['version'] == '3.0.0'`. The following retrieval/check body then ran unchanged inside that wrapper (root is the temporary directory above):
```python
url=meta['dist.tarball'];assert url=='https://registry.npmjs.org/libomemo.js/-/libomemo.js-3.0.0.tgz'
with urllib.request.urlopen(url,context=ssl.create_default_context(),timeout=15) as response:
assert response.status==200 and response.url==url
data=response.read()
sri='sha512-'+base64.b64encode(hashlib.sha512(data).digest()).decode()
assert sri==meta['dist.integrity']
(root/'libomemo.js-3.0.0.tgz').write_bytes(data)
```
Imports were `subprocess,json,pathlib,urllib.request,ssl,hashlib,base64`. The wrapper also wrote public verification JSON under the temporary root. Actual wrapper exit: 0. HTTP status: 200; final URL unchanged; archive size: 1,061,939 bytes. SHA256: `be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8`. Archive saved only under `/tmp`; it was neither extracted nor installed nor executed. Python used its default validated SSL context and existing configured environment; no certificate/proxy-policy bypass was used.
## Acceptance boundary and review handoff
Both required live metadata queries and the pinned artifact/SRI verification succeeded in the fresh agent session. This proposes acceptance of network restoration only. Registry integrity matches bytes to registry metadata; it does not establish independent provenance, safety or crypto suitability. GPL-3.0 is reported metadata, not a distribution approval.
No crypto/backend decision, browser/WASM/worker execution, SCE mapping, audited interoperability, persistence compatibility, application build or release readiness was tested or accepted. ENC-003/009/011 remain obligations of the original investigation. The existing crypto ADR and experiments, specs, contracts and plan definitions are unchanged.
The assigned independent security reviewer should repeat both queries with a new empty cache, repeat pinned metadata/download/SHA512 comparison under normal TLS and the approved environment, inspect scope and evidence, then record the review through tasks.py. Only reviewed resolver completion may return S00-022 to the queue for a new agent. Coordinator owns Git commits.
## Independent acceptance
Security reviewer auto-security-ccce71646176 reproduced both live metadata queries with a new empty temporary cache and the pinned metadata/download/SHA512 check under normal TLS. Responses, 1,061,939-byte archive and SHA256 matched the executor record. No package scripts were executed. `make check` passed 72 tooling tests. This accepts registry connectivity only; all crypto/backend and distribution limits above remain. Coordinator owns the review commit.
docs/decisions/0004-storage-design.md
+179
View File
@@ -0,0 +1,179 @@
# ADR 0004: IndexedDB wrapper and migration policy
- Status: accepted; bounded storage design independently reviewed on 2026-10-15.
- Task / requirements: S00-005 / STORE-001, STORE-004.
- Date: 2026-10-15.
- Decision owner: auto-storage-0ce544ac4b40 (storage).
- Reviewer: auto-qa-4078580caf39 (qa); evidence: `state/evidence/S00-005-review.md`.
## Context and required capabilities
Choose browser persistence tooling and policy, using accepted ADR 0001 (TypeScript,
ESM, Node 24.21.0/npm 11.19.0). Account history, crypto state and settings require
isolation, transactional writes and honest failure reporting. This decision does
not define application record schemas or port signatures. The registry reserves
`docs/contracts/persistence.md` for S01; that file does not exist yet. No current
experiment needs a new shared interface. Downstream implementation must wait for
its accepted models/lifecycle/persistence contracts.
## Candidates and primary sources
Documentation and registry metadata inspected on 2026-10-15:
| Candidate | Benefits | Cost / outcome |
| --- | --- | --- |
| Native IndexedDB | Standard API, no package | Event/request handling requires more adapter code; reference behavior, not selected ergonomics |
| idb 8.0.4, ISC | Promise API, typed schemas, explicit transaction completion and upgrade callbacks | Native transaction lifetime still applies; selected and executed |
| Dexie 4.4.6, Apache-2.0 | Query helpers, declarative versions and transaction API | Broader abstraction than this bounded adapter needs; researched, not installed or benchmarked |
Select **idb 8.0.4**. Its small API surface keeps native transaction boundaries
visible while providing promises and TypeScript declarations. Dexie remains a
viable option if measured query requirements justify it. No speed or security
superiority is claimed. `npm view` verified exact candidate versions/licenses;
installed idb metadata has no runtime dependencies. Only the isolated experiment
manifest/lock changes here; production adoption belongs to later scoped tasks.
Sources:
- [idb documentation](https://github.com/jakearchibald/idb): promises, `tx.done`,
typed schemas, transaction lifetime and upgrade/blocked/blocking/terminated APIs.
- [Dexie design](https://dexie.org/docs/Tutorial/Design): queries, transactions,
versioning and asynchronous transaction limits.
- [IndexedDB standard](https://w3c.github.io/IndexedDB/): request errors,
transaction abort/commit, version changes and durability hints.
- [Storage standard](https://storage.spec.whatwg.org/): estimates and persistence
requests; [WebKit storage policy](https://webkit.org/blog/14403/updates-to-storage-policy/)
illustrates browser-controlled quotas/eviction. No fixed quota is promised.
- Registry records: [idb 8.0.4](https://registry.npmjs.org/idb/8.0.4),
[Dexie 4.4.6](https://registry.npmjs.org/dexie/4.4.6),
[fake-indexeddb 6.2.5](https://registry.npmjs.org/fake-indexeddb/6.2.5).
- [fake-indexeddb documentation](https://github.com/dumbmatter/fakeIndexedDB):
in-memory testing implementation, without disk persistence.
## Transaction and account policy
Use one versioned application database per origin with distinct history, crypto,
settings and metadata stores. Every account-owned key and index starts with the
canonical accountId; unscoped scans are forbidden in account APIs. AccountId is
an opaque application identity, not a password or a raw JID database name. Capture
account/generation before asynchronous work and validate it at application entry;
do not resolve an account from whichever context is active after awaiting.
History mutations and their archive checkpoint share one readwrite transaction.
Any coupled crypto mutation must use that same database transaction when required
by the future crypto contract. Separate stores allow this; separate databases
would not. Cache is disposable and must never be the only copy of crypto state.
Network/worker/crypto preparation finishes before starting a transaction. Await
only IDB requests within it; any other asynchronous work risks auto-commit.
Success is published only after `tx.done` resolves. Synchronous exceptions,
request failures and completion failures all produce a failed save; abort an
active transaction and observe completion before returning. Never swallow a
request error and then report success. External XMPP delivery is not part of the
local transaction: reconcile delivery separately rather than blindly resend.
Use strict durability hints for critical state where supported/verified, with
default durability explicitly recorded otherwise; neither is a hardware vault
or proof against device failure, eviction or user clearing.
## Schema upgrade and connection ownership
Use monotonically increasing integer versions, sequential oldVersion steps and
one versionchange transaction. A fresh database runs every needed step. Modify
existing stores via the upgrade transaction; do not recreate them accidentally.
Upgrade code is deterministic and local: no network, worker waits, secrets or
unbounded whole-history transformation. Large resumable transformations require
an independently designed recovery/checkpoint contract before implementation.
Each tab/worker owns its connection. On blocking/versionchange, stop accepting
new writes, let current work finish/abort, close the connection and request reload
to the supported schema. On blocked, show an upgrade-wait state with instructions
to close/reload other tabs; do not delete the database or claim readiness. A wait
deadline changes UI state, not the upgrade result. IndexedDB open cannot simply
be cancelled: a late success for a retired attempt must be closed and ignored.
On terminated, invalidate the handle and reopen under lifecycle control.
An aborted migration leaves the prior version/data available for investigation
and a corrected forward retry. No automatic wipe, schema downgrade or silent
rebuild of non-recoverable state. An older build receiving VersionError asks for
an update; release rollback must retain a compatible reader or ship a corrective
forward migration. Tests must cover fresh creation and each supported old version.
## Quota, eviction and key ownership
Estimates are advisory and race with other origin storage. Request persistent
storage through supported StorageManager APIs and report the actual granted
state; denial does not mean storage is unavailable. Quota/unknown disk failures
must stop the batch without advancing checkpoint. UI reports history not saved
locally and retains bounded pending work in memory under the later queue policy.
Retry is explicit/bounded after freeing disposable media/cache; never remove
crypto, trust state or unsynced history to make space automatically. Reload or
origin clearing may lose pending memory and local data; startup must detect missing
schema/account markers and request a real recovery path rather than imply success.
Browser testing still must verify native exhaustion, eviction and restart behavior.
Storage owns byte persistence and isolation, **not cryptographic key generation,
trust or unlock policy**. Crypto owns serialization/versioning of opaque state
and any wrapping/unlock material under its accepted ADR/contract. This task does
not authorize saving raw private keys. Passwords remain memory-only; no password,
unlock secret or reusable wrapping secret in localStorage/IndexedDB. Persistent
unlock needs its own accepted decision. Same-origin script access is a security
boundary: IndexedDB alone provides neither XSS resistance nor hardware backing.
Account removal must delete its records across all owned stores atomically,
invalidate in-flight context and release in-memory crypto; exact deletion and
suppression semantics remain S01/application work, not an implemented API here.
## Focused experiment and actual result
`experiments/0004-storage-design` uses exact idb 8.0.4 and fake-indexeddb 6.2.5,
locked HTTPS/SHA512 dependencies and the accepted Node/npm pins. Fresh-cache
`npm ci --ignore-scripts --no-audit --no-fund` and `npm run check` passed.
- Real fixture ConstraintError during v1→v2 unique-index migration aborts open;
v1 store/data survive, new store/index disappear. Corrected retry reaches v2,
is queryable and survives connection reopen in the same process.
- Explicit QuotaExceededError injection after successful history/checkpoint
requests returns failed save, aborts both mutations and preserves account B.
A clean retry commits both. This tests policy, not native quota generation.
- Holding v1 produces versionchange then blocked; upgrade has not executed.
Closing v1 allows v2 and preserves checkpoint. Opening v1 again fails VersionError.
These are synthetic API experiments, not production adapters. Browser inventory
was empty. Native disk quota, crash/process restart, browser multi-tab, eviction,
persistence grants and crypto unlock were not tested. No browser readiness or
application durability acceptance is implied. See README and task evidence for
commands and limits; preserved RECOVERY.md describes the historical checkpoint.
## License / browser constraints and consequences
idb's ISC notice is retained in the experiment; fake-indexeddb's Apache-2.0 text
is retained as a test-only dependency notice. Neither package declares runtime
dependencies in this lock graph. Installs disable lifecycle scripts and enforce
normal TLS; audit/provenance assessment was not performed. Future distributions
must retain notices for the actual bundled graph.
idb targets modern Chrome/Firefox/Safari/Edge and excludes IE. TypeScript types
do not polyfill IndexedDB, Proxy or storage capabilities. ADR 0001 syntax floors
are not a browser test matrix; S00-006 owns product support. If IndexedDB opening
fails (private mode, policy, permissions or security errors), expose unavailable
storage and fail saves honestly. No fake-indexeddb production fallback.
S01 must define exact keys/indexes, normalized account identifiers, save errors,
cancellation, crypto ownership and valid/invalid fixtures before adapter work.
Future tests must add account deletion/suppression, cancelled generations,
every supported migration and native browser quota/restart coverage. New query
requirements, browser incompatibility, unacceptable migration cost or changed
crypto atomicity requirements trigger a bounded ADR revision, never an implicit
wrapper/stack replacement.
## Independent acceptance
QA reviewer auto-qa-4078580caf39 independently repeated fresh-cache npm ci and
all rollback, injected quota-policy and blocked-upgrade assertions on Linux,
Node 24.21.0/npm 11.19.0. Exact lock pins, integrity metadata, installed license
texts and runtime refusal were checked; make check passed 72 tooling tests.
Accepted only the wrapper decision and documented storage policies/fixture
experiments. Native browser quota, disk/crash durability, process restart,
multi-tab behavior, eviction, persistence grants and crypto unlock remain
unverified. S01 contracts and production adapters still require their own work.
See the independent review report for commands, source inspection and limits.
Coordinator owns the review commit.
docs/decisions/0005-browser-matrix.md
+221
View File
@@ -0,0 +1,221 @@
# ADR 0005: Web browser qualification and reference performance passport
- Status: proposed; awaits independent security review of S00-006.
- Task / requirements: S00-006 / NFR-003, NFR-005; specification §27.
- Date: 2026-10-15.
- Decision owner: auto-orchestrator-710c6ba5d8ea (orchestrator).
- Reviewer: assigned security reviewer, not yet recorded.
## Context and decision
Input: accepted ADR 0001, exact requirements, architecture and contract registry,
S00-002 executor/review evidence. Output: one qualification passport with concrete
hardware, browser policy, measurable budgets and permission/fallback procedures.
This decision adds no shared interface, application implementation or dependency.
Budgets are proposed engineering acceptance targets, not observed performance or
a universal SLA. Approval selects reference devices; actual product qualification
requires later browser runs on these devices and the production app.
Select six targets below. The machine-readable table and budget values are in
`experiments/0005-browser-matrix/matrix.json`; this ADR defines their meaning.
| ID | Reference hardware | OS family | Browser / syntax lower bound | CSS viewport / DPR | Modes |
| --- | --- | --- | --- | --- | --- |
| win-chrome | ThinkPad T14 Gen 2 Intel, i5-1135G7, 16 GiB | Windows 11 24H2 x64 | Chrome stable / 111 | 1366×768 / 1 | tab, installed |
| win-edge | Same ThinkPad | Same Windows | Edge stable / 111 | 1366×768 / 1 | tab, installed |
| linux-firefox | Same ThinkPad | Ubuntu 24.04 LTS x64, GNOME Wayland | Firefox stable / 114 | 1366×768 / 1 | tab |
| mac-safari | MacBook Air M1 2020, 8 GiB, 7-core GPU | macOS 15 | Safari stable / 18 | 1280×800 / 2 | tab, installed web app |
| android-chrome | Pixel 6a 128 GB, Tensor, 6 GiB | Android 15 | Chrome stable / 111 | 393×851 / 2.75 | tab, installed |
| ios-safari | iPhone 13 128 GB, A15, 4 GiB | iOS 18 | Safari stable / 18 | 390×844 / 3 | tab, Home Screen |
All measurements use 60 Hz. Desktop SSD, mobile internal storage; leave ≥20%
free. Mobile portrait, standard display scaling/font size, browser UI expanded
at navigation; record actual inner viewport after browser chrome. Desktop set
window inner viewport explicitly. Also test mobile landscape, 320 CSS px width,
wide 1440 CSS px, keyboard/IME, dark mode, 200% text/zoom and reduced motion as
functional variants; they are not substitutes for physical performance devices.
Support policy: qualify the vendor-supported stable build available for each OS
at release cutoff, then freeze its full build in the run record. Floors above
come from ADR 0001, with Safari 18 selected for the named OS families; they do
not authorize using obsolete vulnerable builds online or promise support for all
versions since the floor. If an OS/browser is no longer vendor supported at the
cutoff, revise this passport through review before qualification. Beta/dev,
embedded webviews, other iOS browsers, private profiles and extensions are not
qualified targets. Private/blocked storage must still fail honestly.
Exact patch versions are intentionally resolved at qualification, rather than
inventing future release pins now. Every run MUST supply all `freeze_fields` in
the JSON: full OS/browser build, acquisition source and installer hash (or Apple
OS build), app/asset/fixture hashes, profile reset recipe, tools, time, actual
viewport/DPR/refresh rate and network settings. Archive synthetic fixtures and
build assets with the record. A record saying only “latest” or “stable” is
invalid. Retest the frozen builds for comparison; qualify a new stable version
with a new record after security updates. No automatic acceptance carries over.
Physical devices may be rented/lab-owned; no claim of their availability here.
Emulation/Playwright WebKit alone cannot qualify Safari or mobile hardware.
## PWA and capability policy
Tab mode is primary. Installation is optional progressive enhancement, not a
native Desktop/Android client. No automatic install prompt is assumed. Firefox
uses tab mode in this passport. iOS ordinary Safari tab has no promised Web Push;
Home Screen mode with granted permission, valid subscription and configured
provider is a separate required push scenario. No installation mode promises
continuous sockets/media after hiding, locking, closing or terminating browser.
Resume requires reconciliation; password re-entry/unlock follows its accepted
policy. No offline send/delivery guarantee is introduced.
The JSON `fallbacks` table is normative for all six targets. Probe capabilities
and actual initialization outcomes, not user agent names. Missing required
crypto/secure transport blocks the protected operation. Missing optional media,
location, push, install or biometric capability disables only the dependent
feature and gives a reason. Synthetic fixtures never replace production crypto,
IndexedDB or transports. Storage failure and eviction follow accepted ADR 0004;
this cache budget does not revise persistence schemas or unlock policy.
## Budgets and measurement protocol
| Metric | Desktop | Mobile | Gate |
| --- | --- | --- | --- |
| Cold startup p95 | 2500 ms | 4000 ms | navigation start → usable local shell |
| Warm startup p95 | 1200 ms | 2000 ms | same end point, cached assets/history |
| Action → painted result p95 | 100 ms | 150 ms | open chat, select, type, scroll |
| rAF gap p95 / maximum | 20 / 100 ms | 25 / 150 ms | foreground scripted scroll, 60 Hz |
| Peak app process RAM | 350 MiB | 250 MiB | 10-minute non-call session |
| Retained RAM growth | 30 MiB | 25 MiB | final settled minute minus first |
| Disposable cache ceiling | 128 MiB | 64 MiB | all accounts combined per origin |
Protocol for a later production qualification (not executed in this task):
1. Build production assets with accepted ADR 0001 pins and lockfile. Serve via
valid HTTPS with ordinary certificate validation; no dev server timings. Use
no extensions, other tabs or competing foreground apps; power connected,
power saver off, thermal nominal, ≥50% battery. Record OS/browser builds and
tool versions before runs. Disable diagnostics during timing except required
trace collection. Keep measurements with tracing separately labeled.
2. Deterministic synthetic dataset: one active account, 100 conversations × 100
messages, text `message-00000` through `message-09999`, each padded with ASCII
`x` to 512 characters; 50 visible messages in selected chat. No real JIDs,
credentials or conversations. Seed through future test fixture adapters, not
production authentication bypass. Hash the exact serialized fixture and seed
script; check local row count before each run. Cache workload: 1 MiB synthetic
byte blobs until the ceiling plus two blobs. No audio/video running in the RAM
workload; call/media owners must later define separate active-call budgets.
3. Controlled network: 10 Mbit/s download, 2 Mbit/s upload, 80 ms round-trip,
zero intentional loss, no CPU throttle. Use a recorded external shaper for
physical devices; record tool version/config and measured throughput/RTT to
fixture host. WSS/MAM/server latency is measured separately and not part of
usable-local-shell time. “Ready” means conversation list and 50 local messages
painted, composer focusable and input accepted. Login/unlock/password human
time is excluded and reported separately. Never mark connected/crypto ready
merely to satisfy this local timing gate.
4. Thirty cold runs: retain seeded IndexedDB, clear HTTP/disposable asset cache
and unregister prior service worker, terminate browser, reopen at target URL.
“Cold” here means application asset cold, not OS disk cold. Thirty warm runs:
first prime assets/worker and fixture, close tab and reopen with same profile.
Installed/Home Screen mode repeats both sequences and reports separately.
Record navigation start and app-ready mark using Performance API; confirm
visible ready UI in trace/screenshot. Report raw runs, failures and p95 via
sorted nearest-rank ceil(0.95*n). Do not discard slow runs or mix modes.
5. For each mode collect 100 actions each (open chat, select message, type one
character, scroll one viewport), paced 500 ms apart; 60 seconds continuous
deterministic scroll. Measure input timestamp → frame containing changed UI
with browser performance trace. A double-rAF marker is only a proxy and must
be labeled. Collect rAF timestamps in foreground; compute consecutive gaps,
p95 and maximum. Record hidden/throttled runs separately, not as foreground
passes. Any action failure fails function regardless of percentile.
6. RAM: record baseline blank profile browser process tree, then sample app
renderer/WebContent plus dedicated workers every second during 10 minutes of
repeated chat switching/scrolling. Chromium task manager/process trace,
Firefox about:processes plus OS RSS, Safari WebContent/worker OS RSS (macOS
Activity Monitor; iOS Instruments on physical device). Use isolated browser
profile so shared workers are attributable. Report sum RSS and baseline
separately, not JS heap as total RAM. Peak must fit ceiling; last-minute
median minus first-minute median must fit growth budget, with no forced GC.
If attribution/tool access is unavailable, RAM gate is unverified, never 0.
7. Cache: sum owned disposable asset/media payload bytes with adapter inventory;
compare browser origin storage estimate as advisory, not exact cache size.
Limit is min(reference ceiling, 10% reported quota) when estimate available;
if unavailable, use reference ceiling and stop on actual quota error. Before
admitting another blob evict disposable LRU entries or reject the write;
never exceed budget deliberately. History, crypto/trust and pending unsynced
work are excluded from disposable cache and must not be evicted by this gate.
Confirm counts after reopen; inject QuotaExceededError and test actual device
low-disk failure separately. No checkpoint advance on save failure. Browser
may evict the entire origin: verify explicit recovery state after user clear.
Pass each target/mode independently; a fast desktop cannot offset mobile failure.
These numbers are initial product targets chosen for responsiveness and bounded
resources, not a benchmark derived from the small S00-002 counter. Later measured
infeasibility requires reviewed budget/device change, not silently relaxing gates.
## Contextual permissions and negative scenarios
For each target AND mode, run the following against a trusted HTTPS test origin
with synthetic identities. Fresh profile has no prompts at startup. Trigger only
via explicit relevant action: Start call/record (mic/camera), Send location
(geolocation), Enable notifications (push), Enable unlock (only S00-007 policy).
Storage persistence request must explain context rather than masquerade as login.
| State | Reproduction | Required observation |
| --- | --- | --- |
| prompt / granted | Reset site and OS permissions; invoke each action and grant | Only requested capability activates; no unrelated permission prompt |
| denied | Deny browser prompt, then deny at OS level separately | Reason/actionable settings path; text still usable; no retry prompt loop |
| hardware missing | Disconnect USB camera/mic on desktop; use OS-disabled device on mobile | Capture fails honestly; camera-only failure may offer working audio |
| revoked during session | Start capture then revoke site/OS permission; unplug device; separately revoke location/notification permission | End/reconcile capture, stop watches; clear usable/push state on observed failure or resume; no stale success |
| unsupported | Disable API via test-only fixture boundary or use naturally absent mode | Each JSON fallback observed, protected operations remain blocked |
| ignored prompt / busy | Leave prompt unanswered then cancel action; separately hold camera in another app | Pending is cancellable; late grant is stopped/ignored; busy error not labeled denial |
| lifecycle / loss | Hide, lock, sleep, offline, close, reopen; remove subscription and clear origin | No continuous session promise; resync/unlock and explain lost local state |
A Permissions API query may be unsupported for a descriptor: catch failure and
rely on real API result and track/error events; recheck on focus/resume. Revocation
may arrive through track ended or subsequent failed operation, not a uniform
permission event. Include denied→settings grant→explicit retry and account switch
while prompt pending. Do not log coordinates, device labels, endpoints or secrets.
Screenshots contain synthetic UI only. Browser/OS policy injection is labeled as
fixture evidence; it does not prove physical device revoke or hardware absence.
## Candidates, sources and constraints
Primary sources inspected 2026-10-15; these describe mechanisms, not results on
our selected devices:
- [Vite build compatibility](https://vite.dev/guide/build.html): syntax floors and
lack of automatic API polyfills. The matrix does not change ADR 0001 targets.
- [Chrome release channels](https://developer.chrome.com/docs/web-platform/chrome-release-channels):
stable qualification is chosen over beta/dev; exact run builds still required.
- [WebKit iOS Web Push](https://webkit.org/blog/13878/web-push-for-web-apps-on-ios-and-ipados/):
Home Screen eligibility and direct user interaction for permission requests.
- [Media Capture and Streams](https://www.w3.org/TR/mediacapture-streams/):
permission/device errors and track lifecycle underpin media negative scenarios.
- [Permissions](https://www.w3.org/TR/permissions/): permission state and change
handling; implementation support for individual descriptors remains conditional.
- [Storage Standard](https://storage.spec.whatwg.org/): persistence/estimates are
browser controlled; ceilings are application policy, not guaranteed disk quota.
- [Web Authentication Level 3](https://www.w3.org/TR/webauthn-3/): authenticator
operations do not establish a universal browser hardware-backed storage vault.
Rejected: Chromium-only coverage (misses independent engines/iOS behavior),
“all modern browsers” without reference hardware, emulator-only performance,
unconditional PWA push/background claims and frozen obsolete online binaries.
A broad rolling channel without recorded full builds is also insufficient.
Selected: bounded three-engine/six-target qualification with immutable run records.
No added libraries: dependency license review is not needed for this document and
stdlib checker. Existing stack/library notices remain with their respective ADRs.
No secrets, crypto implementation, network proxy, CORS/TLS exception or application
module is introduced. S01 contracts and downstream performance/browser/provider
implementation tasks retain ownership of exact adapter and telemetry interfaces.
## Focused experiment and actual result
`python3 experiments/0005-browser-matrix/check.py` validates the passport's target
coverage, reproduction fields, budget consistency and fallback coverage; negative
mutations prove incomplete targets, missing fallback and relaxed guards fail.
This is document/fixture validation only. No physical reference device, browser
permission behavior, production startup/RAM/render/cache measurement or provider
integration was executed. Their procedures above are external qualification
checks, not passed results. S00-006 selects a passport; it does not certify release.
Acceptance/qualification failure, OS vendor support ending, new engine/API need,
or changed resource workload requires a separately reviewed passport revision.
experiments/0000-scope/check.py
+69
View File
@@ -0,0 +1,69 @@
"""Check the scope passport against canonical applicability and WEB-002 limits.
Document-only experiment; no product runtime or provider connection is simulated.
"""
import json
import re
from pathlib import Path
ROOT = Path(__file__).resolve().parents[2]
ID = re.compile(r"\| ((?:[A-Z]+-)+\d{3}) \| (.+?) \| (.+?) \|")
STATES = {"foreground", "hidden", "closed-tab", "browser-terminated",
"permission-denied", "offline", "logged-out"}
def check(document, requirements):
excluded = {r["id"] for r in requirements if r["applicability"] == "out_of_scope"}
rows = ID.findall(document)
assert len(rows) == len({r[0] for r in rows}), "Duplicate excluded ID"
assert {r[0] for r in rows} == excluded, "Excluded coverage differs from canonical registry"
for rid, reason, retained in rows:
assert len(reason.strip()) >= 40, f"Missing substantive reason: {rid}"
assert len(retained.strip()) >= 30, f"Missing Web boundary: {rid}"
entry = next(r for r in requirements if r["id"] == rid)
assert f"**{rid}.**" in (ROOT / entry["source"]).read_text(), rid
lifecycle = {}
for line in document.splitlines():
cells = [c.strip() for c in line.split("|")[1:-1]]
if cells and cells[0] in STATES:
assert len(cells) == 5 and cells[0] not in lifecycle, "Malformed lifecycle row"
lifecycle[cells[0]] = cells[1:]
assert set(lifecycle) == STATES, "Incomplete lifecycle scenarios"
assert all(v in {"conditional", "none", "not-guaranteed"}
for row in lifecycle.values() for v in row), "Unsupported guarantee"
for state in {"closed-tab", "browser-terminated", "offline", "logged-out"}:
row = lifecycle[state]
assert row[0] == "none" and row[2:] == ["none", "none"], f"False session/media promise: {state}"
assert lifecycle["hidden"][0] == "not-guaranteed", "Hidden socket continuity promise"
assert lifecycle["closed-tab"][1] == "conditional", "Push confused with session or guaranteed delivery"
assert lifecycle["permission-denied"][1:] == ["none"] * 3, "Denied permissions bypassed"
assert lifecycle["logged-out"] == ["none"] * 4, "Logout reactivation promise"
return len(excluded), len(lifecycle)
def main():
document = (ROOT / "docs/decisions/0000-scope.md").read_text()
requirements = json.loads((ROOT / "planning/requirements.json").read_text())
counts = check(document, requirements)
mutations = [
re.sub(r"^\| ACC-003 \|.*\n", "", document, flags=re.M),
re.sub(r"^\| ACC-003 \|.*$", "| ACC-003 | | |", document, flags=re.M),
document.replace("| closed-tab | none | conditional | none | none |",
"| closed-tab | conditional | conditional | none | none |"),
document.replace("| closed-tab | none | conditional | none | none |",
"| closed-tab | none | conditional | conditional | none |"),
]
for index, mutant in enumerate(mutations, 1):
assert mutant != document, "Negative fixture did not mutate document"
try:
check(mutant, requirements)
except AssertionError:
continue
raise AssertionError(f"False passport accepted: mutation {index}")
print(f"PASS: {counts[0]} excluded IDs match registry/specs with reasons; "
f"{counts[1]} lifecycle scenarios; {len(mutations)} negative mutations rejected.")
print("LIMIT: document validation only; browser/provider behavior is untested.")
if __name__ == "__main__":
main()
experiments/0001-stack/.gitignore
+2
View File
@@ -0,0 +1,2 @@
node_modules/
dist/
experiments/0001-stack/.npmrc
+4
View File
@@ -0,0 +1,4 @@
engine-strict=true
save-exact=true
registry=https://registry.npmjs.org/
strict-ssl=true
experiments/0001-stack/.nvmrc
+1
View File
@@ -0,0 +1 @@
24.21.0
experiments/0001-stack/LICENSE_INVENTORY.md
+73
View File
@@ -0,0 +1,73 @@
# Locked dependency license inventory
Registry/package metadata inspected on 2026-10-15. Exact versions and integrity are in package-lock.json. Optional platform packages are included here even when not installed on macOS ARM64.
| Package | Version | SPDX license |
| --- | --- | --- |
| @oxc-project/types | 0.154.0 | MIT |
| @rolldown/binding-android-arm-eabi | 1.2.14 | MIT |
| @rolldown/binding-android-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-x64 | 1.2.14 | MIT |
| @rolldown/binding-freebsd-x64 | 1.2.14 | MIT |
| @rolldown/binding-linux-arm-gnueabihf | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-musl | 1.2.14 | MIT |
| @rolldown/binding-linux-ppc64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-s390x-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-musl | 1.2.14 | MIT |
| @rolldown/binding-openharmony-arm64 | 1.2.14 | MIT |
| @rolldown/binding-win32-arm64-msvc | 1.2.14 | MIT |
| @rolldown/binding-win32-x64-msvc | 1.2.14 | MIT |
| @rolldown/pluginutils | 1.0.1 | MIT |
| @types/react | 19.3.0 | MIT |
| @types/react-dom | 19.3.0 | MIT |
| @typescript/typescript-aix-ppc64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-darwin-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-darwin-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-freebsd-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-freebsd-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-arm | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-loong64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-mips64el | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-ppc64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-riscv64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-s390x | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-netbsd-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-netbsd-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-openbsd-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-openbsd-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-sunos-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-win32-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-win32-x64 | 7.0.2 | Apache-2.0 |
| csstype | 3.2.3 | MIT |
| detect-libc | 2.1.2 | Apache-2.0 |
| fdir | 6.5.0 | MIT |
| fsevents | 2.3.3 | MIT |
| lightningcss | 1.33.0 | MPL-2.0 |
| lightningcss-android-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-freebsd-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm-gnueabihf | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-win32-arm64-msvc | 1.33.0 | MPL-2.0 |
| lightningcss-win32-x64-msvc | 1.33.0 | MPL-2.0 |
| nanoid | 3.3.20 | MIT |
| picocolors | 1.1.1 | ISC |
| picomatch | 4.0.7 | MIT |
| postcss | 8.5.30 | MIT |
| react | 19.3.1 | MIT |
| react-dom | 19.3.1 | MIT |
| rolldown | 1.2.14 | MIT |
| scheduler | 0.28.0 | MIT |
| source-map-js | 1.2.2 | BSD-3-Clause |
| tinyglobby | 0.2.17 | MIT |
| typescript | 7.0.2 | Apache-2.0 |
| vite | 8.3.4 | MIT |
experiments/0001-stack/README.md
+45
View File
@@ -0,0 +1,45 @@
# S00-002 rendering spike
One local React/TypeScript/Vite experiment for ADR 0001. The registry-access/
subdirectory belongs to the reviewed S00-011 probe and is retained unchanged.
No account, network messaging, crypto, media, service worker or application
scaffold is implemented here.
## Reproduce
Use Node **24.21.0** with bundled npm **11.19.0**. `.nvmrc` is a pin for an
existing version manager; installing the spike never changes system runtimes.
Official binaries: https://nodejs.org/dist/v24.21.0/ — verify the selected archive
against SHASUMS256.txt with normal TLS trust. On this executor, the verified
macOS ARM64 runtime was unpacked at
`/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64`.
From this directory with the pinned runtime's bin directory first on PATH:
```sh
node --version
npm --version
npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-review-cache --fetch-retries=0 --fetch-timeout=15000
npm run build
npm run preview -- --port 4173 --strictPort
```
Use a new cache path for a network/clean-cache check. npm ci itself removes old
node_modules and fails on lock/manifest mismatch. Keep optional platform packages
enabled; TypeScript/Vite use platform binaries and build succeeds without
lifecycle scripts. TLS verification and exact engine checks remain enabled.
The private package is not published. npm install is only for explicitly reviewed
lockfile updates, not normal reproduction.
Open `http://127.0.0.1:4173` locally: expect “Luma rendering spike” and “Count: 0”.
Click Increment twice: expect Count: 2. This is the manual DOM/interaction check;
it was **not run** because this harness exposes no browsers. Build/typechecking
were run successfully. Stop the server with Ctrl-C. `npm run dev` is available
for source development; no React refresh plugin is installed.
Build output/node_modules are ignored. The browser bundle is static and requires
no Node server. Explicit compiler floors: Chrome/Edge 111, Firefox 114, Safari
16.4, with no API polyfills; the product browser matrix is a later decision.
Preserve THIRD_PARTY_NOTICES.md when distributing this bundle; full lock graph
licenses are in LICENSE_INVENTORY.md. CI, release notice automation, app tests
and cryptographic/protocol compatibility remain subsequent tasks.
experiments/0001-stack/THIRD_PARTY_NOTICES.md
+78
View File
@@ -0,0 +1,78 @@
# Third-party notices for the rendering bundle
The browser bundle contains React, React DOM and Scheduler. Build-tool licenses are listed in LICENSE_INVENTORY.md; installed packages retain their license files. No build tool is shipped as a browser runtime. Preserve these notices when distributing this spike.
## react 19.3.1
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## react-dom 19.3.1
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## scheduler 0.28.0
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
experiments/0001-stack/index.html
+5
View File
@@ -0,0 +1,5 @@
<!doctype html>
<html lang="en">
<head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Luma stack spike</title></head>
<body><div id="root"></div><script type="module" src="/src/main.tsx"></script></body>
</html>
experiments/0001-stack/package-lock.json
Generated
+1268
View File
File diff suppressed because it is too large. Load diff
experiments/0001-stack/package.json
+26
View File
@@ -0,0 +1,26 @@
{
"name": "luma-stack-rendering-spike",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
},
"packageManager": "npm@11.19.0",
"scripts": {
"build": "node tools/check-runtime.mjs && tsc --noEmit && vite build",
"dev": "vite --host 127.0.0.1",
"preview": "vite preview --host 127.0.0.1"
},
"dependencies": {
"react": "19.3.1",
"react-dom": "19.3.1"
},
"devDependencies": {
"@types/react": "19.3.0",
"@types/react-dom": "19.3.0",
"typescript": "7.0.2",
"vite": "8.3.4"
}
}
experiments/0001-stack/registry-access/.gitignore
+1
View File
@@ -0,0 +1 @@
artifacts/
experiments/0001-stack/registry-access/README.md
+79
View File
@@ -0,0 +1,79 @@
# Verified public npm registry path — S00-011
Input: S00-002 failed to resolve registry.npmjs.org. Output: a repeatable public
metadata and exact-version tarball probe in the current executor harness.
This is connectivity evidence, not a framework choice or an application build.
## Execution environment and reproduction
Verified in the fresh auto-ci-cd-d105e8027730 executor on 2026-10-15:
Node v26.3.0, npm 11.16.0, Python 3, macOS paths. These are observed tools,
not accepted project runtime versions. The supplied harness has network access
enabled, workspace-write sandboxing and approval policy never. No harness,
runner, DNS, proxy, certificate or Git configuration was changed by this task.
The initial working tree contained only the coordinator's state/tasks.json claim.
The next fresh executor must retain network-enabled execution, working DNS and
HTTPS egress to registry.npmjs.org:443, normal certificate trust, and project-only
source writes with temporary writes under /private/tmp. No credentials are needed.
Do not disable TLS or relax the write sandbox. The previous DNS failure was not
reproduced here; its external correction mechanism is unknown. This report does
not promise network availability in a different or future harness.
From the project root:
```sh
npm view react version license engines --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000
python3 experiments/0001-stack/registry-access/verify.py
```
The first command exactly repeats the original failure. It returned exit 0:
```json
{"version":"19.3.1","license":"MIT","engines":{"node":">=0.10.0"}}
```
`npm config get strict-ssl` returned `true` (exit 0). The second command uses a
new TemporaryDirectory under /private/tmp with empty user/global npmrc files
and a fresh cache, runs from there to avoid project npmrc, and removes that
temporary directory after execution. It refuses NODE_TLS_REJECT_UNAUTHORIZED=0.
It invokes these argument arrays via subprocess, without a shell:
```text
npm view react@19.3.1 version license engines dist --json <common-options>
npm pack react@19.3.1 --ignore-scripts --json --pack-destination=<absolute-scope>/artifacts <common-options>
```
The exact common options are:
```text
--registry=https://registry.npmjs.org/ --strict-ssl=true
--fetch-retries=0 --fetch-timeout=15000
--cache=<fresh-temp>/cache --userconfig=<fresh-temp>/user.npmrc
--globalconfig=<fresh-temp>/global.npmrc
```
The probe installs no dependencies, extracts no archive, runs no package scripts
and adds no package manifest/lockfile. React is only a public connectivity sample.
It checks the metadata version and exact HTTPS tarball URL, downloads through
npm, and independently compares Python hashlib SHA-512/base64 with dist.integrity
and npm pack's integrity. It uses standard libraries, not custom cryptography.
Errors/mismatches exit nonzero. Do not print private environment/configuration.
## Actual result
Both child npm commands and verify.py returned exit 0, using the fresh cache:
- Package: react@19.3.1; metadata license MIT.
- URL: https://registry.npmjs.org/react/-/react-19.3.1.tgz
- Retrieved size: 26394 bytes.
- Registry and independently computed integrity:
`sha512-QNhWdt7nrgVWWQG58QuGsAR3jv3Hbe4mb4vz7w2csnHavciZJgda1CPNaldF6eVxv90ud3jUXpKlHL69gO38yw==`
The local `artifacts/` directory contains the tarball, public metadata.json and
result.json; it is deliberately ignored by Git. Rerun the probe for independent
review instead of trusting an archived result. No secrets are recorded. Registry
signature/provenance verification is not claimed; the acceptance check is registry
integrity over verified HTTPS. Browser/CORS, dependency install, build, framework
compatibility and license acceptance remain outside this task. S00-002 must run
its own clean install/build and make its own stack/runtime decision after review.
experiments/0001-stack/registry-access/verify.py
+68
View File
@@ -0,0 +1,68 @@
#!/usr/bin/env python3
"""Fetch public npm metadata/tarball without installing or running package code."""
import base64
import hashlib
import json
import os
from pathlib import Path
import subprocess
import tempfile
ROOT = Path(__file__).resolve().parent
PACKAGE = "react@19.3.1" # Connectivity sample only; not a stack decision.
def main():
if os.environ.get("NODE_TLS_REJECT_UNAUTHORIZED") == "0":
raise SystemExit("Refusing disabled Node TLS verification")
artifacts = ROOT / "artifacts"
artifacts.mkdir(exist_ok=True)
# Empty configuration files prevent inherited npm credentials/config from
# being needed for this public probe. Never print the process environment.
with tempfile.TemporaryDirectory(prefix="luma-registry-", dir="/private/tmp") as temp:
temp = Path(temp)
for name in ("user.npmrc", "global.npmrc"):
(temp / name).write_text("", encoding="utf-8")
common = [
"--registry=https://registry.npmjs.org/", "--strict-ssl=true",
"--fetch-retries=0", "--fetch-timeout=15000",
f"--cache={temp / 'cache'}", f"--userconfig={temp / 'user.npmrc'}",
f"--globalconfig={temp / 'global.npmrc'}",
]
def npm(args):
# Run outside the project so no project .npmrc is inherited.
result = subprocess.run(["npm", *args, *common], cwd=temp,
check=True, capture_output=True, text=True,
timeout=60)
print("npm " + " ".join(args) + " [isolated TLS/cache options]: exit 0")
return json.loads(result.stdout)
metadata = npm(["view", PACKAGE, "version", "license", "engines", "dist", "--json"])
if metadata["version"] != "19.3.1":
raise SystemExit("Unexpected package version")
if metadata["dist"]["tarball"] != "https://registry.npmjs.org/react/-/react-19.3.1.tgz":
raise SystemExit("Unexpected tarball origin/path")
integrity = metadata["dist"]["integrity"]
algorithm, expected = integrity.split("-", 1)
if algorithm != "sha512":
raise SystemExit("Expected SHA-512 registry integrity")
base64.b64decode(expected, validate=True)
packed = npm(["pack", PACKAGE, "--ignore-scripts", "--json",
f"--pack-destination={artifacts}"])
if len(packed) != 1 or packed[0]["filename"] != "react-19.3.1.tgz":
raise SystemExit("Unexpected pack output")
tarball = artifacts / "react-19.3.1.tgz"
actual = "sha512-" + base64.b64encode(hashlib.sha512(tarball.read_bytes()).digest()).decode("ascii")
if actual != integrity or packed[0]["integrity"] != integrity:
raise SystemExit("Tarball integrity mismatch")
(artifacts / "metadata.json").write_text(json.dumps(metadata, indent=2) + "\n", encoding="utf-8")
result = {"package": PACKAGE, "bytes": tarball.stat().st_size,
"integrity": actual, "registry_integrity_match": True}
print(json.dumps(result, indent=2))
(artifacts / "result.json").write_text(json.dumps(result, indent=2) + "\n", encoding="utf-8")
if __name__ == "__main__":
main()
experiments/0001-stack/src/main.tsx
+20
View File
@@ -0,0 +1,20 @@
import { useState } from 'react';
import { createRoot } from 'react-dom/client';
function RenderingSpike() {
const [count, setCount] = useState(0);
return (
<main>
<h1>Luma rendering spike</h1>
<p>Local UI experiment; no account or transport.</p>
<button type="button" onClick={() => setCount(value => value + 1)}>
Increment
</button>
<output aria-live="polite">Count: {count}</output>
</main>
);
}
const root = document.getElementById('root');
if (!root) throw new Error('Missing rendering root');
createRoot(root).render(<RenderingSpike />);
experiments/0001-stack/tools/check-runtime.mjs
+6
View File
@@ -0,0 +1,6 @@
if (process.versions.node !== '24.21.0') {
throw new Error(`Expected Node 24.21.0, got ${process.versions.node}`);
}
if (!process.env.npm_config_user_agent?.startsWith('npm/11.19.0 ')) {
throw new Error('Run build with npm 11.19.0');
}
experiments/0001-stack/tsconfig.json
+19
View File
@@ -0,0 +1,19 @@
{
"compilerOptions": {
"target": "ES2022",
"lib": [
"ES2022",
"DOM",
"DOM.Iterable"
],
"module": "ESNext",
"moduleResolution": "Bundler",
"jsx": "react-jsx",
"strict": true,
"noEmit": true,
"skipLibCheck": false
},
"include": [
"src"
]
}
experiments/0001-stack/vite.config.js
+1
View File
@@ -0,0 +1 @@
export default { build: { target: ['chrome111', 'edge111', 'firefox114', 'safari16.4'] } };
experiments/0002-xmpp-library/environment-access/.npmrc
+4
View File
@@ -0,0 +1,4 @@
engine-strict=true
strict-ssl=true
ignore-scripts=true
registry=https://registry.npmjs.org/
experiments/0002-xmpp-library/environment-access/README.md
+81
View File
@@ -0,0 +1,81 @@
# S00-020 Linux environment access probe
Normal configured HTTPS access, authorized by the assigned environment-access
probe and this session's enabled network, succeeded on 2026-10-15. The previous
configured-proxy DNS failure did not reproduce. No proxy/environment/system
configuration was changed and no alternate network route was selected. No
separate environment-owner connectivity statement was supplied; the evidence is
actual access through the existing configured path, not an assertion about an
administrator's network changes.
Run from the project root on Linux x86_64 with Python supporting tarfile's
`data` extraction filter (Python 3.12+ recommended), curl and xz support:
```sh
python3 experiments/0002-xmpp-library/environment-access/verify.py
```
The probe retrieves the official Node 24.21.0 Linux x64 archive and vendor
SHASUMS256.txt through verified HTTPS. It checks SHA256 before safe extraction
into a fresh `/tmp/luma-S00-026-*` directory, executes exact Node 24.21.0 and
npm 11.19.0, and installs byte-identical parent manifest/lock copies here using
`npm ci --ignore-scripts --strict-ssl=true --engine-strict=true` with a fresh
isolated cache. All eight locked dependencies retain HTTPS registry URLs and
SHA512 integrity. It checks every installed version, unchanged manifest/lock
bytes and a real Stanza createClient import. Any command/check failure exits
unsuccessfully; `result.json` records the last successful run only.
`SHASUMS256.txt` preserves retrieved vendor checksum material; `result.json`
records the verified archive hash, input hashes and temporary paths. Reviewer
should repeat the probe with fresh retrieval, rather than trust these reports.
The runtime/archive/cache remain temporary, node_modules is Git-ignored, and no
system installation is performed. These paths are available to later local
sessions until temporary storage is removed; rerun the probe if absent.
No TLS/proxy/engine bypass, dependency additions, stack/lock/spec modification,
credentials, real messages, npm lifecycle scripts or Git mutations. The copied
parent graph was already inspected in prior experiment tasks; this probe adds
no dependency or library-selection decision. Node/npm retain their distribution
license files; dependency notices remain in the existing experiment inventories.
Checksum verification trusts the vendor HTTPS origin; no detached signature,
package provenance/advisory audit, browser/WSS authentication, application build
or interoperability claim is made. The S00-026 access prerequisite and S00-024 continuation checkpoint are now
independently accepted. S00-020 is submitted for its own independent QA review;
S00-003 remains separate unfinished work. Historical checkpoints follow.
## S00-024 continuation checkpoint
On 2026-10-15 executor auto-ci-cd-49907d48a6d1 repeated the existing probe
successfully after independent S00-026 acceptance. The interrupted environment
restoration can now be reviewed: official HTTPS checksum/archive retrieval,
Node v24.21.0/npm 11.19.0 execution, fresh-cache installation of eight unchanged
parent locked packages and actual Stanza 12.22.1 import all passed. result.json
contains this session's temporary paths. No probe implementation change was
needed; S00-026 supplied the missing access and verification artifacts.
After independent S00-024 review, a fresh S00-020 executor should rerun the
command above, verify result.json and use its runtime_bin with an isolated cache
within its own card. Host Node/npm are not the pinned runtime. Temporary paths
can expire. This checkpoint does not install dependencies into the parent
experiment or complete S00-020/S00-003; their own acceptance remains required.
## S00-020 environment restoration result
On 2026-10-15 executor auto-ci-cd-2a0186c54ce9 repeated the reviewed probe in
this fresh assigned session. Official checksum/archive HTTPS retrieval succeeded
through the existing configured route. Vendor SHA256 matched before extraction;
Linux Node v24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed all eight
unchanged parent locked dependencies and Stanza 12.22.1 createClient imported.
Separate assertions rechecked downloaded artifacts, copied input hashes, every
installed version and effective strict TLS/engine/script settings. No probe code,
parent manifest/lock, stack, specs or network/system configuration changed.
See state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md and the current result.json.
QA must rerun verify.py with fresh retrieval and inspect scope before accepting
S00-020. After its reviewed acceptance the coordinator may assign S00-003 to a
fresh executor. That executor can use result.json runtime_bin for pinned tools;
the verified Stanza installation is confined here, not in the parent experiment.
The parent task must perform its own scoped dependency installation and WSS/
authentication checks. Temporary paths may expire; rerun the probe if needed.
No browser, WSS, application readiness or interoperability result is supplied.
experiments/0002-xmpp-library/environment-access/SHASUMS256.txt
+34
View File
@@ -0,0 +1,34 @@
aec7b2464afb99f078c19cb06d201d543bd3b311cba071282bce1b17c97e58bb node-v24.21.0-aix-ppc64.tar.gz
22ca85110f26015696a3fa9216bc372ae65203d170622eaf7d211e2dd5bb49e3 node-v24.21.0-arm64.msi
bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057 node-v24.21.0-darwin-arm64.tar.gz
6239d4cf92d864487ec8cd3615038f7b67e7f58b77b21cd2f09ea9fbd68065fe node-v24.21.0-darwin-arm64.tar.xz
1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097 node-v24.21.0-darwin-x64.tar.gz
0ae5a24c24bb7d015cd816c5036b3f90f2945aa872fcf54e58da054753b3a299 node-v24.21.0-darwin-x64.tar.xz
57c6bee2e30bbbee5bd51d6cc343eb992e174b56a2a1d0eab7a7510771c20ea2 node-v24.21.0-headers.tar.gz
7497abc2fac1d332fae580046b6b39d0de283dfaf267207a32b59753739c1517 node-v24.21.0-headers.tar.xz
724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5 node-v24.21.0-linux-arm64.tar.gz
6ad1325edbdb5649c379b75a237147a666c95d4f9ae8d340fef2d1575d289ad2 node-v24.21.0-linux-arm64.tar.xz
51c5d53066ee92920b61783b03b06ecb99f3661160f7b15ca77e8474115a67bc node-v24.21.0-linux-ppc64le.tar.gz
1936fd64623a2f98d1fb31b456686d10c30e92639899cfefdefa8835d22adccd node-v24.21.0-linux-ppc64le.tar.xz
5f2fa37422e0c75de35c1686fe51d78324f2c2a8fe2cc239a41d9c000a29d938 node-v24.21.0-linux-s390x.tar.gz
2ef7e2ecbf7a6c2f3d08d106f6b2f279419c6dac89fe91b8cad193af7890082c node-v24.21.0-linux-s390x.tar.xz
3d63405fc65a0d2d2976c1f0bc2fd27bb0bd07212469e705aac3f03ae5ab4c9c node-v24.21.0-linux-x64-musl.tar.gz
34ab095af8efe9018f21489d3dc19871fb5edd4f130a71469b69c05fd4e32a5e node-v24.21.0-linux-x64-musl.tar.xz
6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff node-v24.21.0-linux-x64.tar.gz
fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6 node-v24.21.0-linux-x64.tar.xz
848cc8d138b712b5ae0f38de08fde62feb404226a63dde07d0ea5ccddbbd9dd7 node-v24.21.0-win-arm64.7z
8779b1bde1d39f8d420e3b57aa657b39891af434d3de44a919044cec06785921 node-v24.21.0-win-arm64.zip
4e5f86609712acf841f3a5e2d9d4854b4c149f6ead024fc38381b6d7b272c636 node-v24.21.0-win-x64.7z
158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541 node-v24.21.0-win-x64.zip
bb0eaee134f9357f22aea915ee793343e627aefc1e66488164bac6915bce2cac node-v24.21.0-x64.msi
9831a74b04c270a429bd5a240e37712c4fe229b02b032e18ff2e0702c17c20fd node-v24.21.0.pkg
622424efb5dc0c26c93fbb619ff10737ee289c605b837c88778e186925d82777 node-v24.21.0.tar.gz
a6f54defb6fd7c84f41dba13d61e78e9b4e0961712cf61f29715c05f5ced94fc node-v24.21.0.tar.xz
dff59da18b6ffe1bf1ca99e1d2af4906080c481740619f5b5098c0fca28bd9b7 win-arm64/node.exe
2c0c3215d59c09d7c136da4949696dae121a299e9bdfc64cd9130a58610af63d win-arm64/node.lib
32ce76dd79deddcf6e08f612da714fc3a28fa39c0e4fe12283e019a90eb76483 win-arm64/node_pdb.7z
d565f0a7a8eda1662886475471e454dbe2c2a53c9d1a8562fc986bd11c24fd72 win-arm64/node_pdb.zip
ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32 win-x64/node.exe
a0a84aa03917b578d286010b7521837e9ff1136ffb2e4a406c14316c33fd06f7 win-x64/node.lib
0df783d02aee58bbe9dcfc157ccc5cc37987d24c4f35889587b39500b12030a9 win-x64/node_pdb.7z
122f2af58bfb25816f12e49179217c3ff5bf96c1e083f3ccb0969a5b4794ff85 win-x64/node_pdb.zip
experiments/0002-xmpp-library/environment-access/package-lock.json
Generated
+99
View File
@@ -0,0 +1,99 @@
{
"name": "luma-xmpp-library-spike",
"version": "0.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "luma-xmpp-library-spike",
"version": "0.0.0",
"dependencies": {
"stanza": "12.22.1"
},
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
}
},
"node_modules/@types/node": {
"version": "22.20.5",
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
"license": "MIT",
"dependencies": {
"undici-types": "~6.21.0"
}
},
"node_modules/@types/punycode": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
"license": "MIT"
},
"node_modules/@types/ws": {
"version": "8.18.2",
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
"license": "MIT",
"dependencies": {
"@types/node": "*"
}
},
"node_modules/punycode": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
"license": "MIT",
"engines": {
"node": ">=6"
}
},
"node_modules/sdp": {
"version": "3.2.2",
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
"license": "MIT"
},
"node_modules/stanza": {
"version": "12.22.1",
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
"license": "MIT",
"dependencies": {
"@types/node": "^22.0.0",
"@types/punycode": "^2.1.0",
"@types/ws": "^8.18.1",
"punycode": "^2.1.1",
"sdp": "^3.0.2",
"ws": "^8.18.2"
}
},
"node_modules/undici-types": {
"version": "6.21.0",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
"license": "MIT"
},
"node_modules/ws": {
"version": "8.22.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
},
"peerDependencies": {
"bufferutil": "^4.0.1",
"utf-8-validate": ">=5.0.2"
},
"peerDependenciesMeta": {
"bufferutil": {
"optional": true
},
"utf-8-validate": {
"optional": true
}
}
}
}
}
experiments/0002-xmpp-library/environment-access/package.json
+10
View File
@@ -0,0 +1,10 @@
{
"name": "luma-xmpp-library-spike",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {"node": "24.21.0", "npm": "11.19.0"},
"packageManager": "npm@11.19.0",
"scripts": {"test": "node --test test/*.test.mjs"},
"dependencies": {"stanza": "12.22.1"}
}
experiments/0002-xmpp-library/environment-access/result.json
+20
View File
@@ -0,0 +1,20 @@
{
"platform": "Linux x86_64",
"origin": "https://nodejs.org/dist/v24.21.0/",
"archive": "node-v24.21.0-linux-x64.tar.xz",
"archive_sha256": "fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6",
"versions": {
"node": "v24.21.0",
"npm": "11.19.0"
},
"runtime_bin": "/tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin",
"cache": "/tmp/luma-S00-026-j1pmys7w/npm-cache",
"parent_sha256": {
"package.json": "e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766",
"package-lock.json": "9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05"
},
"locked_packages": 8,
"stanza": "12.22.1",
"import_check": "Stanza createClient import passed",
"checksum_method": "Vendor HTTPS SHASUMS256.txt; no detached signature check"
}
experiments/0002-xmpp-library/environment-access/verify.py
+82
View File
@@ -0,0 +1,82 @@
#!/usr/bin/env python3
"""Repeat the bounded Linux x64 environment probe; never install system tools."""
import hashlib
import json
import os
from pathlib import Path
import platform
import shutil
import subprocess
import tarfile
import tempfile
HERE = Path(__file__).resolve().parent
PARENT = HERE.parent
ARCHIVE = 'node-v24.21.0-linux-x64.tar.xz'
ORIGIN = 'https://nodejs.org/dist/v24.21.0/'
def run(argv, **kwargs):
return subprocess.check_output(argv, text=True, **kwargs).strip()
def digest(path):
return hashlib.sha256(path.read_bytes()).hexdigest()
def main():
if (platform.system(), platform.machine()) != ('Linux', 'x86_64'):
raise SystemExit('This probe requires Linux x86_64; no alternate runtime is selected.')
work = Path(tempfile.mkdtemp(prefix='luma-S00-026-'))
for name in ('SHASUMS256.txt', ARCHIVE):
subprocess.run(['curl', '--fail', '--silent', '--show-error',
'--proto', '=https', '--connect-timeout', '10',
'--max-time', '60', ORIGIN + name, '-o', str(work / name)], check=True)
shutil.copyfile(work / 'SHASUMS256.txt', HERE / 'SHASUMS256.txt')
entries = dict(line.split()[::-1] for line in (work / 'SHASUMS256.txt').read_text().splitlines())
archive_hash = digest(work / ARCHIVE)
if entries.get(ARCHIVE) != archive_hash:
raise SystemExit('Vendor archive checksum mismatch; extraction refused.')
# Python data filter prevents traversal and unsafe special-file extraction.
with tarfile.open(work / ARCHIVE) as archive:
archive.extractall(work, filter='data')
runtime = work / 'node-v24.21.0-linux-x64' / 'bin'
env = dict(os.environ, PATH=str(runtime) + os.pathsep + os.environ.get('PATH', ''))
versions = {tool: run([str(runtime / tool), '--version'], env=env) for tool in ('node', 'npm')}
if versions != {'node': 'v24.21.0', 'npm': '11.19.0'}:
raise SystemExit('Pinned runtime versions do not match.')
for name in ('package.json', 'package-lock.json'):
shutil.copyfile(PARENT / name, HERE / name)
lock = json.loads((HERE / 'package-lock.json').read_text())
for name, package in lock['packages'].items():
if name and (not package['resolved'].startswith('https://registry.npmjs.org/')
or not package['integrity'].startswith('sha512-')):
raise SystemExit('Locked dependency lacks required HTTPS/SHA512 integrity.')
subprocess.run([str(runtime / 'npm'), 'ci', '--ignore-scripts', '--no-audit', '--no-fund',
'--strict-ssl=true', '--engine-strict=true',
'--registry=https://registry.npmjs.org/', '--fetch-retries=0',
'--fetch-timeout=15000', '--cache', str(work / 'npm-cache')],
cwd=HERE, env=env, check=True)
hashes = {}
for name in ('package.json', 'package-lock.json'):
if (PARENT / name).read_bytes() != (HERE / name).read_bytes():
raise SystemExit('Copied parent manifest/lock changed.')
hashes[name] = digest(HERE / name)
for name, package in lock['packages'].items():
if name:
installed = json.loads((HERE / name / 'package.json').read_text())
if installed['version'] != package['version']:
raise SystemExit('Installed version differs from parent lock: ' + name)
stanza = run([str(runtime / 'node'), '--input-type=module', '-e',
"import {createClient} from 'stanza'; if(typeof createClient !== 'function') process.exit(1); console.log('Stanza createClient import passed')"], cwd=HERE, env=env)
report = {'platform': 'Linux x86_64', 'origin': ORIGIN, 'archive': ARCHIVE,
'archive_sha256': archive_hash, 'versions': versions, 'runtime_bin': str(runtime),
'cache': str(work / 'npm-cache'), 'parent_sha256': hashes,
'locked_packages': len(lock['packages']) - 1, 'stanza': '12.22.1',
'import_check': stanza, 'checksum_method': 'Vendor HTTPS SHASUMS256.txt; no detached signature check'}
(HERE / 'result.json').write_text(json.dumps(report, indent=2) + '\n')
print(json.dumps(report, indent=2))
if __name__ == '__main__':
main()
experiments/0002-xmpp-library/package-lock.json
Generated
+99
View File
@@ -0,0 +1,99 @@
{
"name": "luma-xmpp-library-spike",
"version": "0.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "luma-xmpp-library-spike",
"version": "0.0.0",
"dependencies": {
"stanza": "12.22.1"
},
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
}
},
"node_modules/@types/node": {
"version": "22.20.5",
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
"license": "MIT",
"dependencies": {
"undici-types": "~6.21.0"
}
},
"node_modules/@types/punycode": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
"license": "MIT"
},
"node_modules/@types/ws": {
"version": "8.18.2",
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
"license": "MIT",
"dependencies": {
"@types/node": "*"
}
},
"node_modules/punycode": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
"license": "MIT",
"engines": {
"node": ">=6"
}
},
"node_modules/sdp": {
"version": "3.2.2",
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
"license": "MIT"
},
"node_modules/stanza": {
"version": "12.22.1",
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
"license": "MIT",
"dependencies": {
"@types/node": "^22.0.0",
"@types/punycode": "^2.1.0",
"@types/ws": "^8.18.1",
"punycode": "^2.1.1",
"sdp": "^3.0.2",
"ws": "^8.18.2"
}
},
"node_modules/undici-types": {
"version": "6.21.0",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
"license": "MIT"
},
"node_modules/ws": {
"version": "8.22.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
},
"peerDependencies": {
"bufferutil": "^4.0.1",
"utf-8-validate": ">=5.0.2"
},
"peerDependenciesMeta": {
"bufferutil": {
"optional": true
},
"utf-8-validate": {
"optional": true
}
}
}
}
}
experiments/0002-xmpp-library/package.json
+10
View File
@@ -0,0 +1,10 @@
{
"name": "luma-xmpp-library-spike",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {"node": "24.21.0", "npm": "11.19.0"},
"packageManager": "npm@11.19.0",
"scripts": {"test": "node --test test/*.test.mjs"},
"dependencies": {"stanza": "12.22.1"}
}
experiments/0002-xmpp-library/parser-probe/reproduce.mjs
+57
View File
@@ -0,0 +1,57 @@
// Bounded diagnostic of the stock parser; passing means the defect reproduced.
// No network, credentials, vendor patch, or production implementation.
import assert from 'node:assert/strict';
import {createRequire} from 'node:module';
const require = createRequire(import.meta.url);
const Client = require('stanza/Client').default;
const {StreamParser} = require('stanza/jxt');
assert.equal(require('stanza/package.json').version, '12.22.1');
const tick = () => new Promise(resolve => setImmediate(resolve));
function harness() {
const client = new Client({autoReconnect: false});
// Same parser options as shipped transports/websocket.js.
const parser = new StreamParser({registry: client.stanzas,
wrappedStream: false, allowComments: false});
const received = [], errors = [];
parser.on('data', value => received.push(value));
parser.on('error', error => errors.push(error));
return {parser, received, errors};
}
const opening = '<message xmlns="jabber:client"><body>';
const closing = '</body></message>';
const split = harness();
split.parser.write(opening);
for (let i = 0; i < 16; i++) split.parser.write('a'.repeat(4096));
await tick();
assert.equal(split.errors.length, 0);
assert.equal(split.received.length, 0);
assert.equal(split.parser.destroyed, false);
split.parser.write(closing);
await tick();
assert.equal(split.errors.length, 0);
assert.equal(split.received.length, 1);
assert.equal(split.received[0].stanza.body.length, 65536);
split.parser.destroy();
console.log('stock: 18 separate writes reassembled into one 65536-byte body; no error');
const large = harness();
large.parser.write(opening + 'b'.repeat(1048576) + closing);
await tick();
assert.equal(large.errors.length, 0);
assert.equal(large.received.length, 1);
assert.equal(large.received[0].stanza.body.length, 1048576);
large.parser.destroy();
console.log('stock: 1048576-byte body accepted; no error');
const deep = harness();
deep.parser.write('<message xmlns="jabber:client">' + '<x>'.repeat(256) +
'</x>'.repeat(256) + '</message>');
await tick();
assert.equal(deep.errors.length, 0);
assert.equal(deep.received.length, 1);
let element = deep.received[0].xml, depth = 0;
while (element.children[0]) {element = element.children[0]; depth++;}
assert.equal(depth, 256);
deep.parser.destroy();
console.log('stock: 256 nested child elements accepted; no error');
experiments/0002-xmpp-library/parser-validation/.npmrc
+3
View File
@@ -0,0 +1,3 @@
engine-strict=true
strict-ssl=true
registry=https://registry.npmjs.org/
experiments/0002-xmpp-library/parser-validation/LICENSE_INVENTORY.md
+16
View File
@@ -0,0 +1,16 @@
# Exact dependency license inventory
Inspected 2026-10-15. Node 24.21.0 / npm 11.19.0. Saxes tarball omits its license text: preserved upstream v6.0.0 LICENSE in licenses/saxes-6.0.0-LICENSE, retrieved via verified HTTPS. Other texts are shipped installed files. No advisory/provenance clearance is claimed.
| Package | Version | SPDX | License/notice source |
| --- | --- | --- | --- |
| @types/node | 22.20.5 | MIT | LICENSE |
| @types/punycode | 2.1.4 | MIT | LICENSE |
| @types/ws | 8.18.2 | MIT | LICENSE |
| punycode | 2.3.1 | MIT | LICENSE-MIT.txt |
| saxes | 6.0.0 | ISC | saxes-6.0.0-LICENSE |
| sdp | 3.2.2 | MIT | LICENSE |
| stanza | 12.22.1 | MIT | LICENSE.md, NOTICE.md |
| undici-types | 6.21.0 | MIT | LICENSE |
| ws | 8.22.0 | MIT | LICENSE |
| xmlchars | 2.2.0 | MIT | LICENSE |
experiments/0002-xmpp-library/parser-validation/README.md
+96
View File
@@ -0,0 +1,96 @@
# Bounded standalone XML ingress experiment (S00-018)
This fixture experiment uses real Stanza 12.22.1 Client dispatch, JXT.parse and
registry.import, preceded by saxes 6.0.0 XML 1.0 namespace-aware validation.
It adds a constructor to the public Client.transports registry and selects only
that transport via configuration. It does not use the stock persistent parser,
subclass private transport fields, intercept already imported events, or patch
vendor files. It is not a production transport or a library selection.
From project root, reuse the reviewed isolated Node runtime (macOS ARM64):
```sh
export PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH
npm ci --prefix experiments/0002-xmpp-library/parser-validation --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-parser-review-cache --fetch-retries=0 --fetch-timeout=15000
npm test --prefix experiments/0002-xmpp-library/parser-validation
python3 experiments/0002-xmpp-library/parser-validation/check-dependencies.py
node experiments/0002-xmpp-library/parser-probe/reproduce.mjs
```
The last command reproduces stock defects; exit 0 is NOT safe parsing.
The dependency checker also requires the original candidate already installed in
experiments/0002-xmpp-library/node_modules for byte comparison. It checks all 340
Stanza files and ten exact locked installed package licenses/integrities. The
saxes tarball omits LICENSE: the upstream v6.0.0 license is preserved locally,
with source https://raw.githubusercontent.com/lddubeau/saxes/v6.0.0/LICENSE.
## Enforcement order and local policy
1. Require primitive string. Reject Blob/ArrayBuffer/typed arrays before coercion.
2. Reject more than 4096 UTF-16 units without encoding; then reject more than
4096 UTF-8 bytes using TextEncoder. The temporary encoding buffer is bounded
by the unit check (at most 12288 bytes for any input); it is not an unbounded
copy. First character must be `<` as required by RFC 7395.
3. New saxes parser per message, fragment=false, xmlns=true, XML 1.0 forced,
no inherited namespace resolver. Throw on the first error; close() checks
document completion. No tree is built during this phase.
4. At opentagstart reject depth >8 (including root), elements >32, name >128
UTF-16 units. At attribute reject total attributes >16 (including xmlns),
name >128, decoded value >256, or aggregate decoded attribute name+value
units >1024. Checks occur before JXT tree construction/import. Saxes has
already stored one completed attribute at its callback; lexical tokens,
namespace tables and DTD buffers before callbacks are bounded by 4096 input
bytes. No claim of allocation-free SAX processing is made.
5. Reject DTDs, comments, processing instructions and XML declarations. Only
built-in/numeric entities are available; no DTD fetching/entity expansion is
enabled. CDATA is accepted. Declaration rejection is local conservative
policy; RFC 7395 discourages but does not forbid declarations.
6. Only after complete validation call real JXT.parse and registry.import. An
unknown top-level root or candidate parser/import error closes the attempt.
Parsed output is delivered through Client stream:data only after import
succeeds. No invalid document's earlier root is emitted.
7. On rejection close the socket, detach all four callbacks, clear config and
stream references before emitting a payload-free error code. Every old
captured callback checks the terminal flag. Parsers/trees are synchronous
function locals, never retained between messages. A fresh Client.connect
creates another transport; restart on a failed transport cannot revive it.
The combined boundary fixture hits 4096 bytes, depth 8, 32 elements,
16 attributes and 1024 attribute units simultaneously and imports a real body.
Separate tests cover name/value equality, multibyte byte equality, one-over
bounds, stock 1 MiB/depth-256/18-message cases, malformed tails, incomplete XML,
binary, duplicate attributes/namespaces/entities/invalid characters, callback
replay, fresh connect, stream open/close/restart and outgoing registry export.
Tracing registry.import calls the real implementation; it never fakes success.
FixtureSocket replaces only browser socket effects; tests use actual Client
connect/transport selection and stanza queue events.
## Constraints
The default socket constructor is globalThis.WebSocket; browser use requires a
CommonJS-capable bundler for Stanza/saxes/xmlchars, native WebSocket, URL and
TextEncoder plus support for private class fields. The injected fixture socket
is explicitly separate and never chosen by the default path. Only explicit
wss URLs and the xmpp subprotocol are allowed. TLS/CORS/binding are unchanged;
no real WSS handshake is exercised here. Browser build/runtime and selected
browser versions are NOT verified. Node tests run 24.21.0/npm 11.19.0.
Limits protect application parsing after the browser delivers a complete message.
They cannot prevent the browser/network stack from allocating a huge inbound
message, nor bound total traffic, Client queue growth, CPU rate, reconnect
policy or downstream extension work. Those need separate product/provider
policies. The experiment closes locally on violations rather than implementing
full XMPP stream-error reporting/close negotiation/redirect/keepalive behavior.
It does not enforce complete XMPP stream sequencing or preserve inherited stream
language. JXT interpretation/normalization is retained; SAX and JXT equivalence
for all accepted XML forms is not established. No auth/crypto changes, complete
NET-003 policy, OMEMO, independent server/client interoperability, exhaustion
benchmark, advisory/provenance audit, or release acceptance is claimed.
All ten package license texts/notices are in THIRD_PARTY_NOTICES.md and exact
versions in LICENSE_INVENTORY.md/package-lock.json. Saxes is a mature existing
strict parser with documented XML/namespace conformance and public event APIs;
6.0.0 is an older release, and no ongoing-maintenance SLA is assumed. Its
absence of built-in token limits is why the mandatory byte precheck comes first.
See proposed docs/decisions/0002-xmpp-parser-validation.md. Independent security
review is required; S00-003 remains a separate assignment after reviewed done.
experiments/0002-xmpp-library/parser-validation/THIRD_PARTY_NOTICES.md
+637
View File
@@ -0,0 +1,637 @@
# Third-party notices
Verbatim license/notice texts for this isolated experiment.
## @types/node 22.20.5 — LICENSE
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
## @types/punycode 2.1.4 — LICENSE
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
## @types/ws 8.18.2 — LICENSE
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
## punycode 2.3.1 — LICENSE-MIT.txt
Copyright Mathias Bynens <https://mathiasbynens.be/>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## saxes 6.0.0 — saxes-6.0.0-LICENSE
The ISC License
Copyright (c) Contributors
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
====
The following license is the one that governed sax, from which saxes
was forked. Isaac Schlueter is not *directly* involved with saxes so
don't go bugging him for saxes issues.
The ISC License
Copyright (c) Isaac Z. Schlueter and Contributors
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
====
`String.fromCodePoint` by Mathias Bynens is no longer used, but it can
still be found in old commits. It was once used according to terms of
MIT License, as follows:
Copyright Mathias Bynens <https://mathiasbynens.be/>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## sdp 3.2.2 — LICENSE
Copyright (c) 2017 Philipp Hancke
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## stanza 12.22.1 — LICENSE.md
The MIT License (MIT)
Copyright © 2013-2019 Lance Stout
Copyright © 2013-2019 &yet <https://andyet.com>
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## stanza 12.22.1 — NOTICE.md
# StanzaJS
Copyright © 2013-2019 Lance Stout
Copyright © 2013-2019 &yet <https://andyet.com>
Portions of this code were adapted from existing projects:
## SASL
- saslmechanisms
- sasl-anonymous
- sasl-digest-md5
- sasl-external
- sasl-plain
- sasl-x-oauth2
(The MIT License)
Copyright © 2012-2013 Jared Hanson
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## ltx
Copyright © 2010 Stephan Maka
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
## xhtml-im.js
The MIT License (MIT)
Copyright © 2013 Waqas Hussain
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## wildemitter
The MIT License (MIT)
Copyright © 2012 Henrik Joreteg
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## hash-base
The MIT License (MIT)
Copyright (c) 2016 Kirill Fomichev
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
## cipher-base
The MIT License (MIT)
Copyright (c) 2017 crypto-browserify contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## sha.js
Copyright (c) 2013-2018 sha.js contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Copyright (c) 1998 - 2009, Paul Johnston & Contributors
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
Redistributions in binary form must reproduce the above copyright notice, this
list of conditions and the following disclaimer in the documentation and/or
other materials provided with the distribution.
Neither the name of the author nor the names of its contributors may be used to
endorse or promote products derived from this software without specific prior
written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## md5.js
The MIT License (MIT)
Copyright (c) 2016 Kirill Fomichev
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
## create-hash
The MIT License (MIT)
Copyright (c) 2017 crypto-browserify contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## create-hmac
The MIT License (MIT)
Copyright (c) 2017 crypto-browserify contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## randombytes
MIT License
Copyright (c) 2017 crypto-browserify
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## uuid
The MIT License (MIT)
Copyright (c) 2010-2016 Robert Kieffer and other contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## strict-event-emitter-types
ISC License (ISC)
Copyright 2018 Brian Terlson
Permission to use, copy, modify, and/or distribute this software for any purpose
with or without fee is hereby granted, provided that the above copyright notice
and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
THIS SOFTWARE.
## capsdb
capsdb - A collection of XMPP caps with hashes
Written in 2015 by Thijs Alkemade me@thijsalkema.de
To the extent possible under law, the author(s) have dedicated all copyright and
related and neighboring rights to this software to the public domain worldwide.
This software is distributed without any warranty.
You should have received a copy of the CC0 Public Domain Dedication along with
this software. If not, see http://creativecommons.org/publicdomain/zero/1.0/.
## undici-types 6.21.0 — LICENSE
MIT License
Copyright (c) Matteo Collina and Undici contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## ws 8.22.0 — LICENSE
Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
Copyright (c) 2013 Arnout Kazemier and contributors
Copyright (c) 2016 Luigi Pinca and contributors
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## xmlchars 2.2.0 — LICENSE
Copyright Louis-Dominique Dubeau and contributors to xmlchars
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
experiments/0002-xmpp-library/parser-validation/bounded-ingress.mjs
+146
View File
@@ -0,0 +1,146 @@
import {SaxesParser} from 'saxes';
import jxt from 'stanza/jxt/index.js';
// Experiment policy only. The byte ceiling bounds SAX token/namespace storage
// even before callbacks can inspect a completed name or attribute value.
export const LIMITS = Object.freeze({bytes: 4096, depth: 8, elements: 32,
attributes: 16, attributeChars: 1024, nameChars: 128, valueChars: 256});
class IngressError extends Error {
constructor(code) { super(code); this.code = code; }
}
const fail = code => { throw new IngressError(code); };
export function validateMessage(data) {
if (typeof data !== 'string') fail('text-required');
// Avoid encoding an attacker-sized string. UTF-8 bytes >= UTF-16 units for
// valid XML; isolated surrogates are subsequently rejected by saxes.
if (data.length > LIMITS.bytes) fail('bytes');
if (new TextEncoder().encode(data).length > LIMITS.bytes) fail('bytes');
if (!data.startsWith('<')) fail('framing');
let depth = 0, elements = 0, attributes = 0, attributeChars = 0, ended = false;
const parser = new SaxesParser({xmlns: true, fragment: false,
defaultXMLVersion: '1.0', forceXMLVersion: true});
parser.on('error', () => fail('invalid-xml'));
for (const event of ['doctype', 'comment', 'processinginstruction', 'xmldecl']) {
parser.on(event, () => fail('restricted-xml'));
}
parser.on('opentagstart', tag => {
if (++depth > LIMITS.depth) fail('depth');
if (++elements > LIMITS.elements) fail('elements');
if (tag.name.length > LIMITS.nameChars) fail('name');
});
parser.on('attribute', attr => {
if (++attributes > LIMITS.attributes) fail('attributes');
if (attr.name.length > LIMITS.nameChars) fail('name');
if (attr.value.length > LIMITS.valueChars) fail('attribute-value');
attributeChars += attr.name.length + attr.value.length;
if (attributeChars > LIMITS.attributeChars) fail('attribute-chars');
});
parser.on('closetag', () => { depth--; });
parser.on('end', () => { ended = true; });
// close() detects unfinished XML. Throwing from callbacks aborts immediately;
// there is no recovery listener, DTD fetch, custom entity or tree construction.
parser.write(data).close();
if (!ended || depth !== 0 || elements === 0) fail('framing');
}
export function importMessage(data, registry, config) {
validateMessage(data);
// Only bounded, complete documents reach the actual candidate parser/import.
const xml = jxt.parse(data, {allowComments: false});
if (!xml) fail('invalid-xml');
const kind = registry.getImportKey(xml);
const stanza = registry.import(xml, {lang: config.lang,
acceptLanguages: config.acceptLanguages});
if (!kind || !stanza) fail('unknown-root');
return {kind, stanza};
}
// Public Transport interface and Client.transports constructor registry.
// Socket injection is solely for finite fixtures; default is browser WebSocket.
export function installBoundedTransport(client, Socket = globalThis.WebSocket) {
class BoundedTransport {
#client; #registry; #sm; #socket; #config; #closed = true;
hasStream = false;
stream;
constructor(agent, sm, registry) {
this.#client = agent; this.#sm = sm; this.#registry = registry;
}
connect(config) {
if (this.#socket || !this.#closed) throw new Error('Fresh transport required');
if (new URL(config.url).protocol !== 'wss:') throw new Error('WSS required');
this.#config = config;
this.#closed = false;
const socket = this.#socket = new Socket(config.url, 'xmpp');
socket.onopen = () => {
if (this.#closed) return;
if (socket.protocol !== 'xmpp') return this.#reject('subprotocol');
this.#sm.started = false;
this.#client.emit('connected');
this.restart();
};
socket.onmessage = event => {
if (this.#closed) return;
let parsed;
try { parsed = importMessage(event.data, this.#registry, this.#config); }
catch (error) { return this.#reject(error instanceof IngressError ? error.code : 'invalid-xml'); }
// No raw payload event/log or async parser continuation escapes ingress.
if (parsed.kind === 'stream') {
if (parsed.stanza.action === 'open') {
this.hasStream = true;
this.stream = parsed.stanza;
this.#client.emit('stream:start', parsed.stanza);
} else {
this.#client.emit('stream:end');
this.disconnect(false);
}
} else {
this.#client.emit('stream:data', parsed.stanza, parsed.kind);
}
};
socket.onerror = () => this.#reject('socket-error');
socket.onclose = () => this.disconnect(false);
}
#reject(code) {
if (this.#closed) return;
// Close/clear before notifying consumers; a reentrant callback cannot
// revive the attempt. Never expose parser error text containing input.
this.disconnect(false);
this.#client.emit('ingress:rejected', code);
}
disconnect(clean = true) {
if (this.#closed) return;
this.#closed = true;
const socket = this.#socket;
this.#socket = undefined;
if (socket) {
socket.onopen = socket.onmessage = socket.onerror = socket.onclose = null;
if (clean && this.hasStream && socket.readyState === 1) {
socket.send(this.#registry.export('stream', {action: 'close'}).toString());
}
socket.close();
}
this.hasStream = false;
this.stream = undefined;
this.#config = undefined;
if (this.#client.transport === this) this.#client.emit('--transport-disconnected');
}
restart() {
if (this.#closed) return;
this.hasStream = false;
this.stream = undefined;
this.#write(this.#registry.export('stream', {action: 'open',
lang: this.#config.lang, to: this.#config.server, version: '1.0'}).toString());
}
#write(data) {
if (this.#closed || this.#socket?.readyState !== 1) throw new Error('Socket closed');
this.#socket.send(data);
}
async send(name, data) {
const xml = this.#registry.export(name, data);
if (!xml) throw new Error('Unknown outgoing stanza');
this.#write(xml.toString());
}
}
client.transports['bounded-websocket'] = BoundedTransport;
}
experiments/0002-xmpp-library/parser-validation/check-dependencies.py
+42
View File
@@ -0,0 +1,42 @@
"""Check exact installed graph, preserved notices, and unchanged candidate files."""
import hashlib
import json
from pathlib import Path
root = Path(__file__).resolve().parent
lock = json.loads((root / 'package-lock.json').read_text())
manifest = json.loads((root / 'package.json').read_text())
assert manifest['engines'] == {'node': '24.21.0', 'npm': '11.19.0'}
assert manifest['dependencies'] == {'saxes': '6.0.0', 'stanza': '12.22.1', 'xmlchars': '2.2.0'}
notices = (root / 'THIRD_PARTY_NOTICES.md').read_text()
inventory = (root / 'LICENSE_INVENTORY.md').read_text()
count = 0
for key, entry in lock['packages'].items():
if not key:
continue
count += 1
assert entry['resolved'].startswith('https://registry.npmjs.org/')
assert entry['integrity'].startswith('sha512-')
installed = root / key
meta = json.loads((installed / 'package.json').read_text())
assert meta['version'] == entry['version']
assert meta['license'] == entry['license']
assert f"| {meta['name']} | {meta['version']} | {meta['license']} |" in inventory
files = [p for p in installed.iterdir() if p.is_file() and
(p.name.lower().startswith('license') or p.name.lower().startswith('notice'))]
if meta['name'] == 'saxes':
files = [root / 'licenses/saxes-6.0.0-LICENSE']
assert files
for path in files:
assert path.read_text().strip() in notices
assert count == 10
# Independent previously installed candidate; no ignored vendor patches.
candidate = root / 'node_modules/stanza'
original = root.parent / 'node_modules/stanza'
files = [p for p in candidate.rglob('*') if p.is_file()]
assert files
for path in files:
assert path.read_bytes() == (original / path.relative_to(candidate)).read_bytes(), path
print(f'{count} exact dependency licenses/integrities; {len(files)} unchanged Stanza files')
for name in ['package-lock.json', 'bounded-ingress.mjs', 'licenses/saxes-6.0.0-LICENSE']:
print(f'{name} SHA256 {hashlib.sha256((root / name).read_bytes()).hexdigest()}')
experiments/0002-xmpp-library/parser-validation/licenses/saxes-6.0.0-LICENSE
+64
View File
@@ -0,0 +1,64 @@
The ISC License
Copyright (c) Contributors
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
====
The following license is the one that governed sax, from which saxes
was forked. Isaac Schlueter is not *directly* involved with saxes so
don't go bugging him for saxes issues.
The ISC License
Copyright (c) Isaac Z. Schlueter and Contributors
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
====
`String.fromCodePoint` by Mathias Bynens is no longer used, but it can
still be found in old commits. It was once used according to terms of
MIT License, as follows:
Copyright Mathias Bynens <https://mathiasbynens.be/>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
experiments/0002-xmpp-library/parser-validation/package-lock.json
Generated
+119
View File
@@ -0,0 +1,119 @@
{
"name": "luma-bounded-xml-ingress-experiment",
"version": "0.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "luma-bounded-xml-ingress-experiment",
"version": "0.0.0",
"dependencies": {
"saxes": "6.0.0",
"stanza": "12.22.1",
"xmlchars": "2.2.0"
},
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
}
},
"node_modules/@types/node": {
"version": "22.20.5",
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
"license": "MIT",
"dependencies": {
"undici-types": "~6.21.0"
}
},
"node_modules/@types/punycode": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
"license": "MIT"
},
"node_modules/@types/ws": {
"version": "8.18.2",
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
"license": "MIT",
"dependencies": {
"@types/node": "*"
}
},
"node_modules/punycode": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
"license": "MIT",
"engines": {
"node": ">=6"
}
},
"node_modules/saxes": {
"version": "6.0.0",
"resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
"integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
"license": "ISC",
"dependencies": {
"xmlchars": "^2.2.0"
},
"engines": {
"node": ">=v12.22.7"
}
},
"node_modules/sdp": {
"version": "3.2.2",
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
"license": "MIT"
},
"node_modules/stanza": {
"version": "12.22.1",
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
"license": "MIT",
"dependencies": {
"@types/node": "^22.0.0",
"@types/punycode": "^2.1.0",
"@types/ws": "^8.18.1",
"punycode": "^2.1.1",
"sdp": "^3.0.2",
"ws": "^8.18.2"
}
},
"node_modules/undici-types": {
"version": "6.21.0",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
"license": "MIT"
},
"node_modules/ws": {
"version": "8.22.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
},
"peerDependencies": {
"bufferutil": "^4.0.1",
"utf-8-validate": ">=5.0.2"
},
"peerDependenciesMeta": {
"bufferutil": {
"optional": true
},
"utf-8-validate": {
"optional": true
}
}
},
"node_modules/xmlchars": {
"version": "2.2.0",
"resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
"integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
"license": "MIT"
}
}
}
experiments/0002-xmpp-library/parser-validation/package.json
+10
View File
@@ -0,0 +1,10 @@
{
"name": "luma-bounded-xml-ingress-experiment",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {"node": "24.21.0", "npm": "11.19.0"},
"packageManager": "npm@11.19.0",
"scripts": {"test": "node --test test/*.test.mjs"},
"dependencies": {"saxes": "6.0.0", "stanza": "12.22.1", "xmlchars": "2.2.0"}
}
experiments/0002-xmpp-library/parser-validation/test/fixtures.mjs
+68
View File
@@ -0,0 +1,68 @@
export const opening = '<message xmlns="jabber:client"><body>';
export const closing = '</body></message>';
export const message = text => opening + text + closing;
export const valid = message('finite fixture');
export const deep = n => '<message xmlns="jabber:client">' + '<x>'.repeat(n - 1) +
'</x>'.repeat(n - 1) + '</message>';
export const elements = n => '<message xmlns="jabber:client">' + '<x/>'.repeat(n - 1) + '</message>';
export const attributes = n => '<message xmlns="jabber:client"' +
Array.from({length: n - 1}, (_, i) => ` a${i}="x"`).join('') + '/>';
export function boundary() {
// 16 attributes / 1024 name+value UTF-16 units including xmlns.
let attrs = ' xmlns="jabber:client"';
let chars = 'xmlns'.length + 'jabber:client'.length;
for (let i = 0; i < 15; i++) {
const name = `a${i}`;
const value = 'v'.repeat(i === 14 ? 1024 - chars - name.length : 60);
attrs += ` ${name}="${value}"`;
chars += name.length + value.length;
}
// Root + body + chain of 7 + 23 siblings = 32 elements; depth 8.
const before = `<message${attrs}><body>`;
const after = '</body>' + '<x>'.repeat(7) + '</x>'.repeat(7) + '<x/>'.repeat(23) + '</message>';
return {xml: before + 'z'.repeat(4096 - before.length - after.length) + after,
body: 'z'.repeat(4096 - before.length - after.length)};
}
export const invalid = [
['large stock body', message('b'.repeat(1048576)), 'bytes'],
['deep stock XML', deep(257), 'depth'],
['unfinished opening', opening, 'invalid-xml'],
['unfinished attribute', '<message xmlns="jabber:client" a="unfinished', 'invalid-xml'],
['unfinished tag', '<message xmlns="jabber:client"', 'invalid-xml'],
['unfinished entity', message('&amp'), 'invalid-xml'],
['empty', '', 'framing'],
['leading whitespace', ' ' + valid, 'framing'],
['text only', 'not xml', 'framing'],
['two roots', valid + valid, 'invalid-xml'],
['valid root then unfinished root', valid + '<message', 'invalid-xml'],
['valid root then junk', valid + 'junk', 'invalid-xml'],
['mismatched tags', '<message xmlns="jabber:client"><body></message>', 'invalid-xml'],
['depth over', deep(9), 'depth'],
['elements over', elements(33), 'elements'],
['attributes over', attributes(17), 'attributes'],
['attribute value over', `<message xmlns="jabber:client" a="${'x'.repeat(257)}"/>`, 'attribute-value'],
['attribute chars over', '<message xmlns="jabber:client" ' +
Array.from({length: 4}, (_, i) => `a${i}="${'x'.repeat(256)}"`).join(' ') + '/>', 'attribute-chars'],
['oversized name', `<message xmlns="jabber:client"><${'x'.repeat(129)}/></message>`, 'name'],
['oversized attribute name', `<message xmlns="jabber:client" ${'x'.repeat(129)}="x"/>`, 'name'],
['oversized unfinished token', '<' + 'x'.repeat(4096), 'bytes'],
['UTF-8 bytes over with bounded units', message('🦉'.repeat(1100)), 'bytes'],
['binary buffer', new Uint8Array([60, 120, 47, 62]), 'text-required'],
['binary ArrayBuffer', new ArrayBuffer(4), 'text-required'],
['binary Blob', new Blob([valid]), 'text-required'],
['boxed string', new String(valid), 'text-required'],
['comment', '<!--x-->' + valid, 'restricted-xml'],
['DTD internal entity', '<!DOCTYPE message [<!ENTITY x "payload">]>' + message('&x;'), 'restricted-xml'],
['external DTD', '<!DOCTYPE message SYSTEM "https://example.invalid/dtd">' + valid, 'restricted-xml'],
['processing instruction', '<?test x?>' + valid, 'restricted-xml'],
['XML declaration', '<?xml version="1.0"?>' + valid, 'restricted-xml'],
['duplicate attribute', '<message xmlns="jabber:client" id="a" id="b"/>', 'invalid-xml'],
['duplicate expanded attribute', '<message xmlns="jabber:client" xmlns:a="urn:x" xmlns:b="urn:x" a:id="a" b:id="b"/>', 'invalid-xml'],
['unbound namespace', '<p:message/>', 'invalid-xml'],
['illegal namespace binding', '<message xmlns="jabber:client" xmlns:xml="urn:wrong"/>', 'invalid-xml'],
['unknown entity', message('&unknown;'), 'invalid-xml'],
['illegal control', message('\u0000'), 'invalid-xml'],
['unpaired surrogate', message('\ud800'), 'invalid-xml'],
['invalid char reference', message('&#0;'), 'invalid-xml'],
['unknown root', '<unknown xmlns="urn:fixture"/>', 'unknown-root']
];
experiments/0002-xmpp-library/parser-validation/test/integration.test.mjs
+151
View File
@@ -0,0 +1,151 @@
import assert from 'node:assert/strict';
import {test} from 'node:test';
import clientModule from 'stanza/Client.js';
import {installBoundedTransport, validateMessage, LIMITS} from '../bounded-ingress.mjs';
import {opening, closing, message, valid, deep, elements, attributes, boundary, invalid} from './fixtures.mjs';
const Client = clientModule.default;
const tick = () => new Promise(resolve => setImmediate(resolve));
async function harness() {
const sockets = [];
class FixtureSocket {
readyState = 1; protocol = 'xmpp'; sent = []; closes = 0;
constructor(url, protocol) { this.url = url; this.requestedProtocol = protocol; sockets.push(this); }
send(data) { this.sent.push(data); }
close() { this.closes++; this.readyState = 3; }
}
const client = new Client({autoReconnect: false, server: 'example.invalid'});
installBoundedTransport(client, FixtureSocket);
client.updateConfig({transports: {'bounded-websocket': 'wss://example.invalid/xmpp'},
transportPreferenceOrder: ['bounded-websocket']});
const received = [], errors = [], raw = [], stanzas = [], starts = [];
client.on('stream:data', (stanza, kind) => received.push({stanza, kind}));
client.on('stanza', stanza => stanzas.push(stanza));
client.on('stream:start', stanza => starts.push(stanza));
client.on('ingress:rejected', code => errors.push(code));
client.on('raw', (...args) => raw.push(args));
// Tracing calls the real registry.import; proves rejection before import.
let imports = 0;
const original = client.stanzas.import.bind(client.stanzas);
client.stanzas.import = (...args) => { imports++; return original(...args); };
await client.connect();
const socket = sockets.at(-1);
socket.onopen();
return {client, sockets, socket, received, errors, raw, stanzas, starts,
imports: () => imports, finish: async () => {client.transport?.disconnect(false); await tick();}};
}
for (const [name, xml, code] of invalid) {
test(`terminal rejection: ${name}`, async () => {
const h = await harness();
const late = h.socket.onmessage;
late({data: xml});
assert.deepEqual(h.errors, [code]);
assert.equal(h.socket.closes, 1);
assert.equal(h.socket.onmessage, null);
assert.equal(h.received.length, 0);
assert.equal(h.starts.length, 0);
if (code !== 'unknown-root') assert.equal(h.imports(), 0);
// Old captured handlers and subsequent messages cannot revive an attempt.
late({data: closing}); late({data: valid});
await tick();
assert.equal(h.stanzas.length, 0);
assert.equal(h.received.length, 0);
assert.deepEqual(h.errors, [code]);
assert.equal(h.client.transport, undefined);
assert.equal(h.raw.length, 0);
await h.finish();
});
}
for (const [name, xml, body] of [
['all aggregate limits equal', boundary().xml, boundary().body],
['depth equal', deep(LIMITS.depth)],
['element count equal', elements(LIMITS.elements)],
['attribute count equal', attributes(LIMITS.attributes)],
['attribute value equal', `<message xmlns="jabber:client" a="${'v'.repeat(256)}"/>`],
['name equal', `<message xmlns="jabber:client"><${'x'.repeat(128)}/></message>`],
['UTF-8 byte equality', message('🦉'.repeat(1000) + 'a'.repeat(4096 - message('').length - 4000)), '🦉'.repeat(1000) + 'a'.repeat(4096 - message('').length - 4000)],
['escaped text and CDATA', message('&lt;&amp;<![CDATA[<fixture>]]>'), '<&<fixture>'],
['prefixed namespace', '<c:message xmlns:c="jabber:client"><c:body>namespace</c:body></c:message>', 'namespace']
]) {
test(`actual parser/import accepts ${name}`, async () => {
const h = await harness();
h.socket.onmessage({data: xml});
await tick();
assert.deepEqual(h.errors, []);
assert.equal(h.received.length, 1);
assert.equal(h.received[0].kind, 'message');
if (body !== undefined) assert.equal(h.received[0].stanza.body, body);
assert.equal(h.stanzas.length, 1);
assert.ok(h.imports() > 0);
await h.finish();
});
}
test('bytes one over and UTF-8 one over reject before import', async () => {
for (const xml of [boundary().xml + ' ', message('🦉'.repeat(1000) + 'a'.repeat(4097 - message('').length - 4000))]) {
const h = await harness(); h.socket.onmessage({data: xml});
assert.deepEqual(h.errors, ['bytes']); assert.equal(h.imports(), 0);
await h.finish();
}
});
test('stock 18-message partial document never accumulates or revives; fresh connect works', async () => {
const h = await harness(); const old = h.socket.onmessage;
old({data: opening});
for (let i = 0; i < 16; i++) old({data: 'a'.repeat(4096)});
old({data: closing});
await tick();
assert.equal(h.received.length, 0); assert.equal(h.imports(), 0);
assert.deepEqual(h.errors, ['invalid-xml']);
await h.client.connect(); const fresh = h.sockets.at(-1); fresh.onopen();
old({data: valid}); assert.equal(h.received.length, 0);
fresh.onmessage({data: valid}); await tick();
assert.equal(h.received.length, 1); assert.equal(h.stanzas.length, 1);
assert.equal(h.received[0].stanza.body, 'finite fixture');
await h.finish();
});
test('successive complete documents have no shared namespace/parser state', async () => {
const h = await harness();
h.socket.onmessage({data: valid}); h.socket.onmessage({data: valid}); await tick();
assert.equal(h.stanzas.length, 2);
h.socket.onmessage({data: '<c:message/>'}); await tick();
assert.deepEqual(h.errors, ['invalid-xml']); assert.equal(h.stanzas.length, 2);
await h.finish();
});
test('open, restart, message, outgoing export and close use actual registry', async () => {
const h = await harness();
h.socket.onmessage({data: '<open xmlns="urn:ietf:params:xml:ns:xmpp-framing" from="example.invalid" version="1.0"/>'});
assert.equal(h.client.transport.hasStream, true); assert.equal(h.starts.length, 1);
h.client.transport.restart(); assert.equal(h.client.transport.hasStream, false);
await h.client.transport.send('message', {body: 'outgoing fixture'});
assert.ok(h.socket.sent.at(-1).includes('outgoing fixture'));
h.socket.onmessage({data: '<close xmlns="urn:ietf:params:xml:ns:xmpp-framing"/>'});
await tick(); assert.equal(h.socket.closes, 1); assert.equal(h.client.transport, undefined);
assert.equal(h.errors.length, 0);
await h.finish();
});
test('failed subprotocol, socket error, clean disconnect and stale callbacks are terminal', async () => {
for (const mode of ['subprotocol', 'error', 'clean']) {
const h = await harness(); const old = h.socket.onmessage;
if (mode === 'subprotocol') {h.socket.protocol = 'wrong'; h.socket.onopen();}
if (mode === 'error') h.socket.onerror(new Error('fixture'));
if (mode === 'clean') {
h.socket.onmessage({data: '<open xmlns="urn:ietf:params:xml:ns:xmpp-framing"/>'});
h.client.transport.disconnect(); assert.ok(h.socket.sent.at(-1).includes('close'));
}
old({data: valid}); await tick();
assert.equal(h.received.length, 0); assert.equal(h.socket.closes, 1);
await h.finish();
}
});
test('SAX framing validation retains no attempt object', () => {
assert.throws(() => validateMessage(opening));
assert.throws(() => validateMessage(closing));
assert.doesNotThrow(() => validateMessage(valid));
});
experiments/0002-xmpp-library/sasl-validation/.npmrc
+3
View File
@@ -0,0 +1,3 @@
engine-strict=true
strict-ssl=true
registry=https://registry.npmjs.org/
experiments/0002-xmpp-library/sasl-validation/.nvmrc
+1
View File
@@ -0,0 +1 @@
24.21.0
experiments/0002-xmpp-library/sasl-validation/LICENSE_INVENTORY.md
+14
View File
@@ -0,0 +1,14 @@
# Locked license inventory
Exact installed graph for the isolated Node experiment; no release/browser clearance.
| Package | Version | License |
| --- | --- | --- |
| @types/node | 22.20.5 | MIT |
| @types/punycode | 2.1.4 | MIT |
| @types/ws | 8.18.2 | MIT |
| punycode | 2.3.1 | MIT |
| sdp | 3.2.2 | MIT |
| stanza | 12.22.1 | MIT |
| undici-types | 6.21.0 | MIT |
| ws | 8.22.0 | MIT |
experiments/0002-xmpp-library/sasl-validation/README.md
+76
View File
@@ -0,0 +1,76 @@
# SCRAM server-final validation experiment
S00-017 fixture-only remediation of S00-003. No network connection or production
adapter. Public RFC example credentials are used only in memory. Requires the
accepted Node 24.21.0 / npm 11.19.0 runtime; installs enforce exact engines and TLS.
From the project root, use the isolated runtime already verified by S00-002:
```sh
export PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH
node --version
npm --version
npm ci --prefix experiments/0002-xmpp-library/sasl-validation --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-sasl-review-cache --fetch-retries=0 --fetch-timeout=15000
npm test --prefix experiments/0002-xmpp-library/sasl-validation
```
On another host, obtain the official exact Node runtime with verified HTTPS and
checksum; do not change system configuration or disable certificates. Use a fresh
cache directory for an independent clean-install check. The original parent
experiment manifest remains incomplete and is not used by these commands.
The 44 tests use Stanza's actual Client, XML parse/registry, named SASL feature
handler, feature negotiation dispatcher and SCRAM implementation. Outgoing sends,
restart and disconnect are captured fixture effects, not server evidence. Tests
first reproduce stock 12.22.1 accepting missing/forged premature success, then
verify rejection with the replacement. RFC 5802 §5 / RFC 7677 §3 client-first,
client-proof and verified server-final are checked byte-for-byte for SHA-1/256.
No real credentials or key material are printed. A passing stock reproduction
means the defect was observed, not safe authentication.
`validated-sasl.mjs` installs through the public plugin and feature APIs:
```js
// Illustrative integration for a fresh Client, BEFORE any connect/features.
client.use(validatedSasl);
```
The plugin calls `registerFeature('sasl', 100, handler)`. Stanza's feature registry
uses one handler per name, so this replaces the stock callback. Registration also
adds another order entry; the real dispatcher exits on restart/disconnect, and
our integrated tests verify only one negotiation/completion, including after
reset. Do not install after authentication has started or alongside another SASL
replacement. The stock handler must never have an active event listener.
State is bounded to initial credentials/send, server-first, proof send,
server-final and closed. Success is allowed only after completed proof send,
strict final syntax, `processSuccess` and `finalize` reporting both authenticated
and mutuallyAuthenticated. Invalid input disconnects once, removes listeners
and never requests authenticated restart. Reset closes the old attempt before
awaited work resumes. Crypto remains entirely in the installed library, backed
by Node crypto in this run; no hash, HMAC, KDF or proof implementation is authored.
No credential cache/update is persisted by the replacement.
This is a deliberately limited non-PLUS SHA-256/SHA-1 experiment. It rejects
other mechanisms, supplied TLS binding bytes, extensions, extra challenges and
server-final delivered separately as a challenge. It accepts only server-final
additional-data on success. It checks nonce extension and bounds decoded data
at 4096 bytes and iterations at 100000; these are experiment limits, not shared
contracts/product policy. Racing success before a send promise resolves is
rejected conservatively. A final timeout/lifecycle policy belongs to the original
integration; this experiment does not claim one.
Exact dependency graph and preserved licenses: LICENSE_INVENTORY.md and
THIRD_PARTY_NOTICES.md. All eight locked packages are MIT; lock entries retain
HTTPS registry URLs and SHA512 integrity. Node/npm notices stay with their runtime.
Security review must inspect the state transitions and actual library calls,
repeat clean install/tests, check the diff, licenses and executor evidence, then
approve/reject through the task workflow. No browser build/execution, live WSS,
independent server, parser resource-limit certification, TLS channel binding,
constant-time verification audit, advisory/provenance audit, production SASL
policy or release readiness is claimed. Stanza's verifier uses ordinary string
equality; these tests prove rejection correctness, not a timing guarantee.
Browser Stanza uses its bundled synchronous hash/HMAC code and browser RNG/WS;
that backend is not exercised here. S00-003 retains its library selection,
browser/WSS/parser/extension experiment and stronger-mechanism policy work.
experiments/0002-xmpp-library/sasl-validation/THIRD_PARTY_NOTICES.md
+208
View File
@@ -0,0 +1,208 @@
# Third-party notices
Installed package license texts, preserved for this experiment. Node/npm distribution notices remain with the isolated runtime.
## @types/node 22.20.5
```text
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
```
## @types/punycode 2.1.4
```text
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
```
## @types/ws 8.18.2
```text
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
```
## punycode 2.3.1
```text
Copyright Mathias Bynens <https://mathiasbynens.be/>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
```
## sdp 3.2.2
```text
Copyright (c) 2017 Philipp Hancke
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
```
## stanza 12.22.1
```text
The MIT License (MIT)
Copyright © 2013-2019 Lance Stout
Copyright © 2013-2019 &yet <https://andyet.com>
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
```
## undici-types 6.21.0
```text
MIT License
Copyright (c) Matteo Collina and Undici contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
```
## ws 8.22.0
```text
Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
Copyright (c) 2013 Arnout Kazemier and contributors
Copyright (c) 2016 Luigi Pinca and contributors
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
```
experiments/0002-xmpp-library/sasl-validation/package-lock.json
Generated
+99
View File
@@ -0,0 +1,99 @@
{
"name": "luma-scram-server-final-experiment",
"version": "0.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "luma-scram-server-final-experiment",
"version": "0.0.0",
"dependencies": {
"stanza": "12.22.1"
},
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
}
},
"node_modules/@types/node": {
"version": "22.20.5",
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
"license": "MIT",
"dependencies": {
"undici-types": "~6.21.0"
}
},
"node_modules/@types/punycode": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
"license": "MIT"
},
"node_modules/@types/ws": {
"version": "8.18.2",
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
"license": "MIT",
"dependencies": {
"@types/node": "*"
}
},
"node_modules/punycode": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
"license": "MIT",
"engines": {
"node": ">=6"
}
},
"node_modules/sdp": {
"version": "3.2.2",
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
"license": "MIT"
},
"node_modules/stanza": {
"version": "12.22.1",
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
"license": "MIT",
"dependencies": {
"@types/node": "^22.0.0",
"@types/punycode": "^2.1.0",
"@types/ws": "^8.18.1",
"punycode": "^2.1.1",
"sdp": "^3.0.2",
"ws": "^8.18.2"
}
},
"node_modules/undici-types": {
"version": "6.21.0",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
"license": "MIT"
},
"node_modules/ws": {
"version": "8.22.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
},
"peerDependencies": {
"bufferutil": "^4.0.1",
"utf-8-validate": ">=5.0.2"
},
"peerDependenciesMeta": {
"bufferutil": {
"optional": true
},
"utf-8-validate": {
"optional": true
}
}
}
}
}
experiments/0002-xmpp-library/sasl-validation/package.json
+10
View File
@@ -0,0 +1,10 @@
{
"name": "luma-scram-server-final-experiment",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {"node": "24.21.0", "npm": "11.19.0"},
"packageManager": "npm@11.19.0",
"scripts": {"test": "node --test test/*.test.mjs"},
"dependencies": {"stanza": "12.22.1"}
}
experiments/0002-xmpp-library/sasl-validation/test/fixtures.mjs
+19
View File
@@ -0,0 +1,19 @@
// Public RFC examples only. Not accounts, secrets, or network endpoints.
export const vectors = [
{
source: 'https://www.rfc-editor.org/rfc/rfc5802.html#section-5',
mechanism: 'SCRAM-SHA-1', username: 'user', password: 'pencil',
nonce: 'fyko+d2lbbFgONRv9qkxdawL',
first: 'r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,s=QSXCR+Q6sek8bf92,i=4096',
proof: 'c=biws,r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,p=v0X8v3Bz2T0CJGbJQyF0X+HI4Ts=',
final: 'v=rmF9pqV8S7suAoZWja4dJRkFsKQ='
},
{
source: 'https://www.rfc-editor.org/rfc/rfc7677.html#section-3',
mechanism: 'SCRAM-SHA-256', username: 'user', password: 'pencil',
nonce: 'rOprNGfwEbeRWgbNEkqO',
first: 'r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096',
proof: 'c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=dHzbZapWIk4jUhN+Ute9ytag9zjfMHgsqmmiz7AndVQ=',
final: 'v=6rriTRBi23WpRR/wtup+mMhUZUn/dB5nLTJRsjl95G4='
}
];
experiments/0002-xmpp-library/sasl-validation/test/integration.test.mjs
+277
View File
@@ -0,0 +1,277 @@
import assert from 'node:assert/strict';
import test from 'node:test';
import {createRequire} from 'node:module';
import validatedSasl from '../validated-sasl.mjs';
import {vectors} from './fixtures.mjs';
const require = createRequire(import.meta.url);
const Client = require('stanza/Client').default;
const {parse} = require('stanza/jxt');
const tick = () => new Promise(resolve => setImmediate(resolve));
const deferred = () => {
let resolve;
const promise = new Promise(r => {resolve = r;});
return {promise, resolve};
};
function harness(vector = vectors[1], fixed = true, mechanisms = [vector.mechanism]) {
const client = new Client({jid: 'user@example.invalid', autoReconnect: false,
credentials: {username: vector.username, password: vector.password, clientNonce: vector.nonce}});
const result = {sent: [], success: 0, failed: 0, restart: 0, disconnect: 0, verification: []};
// Capture fixture effects; use the real Client, XML registry, feature dispatcher,
// mechanism factory and SCRAM crypto. Never connect to a real provider.
client.send = async (kind, stanza) => {result.sent.push({kind, stanza});};
client.transport = {authenticated: false, restart: () => {result.restart++;}};
client.disconnect = async () => {result.disconnect++;};
client.on('auth:success', () => {result.success++;});
client.on('auth:failed', () => {result.failed++;});
if (fixed) {
client.use(validatedSasl);
const original = client.sasl.createMechanism.bind(client.sasl);
client.sasl.createMechanism = names => {
const mech = original(names);
if (mech) for (const method of ['processSuccess', 'finalize']) {
const fn = mech[method].bind(mech);
mech[method] = (...args) => {result.verification.push(method); return fn(...args);};
}
return mech;
};
}
const receive = async (type, value) => {
const body = value === undefined ? '' : Buffer.from(value).toString('base64');
const xml = parse(`<${type} xmlns="urn:ietf:params:xml:ns:xmpp-sasl">${body}</${type}>`);
const stanza = client.stanzas.import(xml);
assert.equal(stanza.type, type);
client.emit('sasl', stanza);
await tick();
};
const start = async () => {
client.emit('features', {sasl: {mechanisms}});
await tick();
};
return {client, result, receive, start};
}
function rejected(h) {
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.result.failed, 1);
assert.equal(h.result.disconnect, 1);
assert.equal(h.client.features.negotiated.sasl, false);
assert.equal(h.client.transport.authenticated, false);
assert.equal(h.client.listenerCount('sasl'), 0);
}
for (const vector of vectors) {
test(`${vector.mechanism}: RFC proof and verified final through feature dispatcher`, async () => {
const h = harness(vector);
await h.start();
assert.equal(h.result.sent[0].stanza.value.toString(), `n,,n=user,r=${vector.nonce}`);
await h.receive('challenge', vector.first);
assert.equal(h.result.sent[1].stanza.value.toString(), vector.proof);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.transport.authenticated, false);
await h.receive('success', vector.final);
assert.deepEqual(h.result.verification, ['processSuccess', 'finalize']);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
assert.equal(h.result.disconnect, 0);
assert.equal(h.client.features.negotiated.sasl, true);
assert.equal(h.client.transport.authenticated, true);
await h.receive('success', vector.final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
});
for (const [label, final] of [
['missing', undefined],
['forged', vector.final.replace(/v=./, 'v=A')],
['error', 'e=invalid-proof'],
['conflicting error', `${vector.final},e=invalid-proof`],
['duplicate verifier', `${vector.final},${vector.final}`],
['bad base64', 'v=***'],
['oversized', 'v=' + 'A'.repeat(4096)]
]) {
test(`${vector.mechanism}: reject ${label} server-final after proof`, async () => {
const h = harness(vector);
await h.start();
await h.receive('challenge', vector.first);
await h.receive('success', final);
rejected(h);
if (label === 'forged') assert.deepEqual(h.result.verification, ['processSuccess', 'finalize']);
await h.receive('success', vector.final);
rejected(h);
});
}
test(`${vector.mechanism}: reject valid-looking final before proof`, async () => {
const h = harness(vector);
await h.start();
await h.receive('success', vector.final);
rejected(h);
assert.deepEqual(h.result.verification, []);
});
}
for (const [label, final] of [['missing', undefined], ['forged', 'v=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=']]) {
test(`stock 12.22.1 reproduces ${label} premature acceptance`, async () => {
const h = harness(vectors[1], false);
await h.start();
await h.receive('success', final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
assert.equal(h.client.transport.authenticated, true);
});
test(`replacement rejects original ${label} premature defect`, async () => {
const h = harness();
await h.start();
await h.receive('success', final);
rejected(h);
});
}
for (const [label, first] of [
['wrong nonce', vectors[1].first.replace('r=rOpr', 'r=wrong')],
['unextended nonce', `r=${vectors[1].nonce},s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096`],
['iteration overflow', vectors[1].first.replace('i=4096', 'i=100001')],
['invalid iterations', vectors[1].first.replace('i=4096', 'i=NaN')],
['duplicate attribute', vectors[1].first + ',i=4096'],
['mandatory extension', 'm=required,' + vectors[1].first]
]) {
test(`reject ${label} before library proof work`, async () => {
const h = harness();
await h.start();
await h.receive('challenge', first);
rejected(h);
assert.equal(h.result.sent.length, 1);
});
}
test('reject success while proof send is pending; no late revival', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
await h.receive('success', vectors[1].final);
rejected(h);
pending.resolve();
await tick();
await h.receive('success', vectors[1].final);
rejected(h);
});
test('duplicate challenge while sending proof fails closed', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
await h.receive('challenge', vectors[1].first);
rejected(h);
pending.resolve();
await tick();
rejected(h);
});
test('reset while awaiting credentials prevents late auth and listener leak', async () => {
const h = harness();
const pending = deferred();
h.client.getCredentials = () => pending.promise;
await h.start();
h.client.emit('--reset-stream-features');
pending.resolve({username: 'user', password: 'pencil', clientNonce: vectors[1].nonce});
await tick();
await h.receive('success', vectors[1].final);
assert.equal(h.result.sent.length, 0);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
});
test('reset after proof, new negotiation succeeds without old handlers', async () => {
const h = harness();
await h.start();
await h.receive('challenge', vectors[1].first);
h.client.emit('--reset-stream-features');
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
await h.start();
assert.equal(h.client.listenerCount('sasl'), 1);
await h.receive('challenge', vectors[1].first);
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
});
test('fixture policy filters PLUS and plaintext; strongest available non-PLUS selected', async () => {
const h = harness(vectors[1], true, ['PLAIN', 'SCRAM-SHA-1', 'SCRAM-SHA-256-PLUS', 'SCRAM-SHA-256']);
await h.start();
assert.equal(h.result.sent[0].stanza.mechanism, 'SCRAM-SHA-256');
});
for (const names of [['PLAIN'], ['SCRAM-SHA-256-PLUS'], []]) {
test(`no allowed mechanism (${names.join(',')}) disconnects`, async () => {
const h = harness(vectors[1], true, names);
await h.start();
rejected(h);
assert.equal(h.result.sent.length, 0);
});
}
for (const type of ['failure', 'abort']) {
test(`${type} is terminal; valid final cannot revive it`, async () => {
const h = harness();
await h.start();
await h.receive(type);
await h.receive('success', vectors[1].final);
rejected(h);
});
}
test('success during pending initial credentials fails closed', async () => {
const h = harness();
const pending = deferred();
h.client.getCredentials = () => pending.promise;
await h.start();
await h.receive('success', vectors[1].final);
rejected(h);
pending.resolve({username: 'user', password: 'pencil', clientNonce: vectors[1].nonce});
await tick();
assert.equal(h.result.sent.length, 0);
rejected(h);
});
test('reset during proof send cancels continuation', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
h.client.emit('--reset-stream-features');
pending.resolve();
await tick();
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
});
for (const stage of ['credentials', 'initial send', 'proof send']) {
test(`${stage} rejection disconnects without success`, async () => {
const h = harness();
const reject = async () => {throw new Error('synthetic fixture failure');};
if (stage === 'credentials') h.client.getCredentials = reject;
if (stage === 'initial send') h.client.send = reject;
await h.start();
if (stage === 'proof send') {
h.client.send = reject;
await h.receive('challenge', vectors[1].first);
}
rejected(h);
});
}
test('repeat challenge after completed proof is rejected', async () => {
const h = harness();
await h.start();
await h.receive('challenge', vectors[1].first);
await h.receive('challenge', vectors[1].first);
rejected(h);
});
experiments/0002-xmpp-library/sasl-validation/validated-sasl.mjs
+108
View File
@@ -0,0 +1,108 @@
// Fixture-bound feature replacement. Cryptographic operations stay in Stanza SCRAM.
// No production transport, credential persistence, or channel binding is provided.
const SUPPORTED = new Set(['SCRAM-SHA-256', 'SCRAM-SHA-1']);
const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
function text(value) {
// SASL's parsed additional-data is a Buffer, not raw XML/base64 text.
if (!value || typeof value.toString !== 'function' || value.length > 4096) {
throw new Error('Invalid SASL data');
}
const result = value.toString('utf8');
if (!/^[\x21-\x7e]*$/.test(result)) throw new Error('Invalid SASL data');
return result;
}
function firstMessage(value, nonce) {
// Deliberately narrow, no extensions. Bound work before calling library crypto.
const match = /^r=([\x21-\x2b\x2d-\x7e]+),s=([A-Za-z0-9+/=]+),i=([1-9][0-9]*)$/.exec(text(value));
if (!match || !BASE64.test(match[2]) || !match[1].startsWith(nonce) ||
match[1].length <= nonce.length || Number(match[3]) > 100000) {
throw new Error('Invalid SCRAM server-first');
}
}
function finalMessage(value, name) {
const final = text(value);
const length = name === 'SCRAM-SHA-256' ? 44 : 28;
if (!final.startsWith('v=') || final.length !== length + 2 || !BASE64.test(final.slice(2))) {
throw new Error('Invalid SCRAM server-final');
}
}
export default function validatedSasl(client) {
let active;
// Public plugin + named feature registration replaces the stock handler before use.
client.registerFeature('sasl', 100, async (features, done) => {
if (active) active();
const names = features.sasl.mechanisms.filter(name => SUPPORTED.has(name));
const mech = client.sasl.createMechanism(names);
let phase = 'starting';
let credentials;
let nonce;
const cleanup = () => {
client.off('sasl', handler);
client.off('--reset-stream-features', reset);
if (active === reset) active = undefined;
};
const reset = () => {
phase = 'closed';
cleanup();
client.features.negotiated.sasl = false;
};
const fail = () => {
if (phase === 'closed') return;
phase = 'closed';
cleanup();
client.features.negotiated.sasl = false;
if (client.transport) client.transport.authenticated = false;
client.emit('auth:failed');
done('disconnect', 'SCRAM validation failed'); // Never log peer data/credentials.
};
const handler = async sasl => {
if (phase === 'closed') return;
try {
if (sasl.type === 'challenge' && phase === 'server-first') {
phase = 'sending-proof'; // Reject duplicate challenges and racing success.
firstMessage(sasl.value, nonce);
mech.processChallenge(sasl.value);
const response = mech.createResponse(credentials);
await client.send('sasl', {type: 'response', value: response});
if (phase !== 'closed') phase = 'server-final';
return;
}
if (sasl.type !== 'success' || phase !== 'server-final') return fail();
finalMessage(sasl.value, mech.name);
mech.processSuccess(sasl.value);
const result = mech.finalize();
if (!result.authenticated || !result.mutuallyAuthenticated) return fail();
phase = 'closed';
cleanup();
client.features.negotiated.sasl = true;
if (client.transport) client.transport.authenticated = true;
client.emit('auth:success', client.config.credentials);
done('restart');
} catch {
fail();
}
};
active = reset;
client.features.negotiated.sasl = false;
client.on('sasl', handler);
client.once('--reset-stream-features', reset);
try {
if (!mech || !SUPPORTED.has(mech.name)) return fail();
credentials = await client.getCredentials();
if (phase === 'closed') return;
// Restrict this experiment to non-PLUS; never invent TLS binding bytes.
if (credentials.tlsUnique) return fail();
const response = mech.createResponse(credentials);
nonce = /,r=([^,]+)$/.exec(response.toString('utf8'))?.[1];
if (!nonce) return fail();
await client.send('sasl', {type: 'auth', mechanism: mech.name, value: response});
if (phase !== 'closed') phase = 'server-first';
} catch {
fail();
}
});
}
experiments/0002-xmpp-library/selection-spike/.npmrc
+4
View File
@@ -0,0 +1,4 @@
engine-strict=true
strict-ssl=true
ignore-scripts=true
registry=https://registry.npmjs.org/
experiments/0002-xmpp-library/selection-spike/LICENSE_INVENTORY.md
+57
View File
@@ -0,0 +1,57 @@
# Locked dependency license inventory
Includes optional host entries. No new package families beyond reviewed parser/SHA512 experiments.
| Package | Version | License |
| --- | --- | --- |
| @oxc-project/types | 0.154.0 | MIT |
| @rolldown/binding-android-arm-eabi | 1.2.14 | MIT |
| @rolldown/binding-android-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-x64 | 1.2.14 | MIT |
| @rolldown/binding-freebsd-x64 | 1.2.14 | MIT |
| @rolldown/binding-linux-arm-gnueabihf | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-musl | 1.2.14 | MIT |
| @rolldown/binding-linux-ppc64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-s390x-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-musl | 1.2.14 | MIT |
| @rolldown/binding-openharmony-arm64 | 1.2.14 | MIT |
| @rolldown/binding-win32-arm64-msvc | 1.2.14 | MIT |
| @rolldown/binding-win32-x64-msvc | 1.2.14 | MIT |
| @rolldown/pluginutils | 1.0.1 | MIT |
| @types/node | 22.20.5 | MIT |
| @types/punycode | 2.1.4 | MIT |
| @types/ws | 8.18.2 | MIT |
| detect-libc | 2.1.2 | Apache-2.0 |
| events | 3.3.0 | MIT |
| fdir | 6.5.0 | MIT |
| fsevents | 2.3.3 | MIT |
| lightningcss | 1.33.0 | MPL-2.0 |
| lightningcss-android-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-freebsd-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm-gnueabihf | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-win32-arm64-msvc | 1.33.0 | MPL-2.0 |
| lightningcss-win32-x64-msvc | 1.33.0 | MPL-2.0 |
| nanoid | 3.3.20 | MIT |
| picocolors | 1.1.1 | ISC |
| picomatch | 4.0.7 | MIT |
| postcss | 8.5.30 | MIT |
| punycode | 2.3.1 | MIT |
| rolldown | 1.2.14 | MIT |
| saxes | 6.0.0 | ISC |
| sdp | 3.2.2 | MIT |
| source-map-js | 1.2.2 | BSD-3-Clause |
| stanza | 12.22.1 | MIT |
| tinyglobby | 0.2.17 | MIT |
| undici-types | 6.21.0 | MIT |
| vite | 8.3.4 | MIT |
| ws | 8.22.0 | MIT |
| xmlchars | 2.2.0 | MIT |
experiments/0002-xmpp-library/selection-spike/README.md
+51
View File
@@ -0,0 +1,51 @@
# S00-003 combined XMPP selection spike
One isolated experiment; no application adapter or production provider. See
`docs/decisions/0002-xmpp-library.md` for selection rationale and limits.
Use the authentic pinned Node 24.21.0 / npm 11.19.0 from S00-020. On this host its
reviewed temporary bin path was `/tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin`;
paths may expire. Recreate via the reviewed environment-access probe if needed.
Keep its verified runtime directory first in PATH. OpenSSL must be available.
No system install, trust-store change or secret is needed.
From project root, with the pinned runtime in PATH:
```sh
node --version
npm --version
npm ci --prefix experiments/0002-xmpp-library/selection-spike --ignore-scripts --no-audit --no-fund --engine-strict=true --strict-ssl=true --fetch-retries=0 --fetch-timeout=15000 --cache /tmp/luma-selection-independent-clean
npm test --prefix experiments/0002-xmpp-library/selection-spike
python3 experiments/0002-xmpp-library/selection-spike/check-dependencies.py
make check
```
Use a new empty cache for independent clean-install evidence. The checker compares
vendor bytes against the reviewed `environment-access/node_modules/stanza` graph;
that graph must exist (its verify.py recreates it without altering parent inputs).
No application code or accepted prerequisite source is changed by these commands.
`dist` and node_modules are ignored build artifacts. npm test explicitly invokes
Vite even though install lifecycle scripts are disabled. Lock updates need review.
Tests run the Vite browser artifact in Node. Reused S00-019 regression tests cover
known HMAC vectors, public alias, real feature dispatcher, forged/out-of-order
finals, reset, pending sends, synthetic binding rejection and no derived cache.
WSS tests use a fresh ephemeral localhost certificate/key under /tmp, explicitly
trusted only by the test socket; rejectUnauthorized stays true. A native socket
without that trust must reject it. No certificate/key is committed. The peer
checks fixed public RFC or accepted independent Scramp transcripts; it is a
scripted fixture, not an independent full XMPP implementation. Synthetic fixture
credentials are public/invented data only, never read from the environment.
Bounded ingress and SHA-512 composition are byte-identical reviewed copies.
Only the copied ordering guard extends allowed non-PLUS mechanisms to 512/256/1
and emits safe policy diagnostics. No fallback is enabled. Browser TLS data is
unavailable and never synthesized. Registry tests cover basic MAM/MUC/Jingle/
upload/legacy opaque OMEMO plus an invented extension namespace, not encrypted
interoperability or OMEMO2 wire compliance. They explicitly select the language
collection on export because echoing both library body projections duplicates text;
a separate stock-behavior regression preserves that finding.
No real browser/server/client interoperability, load bound, constant-time audit,
full XEP coverage or product readiness result is implied. All inherited limits
remain in the ADR. Changes are subject to independent QA review.
experiments/0002-xmpp-library/selection-spike/THIRD_PARTY_NOTICES.md
+4216
View File
File diff suppressed because it is too large. Load diff
experiments/0002-xmpp-library/selection-spike/bounded-ingress.mjs
+146
View File
@@ -0,0 +1,146 @@
import {SaxesParser} from 'saxes';
import jxt from 'stanza/jxt/index.js';
// Experiment policy only. The byte ceiling bounds SAX token/namespace storage
// even before callbacks can inspect a completed name or attribute value.
export const LIMITS = Object.freeze({bytes: 4096, depth: 8, elements: 32,
attributes: 16, attributeChars: 1024, nameChars: 128, valueChars: 256});
class IngressError extends Error {
constructor(code) { super(code); this.code = code; }
}
const fail = code => { throw new IngressError(code); };
export function validateMessage(data) {
if (typeof data !== 'string') fail('text-required');
// Avoid encoding an attacker-sized string. UTF-8 bytes >= UTF-16 units for
// valid XML; isolated surrogates are subsequently rejected by saxes.
if (data.length > LIMITS.bytes) fail('bytes');
if (new TextEncoder().encode(data).length > LIMITS.bytes) fail('bytes');
if (!data.startsWith('<')) fail('framing');
let depth = 0, elements = 0, attributes = 0, attributeChars = 0, ended = false;
const parser = new SaxesParser({xmlns: true, fragment: false,
defaultXMLVersion: '1.0', forceXMLVersion: true});
parser.on('error', () => fail('invalid-xml'));
for (const event of ['doctype', 'comment', 'processinginstruction', 'xmldecl']) {
parser.on(event, () => fail('restricted-xml'));
}
parser.on('opentagstart', tag => {
if (++depth > LIMITS.depth) fail('depth');
if (++elements > LIMITS.elements) fail('elements');
if (tag.name.length > LIMITS.nameChars) fail('name');
});
parser.on('attribute', attr => {
if (++attributes > LIMITS.attributes) fail('attributes');
if (attr.name.length > LIMITS.nameChars) fail('name');
if (attr.value.length > LIMITS.valueChars) fail('attribute-value');
attributeChars += attr.name.length + attr.value.length;
if (attributeChars > LIMITS.attributeChars) fail('attribute-chars');
});
parser.on('closetag', () => { depth--; });
parser.on('end', () => { ended = true; });
// close() detects unfinished XML. Throwing from callbacks aborts immediately;
// there is no recovery listener, DTD fetch, custom entity or tree construction.
parser.write(data).close();
if (!ended || depth !== 0 || elements === 0) fail('framing');
}
export function importMessage(data, registry, config) {
validateMessage(data);
// Only bounded, complete documents reach the actual candidate parser/import.
const xml = jxt.parse(data, {allowComments: false});
if (!xml) fail('invalid-xml');
const kind = registry.getImportKey(xml);
const stanza = registry.import(xml, {lang: config.lang,
acceptLanguages: config.acceptLanguages});
if (!kind || !stanza) fail('unknown-root');
return {kind, stanza};
}
// Public Transport interface and Client.transports constructor registry.
// Socket injection is solely for finite fixtures; default is browser WebSocket.
export function installBoundedTransport(client, Socket = globalThis.WebSocket) {
class BoundedTransport {
#client; #registry; #sm; #socket; #config; #closed = true;
hasStream = false;
stream;
constructor(agent, sm, registry) {
this.#client = agent; this.#sm = sm; this.#registry = registry;
}
connect(config) {
if (this.#socket || !this.#closed) throw new Error('Fresh transport required');
if (new URL(config.url).protocol !== 'wss:') throw new Error('WSS required');
this.#config = config;
this.#closed = false;
const socket = this.#socket = new Socket(config.url, 'xmpp');
socket.onopen = () => {
if (this.#closed) return;
if (socket.protocol !== 'xmpp') return this.#reject('subprotocol');
this.#sm.started = false;
this.#client.emit('connected');
this.restart();
};
socket.onmessage = event => {
if (this.#closed) return;
let parsed;
try { parsed = importMessage(event.data, this.#registry, this.#config); }
catch (error) { return this.#reject(error instanceof IngressError ? error.code : 'invalid-xml'); }
// No raw payload event/log or async parser continuation escapes ingress.
if (parsed.kind === 'stream') {
if (parsed.stanza.action === 'open') {
this.hasStream = true;
this.stream = parsed.stanza;
this.#client.emit('stream:start', parsed.stanza);
} else {
this.#client.emit('stream:end');
this.disconnect(false);
}
} else {
this.#client.emit('stream:data', parsed.stanza, parsed.kind);
}
};
socket.onerror = () => this.#reject('socket-error');
socket.onclose = () => this.disconnect(false);
}
#reject(code) {
if (this.#closed) return;
// Close/clear before notifying consumers; a reentrant callback cannot
// revive the attempt. Never expose parser error text containing input.
this.disconnect(false);
this.#client.emit('ingress:rejected', code);
}
disconnect(clean = true) {
if (this.#closed) return;
this.#closed = true;
const socket = this.#socket;
this.#socket = undefined;
if (socket) {
socket.onopen = socket.onmessage = socket.onerror = socket.onclose = null;
if (clean && this.hasStream && socket.readyState === 1) {
socket.send(this.#registry.export('stream', {action: 'close'}).toString());
}
socket.close();
}
this.hasStream = false;
this.stream = undefined;
this.#config = undefined;
if (this.#client.transport === this) this.#client.emit('--transport-disconnected');
}
restart() {
if (this.#closed) return;
this.hasStream = false;
this.stream = undefined;
this.#write(this.#registry.export('stream', {action: 'open',
lang: this.#config.lang, to: this.#config.server, version: '1.0'}).toString());
}
#write(data) {
if (this.#closed || this.#socket?.readyState !== 1) throw new Error('Socket closed');
this.#socket.send(data);
}
async send(name, data) {
const xml = this.#registry.export(name, data);
if (!xml) throw new Error('Unknown outgoing stanza');
this.#write(xml.toString());
}
}
client.transports['bounded-websocket'] = BoundedTransport;
}
experiments/0002-xmpp-library/selection-spike/browser-entry.mjs
+12
View File
@@ -0,0 +1,12 @@
import client from 'stanza/Client.js';
import jxt from 'stanza/jxt/index.js';
import platform from 'stanza/platform';
import sasl from 'stanza/lib/sasl/index.js';
export {default as validatedSasl} from './validated-sasl.mjs';
export {Sha512Mechanism} from './sha512-mechanism.mjs';
export const Client = client.default;
export const parse = jxt.parse;
export const {Buffer, createHash, createHmac, name: backend, randomBytes} = platform;
export const StockScram = sasl.SCRAM;
export {installBoundedTransport, validateMessage, importMessage, LIMITS} from './bounded-ingress.mjs';
export const {attribute, text} = jxt;
experiments/0002-xmpp-library/selection-spike/check-dependencies.py
+55
View File
@@ -0,0 +1,55 @@
"""Check installed locked graph, notices, browser backend and reviewed source reuse."""
import hashlib
import json
from pathlib import Path
root = Path(__file__).resolve().parent
lock = json.loads((root / 'package-lock.json').read_text())['packages']
manifest = json.loads((root / 'package.json').read_text())
inventory = (root / 'LICENSE_INVENTORY.md').read_text()
notices = (root / 'THIRD_PARTY_NOTICES.md').read_text()
for section in ('dependencies', 'devDependencies'):
for name, version in manifest[section].items():
assert lock['node_modules/' + name]['version'] == version
installed = 0
for path, entry in lock.items():
if not path:
continue
name = path.split('node_modules/')[-1]
assert entry['resolved'].startswith('https://registry.npmjs.org/')
assert entry['integrity'].startswith('sha512-')
assert f"| {name} | {entry['version']} | {entry['license']} |" in inventory
package = root / path
if not package.exists():
assert entry.get('optional'), name
continue
meta = json.loads((package / 'package.json').read_text())
assert meta['version'] == entry['version']
assert meta['license'] == entry['license']
licenses = [f for f in package.iterdir() if f.is_file() and
('license' in f.name.lower() or f.name.lower().startswith(('notice', 'copying')))]
if name == 'saxes':
licenses = [root / 'licenses/saxes-6.0.0-LICENSE']
if not licenses and name.startswith('@rolldown/binding-'):
licenses = [root / 'node_modules/rolldown/LICENSE', root / 'node_modules/rolldown/THIRD-PARTY-LICENSE']
assert licenses, name
for file in licenses:
assert file.read_text().rstrip() in notices, file
installed += 1
# Independently installed, reviewed locked vendor graph, read only.
original = root.parent / 'environment-access/node_modules/stanza'
current = root / 'node_modules/stanza'
files = {f.relative_to(current) for f in current.rglob('*') if f.is_file()}
assert files == {f.relative_to(original) for f in original.rglob('*') if f.is_file()}
for file in files:
assert (current / file).read_bytes() == (original / file).read_bytes(), file
for local, reviewed in [('bounded-ingress.mjs', 'parser-validation/bounded-ingress.mjs'),
('sha512-mechanism.mjs', 'sha512-validation/sha512-mechanism.mjs'),
('licenses/saxes-6.0.0-LICENSE', 'parser-validation/licenses/saxes-6.0.0-LICENSE')]:
assert (root / local).read_bytes() == (root.parent / reviewed).read_bytes(), local
modules = json.loads((root / 'dist/modules.json').read_text())
assert any(x.endswith('/stanza/platform/browser/crypto/Hmac.js') for x in modules)
assert not any('/platform/node/' in x or x.startswith('node:') or 'browser-external' in x for x in modules)
print(f'{len(lock)-1} locked / {installed} installed packages; notices verified; {len(files)} unchanged Stanza files; reviewed parser/alias reused; browser backend')
for file in ['package-lock.json', 'validated-sasl.mjs', 'dist/browser.mjs']:
print(file, hashlib.sha256((root / file).read_bytes()).hexdigest())
experiments/0002-xmpp-library/selection-spike/licenses/saxes-6.0.0-LICENSE
+64
View File
@@ -0,0 +1,64 @@
The ISC License
Copyright (c) Contributors
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
====
The following license is the one that governed sax, from which saxes
was forked. Isaac Schlueter is not *directly* involved with saxes so
don't go bugging him for saxes issues.
The ISC License
Copyright (c) Isaac Z. Schlueter and Contributors
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
====
`String.fromCodePoint` by Mathias Bynens is no longer used, but it can
still be found in old commits. It was once used according to terms of
MIT License, as follows:
Copyright Mathias Bynens <https://mathiasbynens.be/>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
experiments/0002-xmpp-library/selection-spike/package-lock.json
Generated
+945
View File
@@ -0,0 +1,945 @@
{
"name": "luma-xmpp-selection-spike",
"version": "0.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "luma-xmpp-selection-spike",
"version": "0.0.0",
"dependencies": {
"events": "3.3.0",
"saxes": "6.0.0",
"stanza": "12.22.1",
"ws": "8.22.0"
},
"devDependencies": {
"vite": "8.3.4"
},
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
}
},
"node_modules/@oxc-project/types": {
"version": "0.154.0",
"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.154.0.tgz",
"integrity": "sha512-KYOUGQFlLWR+s4QMV2Q9ko38TZm7EdO87Qm7rvZLqk/webse/cDjtyxKhg/47l0byCbs/k46LT8qc4PKjAikzA==",
"dev": true,
"license": "MIT",
"funding": {
"url": "https://github.com/sponsors/oxc-project"
}
},
"node_modules/@rolldown/binding-android-arm-eabi": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.14.tgz",
"integrity": "sha512-aWR+XKH9+rW7m5fWq/5360J3mHycrx/o6xZM2DQFdJnTMdyP7/WzxPjhtLbVWdKo2y612/4U1bWqb3HQhiF7vg==",
"cpu": [
"arm"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"android"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-android-arm64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.14.tgz",
"integrity": "sha512-QiVxHofl6A8lQU7WAtOUY4QMVZXohxwz7WJJoeh8NBEUyKfIkMRKhYyq8az/1RypNiIXzNTtiS6KwHz0erxYRQ==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"android"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-darwin-arm64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.14.tgz",
"integrity": "sha512-lTQOzHuBIooh3jIr5XINQkjPGEuGy+Dsy0meXDr6Sjty0b99kYgGh4uBC/8mJX1T0kC8d6S0aPP1Y+bHkh6aBw==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-darwin-x64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.14.tgz",
"integrity": "sha512-hyMKEGatjmBYCs/Q4sbIcL/GqpFEqsX3wc+HYVQ/85A4rxc1o7rPm4DUI4GV4k/h0ITddwFSGpqQunI14GXjTA==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-freebsd-x64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.14.tgz",
"integrity": "sha512-u371GbXoVXrEgP20PwzoGNOdAOqAMhzo19JzzY+V4YmmnC+DTOoqdbMu+O+54emM59Mik/UdrtWgcuEDKWRPKA==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"freebsd"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-arm-gnueabihf": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.14.tgz",
"integrity": "sha512-BqwKsdZQf6EqVWr8fv2MrDYzAvOZ7+NYFSJESRGs87fkseEhs0TU9TXgRJTkZoRRkxTizyEg1LKUXfU3/78uqg==",
"cpu": [
"arm"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-arm64-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.14.tgz",
"integrity": "sha512-SD9kY8M009x/7s57Z1dgUVlP5+uYBgKQK0Tkr1WIWngrtUJmRCW1RJFMY7QDla2khXhmg2i5Io7MUjcmZNZ/KQ==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-arm64-musl": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.14.tgz",
"integrity": "sha512-BJ2CL19M6uuWesMgnqJzgxoI+N+eV7b0A9O9vLV42y+gitC41fNa8KElau1tHVzuLWX5GzEuxMPhAO0tQXQMkg==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-ppc64-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.14.tgz",
"integrity": "sha512-4+Kl8daPV8NDHaD7mfCcc1pRM+Qg7ab8DyMm5FG5WoZgv4h2i3KFN1CybYBNbQqmuYm7ftJLvmMI1eHYJ22S/Q==",
"cpu": [
"ppc64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-s390x-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.14.tgz",
"integrity": "sha512-V/h8ePq1fKDrmtFMz6xcCN3DKvuvMRrwwD1q0PkBeeo4DpK64biaKvqWGVxqCeYKqeRk7gE7/iKPxLCn08O97A==",
"cpu": [
"s390x"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-x64-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.14.tgz",
"integrity": "sha512-WxalXzgrLVpKC93xfpaJ3gCXUWzeCr+FRCbDVD2mUAy4L6Vo3lNVz0epUEUpxPWJkLNYUwM4OSIikv36OJ9mLg==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-x64-musl": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.14.tgz",
"integrity": "sha512-3G3tnAmTpdk9jO3GQtyHXqeFD2SlecfTws/Y3M2mmj9nMBwwuLT4kur8sZKeu7ENUHSpVO3cIsm5A52LEWWwlg==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-openharmony-arm64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.14.tgz",
"integrity": "sha512-qyr5XiNGxm2ytx17vvtcJ9nXn6v1gENETi503bJx3OGwZ1tSonj7BosxbMa/xeAfSl5iS9X6KjEWYXLu6v1L7Q==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"openharmony"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-win32-arm64-msvc": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.14.tgz",
"integrity": "sha512-oA4o5o0S2yB199YyYXDzKUv1Z56Rc+mgOjwm7Z/vJ9Z8igiDPYvoOuDyo6g7AK/ZaF09nPhDKVnGBcYHO11GXA==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-win32-x64-msvc": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.14.tgz",
"integrity": "sha512-9mE94bf2GZUaR/fUSXCMpBoWkctu421Mi0ORpm4zqfbkjKep7RxzPFa5etcGs5h+2KApoWBOA/hAJa/7saGgEQ==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/pluginutils": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
"integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
"dev": true,
"license": "MIT"
},
"node_modules/@types/node": {
"version": "22.20.5",
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
"license": "MIT",
"dependencies": {
"undici-types": "~6.21.0"
}
},
"node_modules/@types/punycode": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
"license": "MIT"
},
"node_modules/@types/ws": {
"version": "8.18.2",
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
"license": "MIT",
"dependencies": {
"@types/node": "*"
}
},
"node_modules/detect-libc": {
"version": "2.1.2",
"resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
"integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
"dev": true,
"license": "Apache-2.0",
"engines": {
"node": ">=8"
}
},
"node_modules/events": {
"version": "3.3.0",
"resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
"integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
"license": "MIT",
"engines": {
"node": ">=0.8.x"
}
},
"node_modules/fdir": {
"version": "6.5.0",
"resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
"integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
"dev": true,
"license": "MIT",
"engines": {
"node": ">=12.0.0"
},
"peerDependencies": {
"picomatch": "^3 || ^4"
},
"peerDependenciesMeta": {
"picomatch": {
"optional": true
}
}
},
"node_modules/fsevents": {
"version": "2.3.3",
"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
"integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
"dev": true,
"hasInstallScript": true,
"license": "MIT",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": "^8.16.0 || ^10.6.0 || >=11.0.0"
}
},
"node_modules/lightningcss": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
"integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
"dev": true,
"license": "MPL-2.0",
"dependencies": {
"detect-libc": "^2.0.3"
},
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
},
"optionalDependencies": {
"lightningcss-android-arm64": "1.33.0",
"lightningcss-darwin-arm64": "1.33.0",
"lightningcss-darwin-x64": "1.33.0",
"lightningcss-freebsd-x64": "1.33.0",
"lightningcss-linux-arm-gnueabihf": "1.33.0",
"lightningcss-linux-arm64-gnu": "1.33.0",
"lightningcss-linux-arm64-musl": "1.33.0",
"lightningcss-linux-x64-gnu": "1.33.0",
"lightningcss-linux-x64-musl": "1.33.0",
"lightningcss-win32-arm64-msvc": "1.33.0",
"lightningcss-win32-x64-msvc": "1.33.0"
}
},
"node_modules/lightningcss-android-arm64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
"integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"android"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-darwin-arm64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
"integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-darwin-x64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
"integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
"cpu": [
"x64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-freebsd-x64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
"integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
"cpu": [
"x64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"freebsd"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-arm-gnueabihf": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
"integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
"cpu": [
"arm"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-arm64-gnu": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
"integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-arm64-musl": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
"integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-x64-gnu": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
"integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-x64-musl": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
"integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-win32-arm64-msvc": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
"integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-win32-x64-msvc": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
"integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
"cpu": [
"x64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/nanoid": {
"version": "3.3.20",
"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.20.tgz",
"integrity": "sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==",
"dev": true,
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/ai"
}
],
"license": "MIT",
"bin": {
"nanoid": "bin/nanoid.cjs"
},
"engines": {
"node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
}
},
"node_modules/picocolors": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
"integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
"dev": true,
"license": "ISC"
},
"node_modules/picomatch": {
"version": "4.0.7",
"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
"integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
"dev": true,
"license": "MIT",
"engines": {
"node": ">=12"
},
"funding": {
"url": "https://github.com/sponsors/jonschlinkert"
}
},
"node_modules/postcss": {
"version": "8.5.30",
"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.30.tgz",
"integrity": "sha512-zkd+e9S1AQHhmaBKye9zlFHWjOwVgqXl1q3ECYy8561K7qxR2cREf/STLskulBFd78k6AOFeA+ff1TtEzk9bAA==",
"dev": true,
"funding": [
{
"type": "opencollective",
"url": "https://opencollective.com/postcss/"
},
{
"type": "tidelift",
"url": "https://tidelift.com/funding/github/npm/postcss"
},
{
"type": "github",
"url": "https://github.com/sponsors/ai"
}
],
"license": "MIT",
"dependencies": {
"nanoid": "^3.3.20",
"picocolors": "^1.1.1",
"source-map-js": "^1.2.2"
},
"engines": {
"node": "^10 || ^12 || >=14"
}
},
"node_modules/punycode": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
"license": "MIT",
"engines": {
"node": ">=6"
}
},
"node_modules/rolldown": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.14.tgz",
"integrity": "sha512-eTBTTqMR6uHKLgcUqpJP8ntzDI6V4LYA8negAMBEI7gkgVvOdrx6VsvS2Ym+83KhOPdLCHWJu0w7UQFJZhHKNw==",
"dev": true,
"license": "MIT",
"dependencies": {
"@oxc-project/types": "=0.154.0",
"@rolldown/pluginutils": "^1.0.0"
},
"bin": {
"rolldown": "bin/cli.mjs"
},
"engines": {
"node": "^20.19.0 || >=22.12.0"
},
"optionalDependencies": {
"@rolldown/binding-android-arm-eabi": "1.2.14",
"@rolldown/binding-android-arm64": "1.2.14",
"@rolldown/binding-darwin-arm64": "1.2.14",
"@rolldown/binding-darwin-x64": "1.2.14",
"@rolldown/binding-freebsd-x64": "1.2.14",
"@rolldown/binding-linux-arm-gnueabihf": "1.2.14",
"@rolldown/binding-linux-arm64-gnu": "1.2.14",
"@rolldown/binding-linux-arm64-musl": "1.2.14",
"@rolldown/binding-linux-ppc64-gnu": "1.2.14",
"@rolldown/binding-linux-s390x-gnu": "1.2.14",
"@rolldown/binding-linux-x64-gnu": "1.2.14",
"@rolldown/binding-linux-x64-musl": "1.2.14",
"@rolldown/binding-openharmony-arm64": "1.2.14",
"@rolldown/binding-win32-arm64-msvc": "1.2.14",
"@rolldown/binding-win32-x64-msvc": "1.2.14"
}
},
"node_modules/saxes": {
"version": "6.0.0",
"resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
"integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
"license": "ISC",
"dependencies": {
"xmlchars": "^2.2.0"
},
"engines": {
"node": ">=v12.22.7"
}
},
"node_modules/sdp": {
"version": "3.2.2",
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
"license": "MIT"
},
"node_modules/source-map-js": {
"version": "1.2.2",
"resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
"integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
"dev": true,
"license": "BSD-3-Clause",
"engines": {
"node": ">=0.10.0"
}
},
"node_modules/stanza": {
"version": "12.22.1",
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
"license": "MIT",
"dependencies": {
"@types/node": "^22.0.0",
"@types/punycode": "^2.1.0",
"@types/ws": "^8.18.1",
"punycode": "^2.1.1",
"sdp": "^3.0.2",
"ws": "^8.18.2"
}
},
"node_modules/tinyglobby": {
"version": "0.2.17",
"resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
"integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
"dev": true,
"license": "MIT",
"dependencies": {
"fdir": "^6.5.0",
"picomatch": "^4.0.4"
},
"engines": {
"node": ">=12.0.0"
},
"funding": {
"url": "https://github.com/sponsors/SuperchupuDev"
}
},
"node_modules/undici-types": {
"version": "6.21.0",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
"license": "MIT"
},
"node_modules/vite": {
"version": "8.3.4",
"resolved": "https://registry.npmjs.org/vite/-/vite-8.3.4.tgz",
"integrity": "sha512-IftLE8phJhdNRIGNEV4JCCvfNScoZQVfcXaN8TQropWGJtOHcu+iAB9pHcuGvmEb/kddw0LBe/jS8ztdC6xdiQ==",
"dev": true,
"license": "MIT",
"dependencies": {
"lightningcss": "^1.33.0",
"picomatch": "^4.0.7",
"postcss": "^8.5.29",
"rolldown": "~1.2.12",
"tinyglobby": "^0.2.17"
},
"bin": {
"vite": "bin/vite.js"
},
"engines": {
"node": "^20.19.0 || >=22.12.0"
},
"funding": {
"url": "https://github.com/vitejs/vite?sponsor=1"
},
"optionalDependencies": {
"fsevents": "~2.3.3"
},
"peerDependencies": {
"@types/node": "^20.19.0 || >=22.12.0",
"@vitejs/devtools": "^0.7.1",
"esbuild": "^0.27.0 || ^0.28.0",
"jiti": ">=1.21.0",
"less": "^4.0.0",
"sass": "^1.70.0",
"sass-embedded": "^1.70.0",
"stylus": ">=0.54.8",
"sugarss": "^5.0.0",
"terser": "^5.16.0",
"tsx": "^4.8.1",
"yaml": "^2.4.2"
},
"peerDependenciesMeta": {
"@types/node": {
"optional": true
},
"@vitejs/devtools": {
"optional": true
},
"esbuild": {
"optional": true
},
"jiti": {
"optional": true
},
"less": {
"optional": true
},
"sass": {
"optional": true
},
"sass-embedded": {
"optional": true
},
"stylus": {
"optional": true
},
"sugarss": {
"optional": true
},
"terser": {
"optional": true
},
"tsx": {
"optional": true
},
"yaml": {
"optional": true
}
}
},
"node_modules/ws": {
"version": "8.22.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
},
"peerDependencies": {
"bufferutil": "^4.0.1",
"utf-8-validate": ">=5.0.2"
},
"peerDependenciesMeta": {
"bufferutil": {
"optional": true
},
"utf-8-validate": {
"optional": true
}
}
},
"node_modules/xmlchars": {
"version": "2.2.0",
"resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
"integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
"license": "MIT"
}
}
}
experiments/0002-xmpp-library/selection-spike/package.json
+24
View File
@@ -0,0 +1,24 @@
{
"name": "luma-xmpp-selection-spike",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
},
"packageManager": "npm@11.19.0",
"scripts": {
"build": "vite build",
"test": "npm run build && node --test test/*.test.mjs"
},
"dependencies": {
"stanza": "12.22.1",
"events": "3.3.0",
"saxes": "6.0.0",
"ws": "8.22.0"
},
"devDependencies": {
"vite": "8.3.4"
}
}
experiments/0002-xmpp-library/selection-spike/sha512-mechanism.mjs
+28
View File
@@ -0,0 +1,28 @@
import sasl from 'stanza/lib/sasl/index.js';
// Public constructor selects the existing browser backend's supported hash alias.
// The delegate name never goes on the wire. No private field is read or changed.
export class Sha512Mechanism {
name = 'SCRAM-SHA-512';
providesMutualAuthentication = true;
#delegate;
constructor(name) {
if (name !== this.name) throw new Error('Unsupported mechanism');
this.#delegate = new sasl.SCRAM('SCRAM-SHA512');
}
getExpectedCredentials() { return this.#delegate.getExpectedCredentials(); }
// Keep derived credentials attempt-local; no cache leaves this boundary.
getCacheableCredentials() { return null; }
createResponse(credentials) {
if (credentials.tlsUnique) throw new Error('Channel binding unavailable');
return this.#delegate.createResponse(credentials);
}
processChallenge(value) { this.#delegate.processChallenge(value); }
processSuccess(value) { this.#delegate.processSuccess(value); }
finalize() { return this.#delegate.finalize(); }
}
export function registerSha512(client) {
client.sasl.disable('SCRAM-SHA-512');
client.sasl.register('SCRAM-SHA-512', Sha512Mechanism, 1000);
}
experiments/0002-xmpp-library/selection-spike/test/backend.test.mjs
+83
View File
@@ -0,0 +1,83 @@
import assert from 'node:assert/strict';
import test from 'node:test';
import {readFileSync} from 'node:fs';
import {createHash as oracleHash, createHmac as oracleHmac} from 'node:crypto';
import {Buffer as BrowserBuffer, createHash, createHmac, backend, StockScram, Sha512Mechanism, randomBytes} from '../dist/browser.mjs';
const hmacVectors = JSON.parse(readFileSync(new URL('./hmac-vectors.json', import.meta.url)));
const scramVectors = JSON.parse(readFileSync(new URL('./scramp-vectors.json', import.meta.url)));
test('bundle resolves browser backend and contains no external runtime imports', () => {
assert.equal(backend, 'browser');
const modules = JSON.parse(readFileSync(new URL('../dist/modules.json', import.meta.url)));
assert.ok(modules.some(id => id.endsWith('/platform/browser/crypto/Hmac.js')));
assert.ok(modules.some(id => id.endsWith('/platform/browser/crypto/SHA-512.js')));
assert.ok(!modules.some(id => /platform\/node\/|^node:|browser-external/.test(id)));
const bundle = readFileSync(new URL('../dist/browser.mjs', import.meta.url), 'utf8');
assert.ok(!/^import\s|\brequire\(/m.test(bundle));
});
for (const vector of hmacVectors) {
for (const algorithm of ['sha512', 'SHA512']) {
test(`RFC 4231 case ${vector.case}, browser ${algorithm}`, () => {
const key = BrowserBuffer.from(vector.key, 'hex');
const data = BrowserBuffer.from(vector.data, 'hex');
const actual = createHmac(algorithm, key).update(data).digest('hex');
assert.equal(actual.slice(0, vector.digest.length), vector.digest);
});
}
}
test('reproduce browser hyphenated HMAC mismatch, keep Node independent control', () => {
const vector = hmacVectors[0];
const key = BrowserBuffer.from(vector.key, 'hex');
const data = BrowserBuffer.from(vector.data, 'hex');
const broken = createHmac('sha-512', key).update(data).digest('hex');
assert.notEqual(broken, vector.digest);
assert.equal(broken, '9656975ee5de55e75f2976ecce9a04501060b9dc22a6eda2eaef638966280182477fe09f080b2bf564649cad42af8607a2bd8d02979df3a980f15e2326a0a22a');
assert.equal(oracleHmac('sha512', Buffer.from(vector.key, 'hex')).update(Buffer.from(vector.data, 'hex')).digest('hex'), vector.digest);
});
const abc = 'ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192' +
'992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f';
for (const algorithm of ['sha512', 'sha-512', 'SHA512', 'SHA-512']) {
test(`fixed SHA512 abc digest, browser ${algorithm}`, () => {
assert.equal(createHash(algorithm).update('abc').digest('hex'), abc);
});
}
for (const length of [0, 1, 63, 64, 65, 127, 128, 129, 131, 256]) {
test(`browser HMAC alias key length ${length} agrees with Node crypto`, () => {
const key = Buffer.alloc(length, 0xab);
const data = Buffer.alloc(257, 0xcd);
assert.equal(createHmac('sha512', BrowserBuffer.from(key)).update(BrowserBuffer.from(data)).digest('hex'),
oracleHmac('sha512', key).update(data).digest('hex'));
assert.equal(createHash('sha512').update(BrowserBuffer.from(data)).digest('hex'),
oracleHash('sha512').update(data).digest('hex'));
});
}
test('stock browser SHA512 proof mismatch; public alias delegate matches independent vector', () => {
const vector = scramVectors[0];
const credentials = {username: vector.username, password: vector.password, clientNonce: vector.nonce};
const stock = new StockScram('SCRAM-SHA-512');
stock.createResponse(credentials);
stock.processChallenge(BrowserBuffer.from(vector.first));
assert.notEqual(stock.createResponse(credentials).toString(), vector.proof);
const selected = new Sha512Mechanism('SCRAM-SHA-512');
assert.equal(selected.name, vector.mechanism);
assert.equal(selected.createResponse(credentials).toString(), vector.initial);
selected.processChallenge(BrowserBuffer.from(vector.first));
assert.equal(selected.createResponse(credentials).toString(), vector.proof);
selected.processSuccess(BrowserBuffer.from(vector.final));
assert.deepEqual(selected.finalize(), {authenticated: true, mutuallyAuthenticated: true});
assert.equal(selected.getCacheableCredentials(), null);
});
test('native browser RNG path works without fixed nonce, no invented channel binding', () => {
assert.equal(randomBytes(32).length, 32);
const selected = new Sha512Mechanism('SCRAM-SHA-512');
const initial = selected.createResponse({username: 'user', password: 'pencil'}).toString();
assert.match(initial, /^n,,n=user,r=[0-9a-f]{64}$/);
assert.throws(() => new Sha512Mechanism('SCRAM-SHA-512-PLUS'));
assert.throws(() => new Sha512Mechanism('SCRAM-SHA-512').createResponse({tlsUnique: BrowserBuffer.alloc(32)}));
});
experiments/0002-xmpp-library/selection-spike/test/extensions.test.mjs
+42
View File
@@ -0,0 +1,42 @@
import assert from 'node:assert/strict';
import test from 'node:test';
import {Client, importMessage, attribute, text} from '../dist/browser.mjs';
const client=new Client();
const roundtrip=(kind,xml)=>{
const imported=importMessage(xml,client.stanzas,{});
assert.equal(imported.kind,kind);
// The API exposes both a selected body and the full language collection.
// For this fixture choose the language collection as the sole export input;
// passing both representations concatenates text in Stanza 12.22.1.
const output = {...imported.stanza};
if (output.archive?.item?.message) {
output.archive = {...output.archive, item: {...output.archive.item, message: {...output.archive.item.message}}};
delete output.archive.item.message.body;
}
const emitted=client.stanzas.export(kind,output).toString();
const again=importMessage(emitted,client.stanzas,{}).stanza;
return {stanza:imported.stanza,again,emitted};
};
for(const [name,kind,xml,check] of [
['MAM result/forwarded stable IDs','message','<message xmlns="jabber:client"><result xmlns="urn:xmpp:mam:2" id="archive-1" queryid="query-1"><forwarded xmlns="urn:xmpp:forward:0"><message xmlns="jabber:client" id="message-1"><body>synthetic</body><origin-id xmlns="urn:xmpp:sid:0" id="origin-1"/></message></forwarded></result></message>',s=>{assert.equal(s.archive.id,'archive-1');assert.equal(s.archive.item.message.originId,'origin-1');assert.equal(s.archive.item.message.body,'synthetic');}],
['MUC join','presence','<presence xmlns="jabber:client" to="room@conference.example.invalid/user"><x xmlns="http://jabber.org/protocol/muc"/></presence>',s=>assert.equal(s.muc.type,'join')],
['Jingle signaling','iq','<iq xmlns="jabber:client" type="set" id="call-1"><jingle xmlns="urn:xmpp:jingle:1" action="session-terminate" sid="session-1"><reason><success/></reason></jingle></iq>',s=>{assert.equal(s.jingle.action,'session-terminate');assert.equal(s.jingle.sid,'session-1');}],
['HTTP upload slot','iq','<iq xmlns="jabber:client" type="result" id="upload-1"><slot xmlns="urn:xmpp:http:upload:0"><put url="https://upload.example.invalid/put"/><get url="https://upload.example.invalid/get"/></slot></iq>',s=>{assert.equal(s.httpUpload.download,'https://upload.example.invalid/get');}],
['legacy opaque OMEMO encoding','message','<message xmlns="jabber:client"><encrypted xmlns="eu.siacs.conversations.axolotl"><header sid="1"><key rid="2">AA==</key><iv>AA==</iv></header><payload>AA==</payload></encrypted></message>',s=>{assert.equal(s.omemo.header.sid,1);assert.equal(s.omemo.header.keys[0].rid,2);assert.equal(s.omemo.payload.toString('hex'),'00');}]
]) test(`${name}: real registry import/export`,()=>{const r=roundtrip(kind,xml);check(r.stanza);check(r.again);});
test('public plugin registry supports future opaque extension without vendor patch',()=>{
// Deliberately NOT a claimed OMEMO2 wire implementation or encryption result.
client.use(c=>c.stanzas.define({namespace:'urn:luma:selection-spike:opaque',element:'opaque',
path:'message.spikeOpaque',fields:{id:attribute('id'),value:text()}}));
const r=roundtrip('message','<message xmlns="jabber:client"><opaque xmlns="urn:luma:selection-spike:opaque" id="fixture-1">synthetic-data</opaque></message>');
assert.deepEqual(r.stanza.spikeOpaque,{id:'fixture-1',value:'synthetic-data'});
assert.deepEqual(r.again.spikeOpaque,r.stanza.spikeOpaque);
const wrong=importMessage('<message xmlns="jabber:client"><opaque xmlns="urn:luma:wrong" id="fixture-1">ignored</opaque></message>',client.stanzas,{});
assert.equal(wrong.stanza.spikeOpaque,undefined);
});
test('record raw dual-body export behavior requiring explicit projection',()=>{
const r=importMessage('<message xmlns="jabber:client"><body>synthetic</body></message>',client.stanzas,{});
const raw=client.stanzas.export('message',r.stanza).toString();
assert.equal(importMessage(raw,client.stanzas,{}).stanza.body,'syntheticsynthetic');
});
experiments/0002-xmpp-library/selection-spike/test/fixtures.mjs
+19
View File
@@ -0,0 +1,19 @@
// Public RFC examples only. Not accounts, secrets, or network endpoints.
export const vectors = [
{
source: 'https://www.rfc-editor.org/rfc/rfc5802.html#section-5',
mechanism: 'SCRAM-SHA-1', username: 'user', password: 'pencil',
nonce: 'fyko+d2lbbFgONRv9qkxdawL',
first: 'r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,s=QSXCR+Q6sek8bf92,i=4096',
proof: 'c=biws,r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,p=v0X8v3Bz2T0CJGbJQyF0X+HI4Ts=',
final: 'v=rmF9pqV8S7suAoZWja4dJRkFsKQ='
},
{
source: 'https://www.rfc-editor.org/rfc/rfc7677.html#section-3',
mechanism: 'SCRAM-SHA-256', username: 'user', password: 'pencil',
nonce: 'rOprNGfwEbeRWgbNEkqO',
first: 'r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096',
proof: 'c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=dHzbZapWIk4jUhN+Ute9ytag9zjfMHgsqmmiz7AndVQ=',
final: 'v=6rriTRBi23WpRR/wtup+mMhUZUn/dB5nLTJRsjl95G4='
}
];
experiments/0002-xmpp-library/selection-spike/test/hmac-vectors.json
+44
View File
@@ -0,0 +1,44 @@
[
{
"case": 1,
"key": "0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b",
"data": "4869205468657265",
"digest": "87aa7cdea5ef619d4ff0b4241a1d6cb02379f4e2ce4ec2787ad0b30545e17cdedaa833b7d6b8a702038b274eaea3f4e4be9d914eeb61f1702e696c203a126854"
},
{
"case": 2,
"key": "4a656665",
"data": "7768617420646f2079612077616e7420666f72206e6f7468696e673f",
"digest": "164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea2505549758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737"
},
{
"case": 3,
"key": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"data": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
"digest": "fa73b0089d56a284efb0f0756c890be9b1b5dbdd8ee81a3655f83e33b2279d39bf3e848279a722c806b485a47e67c807b946a337bee8942674278859e13292fb"
},
{
"case": 4,
"key": "0102030405060708090a0b0c0d0e0f10111213141516171819",
"data": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
"digest": "b0ba465637458c6990e5a8c5f61d4af7e576d97ff94b872de76f8050361ee3dba91ca5c11aa25eb4d679275cc5788063a5f19741120c4f2de2adebeb10a298dd"
},
{
"case": 5,
"key": "0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c",
"data": "546573742057697468205472756e636174696f6e",
"digest": "415fad6271580a531d4179bc891d87a6"
},
{
"case": 6,
"key": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"data": "54657374205573696e67204c6172676572205468616e20426c6f636b2d53697a65204b6579202d2048617368204b6579204669727374",
"digest": "80b24263c7c1a3ebb71493c1dd7be8b49b46d1f41b4aeec1121b013783f8f3526b56d037e05f2598bd0fd2215d6a1e5295e64f73f63f0aec8b915a985d786598"
},
{
"case": 7,
"key": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"data": "5468697320697320612074657374207573696e672061206c6172676572207468616e20626c6f636b2d73697a65206b657920616e642061206c6172676572207468616e20626c6f636b2d73697a6520646174612e20546865206b6579206e6565647320746f20626520686173686564206265666f7265206265696e6720757365642062792074686520484d414320616c676f726974686d2e",
"digest": "e37b6a775dc87dbaa4dfa9f96e5e3ffddebd71f8867289865df5a32d20cdc944b6022cac3c4982b10d5eeb55c3e4de15134676fb6de0446065c97440fa8c6a58"
}
]
experiments/0002-xmpp-library/selection-spike/test/integration.test.mjs
+302
View File
@@ -0,0 +1,302 @@
import assert from 'node:assert/strict';
import test from 'node:test';
import {readFileSync} from 'node:fs';
import {Client, parse, validatedSasl, StockScram} from '../dist/browser.mjs';
const vectors = JSON.parse(readFileSync(new URL('./scramp-vectors.json', import.meta.url)));
const tick = () => new Promise(resolve => setImmediate(resolve));
const deferred = () => {
let resolve;
const promise = new Promise(r => {resolve = r;});
return {promise, resolve};
};
function harness(vector = vectors[1], fixed = true, mechanisms = [vector.mechanism]) {
const client = new Client({jid: 'user@example.invalid', autoReconnect: false,
credentials: {username: vector.username, password: vector.password, clientNonce: vector.nonce}});
const result = {sent: [], success: 0, failed: 0, restart: 0, disconnect: 0, verification: []};
// Capture fixture effects; use the real Client, XML registry, feature dispatcher,
// mechanism factory and SCRAM crypto. Never connect to a real provider.
client.send = async (kind, stanza) => {result.sent.push({kind, stanza});};
client.transport = {authenticated: false, restart: () => {result.restart++;}};
client.disconnect = async () => {result.disconnect++;};
client.on('auth:success', () => {result.success++;});
client.on('auth:failed', () => {result.failed++;});
if (!fixed) client.sasl.register('SCRAM-SHA-512', StockScram, 1000);
if (fixed) {
client.use(validatedSasl);
const original = client.sasl.createMechanism.bind(client.sasl);
client.sasl.createMechanism = names => {
const mech = original(names);
if (mech) for (const method of ['processSuccess', 'finalize']) {
const fn = mech[method].bind(mech);
mech[method] = (...args) => {result.verification.push(method); return fn(...args);};
}
return mech;
};
}
const receive = async (type, value) => {
const body = value === undefined ? '' : Buffer.from(value).toString('base64');
const xml = parse(`<${type} xmlns="urn:ietf:params:xml:ns:xmpp-sasl">${body}</${type}>`);
const stanza = client.stanzas.import(xml);
assert.equal(stanza.type, type);
client.emit('sasl', stanza);
await tick();
};
const start = async () => {
client.emit('features', {sasl: {mechanisms}});
await tick();
};
return {client, result, receive, start};
}
function rejected(h) {
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.result.failed, 1);
assert.equal(h.result.disconnect, 1);
assert.equal(h.client.features.negotiated.sasl, false);
assert.equal(h.client.transport.authenticated, false);
assert.equal(h.client.listenerCount('sasl'), 0);
}
for (const vector of vectors) {
test(`${vector.mechanism}: independent Scramp proof and verified final through feature dispatcher`, async () => {
const h = harness(vector);
await h.start();
assert.equal(h.result.sent[0].stanza.mechanism, vector.mechanism);
assert.equal(h.result.sent[0].stanza.value.toString(), `n,,n=user,r=${vector.nonce}`);
await h.receive('challenge', vector.first);
assert.equal(h.result.sent[1].stanza.value.toString(), vector.proof);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.transport.authenticated, false);
await h.receive('success', vector.final);
assert.deepEqual(h.result.verification, ['processSuccess', 'finalize']);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
assert.equal(h.result.disconnect, 0);
assert.equal(h.client.features.negotiated.sasl, true);
assert.equal(h.client.transport.authenticated, true);
await h.receive('success', vector.final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
});
for (const [label, final] of [
['missing', undefined],
['forged', 'v=' + (vector.final[2] === 'A' ? 'B' : 'A') + vector.final.slice(3)],
['error', 'e=invalid-proof'],
['conflicting error', `${vector.final},e=invalid-proof`],
['duplicate verifier', `${vector.final},${vector.final}`],
['bad base64', 'v=***'],
['oversized', 'v=' + 'A'.repeat(4096)]
]) {
test(`${vector.mechanism}: reject ${label} server-final after proof`, async () => {
const h = harness(vector);
await h.start();
await h.receive('challenge', vector.first);
await h.receive('success', final);
rejected(h);
if (label === 'forged') assert.deepEqual(h.result.verification, ['processSuccess', 'finalize']);
await h.receive('success', vector.final);
rejected(h);
});
}
test(`${vector.mechanism}: reject valid-looking final before proof`, async () => {
const h = harness(vector);
await h.start();
await h.receive('success', vector.final);
rejected(h);
assert.deepEqual(h.result.verification, []);
});
}
for (const [label, final] of [['missing', undefined], ['forged', 'v=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=']]) {
test(`stock 12.22.1 reproduces ${label} premature acceptance`, async () => {
const h = harness(vectors[1], false);
await h.start();
await h.receive('success', final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
assert.equal(h.client.transport.authenticated, true);
});
test(`replacement rejects original ${label} premature defect`, async () => {
const h = harness();
await h.start();
await h.receive('success', final);
rejected(h);
});
}
for (const [label, first] of [
['wrong nonce', vectors[1].first.replace('r=rOpr', 'r=wrong')],
['unextended nonce', `r=${vectors[1].nonce},s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096`],
['iteration overflow', vectors[1].first.replace('i=4096', 'i=100001')],
['invalid iterations', vectors[1].first.replace('i=4096', 'i=NaN')],
['duplicate attribute', vectors[1].first + ',i=4096'],
['mandatory extension', 'm=required,' + vectors[1].first]
]) {
test(`reject ${label} before library proof work`, async () => {
const h = harness();
await h.start();
await h.receive('challenge', first);
rejected(h);
assert.equal(h.result.sent.length, 1);
});
}
test('reject success while proof send is pending; no late revival', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
await h.receive('success', vectors[1].final);
rejected(h);
pending.resolve();
await tick();
await h.receive('success', vectors[1].final);
rejected(h);
});
test('duplicate challenge while sending proof fails closed', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
await h.receive('challenge', vectors[1].first);
rejected(h);
pending.resolve();
await tick();
rejected(h);
});
test('reset while awaiting credentials prevents late auth and listener leak', async () => {
const h = harness();
const pending = deferred();
h.client.getCredentials = () => pending.promise;
await h.start();
h.client.emit('--reset-stream-features');
pending.resolve({username: 'user', password: 'pencil', clientNonce: vectors[1].nonce});
await tick();
await h.receive('success', vectors[1].final);
assert.equal(h.result.sent.length, 0);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
});
test('reset after proof, new negotiation succeeds without old handlers', async () => {
const h = harness();
await h.start();
await h.receive('challenge', vectors[1].first);
h.client.emit('--reset-stream-features');
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
await h.start();
assert.equal(h.client.listenerCount('sasl'), 1);
await h.receive('challenge', vectors[1].first);
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
});
test('fixture policy filters PLUS and plaintext; strongest available non-PLUS selected', async () => {
const h = harness(vectors[1], true, ['PLAIN', 'SCRAM-SHA-1', 'SCRAM-SHA-512-PLUS', 'SCRAM-SHA-256', 'SCRAM-SHA-512']);
await h.start();
assert.equal(h.result.sent[0].stanza.mechanism, 'SCRAM-SHA-512');
});
for (const names of [['PLAIN'], ['SCRAM-SHA-512-PLUS'], []]) {
test(`no allowed mechanism (${names.join(',')}) disconnects`, async () => {
const h = harness(vectors[1], true, names);
await h.start();
rejected(h);
assert.equal(h.result.sent.length, 0);
});
}
for (const type of ['failure', 'abort']) {
test(`${type} is terminal; valid final cannot revive it`, async () => {
const h = harness();
await h.start();
await h.receive(type);
await h.receive('success', vectors[1].final);
rejected(h);
});
}
test('success during pending initial credentials fails closed', async () => {
const h = harness();
const pending = deferred();
h.client.getCredentials = () => pending.promise;
await h.start();
await h.receive('success', vectors[1].final);
rejected(h);
pending.resolve({username: 'user', password: 'pencil', clientNonce: vectors[1].nonce});
await tick();
assert.equal(h.result.sent.length, 0);
rejected(h);
});
test('reset during proof send cancels continuation', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
h.client.emit('--reset-stream-features');
pending.resolve();
await tick();
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
});
for (const stage of ['credentials', 'initial send', 'proof send']) {
test(`${stage} rejection disconnects without success`, async () => {
const h = harness();
const reject = async () => {throw new Error('synthetic fixture failure');};
if (stage === 'credentials') h.client.getCredentials = reject;
if (stage === 'initial send') h.client.send = reject;
await h.start();
if (stage === 'proof send') {
h.client.send = reject;
await h.receive('challenge', vectors[1].first);
}
rejected(h);
});
}
test('repeat challenge after completed proof is rejected', async () => {
const h = harness();
await h.start();
await h.receive('challenge', vectors[1].first);
await h.receive('challenge', vectors[1].first);
rejected(h);
});
test('synthetic binding input fails without auth or plaintext fallback', async () => {
const h = harness();
h.client.config.credentials.tlsUnique = Buffer.alloc(32);
await h.start();
rejected(h);
assert.equal(h.result.sent.length, 0);
});
test('server silence after proof never authenticates; reset discards attempt', async () => {
const h = harness();
let cacheEvents = 0;
h.client.on('credentials:update', () => {cacheEvents++;});
await h.start();
await h.receive('challenge', vectors[0].first);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.transport.authenticated, false);
assert.equal(cacheEvents, 0);
assert.equal(h.client.config.credentials.saltedPassword, undefined);
h.client.emit('--reset-stream-features');
await h.receive('success', vectors[0].final);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
});
experiments/0002-xmpp-library/selection-spike/test/scramp-vectors.json
+32
View File
@@ -0,0 +1,32 @@
[
{
"mechanism": "SCRAM-SHA-512",
"username": "user",
"password": "pencil",
"nonce": "rOprNGfwEbeRWgbNEkqO",
"initial": "n,,n=user,r=rOprNGfwEbeRWgbNEkqO",
"first": "r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096",
"proof": "c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=gMGXRcevScNtxZ6/8lQYpGtnsNAc3mGcmNomv+xnoOMw+3R2xNJdMNnzMlTN8PPC6wdp6dybEmDYXYTxwnYPJQ==",
"final": "v=ZQnYEgWQMFmmsM8aQMF0nDDCy/AgCzkwk8CmMZYcMg0vSVlKDanekLtifDSeVGT4+5ZxXnJq199RVG2rR7N7Zw=="
},
{
"mechanism": "SCRAM-SHA-512",
"username": "user",
"password": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"nonce": "rOprNGfwEbeRWgbNEkqO",
"initial": "n,,n=user,r=rOprNGfwEbeRWgbNEkqO",
"first": "r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096",
"proof": "c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=FQ+Ds6nMR5kU+jnkwyhJGBK8lA2hTFKTqEBVSUCvSgmexvd4GGT4uAqD3iACaCkLYP0Bc6JHwnHMWkpGNOX2rg==",
"final": "v=dXX1mz64UYbnX15NloHSoWfqoMVVvFg23i8KXwHigIVa+U6w+eJBBwhNg47qeIqkRLhhVnRnvcVvQMXpqav+4A=="
},
{
"mechanism": "SCRAM-SHA-512",
"username": "user",
"password": "p\u00e9ncil",
"nonce": "rOprNGfwEbeRWgbNEkqO",
"initial": "n,,n=user,r=rOprNGfwEbeRWgbNEkqO",
"first": "r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096",
"proof": "c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=Jwk58tl/01ikMIUvnr0MXiTPWZJOiqtTyIAKx2A7IL85TXsL9S/fvBEIYvd/a0QIAQrNp47BSvResR5QB63TSg==",
"final": "v=QwFhP0JOInTkJ/uTsZ2DRt00V0dQtkZKotpq815cU8X2SpF/5qbOd8sd6TCj8NjX/GPke8Xj4yg6whLHu7KNlw=="
}
]
experiments/0002-xmpp-library/selection-spike/test/wss.test.mjs
+122
View File
@@ -0,0 +1,122 @@
import assert from 'node:assert/strict';
import test from 'node:test';
import {createServer} from 'node:https';
import {mkdtempSync, readFileSync, rmSync} from 'node:fs';
import {tmpdir} from 'node:os';
import {join} from 'node:path';
import {execFileSync} from 'node:child_process';
import {once} from 'node:events';
import WS, {WebSocketServer} from 'ws';
import {Client, installBoundedTransport, validatedSasl, importMessage, validateMessage, backend} from '../dist/browser.mjs';
import {vectors as rfc} from './fixtures.mjs';
const sha512 = JSON.parse(readFileSync(new URL('./scramp-vectors.json', import.meta.url)));
const vectors = [...rfc, sha512[0]];
const enc = s => Buffer.from(s).toString('base64');
const sasl = (type, data='') => `<${type} xmlns="urn:ietf:params:xml:ns:xmpp-sasl">${enc(data)}</${type}>`;
const waitFor = async fn => {
for (let i=0;i<300;i++) { if (fn()) return; await new Promise(r=>setTimeout(r,10)); }
throw new Error('Fixture timeout');
};
const dir = mkdtempSync(join(tmpdir(), 'luma-wss-'));
// Ephemeral synthetic localhost CA/server certificate; never committed.
execFileSync('openssl', ['req','-x509','-newkey','rsa:2048','-nodes','-keyout',join(dir,'key.pem'),
'-out',join(dir,'cert.pem'),'-days','1','-subj','/CN=localhost',
'-addext','subjectAltName=DNS:localhost,IP:127.0.0.1'], {stdio:'ignore'});
const cert = readFileSync(join(dir,'cert.pem'));
const key = readFileSync(join(dir,'key.pem'));
test.after(()=>rmSync(dir,{recursive:true,force:true}));
async function scenario(t, vector, offers, mode='valid') {
const server=createServer({key,cert});
const wss=new WebSocketServer({server,handleProtocols: protocols=>protocols.has('xmpp')?'xmpp':false});
const seen={opens:0,success:0,failed:0,rejected:[],policies:[],peerErrors:[]};
const client=new Client({jid:'user@example.invalid',server:'example.invalid',autoReconnect:false,
credentials:{username:vector.username,password:vector.password,clientNonce:vector.nonce},
transports:{'bounded-websocket':'wss://127.0.0.1'},transportPreferenceOrder:['bounded-websocket']});
// Explicit CA trust for this fixture only; hostname/TLS validation stays enabled.
class TrustedSocket extends WS {constructor(url,protocol){super(url,protocol,{ca:cert,rejectUnauthorized:true});}}
installBoundedTransport(client,TrustedSocket);
client.use(validatedSasl);
client.on('auth:success',()=>seen.success++);
client.on('auth:failed',()=>seen.failed++);
client.on('ingress:rejected',code=>seen.rejected.push(code));
client.on('sasl:policy',policy=>seen.policies.push(policy));
wss.on('connection',(socket,req)=>{
seen.protocol=req.headers['sec-websocket-protocol'];
seen.tls=socket._socket.encrypted;
socket.on('message', (bytes,isBinary)=>{
try {
assert.equal(isBinary,false);
const xml=bytes.toString();
if (xml.startsWith('<open')) {
seen.opens++;
socket.send('<open xmlns="urn:ietf:params:xml:ns:xmpp-framing" from="example.invalid" version="1.0" id="fixture"/>');
if (seen.opens===1) {
if (mode==='oversize') return socket.send('<message xmlns="jabber:client"><body>'+ 'x'.repeat(4096)+'</body></message>');
if (mode==='split') return socket.send('<message xmlns="jabber:client">');
socket.send('<stream:features xmlns:stream="http://etherx.jabber.org/streams"><mechanisms xmlns="urn:ietf:params:xml:ns:xmpp-sasl">'+offers.map(x=>`<mechanism>${x}</mechanism>`).join('')+'</mechanisms></stream:features>');
}
} else if (xml.startsWith('<auth')) {
seen.mechanism=/mechanism="([^"]+)"/.exec(xml)?.[1];
const initial=Buffer.from(/>([^<]+)</.exec(xml)[1],'base64').toString();
assert.equal(initial,`n,,n=user,r=${vector.nonce}`);
socket.send(mode==='premature'?sasl('success',vector.final):sasl('challenge',vector.first));
} else if (xml.startsWith('<response')) {
seen.proof=Buffer.from(/>([^<]+)</.exec(xml)[1],'base64').toString();
assert.equal(seen.proof,vector.proof);
socket.send(sasl('success',mode==='forged'?'v='+ 'A'.repeat(vector.final.length-2):vector.final));
}
} catch(error) {seen.peerErrors.push(error.message); socket.close();}
});
});
server.listen(0,'127.0.0.1'); await once(server,'listening');
client.updateConfig({transports:{'bounded-websocket':`wss://127.0.0.1:${server.address().port}`}});
t.after(async()=>{await client.disconnect(); for(const socket of wss.clients)socket.terminate(); await new Promise(r=>wss.close(r)); await new Promise(r=>server.close(r));});
await client.connect();
await waitFor(()=> mode==='valid'? seen.opens===2 : seen.failed||seen.rejected.length||seen.peerErrors.length);
assert.deepEqual(seen.peerErrors,[]);
assert.equal(seen.protocol,'xmpp'); assert.equal(seen.tls,true);
if(mode==='valid') {
assert.equal(seen.success,1); assert.equal(seen.failed,0); assert.equal(seen.mechanism,vector.mechanism);
assert.equal(seen.proof,vector.proof); assert.equal(seen.opens,2);
assert.deepEqual(seen.policies,[{selected:vector.mechanism,channelBinding:'unavailable',fallback:'disabled'}]);
} else {assert.equal(seen.success,0);assert.equal(seen.opens,1);}
return seen;
}
test('browser bundle uses browser backend with TLS validation enabled',()=>{assert.equal(backend,'browser');assert.notEqual(process.env.NODE_TLS_REJECT_UNAUTHORIZED,'0');});
test('public transport rejects plaintext endpoint before socket creation',async()=>{
const client=new Client({transports:{'bounded-websocket':'ws://127.0.0.1'},transportPreferenceOrder:['bounded-websocket']});
let sockets=0; installBoundedTransport(client,class{constructor(){sockets++;}});
await assert.rejects(client.connect(),/WSS required/);assert.equal(sockets,0);
});
for(const vector of vectors) {
const offers=['PLAIN','SCRAM-SHA-512-PLUS','SCRAM-SHA-256-PLUS','SCRAM-SHA-1',
...(vector.mechanism!=='SCRAM-SHA-1'?['SCRAM-SHA-256']:[]),
...(vector.mechanism==='SCRAM-SHA-512'?['SCRAM-SHA-512']:[])];
test(`trusted WSS strongest compatible ${vector.mechanism}, verified restart`,t=>scenario(t,vector,offers));
for(const mode of ['forged','premature'])test(`WSS ${vector.mechanism} rejects ${mode}`,t=>scenario(t,vector,offers,mode));
}
for(const mode of ['oversize','split']) test(`WSS bounded ingress rejects ${mode}`,async t=>{
const seen=await scenario(t,vectors[2],['SCRAM-SHA-512'],mode);assert.equal(seen.rejected.length,1);
});
for(const offers of [['SCRAM-SHA-512-PLUS'],['PLAIN'],[]]) test(`WSS refuses unsupported offer ${offers}`,async t=>{
const seen=await scenario(t,vectors[2],offers,'unsupported'); assert.equal(seen.failed,1); assert.equal(seen.mechanism,undefined);
});
test('default native WebSocket rejects untrusted WSS certificate',async t=>{
const server=createServer({key,cert}); const wss=new WebSocketServer({server});
server.listen(0,'127.0.0.1');await once(server,'listening');
t.after(async()=>{wss.close();await new Promise(r=>server.close(r));});
const socket=new globalThis.WebSocket(`wss://127.0.0.1:${server.address().port}`,'xmpp');
let opened=false;socket.onopen=()=>{opened=true;socket.close();};
await new Promise((resolve,reject)=>{const timer=setTimeout(()=>{socket.close();reject(new Error('TLS timeout'));},3000);socket.onerror=()=>{clearTimeout(timer);resolve();};});
assert.equal(opened,false);
});
test('XML resource and standalone boundaries compose before registry import',()=>{
const client=new Client();let imports=0; const registry={getImportKey:()=>{imports++;return 'message';},import:()=>{imports++;return {};}};
for(const data of ['<message>', '<message/><message/>','<!DOCTYPE x><x/>','<x>'+ '<x>'.repeat(8)+'</x>'.repeat(8)+'</x>',new Uint8Array(1)]) {
assert.throws(()=>importMessage(data,registry,{}));assert.equal(imports,0);
}
assert.doesNotThrow(()=>validateMessage('<message xmlns="jabber:client"><body>safe &amp; synthetic</body></message>'));
assert.equal(importMessage('<message xmlns="jabber:client"><body>synthetic</body></message>',client.stanzas,{}).stanza.body,'synthetic');
});
experiments/0002-xmpp-library/selection-spike/validated-sasl.mjs
+113
View File
@@ -0,0 +1,113 @@
// Selection experiment: reviewed guard with explicit strongest-first non-PLUS policy.
import {registerSha512} from './sha512-mechanism.mjs';
// No production transport, credential persistence, or channel binding is provided.
const SUPPORTED = new Set(['SCRAM-SHA-512', 'SCRAM-SHA-256', 'SCRAM-SHA-1']);
const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
function text(value) {
// SASL's parsed additional-data is a Buffer, not raw XML/base64 text.
if (!value || typeof value.toString !== 'function' || value.length > 4096) {
throw new Error('Invalid SASL data');
}
const result = value.toString('utf8');
if (!/^[\x21-\x7e]*$/.test(result)) throw new Error('Invalid SASL data');
return result;
}
function firstMessage(value, nonce) {
// Deliberately narrow, no extensions. Bound work before calling library crypto.
const match = /^r=([\x21-\x2b\x2d-\x7e]+),s=([A-Za-z0-9+/=]+),i=([1-9][0-9]*)$/.exec(text(value));
if (!match || !BASE64.test(match[2]) || !match[1].startsWith(nonce) ||
match[1].length <= nonce.length || Number(match[3]) > 100000) {
throw new Error('Invalid SCRAM server-first');
}
}
function finalMessage(value, name) {
const final = text(value);
const length = {'SCRAM-SHA-512': 88, 'SCRAM-SHA-256': 44, 'SCRAM-SHA-1': 28}[name];
if (!length) throw new Error('Unsupported mechanism');
if (!final.startsWith('v=') || final.length !== length + 2 || !BASE64.test(final.slice(2))) {
throw new Error('Invalid SCRAM server-final');
}
}
export default function validatedSasl(client) {
registerSha512(client);
let active;
// Public plugin + named feature registration replaces the stock handler before use.
client.registerFeature('sasl', 100, async (features, done) => {
if (active) active();
const offered = features.sasl.mechanisms;
const names = ['SCRAM-SHA-512', 'SCRAM-SHA-256', 'SCRAM-SHA-1'].filter(name => offered.includes(name));
client.emit('sasl:policy', {selected: names[0] ?? null, channelBinding: 'unavailable', fallback: 'disabled'});
const mech = client.sasl.createMechanism(names);
let phase = 'starting';
let credentials;
let nonce;
const cleanup = () => {
client.off('sasl', handler);
client.off('--reset-stream-features', reset);
if (active === reset) active = undefined;
};
const reset = () => {
phase = 'closed';
cleanup();
client.features.negotiated.sasl = false;
};
const fail = () => {
if (phase === 'closed') return;
phase = 'closed';
cleanup();
client.features.negotiated.sasl = false;
if (client.transport) client.transport.authenticated = false;
client.emit('auth:failed');
done('disconnect', 'SCRAM validation failed'); // Never log peer data/credentials.
};
const handler = async sasl => {
if (phase === 'closed') return;
try {
if (sasl.type === 'challenge' && phase === 'server-first') {
phase = 'sending-proof'; // Reject duplicate challenges and racing success.
firstMessage(sasl.value, nonce);
mech.processChallenge(sasl.value);
const response = mech.createResponse(credentials);
await client.send('sasl', {type: 'response', value: response});
if (phase !== 'closed') phase = 'server-final';
return;
}
if (sasl.type !== 'success' || phase !== 'server-final') return fail();
finalMessage(sasl.value, mech.name);
mech.processSuccess(sasl.value);
const result = mech.finalize();
if (!result.authenticated || !result.mutuallyAuthenticated) return fail();
phase = 'closed';
cleanup();
client.features.negotiated.sasl = true;
if (client.transport) client.transport.authenticated = true;
client.emit('auth:success', client.config.credentials);
done('restart');
} catch {
fail();
}
};
active = reset;
client.features.negotiated.sasl = false;
client.on('sasl', handler);
client.once('--reset-stream-features', reset);
try {
if (!mech || !SUPPORTED.has(mech.name)) return fail();
credentials = await client.getCredentials();
if (phase === 'closed') return;
// Restrict this experiment to non-PLUS; never invent TLS binding bytes.
if (credentials.tlsUnique) return fail();
const response = mech.createResponse(credentials);
nonce = /,r=([^,]+)$/.exec(response.toString('utf8'))?.[1];
if (!nonce) return fail();
await client.send('sasl', {type: 'auth', mechanism: mech.name, value: response});
if (phase !== 'closed') phase = 'server-first';
} catch {
fail();
}
});
}
experiments/0002-xmpp-library/selection-spike/vite.config.mjs
+23
View File
@@ -0,0 +1,23 @@
import {defineConfig} from 'vite';
import {fileURLToPath} from 'node:url';
export default defineConfig({
resolve: {alias: {events: fileURLToPath(new URL('./node_modules/events/events.js', import.meta.url))}},
build: {
target: ['chrome111', 'edge111', 'firefox114', 'safari16.4'],
minify: false,
lib: {entry: 'browser-entry.mjs', formats: ['es'], fileName: () => 'browser.mjs'},
rollupOptions: {plugins: [{
name: 'backend-evidence',
generateBundle() {
const modules = [...this.getModuleIds()].map(id => id.replace(process.cwd(), '.')).sort();
if (!modules.some(id => id.endsWith('/stanza/platform/browser/crypto/Hmac.js'))) {
throw new Error('Browser HMAC missing');
}
if (modules.some(id => /stanza\/platform\/node\/|^node:|browser-external/.test(id))) {
throw new Error('Unexpected Node runtime backend');
}
this.emitFile({type: 'asset', fileName: 'modules.json', source: JSON.stringify(modules, null, 2) + '\n'});
}
}]}
}
});
experiments/0002-xmpp-library/sha512-validation/.npmrc
+3
View File
@@ -0,0 +1,3 @@
engine-strict=true
strict-ssl=true
registry=https://registry.npmjs.org/
experiments/0002-xmpp-library/sha512-validation/LICENSE_INVENTORY.md
+55
View File
@@ -0,0 +1,55 @@
# Locked dependency license inventory
All optional build-host entries are included; installed graph checked separately.
| Package | Version | License |
| --- | --- | --- |
| @oxc-project/types | 0.154.0 | MIT |
| @rolldown/binding-android-arm-eabi | 1.2.14 | MIT |
| @rolldown/binding-android-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-x64 | 1.2.14 | MIT |
| @rolldown/binding-freebsd-x64 | 1.2.14 | MIT |
| @rolldown/binding-linux-arm-gnueabihf | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-musl | 1.2.14 | MIT |
| @rolldown/binding-linux-ppc64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-s390x-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-musl | 1.2.14 | MIT |
| @rolldown/binding-openharmony-arm64 | 1.2.14 | MIT |
| @rolldown/binding-win32-arm64-msvc | 1.2.14 | MIT |
| @rolldown/binding-win32-x64-msvc | 1.2.14 | MIT |
| @rolldown/pluginutils | 1.0.1 | MIT |
| @types/node | 22.20.5 | MIT |
| @types/punycode | 2.1.4 | MIT |
| @types/ws | 8.18.2 | MIT |
| detect-libc | 2.1.2 | Apache-2.0 |
| events | 3.3.0 | MIT |
| fdir | 6.5.0 | MIT |
| fsevents | 2.3.3 | MIT |
| lightningcss | 1.33.0 | MPL-2.0 |
| lightningcss-android-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-freebsd-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm-gnueabihf | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-win32-arm64-msvc | 1.33.0 | MPL-2.0 |
| lightningcss-win32-x64-msvc | 1.33.0 | MPL-2.0 |
| nanoid | 3.3.20 | MIT |
| picocolors | 1.1.1 | ISC |
| picomatch | 4.0.7 | MIT |
| postcss | 8.5.30 | MIT |
| punycode | 2.3.1 | MIT |
| rolldown | 1.2.14 | MIT |
| sdp | 3.2.2 | MIT |
| source-map-js | 1.2.2 | BSD-3-Clause |
| stanza | 12.22.1 | MIT |
| tinyglobby | 0.2.17 | MIT |
| undici-types | 6.21.0 | MIT |
| vite | 8.3.4 | MIT |
| ws | 8.22.0 | MIT |
experiments/0002-xmpp-library/sha512-validation/ORACLE_NOTICES.md
+47
View File
@@ -0,0 +1,47 @@
# Independent oracle licenses
Test-only Python dependencies; not browser/app/runtime dependencies.
## scramp 1.4.6
MIT No Attribution
Copyright The Contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## asn1crypto 1.5.1
Copyright (c) 2015-2022 Will Bond <will@wbond.net>
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
experiments/0002-xmpp-library/sha512-validation/README.md
+103
View File
@@ -0,0 +1,103 @@
# Isolated browser SCRAM-SHA-512 validation
S00-019 fixture experiment, proposed for independent security review. No live
account/transport or parent library selection. Node executes the **browser-built
backend**, not Stanza's Node crypto. This is browser bundle/backend evidence,
not an actual Chrome/Firefox/Safari execution or WSS interoperability result.
## Reproduce
Use accepted Node 24.21.0 / npm 11.19.0. Existing reviewed macOS ARM64 runtime:
```sh
export PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH
npm ci --prefix experiments/0002-xmpp-library/sha512-validation --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-sha512-review-cache --fetch-retries=0 --fetch-timeout=15000
npm test --prefix experiments/0002-xmpp-library/sha512-validation
python3 experiments/0002-xmpp-library/sha512-validation/check-dependencies.py
```
Use a new empty cache for independent clean-install evidence. The dependency
check also reads the original installed candidate at the parent node_modules
for byte comparison; it does not modify it. If unavailable, reproduce its pinned
install under the parent task's authority or compare Stanza against its locked
tarball separately; do not change the parent from this task.
`npm test` builds before running 87 checks. Vite's default browser resolution
selects stanza/platform/browser. events 3.3.0 is the explicit browser EventEmitter
polyfill. Build fails if module IDs show Node backend/builtins/browser externals
or no browser HMAC. Output `dist/modules.json` lists resolved modules;
`dist/browser.mjs` is a self-contained ESM bundle. Backend tests inspect graph,
no runtime imports/require, and exported platform name `browser`. All integrated
exchanges import this artifact, never Node source. Node crypto is an independent
primitive oracle in tests only; the integration suite has no Node crypto import.
The native RNG path uses host getRandomValues, not a fabricated success value.
## Independent full-exchange oracle
The checked-in `test/scramp-vectors.json` is fixed output from **Scramp 1.4.6**
client and server (Python test-only MIT-0 dependency, asn1crypto 1.5.1 MIT).
Both client proof and server-final are independently verified. Inputs combine
public RFC 7677 nonce/salt/4096-iteration data with SHA-512 and synthetic passwords
pencil, 131 A characters and péncil. These SHA-512 transcripts are independently
derived vectors, not a claim that RFC 7677 specifies SHA-512 examples.
```sh
python3 -m venv /private/tmp/luma-sha512-review-oracle
/private/tmp/luma-sha512-review-oracle/bin/python -m pip install --require-hashes --only-binary=:all: --no-cache-dir -r experiments/0002-xmpp-library/sha512-validation/oracle-requirements.txt
/private/tmp/luma-sha512-review-oracle/bin/python experiments/0002-xmpp-library/sha512-validation/oracle.py
```
Python >=3.8; each wheel version/hash is exact. Default oracle mode compares
existing fixed fixtures; it does not rewrite them. `--write` is an explicit
fixture-generation operation. Scramp is excluded from the app/browser graph.
1.4.6 supports the available Python 3.9 host and the documented APIs; no current
release or supply-chain/advisory clearance is inferred. Notices are preserved.
## Public mechanism path
`Sha512Mechanism` composes Stanza's exported `SCRAM` using its public string
constructor with `SCRAM-SHA512`, selecting the existing documented-by-shipped-code
`sha512` alias. Its separate Mechanism.name is always **SCRAM-SHA-512**. Internal
alias never goes on the wire. Public Factory.disable/register installs that
constructor. No Stanza private field is read/changed, no subclass/private-method
hook or vendor/bundler crypto patch. Actual cryptographic primitives, PBKDF-style
SCRAM composition, SASLprep and verifier stay in unmodified Stanza library code.
This is version-specific public API composition, not an upstream endorsement of
a future stable alias contract; pins and full vectors are mandatory safeguards.
The isolated feature handler is copied from reviewed S00-017, narrowed to SHA-512
and 88-character base64 verifier, and registers the new mechanism. Install via
Client.use on a fresh Client before any negotiation; never install after stock
SASL begins. Mechanism priorities filter to SHA-512 even alongside PLUS/256/1/PLAIN
offers; unsupported-only offers fail. Complete product fallback policy stays
with S00-003. No real channel binding exists; tlsUnique input fails rather than
creating PLUS or a fabricated binding. Initial GS2 is n,, and c=biws.
Guard requires completed proof send before success, strict bounded first/final
syntax, then real processSuccess/finalize with both authenticated flags. Missing,
forged, malformed, premature/duplicate/racing final and replay fail without auth
or restart. Async reset/send failures discard continuation. No derived cache is
persisted/emitted and no raw credentials/peer data is logged by authored code.
Captured send/transport/disconnect effects are explicit fixtures; actual Client,
registry/XML parser, feature dispatcher, mechanism and crypto run.
## Limits
Only server-final in success additional-data, no SCRAM extensions/separate final
challenge. Limits 4096 decoded bytes and 100000 iterations are fixture policy.
Synchronous library PBKDF work can block the UI; no worker/performance acceptance.
No constant-time claim: Stanza compares verifier strings. No timeout is added;
server silence stays unauthenticated until external reset/cancellation. No
arbitrary Unicode/SASLprep conformance certification beyond the fixed case.
Native browser engine/RNG execution, WSS/TLS, independent live server/client,
parent bounded-ingress integration, complete mechanism policy and release
readiness remain outside this experiment. No TLS/certificate/CORS bypass or
plaintext downgrade. Browser syntax floors match accepted Vite targets
Chrome/Edge 111, Firefox 114, Safari 16.4; API requirements include crypto RNG,
fetch and WebSocket. These are build floors, not a certified product matrix.
Licenses: full locked graph in LICENSE_INVENTORY.md, installed notices including
Stanza browser crypto ancestry in THIRD_PARTY_NOTICES.md; oracle notices separate.
Vite/build native components are not browser runtime crypto. events maintenance
has few contributors per upstream; Stanza crypto is reviewed here with vectors,
not newly audited. Dependency/advisory/provenance review remains release work.
experiments/0002-xmpp-library/sha512-validation/THIRD_PARTY_NOTICES.md
+4155
View File
File diff suppressed because it is too large. Load diff
experiments/0002-xmpp-library/sha512-validation/browser-entry.mjs
+10
View File
@@ -0,0 +1,10 @@
import client from 'stanza/Client.js';
import jxt from 'stanza/jxt/index.js';
import platform from 'stanza/platform';
import sasl from 'stanza/lib/sasl/index.js';
export {default as validatedSasl} from './validated-sasl.mjs';
export {Sha512Mechanism} from './sha512-mechanism.mjs';
export const Client = client.default;
export const parse = jxt.parse;
export const {Buffer, createHash, createHmac, name: backend, randomBytes} = platform;
export const StockScram = sasl.SCRAM;
experiments/0002-xmpp-library/sha512-validation/check-dependencies.py
+54
View File
@@ -0,0 +1,54 @@
"""Verify exact installed pins/notices, immutable vendor files and browser graph."""
import hashlib
import json
from pathlib import Path
root = Path(__file__).resolve().parent
lock = json.loads((root / 'package-lock.json').read_text())
manifest = json.loads((root / 'package.json').read_text())
inventory = (root / 'LICENSE_INVENTORY.md').read_text()
notices = (root / 'THIRD_PARTY_NOTICES.md').read_text()
installed = 0
for section in ['dependencies', 'devDependencies']:
for name, version in manifest[section].items():
assert lock['packages']['node_modules/' + name]['version'] == version
for path, entry in lock['packages'].items():
if not path:
continue
name = path.split('node_modules/')[-1]
assert entry['resolved'].startswith('https://registry.npmjs.org/')
assert entry['integrity'].startswith('sha512-')
assert f"| {name} | {entry['version']} | {entry['license']} |" in inventory
package = root / path
if not package.exists():
assert entry.get('optional'), name
continue
meta = json.loads((package / 'package.json').read_text())
assert meta['version'] == entry['version'], name
assert meta['license'] == entry['license'], name
licenses = [f for f in package.iterdir() if f.is_file() and
('license' in f.name.lower() or f.name.lower().startswith(('copying', 'notice')))]
if name == '@rolldown/binding-darwin-arm64':
assert not licenses
licenses = [root / 'node_modules/rolldown/LICENSE',
root / 'node_modules/rolldown/THIRD-PARTY-LICENSE']
assert licenses, name
for file in licenses:
assert file.read_text().rstrip() in notices, file
installed += 1
# Parent is read-only evidence of unmodified pinned candidate, not a dependency.
original = root.parent / 'node_modules/stanza'
current = root / 'node_modules/stanza'
files = [f for f in current.rglob('*') if f.is_file()]
assert {f.relative_to(current) for f in files} == {
f.relative_to(original) for f in original.rglob('*') if f.is_file()}
for file in files:
assert file.read_bytes() == (original / file.relative_to(current)).read_bytes(), file
modules = json.loads((root / 'dist/modules.json').read_text())
assert any(x.endswith('/stanza/platform/browser/crypto/Hmac.js') for x in modules)
assert not any('/platform/node/' in x or x.startswith('node:') or 'browser-external' in x for x in modules)
print(f"{len(lock['packages']) - 1} locked entries; {installed} installed licenses/pins; "
f"{len(files)} unchanged Stanza files; browser backend confirmed")
for name in ['package-lock.json', 'sha512-mechanism.mjs', 'validated-sasl.mjs',
'test/scramp-vectors.json', 'dist/browser.mjs', 'dist/modules.json']:
print(name, hashlib.sha256((root / name).read_bytes()).hexdigest())
experiments/0002-xmpp-library/sha512-validation/oracle-requirements.txt
+2
View File
@@ -0,0 +1,2 @@
scramp==1.4.6 --hash=sha256:a0cf9d2b4624b69bac5432dd69fecfc55a542384fe73c3a23ed9b138cda484e1
asn1crypto==1.5.1 --hash=sha256:db4e40728b728508912cbb3d44f19ce188f218e9eba635821bb4b68564f8fd67
experiments/0002-xmpp-library/sha512-validation/oracle.py
+39
View File
@@ -0,0 +1,39 @@
"""Independent existing SCRAM client/server; synthetic public fixture data only."""
import base64
import json
import sys
from importlib.metadata import version
from pathlib import Path
from scramp import ScramClient, ScramMechanism
assert version("scramp") == "1.4.6"
assert version("asn1crypto") == "1.5.1"
path = Path(__file__).parent / "test" / "scramp-vectors.json"
nonce = "rOprNGfwEbeRWgbNEkqO"
server_nonce = "%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0"
salt = base64.b64decode("W22ZaJ0SNY7soEsUEjb6gQ==")
results = []
for password in ["pencil", "A" * 131, "p\u00e9ncil"]:
mechanism = ScramMechanism("SCRAM-SHA-512")
auth = mechanism.make_auth_info(password, iteration_count=4096, salt=salt)
def auth_fn(username):
assert username == "user"
return auth
server = mechanism.make_server(auth_fn, s_nonce=server_nonce)
client = ScramClient(["SCRAM-SHA-512"], "user", password, c_nonce=nonce)
initial = client.get_client_first()
server.set_client_first(initial)
first = server.get_server_first()
client.set_server_first(first)
proof = client.get_client_final()
server.set_client_final(proof) # Independent server verifies proof.
final = server.get_server_final()
client.set_server_final(final) # Independent client verifies server.
results.append(dict(mechanism="SCRAM-SHA-512", username="user", password=password,
nonce=nonce, initial=initial, first=first, proof=proof, final=final))
if sys.argv[1:] == ["--write"]:
path.write_text(json.dumps(results, indent=2) + "\n")
else:
assert not sys.argv[1:]
assert json.loads(path.read_text()) == results
print("scramp 1.4.6: three fixed SHA-512 client/server exchanges verified")
experiments/0002-xmpp-library/sha512-validation/package-lock.json
Generated
+925
View File
@@ -0,0 +1,925 @@
{
"name": "luma-browser-scram-sha512-experiment",
"version": "0.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "luma-browser-scram-sha512-experiment",
"version": "0.0.0",
"dependencies": {
"events": "3.3.0",
"stanza": "12.22.1"
},
"devDependencies": {
"vite": "8.3.4"
},
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
}
},
"node_modules/@oxc-project/types": {
"version": "0.154.0",
"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.154.0.tgz",
"integrity": "sha512-KYOUGQFlLWR+s4QMV2Q9ko38TZm7EdO87Qm7rvZLqk/webse/cDjtyxKhg/47l0byCbs/k46LT8qc4PKjAikzA==",
"dev": true,
"license": "MIT",
"funding": {
"url": "https://github.com/sponsors/oxc-project"
}
},
"node_modules/@rolldown/binding-android-arm-eabi": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.14.tgz",
"integrity": "sha512-aWR+XKH9+rW7m5fWq/5360J3mHycrx/o6xZM2DQFdJnTMdyP7/WzxPjhtLbVWdKo2y612/4U1bWqb3HQhiF7vg==",
"cpu": [
"arm"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"android"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-android-arm64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.14.tgz",
"integrity": "sha512-QiVxHofl6A8lQU7WAtOUY4QMVZXohxwz7WJJoeh8NBEUyKfIkMRKhYyq8az/1RypNiIXzNTtiS6KwHz0erxYRQ==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"android"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-darwin-arm64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.14.tgz",
"integrity": "sha512-lTQOzHuBIooh3jIr5XINQkjPGEuGy+Dsy0meXDr6Sjty0b99kYgGh4uBC/8mJX1T0kC8d6S0aPP1Y+bHkh6aBw==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-darwin-x64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.14.tgz",
"integrity": "sha512-hyMKEGatjmBYCs/Q4sbIcL/GqpFEqsX3wc+HYVQ/85A4rxc1o7rPm4DUI4GV4k/h0ITddwFSGpqQunI14GXjTA==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-freebsd-x64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.14.tgz",
"integrity": "sha512-u371GbXoVXrEgP20PwzoGNOdAOqAMhzo19JzzY+V4YmmnC+DTOoqdbMu+O+54emM59Mik/UdrtWgcuEDKWRPKA==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"freebsd"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-arm-gnueabihf": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.14.tgz",
"integrity": "sha512-BqwKsdZQf6EqVWr8fv2MrDYzAvOZ7+NYFSJESRGs87fkseEhs0TU9TXgRJTkZoRRkxTizyEg1LKUXfU3/78uqg==",
"cpu": [
"arm"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-arm64-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.14.tgz",
"integrity": "sha512-SD9kY8M009x/7s57Z1dgUVlP5+uYBgKQK0Tkr1WIWngrtUJmRCW1RJFMY7QDla2khXhmg2i5Io7MUjcmZNZ/KQ==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-arm64-musl": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.14.tgz",
"integrity": "sha512-BJ2CL19M6uuWesMgnqJzgxoI+N+eV7b0A9O9vLV42y+gitC41fNa8KElau1tHVzuLWX5GzEuxMPhAO0tQXQMkg==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-ppc64-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.14.tgz",
"integrity": "sha512-4+Kl8daPV8NDHaD7mfCcc1pRM+Qg7ab8DyMm5FG5WoZgv4h2i3KFN1CybYBNbQqmuYm7ftJLvmMI1eHYJ22S/Q==",
"cpu": [
"ppc64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-s390x-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.14.tgz",
"integrity": "sha512-V/h8ePq1fKDrmtFMz6xcCN3DKvuvMRrwwD1q0PkBeeo4DpK64biaKvqWGVxqCeYKqeRk7gE7/iKPxLCn08O97A==",
"cpu": [
"s390x"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-x64-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.14.tgz",
"integrity": "sha512-WxalXzgrLVpKC93xfpaJ3gCXUWzeCr+FRCbDVD2mUAy4L6Vo3lNVz0epUEUpxPWJkLNYUwM4OSIikv36OJ9mLg==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-x64-musl": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.14.tgz",
"integrity": "sha512-3G3tnAmTpdk9jO3GQtyHXqeFD2SlecfTws/Y3M2mmj9nMBwwuLT4kur8sZKeu7ENUHSpVO3cIsm5A52LEWWwlg==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-openharmony-arm64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.14.tgz",
"integrity": "sha512-qyr5XiNGxm2ytx17vvtcJ9nXn6v1gENETi503bJx3OGwZ1tSonj7BosxbMa/xeAfSl5iS9X6KjEWYXLu6v1L7Q==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"openharmony"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-win32-arm64-msvc": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.14.tgz",
"integrity": "sha512-oA4o5o0S2yB199YyYXDzKUv1Z56Rc+mgOjwm7Z/vJ9Z8igiDPYvoOuDyo6g7AK/ZaF09nPhDKVnGBcYHO11GXA==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-win32-x64-msvc": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.14.tgz",
"integrity": "sha512-9mE94bf2GZUaR/fUSXCMpBoWkctu421Mi0ORpm4zqfbkjKep7RxzPFa5etcGs5h+2KApoWBOA/hAJa/7saGgEQ==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/pluginutils": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
"integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
"dev": true,
"license": "MIT"
},
"node_modules/@types/node": {
"version": "22.20.5",
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
"license": "MIT",
"dependencies": {
"undici-types": "~6.21.0"
}
},
"node_modules/@types/punycode": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
"license": "MIT"
},
"node_modules/@types/ws": {
"version": "8.18.2",
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
"license": "MIT",
"dependencies": {
"@types/node": "*"
}
},
"node_modules/detect-libc": {
"version": "2.1.2",
"resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
"integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
"dev": true,
"license": "Apache-2.0",
"engines": {
"node": ">=8"
}
},
"node_modules/events": {
"version": "3.3.0",
"resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
"integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
"license": "MIT",
"engines": {
"node": ">=0.8.x"
}
},
"node_modules/fdir": {
"version": "6.5.0",
"resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
"integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
"dev": true,
"license": "MIT",
"engines": {
"node": ">=12.0.0"
},
"peerDependencies": {
"picomatch": "^3 || ^4"
},
"peerDependenciesMeta": {
"picomatch": {
"optional": true
}
}
},
"node_modules/fsevents": {
"version": "2.3.3",
"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
"integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
"dev": true,
"hasInstallScript": true,
"license": "MIT",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": "^8.16.0 || ^10.6.0 || >=11.0.0"
}
},
"node_modules/lightningcss": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
"integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
"dev": true,
"license": "MPL-2.0",
"dependencies": {
"detect-libc": "^2.0.3"
},
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
},
"optionalDependencies": {
"lightningcss-android-arm64": "1.33.0",
"lightningcss-darwin-arm64": "1.33.0",
"lightningcss-darwin-x64": "1.33.0",
"lightningcss-freebsd-x64": "1.33.0",
"lightningcss-linux-arm-gnueabihf": "1.33.0",
"lightningcss-linux-arm64-gnu": "1.33.0",
"lightningcss-linux-arm64-musl": "1.33.0",
"lightningcss-linux-x64-gnu": "1.33.0",
"lightningcss-linux-x64-musl": "1.33.0",
"lightningcss-win32-arm64-msvc": "1.33.0",
"lightningcss-win32-x64-msvc": "1.33.0"
}
},
"node_modules/lightningcss-android-arm64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
"integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"android"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-darwin-arm64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
"integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-darwin-x64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
"integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
"cpu": [
"x64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-freebsd-x64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
"integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
"cpu": [
"x64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"freebsd"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-arm-gnueabihf": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
"integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
"cpu": [
"arm"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-arm64-gnu": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
"integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-arm64-musl": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
"integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-x64-gnu": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
"integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-x64-musl": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
"integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-win32-arm64-msvc": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
"integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-win32-x64-msvc": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
"integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
"cpu": [
"x64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/nanoid": {
"version": "3.3.20",
"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.20.tgz",
"integrity": "sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==",
"dev": true,
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/ai"
}
],
"license": "MIT",
"bin": {
"nanoid": "bin/nanoid.cjs"
},
"engines": {
"node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
}
},
"node_modules/picocolors": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
"integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
"dev": true,
"license": "ISC"
},
"node_modules/picomatch": {
"version": "4.0.7",
"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
"integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
"dev": true,
"license": "MIT",
"engines": {
"node": ">=12"
},
"funding": {
"url": "https://github.com/sponsors/jonschlinkert"
}
},
"node_modules/postcss": {
"version": "8.5.30",
"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.30.tgz",
"integrity": "sha512-zkd+e9S1AQHhmaBKye9zlFHWjOwVgqXl1q3ECYy8561K7qxR2cREf/STLskulBFd78k6AOFeA+ff1TtEzk9bAA==",
"dev": true,
"funding": [
{
"type": "opencollective",
"url": "https://opencollective.com/postcss/"
},
{
"type": "tidelift",
"url": "https://tidelift.com/funding/github/npm/postcss"
},
{
"type": "github",
"url": "https://github.com/sponsors/ai"
}
],
"license": "MIT",
"dependencies": {
"nanoid": "^3.3.20",
"picocolors": "^1.1.1",
"source-map-js": "^1.2.2"
},
"engines": {
"node": "^10 || ^12 || >=14"
}
},
"node_modules/punycode": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
"license": "MIT",
"engines": {
"node": ">=6"
}
},
"node_modules/rolldown": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.14.tgz",
"integrity": "sha512-eTBTTqMR6uHKLgcUqpJP8ntzDI6V4LYA8negAMBEI7gkgVvOdrx6VsvS2Ym+83KhOPdLCHWJu0w7UQFJZhHKNw==",
"dev": true,
"license": "MIT",
"dependencies": {
"@oxc-project/types": "=0.154.0",
"@rolldown/pluginutils": "^1.0.0"
},
"bin": {
"rolldown": "bin/cli.mjs"
},
"engines": {
"node": "^20.19.0 || >=22.12.0"
},
"optionalDependencies": {
"@rolldown/binding-android-arm-eabi": "1.2.14",
"@rolldown/binding-android-arm64": "1.2.14",
"@rolldown/binding-darwin-arm64": "1.2.14",
"@rolldown/binding-darwin-x64": "1.2.14",
"@rolldown/binding-freebsd-x64": "1.2.14",
"@rolldown/binding-linux-arm-gnueabihf": "1.2.14",
"@rolldown/binding-linux-arm64-gnu": "1.2.14",
"@rolldown/binding-linux-arm64-musl": "1.2.14",
"@rolldown/binding-linux-ppc64-gnu": "1.2.14",
"@rolldown/binding-linux-s390x-gnu": "1.2.14",
"@rolldown/binding-linux-x64-gnu": "1.2.14",
"@rolldown/binding-linux-x64-musl": "1.2.14",
"@rolldown/binding-openharmony-arm64": "1.2.14",
"@rolldown/binding-win32-arm64-msvc": "1.2.14",
"@rolldown/binding-win32-x64-msvc": "1.2.14"
}
},
"node_modules/sdp": {
"version": "3.2.2",
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
"license": "MIT"
},
"node_modules/source-map-js": {
"version": "1.2.2",
"resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
"integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
"dev": true,
"license": "BSD-3-Clause",
"engines": {
"node": ">=0.10.0"
}
},
"node_modules/stanza": {
"version": "12.22.1",
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
"license": "MIT",
"dependencies": {
"@types/node": "^22.0.0",
"@types/punycode": "^2.1.0",
"@types/ws": "^8.18.1",
"punycode": "^2.1.1",
"sdp": "^3.0.2",
"ws": "^8.18.2"
}
},
"node_modules/tinyglobby": {
"version": "0.2.17",
"resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
"integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
"dev": true,
"license": "MIT",
"dependencies": {
"fdir": "^6.5.0",
"picomatch": "^4.0.4"
},
"engines": {
"node": ">=12.0.0"
},
"funding": {
"url": "https://github.com/sponsors/SuperchupuDev"
}
},
"node_modules/undici-types": {
"version": "6.21.0",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
"license": "MIT"
},
"node_modules/vite": {
"version": "8.3.4",
"resolved": "https://registry.npmjs.org/vite/-/vite-8.3.4.tgz",
"integrity": "sha512-IftLE8phJhdNRIGNEV4JCCvfNScoZQVfcXaN8TQropWGJtOHcu+iAB9pHcuGvmEb/kddw0LBe/jS8ztdC6xdiQ==",
"dev": true,
"license": "MIT",
"dependencies": {
"lightningcss": "^1.33.0",
"picomatch": "^4.0.7",
"postcss": "^8.5.29",
"rolldown": "~1.2.12",
"tinyglobby": "^0.2.17"
},
"bin": {
"vite": "bin/vite.js"
},
"engines": {
"node": "^20.19.0 || >=22.12.0"
},
"funding": {
"url": "https://github.com/vitejs/vite?sponsor=1"
},
"optionalDependencies": {
"fsevents": "~2.3.3"
},
"peerDependencies": {
"@types/node": "^20.19.0 || >=22.12.0",
"@vitejs/devtools": "^0.7.1",
"esbuild": "^0.27.0 || ^0.28.0",
"jiti": ">=1.21.0",
"less": "^4.0.0",
"sass": "^1.70.0",
"sass-embedded": "^1.70.0",
"stylus": ">=0.54.8",
"sugarss": "^5.0.0",
"terser": "^5.16.0",
"tsx": "^4.8.1",
"yaml": "^2.4.2"
},
"peerDependenciesMeta": {
"@types/node": {
"optional": true
},
"@vitejs/devtools": {
"optional": true
},
"esbuild": {
"optional": true
},
"jiti": {
"optional": true
},
"less": {
"optional": true
},
"sass": {
"optional": true
},
"sass-embedded": {
"optional": true
},
"stylus": {
"optional": true
},
"sugarss": {
"optional": true
},
"terser": {
"optional": true
},
"tsx": {
"optional": true
},
"yaml": {
"optional": true
}
}
},
"node_modules/ws": {
"version": "8.22.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
},
"peerDependencies": {
"bufferutil": "^4.0.1",
"utf-8-validate": ">=5.0.2"
},
"peerDependenciesMeta": {
"bufferutil": {
"optional": true
},
"utf-8-validate": {
"optional": true
}
}
}
}
}
experiments/0002-xmpp-library/sha512-validation/package.json
+22
View File
@@ -0,0 +1,22 @@
{
"name": "luma-browser-scram-sha512-experiment",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
},
"packageManager": "npm@11.19.0",
"scripts": {
"build": "vite build",
"test": "npm run build && node --test test/*.test.mjs"
},
"dependencies": {
"stanza": "12.22.1",
"events": "3.3.0"
},
"devDependencies": {
"vite": "8.3.4"
}
}
experiments/0002-xmpp-library/sha512-validation/sha512-mechanism.mjs
+28
View File
@@ -0,0 +1,28 @@
import sasl from 'stanza/lib/sasl/index.js';
// Public constructor selects the existing browser backend's supported hash alias.
// The delegate name never goes on the wire. No private field is read or changed.
export class Sha512Mechanism {
name = 'SCRAM-SHA-512';
providesMutualAuthentication = true;
#delegate;
constructor(name) {
if (name !== this.name) throw new Error('Unsupported mechanism');
this.#delegate = new sasl.SCRAM('SCRAM-SHA512');
}
getExpectedCredentials() { return this.#delegate.getExpectedCredentials(); }
// Keep derived credentials attempt-local; no cache leaves this boundary.
getCacheableCredentials() { return null; }
createResponse(credentials) {
if (credentials.tlsUnique) throw new Error('Channel binding unavailable');
return this.#delegate.createResponse(credentials);
}
processChallenge(value) { this.#delegate.processChallenge(value); }
processSuccess(value) { this.#delegate.processSuccess(value); }
finalize() { return this.#delegate.finalize(); }
}
export function registerSha512(client) {
client.sasl.disable('SCRAM-SHA-512');
client.sasl.register('SCRAM-SHA-512', Sha512Mechanism, 1000);
}
experiments/0002-xmpp-library/sha512-validation/test/backend.test.mjs
+83
View File
@@ -0,0 +1,83 @@
import assert from 'node:assert/strict';
import test from 'node:test';
import {readFileSync} from 'node:fs';
import {createHash as oracleHash, createHmac as oracleHmac} from 'node:crypto';
import {Buffer as BrowserBuffer, createHash, createHmac, backend, StockScram, Sha512Mechanism, randomBytes} from '../dist/browser.mjs';
const hmacVectors = JSON.parse(readFileSync(new URL('./hmac-vectors.json', import.meta.url)));
const scramVectors = JSON.parse(readFileSync(new URL('./scramp-vectors.json', import.meta.url)));
test('bundle resolves browser backend and contains no external runtime imports', () => {
assert.equal(backend, 'browser');
const modules = JSON.parse(readFileSync(new URL('../dist/modules.json', import.meta.url)));
assert.ok(modules.some(id => id.endsWith('/platform/browser/crypto/Hmac.js')));
assert.ok(modules.some(id => id.endsWith('/platform/browser/crypto/SHA-512.js')));
assert.ok(!modules.some(id => /platform\/node\/|^node:|browser-external/.test(id)));
const bundle = readFileSync(new URL('../dist/browser.mjs', import.meta.url), 'utf8');
assert.ok(!/^import\s|\brequire\(/m.test(bundle));
});
for (const vector of hmacVectors) {
for (const algorithm of ['sha512', 'SHA512']) {
test(`RFC 4231 case ${vector.case}, browser ${algorithm}`, () => {
const key = BrowserBuffer.from(vector.key, 'hex');
const data = BrowserBuffer.from(vector.data, 'hex');
const actual = createHmac(algorithm, key).update(data).digest('hex');
assert.equal(actual.slice(0, vector.digest.length), vector.digest);
});
}
}
test('reproduce browser hyphenated HMAC mismatch, keep Node independent control', () => {
const vector = hmacVectors[0];
const key = BrowserBuffer.from(vector.key, 'hex');
const data = BrowserBuffer.from(vector.data, 'hex');
const broken = createHmac('sha-512', key).update(data).digest('hex');
assert.notEqual(broken, vector.digest);
assert.equal(broken, '9656975ee5de55e75f2976ecce9a04501060b9dc22a6eda2eaef638966280182477fe09f080b2bf564649cad42af8607a2bd8d02979df3a980f15e2326a0a22a');
assert.equal(oracleHmac('sha512', Buffer.from(vector.key, 'hex')).update(Buffer.from(vector.data, 'hex')).digest('hex'), vector.digest);
});
const abc = 'ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192' +
'992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f';
for (const algorithm of ['sha512', 'sha-512', 'SHA512', 'SHA-512']) {
test(`fixed SHA512 abc digest, browser ${algorithm}`, () => {
assert.equal(createHash(algorithm).update('abc').digest('hex'), abc);
});
}
for (const length of [0, 1, 63, 64, 65, 127, 128, 129, 131, 256]) {
test(`browser HMAC alias key length ${length} agrees with Node crypto`, () => {
const key = Buffer.alloc(length, 0xab);
const data = Buffer.alloc(257, 0xcd);
assert.equal(createHmac('sha512', BrowserBuffer.from(key)).update(BrowserBuffer.from(data)).digest('hex'),
oracleHmac('sha512', key).update(data).digest('hex'));
assert.equal(createHash('sha512').update(BrowserBuffer.from(data)).digest('hex'),
oracleHash('sha512').update(data).digest('hex'));
});
}
test('stock browser SHA512 proof mismatch; public alias delegate matches independent vector', () => {
const vector = scramVectors[0];
const credentials = {username: vector.username, password: vector.password, clientNonce: vector.nonce};
const stock = new StockScram('SCRAM-SHA-512');
stock.createResponse(credentials);
stock.processChallenge(BrowserBuffer.from(vector.first));
assert.notEqual(stock.createResponse(credentials).toString(), vector.proof);
const selected = new Sha512Mechanism('SCRAM-SHA-512');
assert.equal(selected.name, vector.mechanism);
assert.equal(selected.createResponse(credentials).toString(), vector.initial);
selected.processChallenge(BrowserBuffer.from(vector.first));
assert.equal(selected.createResponse(credentials).toString(), vector.proof);
selected.processSuccess(BrowserBuffer.from(vector.final));
assert.deepEqual(selected.finalize(), {authenticated: true, mutuallyAuthenticated: true});
assert.equal(selected.getCacheableCredentials(), null);
});
test('native browser RNG path works without fixed nonce, no invented channel binding', () => {
assert.equal(randomBytes(32).length, 32);
const selected = new Sha512Mechanism('SCRAM-SHA-512');
const initial = selected.createResponse({username: 'user', password: 'pencil'}).toString();
assert.match(initial, /^n,,n=user,r=[0-9a-f]{64}$/);
assert.throws(() => new Sha512Mechanism('SCRAM-SHA-512-PLUS'));
assert.throws(() => new Sha512Mechanism('SCRAM-SHA-512').createResponse({tlsUnique: BrowserBuffer.alloc(32)}));
});
experiments/0002-xmpp-library/sha512-validation/test/hmac-vectors.json
+44
View File
@@ -0,0 +1,44 @@
[
{
"case": 1,
"key": "0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b",
"data": "4869205468657265",
"digest": "87aa7cdea5ef619d4ff0b4241a1d6cb02379f4e2ce4ec2787ad0b30545e17cdedaa833b7d6b8a702038b274eaea3f4e4be9d914eeb61f1702e696c203a126854"
},
{
"case": 2,
"key": "4a656665",
"data": "7768617420646f2079612077616e7420666f72206e6f7468696e673f",
"digest": "164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea2505549758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737"
},
{
"case": 3,
"key": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"data": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
"digest": "fa73b0089d56a284efb0f0756c890be9b1b5dbdd8ee81a3655f83e33b2279d39bf3e848279a722c806b485a47e67c807b946a337bee8942674278859e13292fb"
},
{
"case": 4,
"key": "0102030405060708090a0b0c0d0e0f10111213141516171819",
"data": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
"digest": "b0ba465637458c6990e5a8c5f61d4af7e576d97ff94b872de76f8050361ee3dba91ca5c11aa25eb4d679275cc5788063a5f19741120c4f2de2adebeb10a298dd"
},
{
"case": 5,
"key": "0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c",
"data": "546573742057697468205472756e636174696f6e",
"digest": "415fad6271580a531d4179bc891d87a6"
},
{
"case": 6,
"key": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"data": "54657374205573696e67204c6172676572205468616e20426c6f636b2d53697a65204b6579202d2048617368204b6579204669727374",
"digest": "80b24263c7c1a3ebb71493c1dd7be8b49b46d1f41b4aeec1121b013783f8f3526b56d037e05f2598bd0fd2215d6a1e5295e64f73f63f0aec8b915a985d786598"
},
{
"case": 7,
"key": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"data": "5468697320697320612074657374207573696e672061206c6172676572207468616e20626c6f636b2d73697a65206b657920616e642061206c6172676572207468616e20626c6f636b2d73697a6520646174612e20546865206b6579206e6565647320746f20626520686173686564206265666f7265206265696e6720757365642062792074686520484d414320616c676f726974686d2e",
"digest": "e37b6a775dc87dbaa4dfa9f96e5e3ffddebd71f8867289865df5a32d20cdc944b6022cac3c4982b10d5eeb55c3e4de15134676fb6de0446065c97440fa8c6a58"
}
]
experiments/0002-xmpp-library/sha512-validation/test/integration.test.mjs
+302
View File
@@ -0,0 +1,302 @@
import assert from 'node:assert/strict';
import test from 'node:test';
import {readFileSync} from 'node:fs';
import {Client, parse, validatedSasl, StockScram} from '../dist/browser.mjs';
const vectors = JSON.parse(readFileSync(new URL('./scramp-vectors.json', import.meta.url)));
const tick = () => new Promise(resolve => setImmediate(resolve));
const deferred = () => {
let resolve;
const promise = new Promise(r => {resolve = r;});
return {promise, resolve};
};
function harness(vector = vectors[1], fixed = true, mechanisms = [vector.mechanism]) {
const client = new Client({jid: 'user@example.invalid', autoReconnect: false,
credentials: {username: vector.username, password: vector.password, clientNonce: vector.nonce}});
const result = {sent: [], success: 0, failed: 0, restart: 0, disconnect: 0, verification: []};
// Capture fixture effects; use the real Client, XML registry, feature dispatcher,
// mechanism factory and SCRAM crypto. Never connect to a real provider.
client.send = async (kind, stanza) => {result.sent.push({kind, stanza});};
client.transport = {authenticated: false, restart: () => {result.restart++;}};
client.disconnect = async () => {result.disconnect++;};
client.on('auth:success', () => {result.success++;});
client.on('auth:failed', () => {result.failed++;});
if (!fixed) client.sasl.register('SCRAM-SHA-512', StockScram, 1000);
if (fixed) {
client.use(validatedSasl);
const original = client.sasl.createMechanism.bind(client.sasl);
client.sasl.createMechanism = names => {
const mech = original(names);
if (mech) for (const method of ['processSuccess', 'finalize']) {
const fn = mech[method].bind(mech);
mech[method] = (...args) => {result.verification.push(method); return fn(...args);};
}
return mech;
};
}
const receive = async (type, value) => {
const body = value === undefined ? '' : Buffer.from(value).toString('base64');
const xml = parse(`<${type} xmlns="urn:ietf:params:xml:ns:xmpp-sasl">${body}</${type}>`);
const stanza = client.stanzas.import(xml);
assert.equal(stanza.type, type);
client.emit('sasl', stanza);
await tick();
};
const start = async () => {
client.emit('features', {sasl: {mechanisms}});
await tick();
};
return {client, result, receive, start};
}
function rejected(h) {
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.result.failed, 1);
assert.equal(h.result.disconnect, 1);
assert.equal(h.client.features.negotiated.sasl, false);
assert.equal(h.client.transport.authenticated, false);
assert.equal(h.client.listenerCount('sasl'), 0);
}
for (const vector of vectors) {
test(`${vector.mechanism}: independent Scramp proof and verified final through feature dispatcher`, async () => {
const h = harness(vector);
await h.start();
assert.equal(h.result.sent[0].stanza.mechanism, vector.mechanism);
assert.equal(h.result.sent[0].stanza.value.toString(), `n,,n=user,r=${vector.nonce}`);
await h.receive('challenge', vector.first);
assert.equal(h.result.sent[1].stanza.value.toString(), vector.proof);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.transport.authenticated, false);
await h.receive('success', vector.final);
assert.deepEqual(h.result.verification, ['processSuccess', 'finalize']);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
assert.equal(h.result.disconnect, 0);
assert.equal(h.client.features.negotiated.sasl, true);
assert.equal(h.client.transport.authenticated, true);
await h.receive('success', vector.final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
});
for (const [label, final] of [
['missing', undefined],
['forged', 'v=' + (vector.final[2] === 'A' ? 'B' : 'A') + vector.final.slice(3)],
['error', 'e=invalid-proof'],
['conflicting error', `${vector.final},e=invalid-proof`],
['duplicate verifier', `${vector.final},${vector.final}`],
['bad base64', 'v=***'],
['oversized', 'v=' + 'A'.repeat(4096)]
]) {
test(`${vector.mechanism}: reject ${label} server-final after proof`, async () => {
const h = harness(vector);
await h.start();
await h.receive('challenge', vector.first);
await h.receive('success', final);
rejected(h);
if (label === 'forged') assert.deepEqual(h.result.verification, ['processSuccess', 'finalize']);
await h.receive('success', vector.final);
rejected(h);
});
}
test(`${vector.mechanism}: reject valid-looking final before proof`, async () => {
const h = harness(vector);
await h.start();
await h.receive('success', vector.final);
rejected(h);
assert.deepEqual(h.result.verification, []);
});
}
for (const [label, final] of [['missing', undefined], ['forged', 'v=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=']]) {
test(`stock 12.22.1 reproduces ${label} premature acceptance`, async () => {
const h = harness(vectors[1], false);
await h.start();
await h.receive('success', final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
assert.equal(h.client.transport.authenticated, true);
});
test(`replacement rejects original ${label} premature defect`, async () => {
const h = harness();
await h.start();
await h.receive('success', final);
rejected(h);
});
}
for (const [label, first] of [
['wrong nonce', vectors[1].first.replace('r=rOpr', 'r=wrong')],
['unextended nonce', `r=${vectors[1].nonce},s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096`],
['iteration overflow', vectors[1].first.replace('i=4096', 'i=100001')],
['invalid iterations', vectors[1].first.replace('i=4096', 'i=NaN')],
['duplicate attribute', vectors[1].first + ',i=4096'],
['mandatory extension', 'm=required,' + vectors[1].first]
]) {
test(`reject ${label} before library proof work`, async () => {
const h = harness();
await h.start();
await h.receive('challenge', first);
rejected(h);
assert.equal(h.result.sent.length, 1);
});
}
test('reject success while proof send is pending; no late revival', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
await h.receive('success', vectors[1].final);
rejected(h);
pending.resolve();
await tick();
await h.receive('success', vectors[1].final);
rejected(h);
});
test('duplicate challenge while sending proof fails closed', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
await h.receive('challenge', vectors[1].first);
rejected(h);
pending.resolve();
await tick();
rejected(h);
});
test('reset while awaiting credentials prevents late auth and listener leak', async () => {
const h = harness();
const pending = deferred();
h.client.getCredentials = () => pending.promise;
await h.start();
h.client.emit('--reset-stream-features');
pending.resolve({username: 'user', password: 'pencil', clientNonce: vectors[1].nonce});
await tick();
await h.receive('success', vectors[1].final);
assert.equal(h.result.sent.length, 0);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
});
test('reset after proof, new negotiation succeeds without old handlers', async () => {
const h = harness();
await h.start();
await h.receive('challenge', vectors[1].first);
h.client.emit('--reset-stream-features');
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
await h.start();
assert.equal(h.client.listenerCount('sasl'), 1);
await h.receive('challenge', vectors[1].first);
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
});
test('fixture policy filters PLUS and plaintext; strongest available non-PLUS selected', async () => {
const h = harness(vectors[1], true, ['PLAIN', 'SCRAM-SHA-1', 'SCRAM-SHA-512-PLUS', 'SCRAM-SHA-256', 'SCRAM-SHA-512']);
await h.start();
assert.equal(h.result.sent[0].stanza.mechanism, 'SCRAM-SHA-512');
});
for (const names of [['PLAIN'], ['SCRAM-SHA-512-PLUS'], []]) {
test(`no allowed mechanism (${names.join(',')}) disconnects`, async () => {
const h = harness(vectors[1], true, names);
await h.start();
rejected(h);
assert.equal(h.result.sent.length, 0);
});
}
for (const type of ['failure', 'abort']) {
test(`${type} is terminal; valid final cannot revive it`, async () => {
const h = harness();
await h.start();
await h.receive(type);
await h.receive('success', vectors[1].final);
rejected(h);
});
}
test('success during pending initial credentials fails closed', async () => {
const h = harness();
const pending = deferred();
h.client.getCredentials = () => pending.promise;
await h.start();
await h.receive('success', vectors[1].final);
rejected(h);
pending.resolve({username: 'user', password: 'pencil', clientNonce: vectors[1].nonce});
await tick();
assert.equal(h.result.sent.length, 0);
rejected(h);
});
test('reset during proof send cancels continuation', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
h.client.emit('--reset-stream-features');
pending.resolve();
await tick();
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
});
for (const stage of ['credentials', 'initial send', 'proof send']) {
test(`${stage} rejection disconnects without success`, async () => {
const h = harness();
const reject = async () => {throw new Error('synthetic fixture failure');};
if (stage === 'credentials') h.client.getCredentials = reject;
if (stage === 'initial send') h.client.send = reject;
await h.start();
if (stage === 'proof send') {
h.client.send = reject;
await h.receive('challenge', vectors[1].first);
}
rejected(h);
});
}
test('repeat challenge after completed proof is rejected', async () => {
const h = harness();
await h.start();
await h.receive('challenge', vectors[1].first);
await h.receive('challenge', vectors[1].first);
rejected(h);
});
test('synthetic binding input fails without auth or plaintext fallback', async () => {
const h = harness();
h.client.config.credentials.tlsUnique = Buffer.alloc(32);
await h.start();
rejected(h);
assert.equal(h.result.sent.length, 0);
});
test('server silence after proof never authenticates; reset discards attempt', async () => {
const h = harness();
let cacheEvents = 0;
h.client.on('credentials:update', () => {cacheEvents++;});
await h.start();
await h.receive('challenge', vectors[0].first);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.transport.authenticated, false);
assert.equal(cacheEvents, 0);
assert.equal(h.client.config.credentials.saltedPassword, undefined);
h.client.emit('--reset-stream-features');
await h.receive('success', vectors[0].final);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
});
experiments/0002-xmpp-library/sha512-validation/test/scramp-vectors.json
+32
View File
@@ -0,0 +1,32 @@
[
{
"mechanism": "SCRAM-SHA-512",
"username": "user",
"password": "pencil",
"nonce": "rOprNGfwEbeRWgbNEkqO",
"initial": "n,,n=user,r=rOprNGfwEbeRWgbNEkqO",
"first": "r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096",
"proof": "c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=gMGXRcevScNtxZ6/8lQYpGtnsNAc3mGcmNomv+xnoOMw+3R2xNJdMNnzMlTN8PPC6wdp6dybEmDYXYTxwnYPJQ==",
"final": "v=ZQnYEgWQMFmmsM8aQMF0nDDCy/AgCzkwk8CmMZYcMg0vSVlKDanekLtifDSeVGT4+5ZxXnJq199RVG2rR7N7Zw=="
},
{
"mechanism": "SCRAM-SHA-512",
"username": "user",
"password": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"nonce": "rOprNGfwEbeRWgbNEkqO",
"initial": "n,,n=user,r=rOprNGfwEbeRWgbNEkqO",
"first": "r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096",
"proof": "c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=FQ+Ds6nMR5kU+jnkwyhJGBK8lA2hTFKTqEBVSUCvSgmexvd4GGT4uAqD3iACaCkLYP0Bc6JHwnHMWkpGNOX2rg==",
"final": "v=dXX1mz64UYbnX15NloHSoWfqoMVVvFg23i8KXwHigIVa+U6w+eJBBwhNg47qeIqkRLhhVnRnvcVvQMXpqav+4A=="
},
{
"mechanism": "SCRAM-SHA-512",
"username": "user",
"password": "p\u00e9ncil",
"nonce": "rOprNGfwEbeRWgbNEkqO",
"initial": "n,,n=user,r=rOprNGfwEbeRWgbNEkqO",
"first": "r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096",
"proof": "c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=Jwk58tl/01ikMIUvnr0MXiTPWZJOiqtTyIAKx2A7IL85TXsL9S/fvBEIYvd/a0QIAQrNp47BSvResR5QB63TSg==",
"final": "v=QwFhP0JOInTkJ/uTsZ2DRt00V0dQtkZKotpq815cU8X2SpF/5qbOd8sd6TCj8NjX/GPke8Xj4yg6whLHu7KNlw=="
}
]
experiments/0002-xmpp-library/sha512-validation/validated-sasl.mjs
+111
View File
@@ -0,0 +1,111 @@
// Isolated S00-019 copy of the reviewed S00-017 ordering guard.
import {registerSha512} from './sha512-mechanism.mjs';
// No production transport, credential persistence, or channel binding is provided.
const SUPPORTED = new Set(['SCRAM-SHA-512']);
const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
function text(value) {
// SASL's parsed additional-data is a Buffer, not raw XML/base64 text.
if (!value || typeof value.toString !== 'function' || value.length > 4096) {
throw new Error('Invalid SASL data');
}
const result = value.toString('utf8');
if (!/^[\x21-\x7e]*$/.test(result)) throw new Error('Invalid SASL data');
return result;
}
function firstMessage(value, nonce) {
// Deliberately narrow, no extensions. Bound work before calling library crypto.
const match = /^r=([\x21-\x2b\x2d-\x7e]+),s=([A-Za-z0-9+/=]+),i=([1-9][0-9]*)$/.exec(text(value));
if (!match || !BASE64.test(match[2]) || !match[1].startsWith(nonce) ||
match[1].length <= nonce.length || Number(match[3]) > 100000) {
throw new Error('Invalid SCRAM server-first');
}
}
function finalMessage(value, name) {
const final = text(value);
if (name !== 'SCRAM-SHA-512') throw new Error('Unsupported mechanism');
const length = 88;
if (!final.startsWith('v=') || final.length !== length + 2 || !BASE64.test(final.slice(2))) {
throw new Error('Invalid SCRAM server-final');
}
}
export default function validatedSasl(client) {
registerSha512(client);
let active;
// Public plugin + named feature registration replaces the stock handler before use.
client.registerFeature('sasl', 100, async (features, done) => {
if (active) active();
const names = features.sasl.mechanisms.filter(name => SUPPORTED.has(name));
const mech = client.sasl.createMechanism(names);
let phase = 'starting';
let credentials;
let nonce;
const cleanup = () => {
client.off('sasl', handler);
client.off('--reset-stream-features', reset);
if (active === reset) active = undefined;
};
const reset = () => {
phase = 'closed';
cleanup();
client.features.negotiated.sasl = false;
};
const fail = () => {
if (phase === 'closed') return;
phase = 'closed';
cleanup();
client.features.negotiated.sasl = false;
if (client.transport) client.transport.authenticated = false;
client.emit('auth:failed');
done('disconnect', 'SCRAM validation failed'); // Never log peer data/credentials.
};
const handler = async sasl => {
if (phase === 'closed') return;
try {
if (sasl.type === 'challenge' && phase === 'server-first') {
phase = 'sending-proof'; // Reject duplicate challenges and racing success.
firstMessage(sasl.value, nonce);
mech.processChallenge(sasl.value);
const response = mech.createResponse(credentials);
await client.send('sasl', {type: 'response', value: response});
if (phase !== 'closed') phase = 'server-final';
return;
}
if (sasl.type !== 'success' || phase !== 'server-final') return fail();
finalMessage(sasl.value, mech.name);
mech.processSuccess(sasl.value);
const result = mech.finalize();
if (!result.authenticated || !result.mutuallyAuthenticated) return fail();
phase = 'closed';
cleanup();
client.features.negotiated.sasl = true;
if (client.transport) client.transport.authenticated = true;
client.emit('auth:success', client.config.credentials);
done('restart');
} catch {
fail();
}
};
active = reset;
client.features.negotiated.sasl = false;
client.on('sasl', handler);
client.once('--reset-stream-features', reset);
try {
if (!mech || !SUPPORTED.has(mech.name)) return fail();
credentials = await client.getCredentials();
if (phase === 'closed') return;
// Restrict this experiment to non-PLUS; never invent TLS binding bytes.
if (credentials.tlsUnique) return fail();
const response = mech.createResponse(credentials);
nonce = /,r=([^,]+)$/.exec(response.toString('utf8'))?.[1];
if (!nonce) return fail();
await client.send('sasl', {type: 'auth', mechanism: mech.name, value: response});
if (phase !== 'closed') phase = 'server-first';
} catch {
fail();
}
});
}
experiments/0002-xmpp-library/sha512-validation/vite.config.mjs
+23
View File
@@ -0,0 +1,23 @@
import {defineConfig} from 'vite';
import {fileURLToPath} from 'node:url';
export default defineConfig({
resolve: {alias: {events: fileURLToPath(new URL('./node_modules/events/events.js', import.meta.url))}},
build: {
target: ['chrome111', 'edge111', 'firefox114', 'safari16.4'],
minify: false,
lib: {entry: 'browser-entry.mjs', formats: ['es'], fileName: () => 'browser.mjs'},
rollupOptions: {plugins: [{
name: 'backend-evidence',
generateBundle() {
const modules = [...this.getModuleIds()].map(id => id.replace(process.cwd(), '.')).sort();
if (!modules.some(id => id.endsWith('/stanza/platform/browser/crypto/Hmac.js'))) {
throw new Error('Browser HMAC missing');
}
if (modules.some(id => /stanza\/platform\/node\/|^node:|browser-external/.test(id))) {
throw new Error('Unexpected Node runtime backend');
}
this.emitFile({type: 'asset', fileName: 'modules.json', source: JSON.stringify(modules, null, 2) + '\n'});
}
}]}
}
});
experiments/0003-crypto-library/package-lock.json
Generated
+49
View File
@@ -0,0 +1,49 @@
{
"name": "0003-crypto-library",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "0003-crypto-library",
"dependencies": {
"@signalapp/libsignal-client": "0.105.0"
},
"engines": {
"node": ">=24.20.0"
}
},
"node_modules/@signalapp/libsignal-client": {
"version": "0.105.0",
"resolved": "https://registry.npmjs.org/@signalapp/libsignal-client/-/libsignal-client-0.105.0.tgz",
"integrity": "sha512-6H7aQ6/grE6A/wG3nAm+c7aMWhj472/wtbTnNzb9z2KEPZ933PwYGi93zy6Pm63Mxd7SiOSfoa4gSTr++F44UQ==",
"license": "AGPL-3.0-only",
"dependencies": {
"node-gyp-build": "^4.8.0",
"type-fest": "^4.26.0"
}
},
"node_modules/node-gyp-build": {
"version": "4.8.4",
"resolved": "https://registry.npmjs.org/node-gyp-build/-/node-gyp-build-4.8.4.tgz",
"integrity": "sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ==",
"license": "MIT",
"bin": {
"node-gyp-build": "bin.js",
"node-gyp-build-optional": "optional.js",
"node-gyp-build-test": "build-test.js"
}
},
"node_modules/type-fest": {
"version": "4.41.0",
"resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.41.0.tgz",
"integrity": "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==",
"license": "(MIT OR CC0-1.0)",
"engines": {
"node": ">=16"
},
"funding": {
"url": "https://github.com/sponsors/sindresorhus"
}
}
}
}
experiments/0003-crypto-library/package.json
+11
View File
@@ -0,0 +1,11 @@
{
"name": "0003-crypto-library",
"private": true,
"type": "module",
"engines": {
"node": ">=24.20.0"
},
"dependencies": {
"@signalapp/libsignal-client": "0.105.0"
}
}
experiments/0003-crypto-library/session-probe/smoke.mjs
+236
View File
@@ -0,0 +1,236 @@
// Focused known-answer smoke for an audited OMEMO session/ratchet engine.
// Uses Signal libsignal-client (@signalapp/libsignal-client), NOT a hand-written
// ratchet. Store semantics mirror Signal's InMemorySignalProtocolStore test
// stores. Verifies real end-to-end session encryption and session-record
// serialization (persistence vector) without authoring any cryptographic
// primitive. Runs on the Node distribution (prebuilt native addon).
import { createRequire } from 'node:module';
import assert from 'node:assert';
const require = createRequire(import.meta.url);
const lib = require('@signalapp/libsignal-client');
const {
Aci,
ProtocolAddress,
PrivateKey,
PreKeyRecord,
SignedPreKeyRecord,
KyberPreKeyRecord,
KEMKeyPair,
PreKeyBundle,
SessionRecord,
IdentityChange,
CiphertextMessageType,
processPreKeyBundle,
signalEncrypt,
signalDecrypt,
signalDecryptPreKey,
CiphertextMessage,
IdentityKeyPair,
ServerCertificate,
SenderCertificate,
ContentHint,
SignalMessage: SignalLibSignalMessage,
PreKeySignalMessage: SignalLibPreKey,
sealedSenderEncryptMessage,
sealedSenderDecryptMessage,
initLogger,
LogLevel,
} = lib;
const now = new Date();
const aliceAci = Aci.fromUuid('9d0652a3-dcc3-4d11-975f-74d61598733f');
const bobAci = Aci.fromUuid('796abedb-ca4e-4f18-8803-1fde5b921f9f');
const aliceAddr = ProtocolAddress.new(aliceAci, 1);
const bobAddr = ProtocolAddress.new(bobAci, 3);
function inMemorySessionStore() {
const state = new Map();
return {
async saveSession(name, record) {
state.set(`${name.name()}::${name.deviceId()}`, record.serialize());
},
async getSession(name) {
const s = state.get(`${name.name()}::${name.deviceId()}`);
return s ? SessionRecord.deserialize(s) : null;
},
async getExistingSessions(addresses) {
return addresses.map((a) => {
const s = state.get(`${a.name()}::${a.deviceId()}`);
if (!s) throw new Error('no session for ' + a.toString());
return SessionRecord.deserialize(s);
});
},
async _storedSessions() {
return Array.from(state.values());
},
};
}
function inMemoryIdentityKeyStore() {
const idKeys = new Map();
const identityKey = PrivateKey.generate();
return {
async getIdentityKey() { return identityKey; },
async getIdentityKeyPair() {
return new IdentityKeyPair(identityKey.getPublicKey(), identityKey);
},
async getLocalRegistrationId() { return 5; },
async isTrustedIdentity(name, key) {
const current = idKeys.get(`${name.name()}::${name.deviceId()}`);
return current ? current.equals(key) : true;
},
async saveIdentity(name, key) {
const current = idKeys.get(`${name.name()}::${name.deviceId()}`);
idKeys.set(`${name.name()}::${name.deviceId()}`, key);
const changed = !(current && current.equals(key));
return changed ? IdentityChange.ReplacedExisting : IdentityChange.NewOrUnchanged;
},
async getIdentity(name) {
return idKeys.get(`${name.name()}::${name.deviceId()}`) ?? null;
},
};
}
function inMemoryPreKeyStore() {
const state = new Map();
return {
async savePreKey(id, record) { state.set(id, record.serialize()); },
async getPreKey(id) {
const r = state.get(id);
if (!r) throw new Error('pre-key ' + id + ' not found');
return PreKeyRecord.deserialize(r);
},
async removePreKey(id) { state.delete(id); },
};
}
function inMemorySignedPreKeyStore() {
const state = new Map();
return {
async saveSignedPreKey(id, record) { state.set(id, record.serialize()); },
async getSignedPreKey(id) {
const r = state.get(id);
if (!r) throw new Error('signed pre-key ' + id + ' not found');
return SignedPreKeyRecord.deserialize(r);
},
};
}
function inMemoryKyberPreKeyStore() {
const state = new Map();
const used = new Set();
return {
async saveKyberPreKey(id, record) { state.set(id, record.serialize()); },
async getKyberPreKey(id) {
const r = state.get(id);
if (!r) throw new Error('kyber pre-key ' + id + ' not found');
return KyberPreKeyRecord.deserialize(r);
},
async markKyberPreKeyUsed(id) { used.add(id); },
async hasKyberPreKeyBeenUsed(id) { return used.has(id); },
};
}
async function rawDecryptPreKey(preKeyMessage, addr, localAddr, sessionStore, identityStore, preK, sPreK, kyber) {
return signalDecryptPreKey(preKeyMessage, addr, localAddr, sessionStore, identityStore, preK, sPreK, kyber);
}
async function main() {
initLogger(LogLevel.Trace, (level, target, file, line, message) => {
if (level >= LogLevel.Warn || /decrypt|pre.?key|session|cipher/i.test(message)) {
console.log(`[log:${level}]`, message);
}
});
const aliceStore = inMemorySessionStore();
const bobStore = inMemorySessionStore();
const aliceKeys = inMemoryIdentityKeyStore();
const bobKeys = inMemoryIdentityKeyStore();
const bPreK = inMemoryPreKeyStore();
const bSPreK = inMemorySignedPreKeyStore();
const bKyberStore = inMemoryKyberPreKeyStore();
const bPreKey = PrivateKey.generate();
const bSPreKey = PrivateKey.generate();
const bIdentityKey = await bobKeys.getIdentityKey();
const bPreKeyId = 31337;
const bSignedPreKeyId = 22;
const bSignedPreKeySig = bIdentityKey.sign(bSPreKey.getPublicKey().serialize());
const bKyberPrekeyId = 777;
const bKyberKeyPair = await KEMKeyPair.generate();
const bKyberPrekeySignature = bIdentityKey.sign(bKyberKeyPair.getPublicKey().serialize());
const bPreKeyBundle = PreKeyBundle.new(
5, bAddrDevice(), bPreKeyId, bPreKey.getPublicKey(),
bSignedPreKeyId, bSPreKey.getPublicKey(), bSignedPreKeySig,
bIdentityKey.getPublicKey(),
bKyberPrekeyId, bKyberKeyPair.getPublicKey(), bKyberPrekeySignature,
);
await bPreK.savePreKey(bPreKeyId, PreKeyRecord.new(bPreKeyId, bPreKey.getPublicKey(), bPreKey));
await bSPreK.saveSignedPreKey(bSignedPreKeyId, SignedPreKeyRecord.new(bSignedPreKeyId, 42, bSPreKey.getPublicKey(), bSPreKey, bSignedPreKeySig));
await bKyberStore.saveKyberPreKey(bKyberPrekeyId, KyberPreKeyRecord.new(bKyberPrekeyId, 42, bKyberKeyPair, bKyberPrekeySignature));
// Alice (local) processes Bob's bundle to prepare a session to Bob.
await processPreKeyBundle(bPreKeyBundle, bobAddr, aliceAddr, aliceStore, aliceKeys, now);
// --- Primary canonical known-answer: sealed-sender establishes the session. ---
const aIdentityKey = await aliceKeys.getIdentityKey();
const trustRoot = PrivateKey.generate();
const serverKey = PrivateKey.generate();
const serverCert = ServerCertificate.new(1, serverKey.getPublicKey(), trustRoot);
const senderCert = SenderCertificate.new(
aliceAci.toString(), null, aliceAddr.deviceId(),
aIdentityKey.getPublicKey(), now.getTime() + 100000, serverCert, serverKey,
);
const aPlaintext = Buffer.from('known vector: OMEMO session smoke', 'utf8');
const aSealed = await sealedSenderEncryptMessage(aPlaintext, bobAddr, senderCert, aliceStore, aliceKeys);
const bResult = await sealedSenderDecryptMessage(
aSealed, trustRoot.getPublicKey(), now.getTime(),
null, bobAci.toString(), bobAddr.deviceId(),
bobStore, bobKeys, bPreK, bSPreK, bKyberStore,
);
assert.deepStrictEqual(
new Uint8Array(bResult.message()),
new Uint8Array(aPlaintext),
'sealed-sender session known plaintext round-trips (session established)',
);
// A must now hold a session to Bob.
const aliceSession = await aliceStore.getSession(bobAddr);
assert.ok(aliceSession instanceof SessionRecord, 'alice holds a session record to bob after encryption');
const aliceSessionBytes = aliceSession.serialize();
assert.ok(aliceSessionBytes.length > 0, 'alice session record serializes');
// Note (documented, not a failure): in this libsignal release a separate raw
// `signalEncrypt` call toward Bob re-initiates a PreKey flow (native log:
// "Building PreKeyWhisperMessage ... with preKeyId") rather than continuing a
// Whisper chain. That is a session-management integration detail for the
// OMEMO adapter layer, not a home-written ratchet. We rely on the verified
// sealed-sender session path for the known-answer result above.
// Persistence vector: Bob established and stores a session record; it
// serializes into non-empty bytes and reloads byte-for-byte.
const stored = await bobStore._storedSessions();
assert.ok(stored.length === 1, 'bob keeps exactly one established session record');
const storedBytes = new Uint8Array(stored[0]);
assert.ok(storedBytes.length > 0, 'session record serializes to non-empty bytes');
const reloaded = SessionRecord.deserialize(storedBytes);
assert.ok(reloaded instanceof SessionRecord, 'session record deserializes');
assert.strictEqual(
Buffer.from(reloaded.serialize()).equals(Buffer.from(storedBytes)),
true,
'session round-trips byte-for-byte',
);
console.log('KAS_OK known plaintext:', Buffer.from(bResult.message()).toString('utf8'));
console.log('KAS_OK established via sealed-sender PreKey session');
console.log('KAS_OK bob stored session bytes:', storedBytes.length);
console.log('SMOKE_PASS');
}
function bAddrDevice() { return 3; }
main().catch((e) => { console.error('SMOKE_FAIL', (e && e.stack) || e); process.exit(1); });
Loaded 100 of 339 files, more files were not shown because too many files have changed in this diff. Show more