@antseed/node 0.2.107 → 0.2.109

package/dist/p2p/secure-channel.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Encrypted TCP transport (transport.tcp-enc.v1): wallet-signed ephemeral
+ * X25519 handshake, HKDF-SHA256 with transcript-bound salt, one
+ * ChaCha20-Poly1305 key per direction, length-prefixed frames with implicit
+ * counter nonces (safe: per-direction keys, TCP ordering).
+ */
+import { type KeyObject } from "node:crypto";
+export declare const MAX_FRAME_PLAINTEXT_BYTES: number;
+export interface EphemeralKeyPair {
+    privateKey: KeyObject;
+    /** Raw 32-byte public key, lowercase hex (64 chars). */
+    publicKeyHex: string;
+}
+export declare const X25519_PUB_HEX_REGEX: RegExp;
+export declare function generateEphemeralKeyPair(): EphemeralKeyPair;
+export interface SessionKeys {
+    sendKey: Buffer;
+    recvKey: Buffer;
+}
+export interface HandshakeTranscript {
+    initiatorPeerId: string;
+    responderPeerId: string;
+    initiatorNonce: string;
+    responderNonce: string;
+    initiatorPubHex: string;
+    responderPubHex: string;
+}
+/** Derive per-direction AEAD keys; `isInitiator` mirrors send/recv halves. */
+export declare function deriveSessionKeys(localPrivateKey: KeyObject, remotePublicKeyHex: string, transcript: HandshakeTranscript, isInitiator: boolean): SessionKeys;
+/** Encrypts outbound messages into length-prefixed AEAD frames. */
+export declare class FrameEncryptor {
+    private readonly key;
+    private _counter;
+    constructor(key: Buffer);
+    encrypt(plaintext: Uint8Array): Buffer;
+}
+/** Accumulates inbound bytes and decrypts complete AEAD frames. */
+export declare class FrameDecryptor {
+    private readonly key;
+    private _counter;
+    private _buffer;
+    constructor(key: Buffer);
+    /** Feed raw bytes, get decrypted messages. Throws are fatal for the connection. */
+    push(chunk: Uint8Array): Uint8Array[];
+}
+/** Bidirectional cipher state attached to an encrypted TCP connection. */
+export interface TransportCrypto {
+    encryptor: FrameEncryptor;
+    decryptor: FrameDecryptor;
+}
+export declare function createTransportCrypto(keys: SessionKeys): TransportCrypto;
+export declare function sha256Hex(data: string): string;
+//# sourceMappingURL=secure-channel.d.ts.map

package/dist/p2p/secure-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-channel.d.ts","sourceRoot":"","sources":["../../src/p2p/secure-channel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAKrB,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAM1D,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,SAAS,CAAC;IACtB,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAErD,wBAAgB,wBAAwB,IAAI,gBAAgB,CAK3D;AAUD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AAWD,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAC/B,eAAe,EAAE,SAAS,EAC1B,kBAAkB,EAAE,MAAM,EAC1B,UAAU,EAAE,mBAAmB,EAC/B,WAAW,EAAE,OAAO,GACnB,WAAW,CAab;AAQD,mEAAmE;AACnE,qBAAa,cAAc;IAGb,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,QAAQ,CAAM;gBAEO,GAAG,EAAE,MAAM;IAExC,OAAO,CAAC,SAAS,EAAE,UAAU,GAAG,MAAM;CAavC;AAED,mEAAmE;AACnE,qBAAa,cAAc;IAIb,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,OAAO,CAAmB;gBAEL,GAAG,EAAE,MAAM;IAExC,mFAAmF;IACnF,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE;CA8BtC;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,cAAc,CAAC;IAC1B,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,eAAe,CAKxE;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C"}

package/dist/p2p/secure-channel.js

@@ -0,0 +1,121 @@
+/**
+ * Encrypted TCP transport (transport.tcp-enc.v1): wallet-signed ephemeral
+ * X25519 handshake, HKDF-SHA256 with transcript-bound salt, one
+ * ChaCha20-Poly1305 key per direction, length-prefixed frames with implicit
+ * counter nonces (safe: per-direction keys, TCP ordering).
+ */
+import { createCipheriv, createDecipheriv, createHash, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, } from "node:crypto";
+const AEAD_ALGORITHM = "chacha20-poly1305";
+const AEAD_TAG_BYTES = 16;
+const FRAME_HEADER_BYTES = 4;
+export const MAX_FRAME_PLAINTEXT_BYTES = 16 * 1024 * 1024;
+const HKDF_INFO = "antseed-tcp-enc-v1";
+const X25519_RAW_KEY_BYTES = 32;
+/** DER SPKI prefix for an X25519 public key (RFC 8410). */
+const X25519_SPKI_PREFIX = Buffer.from("302a300506032b656e032100", "hex");
+export const X25519_PUB_HEX_REGEX = /^[0-9a-f]{64}$/;
+export function generateEphemeralKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync("x25519");
+    const spki = publicKey.export({ type: "spki", format: "der" });
+    const raw = spki.subarray(spki.length - X25519_RAW_KEY_BYTES);
+    return { privateKey, publicKeyHex: raw.toString("hex") };
+}
+function importPublicKey(publicKeyHex) {
+    if (!X25519_PUB_HEX_REGEX.test(publicKeyHex)) {
+        throw new Error("Invalid X25519 public key");
+    }
+    const der = Buffer.concat([X25519_SPKI_PREFIX, Buffer.from(publicKeyHex, "hex")]);
+    return createPublicKey({ key: der, format: "der", type: "spki" });
+}
+function transcriptHash(t) {
+    return createHash("sha256")
+        .update(`${t.initiatorPeerId}|${t.responderPeerId}|${t.initiatorNonce}|${t.responderNonce}|${t.initiatorPubHex}|${t.responderPubHex}`, "utf8")
+        .digest();
+}
+/** Derive per-direction AEAD keys; `isInitiator` mirrors send/recv halves. */
+export function deriveSessionKeys(localPrivateKey, remotePublicKeyHex, transcript, isInitiator) {
+    const shared = diffieHellman({
+        privateKey: localPrivateKey,
+        publicKey: importPublicKey(remotePublicKeyHex),
+    });
+    const okm = Buffer.from(hkdfSync("sha256", shared, transcriptHash(transcript), HKDF_INFO, 64));
+    const initiatorToResponder = okm.subarray(0, 32);
+    const responderToInitiator = okm.subarray(32, 64);
+    return isInitiator
+        ? { sendKey: initiatorToResponder, recvKey: responderToInitiator }
+        : { sendKey: responderToInitiator, recvKey: initiatorToResponder };
+}
+function counterIv(counter) {
+    const iv = Buffer.alloc(12);
+    iv.writeBigUInt64BE(counter, 4);
+    return iv;
+}
+/** Encrypts outbound messages into length-prefixed AEAD frames. */
+export class FrameEncryptor {
+    key;
+    _counter = 0n;
+    constructor(key) {
+        this.key = key;
+    }
+    encrypt(plaintext) {
+        if (plaintext.length > MAX_FRAME_PLAINTEXT_BYTES) {
+            throw new Error(`Frame plaintext exceeds ${MAX_FRAME_PLAINTEXT_BYTES} bytes`);
+        }
+        const cipher = createCipheriv(AEAD_ALGORITHM, this.key, counterIv(this._counter), {
+            authTagLength: AEAD_TAG_BYTES,
+        });
+        this._counter += 1n;
+        const body = Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
+        const header = Buffer.alloc(FRAME_HEADER_BYTES);
+        header.writeUInt32BE(body.length, 0);
+        return Buffer.concat([header, body]);
+    }
+}
+/** Accumulates inbound bytes and decrypts complete AEAD frames. */
+export class FrameDecryptor {
+    key;
+    _counter = 0n;
+    _buffer = Buffer.alloc(0);
+    constructor(key) {
+        this.key = key;
+    }
+    /** Feed raw bytes, get decrypted messages. Throws are fatal for the connection. */
+    push(chunk) {
+        this._buffer = this._buffer.length === 0
+            ? Buffer.from(chunk)
+            : Buffer.concat([this._buffer, chunk]);
+        const messages = [];
+        while (this._buffer.length >= FRAME_HEADER_BYTES) {
+            const bodyLength = this._buffer.readUInt32BE(0);
+            if (bodyLength < AEAD_TAG_BYTES || bodyLength > MAX_FRAME_PLAINTEXT_BYTES + AEAD_TAG_BYTES) {
+                throw new Error(`Invalid encrypted frame length ${bodyLength}`);
+            }
+            if (this._buffer.length < FRAME_HEADER_BYTES + bodyLength) {
+                break;
+            }
+            const body = this._buffer.subarray(FRAME_HEADER_BYTES, FRAME_HEADER_BYTES + bodyLength);
+            this._buffer = this._buffer.subarray(FRAME_HEADER_BYTES + bodyLength);
+            const decipher = createDecipheriv(AEAD_ALGORITHM, this.key, counterIv(this._counter), {
+                authTagLength: AEAD_TAG_BYTES,
+            });
+            this._counter += 1n;
+            decipher.setAuthTag(body.subarray(body.length - AEAD_TAG_BYTES));
+            const plaintext = Buffer.concat([
+                decipher.update(body.subarray(0, body.length - AEAD_TAG_BYTES)),
+                decipher.final(),
+            ]);
+            messages.push(new Uint8Array(plaintext));
+        }
+        return messages;
+    }
+}
+export function createTransportCrypto(keys) {
+    return {
+        encryptor: new FrameEncryptor(keys.sendKey),
+        decryptor: new FrameDecryptor(keys.recvKey),
+    };
+}
+export function sha256Hex(data) {
+    return createHash("sha256").update(data, "utf8").digest("hex");
+}
+//# sourceMappingURL=secure-channel.js.map

package/dist/p2p/secure-channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-channel.js","sourceRoot":"","sources":["../../src/p2p/secure-channel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,QAAQ,GAET,MAAM,aAAa,CAAC;AAErB,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAC3C,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1D,MAAM,SAAS,GAAG,oBAAoB,CAAC;AACvC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,2DAA2D;AAC3D,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAQ1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,MAAM,UAAU,wBAAwB;IACtC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,CAAC;IAC9D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB;IAC3C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AAgBD,SAAS,cAAc,CAAC,CAAsB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,GAAG,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,eAAe,EAAE,EAC7H,MAAM,CACP;SACA,MAAM,EAAE,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAC/B,eAA0B,EAC1B,kBAA0B,EAC1B,UAA+B,EAC/B,WAAoB;IAEpB,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,eAAe,CAAC,kBAAkB,CAAC;KAC/C,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CACtE,CAAC;IACF,MAAM,oBAAoB,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,oBAAoB,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,WAAW;QAChB,CAAC,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,oBAAoB,EAAE;QAClE,CAAC,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5B,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,mEAAmE;AACnE,MAAM,OAAO,cAAc;IAGI;IAFrB,QAAQ,GAAG,EAAE,CAAC;IAEtB,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,OAAO,CAAC,SAAqB;QAC3B,IAAI,SAAS,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,2BAA2B,yBAAyB,QAAQ,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAChF,aAAa,EAAE,cAAc;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,cAAc;IAII;IAHrB,QAAQ,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElC,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,mFAAmF;IACnF,IAAI,CAAC,KAAiB;QACpB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACtC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,UAAU,GAAG,cAAc,IAAI,UAAU,GAAG,yBAAyB,GAAG,cAAc,EAAE,CAAC;gBAC3F,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,kBAAkB,GAAG,UAAU,EAAE,CAAC;gBAC1D,MAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,UAAU,CAAC,CAAC;YACxF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,GAAG,UAAU,CAAC,CAAC;YAEtE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACpF,aAAa,EAAE,cAAc;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YACpB,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;gBAC/D,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAQD,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,OAAO;QACL,SAAS,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antseed/node",
-  "version": "0.2.107",
+  "version": "0.2.109",
   "description": "Antseed Network protocol SDK — P2P inference marketplace",
   "type": "module",
   "files": [
@@ -50,8 +50,8 @@
     "node-datachannel": "^0.7.0",
     "tokenx": "^1.3.0",
     "@antseed/api-adapter": "0.1.43",
-    "@antseed/buyer-core": "0.1.1",
-    "@antseed/protocol": "0.1.1"
+    "@antseed/buyer-core": "0.1.3",
+    "@antseed/protocol": "0.1.3"
   },
   "optionalDependencies": {
     "keytar": "^7.9.0"