@bytetrue/byspace 0.1.0

package/node_modules/@bytetrue/byspace-relay/dist/crypto.d.ts

@@ -0,0 +1,30 @@
+/**
+ * E2EE crypto primitives using NaCl (tweetnacl).
+ *
+ * - Key exchange: Curve25519 (nacl.box.before)
+ * - Encryption: XSalsa20-Poly1305 (nacl.box.after / open.after)
+ *
+ * Bundle format (binary):
+ *   [nonce (24 bytes)] [ciphertext...]
+ *
+ * Transport format:
+ *   The encrypted-channel sends the bundle as base64 text over WebSocket.
+ */
+export interface KeyPair {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}
+export type SharedKey = Uint8Array;
+export declare function generateKeyPair(): KeyPair;
+export declare function exportPublicKey(publicKey: Uint8Array): string;
+export declare function importPublicKey(base64: string): Uint8Array;
+export declare function exportSecretKey(secretKey: Uint8Array): string;
+export declare function importSecretKey(base64: string): Uint8Array;
+export declare function deriveSharedKey(ourSecretKey: Uint8Array, peerPublicKey: Uint8Array): SharedKey;
+/**
+ * Encrypts data and returns the binary bundle:
+ *   [nonce (24)] [ciphertext...]
+ */
+export declare function encrypt(sharedKey: SharedKey, data: string | ArrayBuffer): ArrayBuffer;
+export declare function decrypt(sharedKey: SharedKey, data: ArrayBuffer): string | ArrayBuffer;
+//# sourceMappingURL=crypto.d.ts.map

package/node_modules/@bytetrue/byspace-relay/dist/crypto.js

@@ -0,0 +1,132 @@
+/// <reference lib="dom" />
+/**
+ * E2EE crypto primitives using NaCl (tweetnacl).
+ *
+ * - Key exchange: Curve25519 (nacl.box.before)
+ * - Encryption: XSalsa20-Poly1305 (nacl.box.after / open.after)
+ *
+ * Bundle format (binary):
+ *   [nonce (24 bytes)] [ciphertext...]
+ *
+ * Transport format:
+ *   The encrypted-channel sends the bundle as base64 text over WebSocket.
+ */
+import nacl from "tweetnacl";
+import { fromByteArray, toByteArray } from "base64-js";
+const NONCE_LENGTH = nacl.box.nonceLength; // 24
+let prngReady = false;
+function getGlobalCrypto() {
+    const g = globalThis;
+    return g.crypto;
+}
+function ensurePrng() {
+    if (prngReady)
+        return;
+    try {
+        nacl.randomBytes(1);
+        prngReady = true;
+        return;
+    }
+    catch {
+        // fallthrough
+    }
+    const cryptoObj = getGlobalCrypto();
+    if (cryptoObj?.getRandomValues) {
+        nacl.setPRNG((x, n) => {
+            const buf = new Uint8Array(n);
+            cryptoObj.getRandomValues(buf);
+            x.set(buf, 0);
+        });
+        prngReady = true;
+        return;
+    }
+    throw new Error("No secure PRNG available for tweetnacl (missing crypto.getRandomValues)");
+}
+function encodeBase64(bytes) {
+    return fromByteArray(bytes);
+}
+function decodeBase64(base64) {
+    return toByteArray(base64);
+}
+function toUint8(data) {
+    return typeof data === "string" ? new TextEncoder().encode(data) : new Uint8Array(data);
+}
+function toArrayBuffer(bytes) {
+    const out = new Uint8Array(bytes.byteLength);
+    out.set(bytes);
+    return out.buffer;
+}
+export function generateKeyPair() {
+    ensurePrng();
+    const { publicKey, secretKey } = nacl.box.keyPair();
+    return { publicKey, secretKey };
+}
+export function exportPublicKey(publicKey) {
+    if (!(publicKey instanceof Uint8Array) || publicKey.byteLength !== nacl.box.publicKeyLength) {
+        throw new Error(`Invalid public key length (expected ${nacl.box.publicKeyLength})`);
+    }
+    return encodeBase64(publicKey);
+}
+export function importPublicKey(base64) {
+    const bytes = decodeBase64(base64);
+    if (bytes.byteLength !== nacl.box.publicKeyLength) {
+        throw new Error(`Invalid public key length (expected ${nacl.box.publicKeyLength})`);
+    }
+    return bytes;
+}
+export function exportSecretKey(secretKey) {
+    if (!(secretKey instanceof Uint8Array) || secretKey.byteLength !== nacl.box.secretKeyLength) {
+        throw new Error(`Invalid secret key length (expected ${nacl.box.secretKeyLength})`);
+    }
+    return encodeBase64(secretKey);
+}
+export function importSecretKey(base64) {
+    const bytes = decodeBase64(base64);
+    if (bytes.byteLength !== nacl.box.secretKeyLength) {
+        throw new Error(`Invalid secret key length (expected ${nacl.box.secretKeyLength})`);
+    }
+    return bytes;
+}
+export function deriveSharedKey(ourSecretKey, peerPublicKey) {
+    if (ourSecretKey.byteLength !== nacl.box.secretKeyLength) {
+        throw new Error(`Invalid secret key length (expected ${nacl.box.secretKeyLength})`);
+    }
+    if (peerPublicKey.byteLength !== nacl.box.publicKeyLength) {
+        throw new Error(`Invalid peer public key length (expected ${nacl.box.publicKeyLength})`);
+    }
+    return nacl.box.before(peerPublicKey, ourSecretKey);
+}
+/**
+ * Encrypts data and returns the binary bundle:
+ *   [nonce (24)] [ciphertext...]
+ */
+export function encrypt(sharedKey, data) {
+    ensurePrng();
+    const nonce = nacl.randomBytes(NONCE_LENGTH);
+    const plaintext = toUint8(data);
+    const ciphertext = nacl.box.after(plaintext, nonce, sharedKey);
+    const out = new Uint8Array(nonce.byteLength + ciphertext.byteLength);
+    out.set(nonce, 0);
+    out.set(ciphertext, nonce.byteLength);
+    return toArrayBuffer(out);
+}
+export function decrypt(sharedKey, data) {
+    const bytes = new Uint8Array(data);
+    if (bytes.byteLength < NONCE_LENGTH) {
+        throw new Error("Ciphertext bundle too short");
+    }
+    const nonce = bytes.slice(0, NONCE_LENGTH);
+    const ciphertext = bytes.slice(NONCE_LENGTH);
+    const opened = nacl.box.open.after(ciphertext, nonce, sharedKey);
+    if (!opened) {
+        throw new Error("Decryption failed");
+    }
+    const plaintext = toArrayBuffer(opened);
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(plaintext);
+    }
+    catch {
+        return plaintext;
+    }
+}
+//# sourceMappingURL=crypto.js.map

package/node_modules/@bytetrue/byspace-relay/dist/cutover-proxy.d.ts

@@ -0,0 +1,6 @@
+interface CutoverProxy {
+    fetch(request: Request): Promise<Response>;
+}
+export declare function createCutoverProxy(origin: string): CutoverProxy;
+export {};
+//# sourceMappingURL=cutover-proxy.d.ts.map

package/node_modules/@bytetrue/byspace-relay/dist/cutover-proxy.js

@@ -0,0 +1,12 @@
+export function createCutoverProxy(origin) {
+    const originUrl = new URL(origin);
+    return {
+        async fetch(request) {
+            const upstreamUrl = new URL(request.url);
+            upstreamUrl.protocol = originUrl.protocol;
+            upstreamUrl.host = originUrl.host;
+            return fetch(new Request(upstreamUrl, request));
+        },
+    };
+}
+//# sourceMappingURL=cutover-proxy.js.map

package/node_modules/@bytetrue/byspace-relay/dist/e2ee.d.ts

@@ -0,0 +1,5 @@
+export { createClientChannel, createDaemonChannel, EncryptedChannel } from "./encrypted-channel.js";
+export type { Transport, EncryptedChannelEvents } from "./encrypted-channel.js";
+export { generateKeyPair, exportPublicKey, importPublicKey, exportSecretKey, importSecretKey, } from "./crypto.js";
+export type { KeyPair, SharedKey } from "./crypto.js";
+//# sourceMappingURL=e2ee.d.ts.map

package/node_modules/@bytetrue/byspace-relay/dist/e2ee.js

@@ -0,0 +1,3 @@
+export { createClientChannel, createDaemonChannel, EncryptedChannel } from "./encrypted-channel.js";
+export { generateKeyPair, exportPublicKey, importPublicKey, exportSecretKey, importSecretKey, } from "./crypto.js";
+//# sourceMappingURL=e2ee.js.map

package/node_modules/@bytetrue/byspace-relay/dist/encrypted-channel.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Encrypted channel that wraps a WebSocket-like transport.
+ *
+ * Handles ECDH handshake and encrypts/decrypts all messages.
+ * Works identically for daemon and client sides.
+ */
+import { type KeyPair, type SharedKey } from "./crypto.js";
+export interface Transport {
+    send(data: string | ArrayBuffer): void;
+    close(code?: number, reason?: string): void;
+    onmessage: ((data: string | ArrayBuffer) => void) | null;
+    onclose: ((code: number, reason: string) => void) | null;
+    onerror: ((error: Error) => void) | null;
+}
+export interface EncryptedChannelEvents {
+    onopen?: () => void;
+    onmessage?: (data: string | ArrayBuffer) => void;
+    onclose?: (code: number, reason: string) => void;
+    onerror?: (error: Error) => void;
+}
+type ChannelState = "connecting" | "handshaking" | "open" | "closed";
+interface EncryptedChannelOptions {
+    /**
+     * If set, the channel can validate repeated plaintext `{type:"e2ee_hello"}`
+     * messages even after it is open.
+     *
+     * This is useful for robustness when the client retries the handshake
+     * (e.g., it didn't observe the daemon's `{type:"e2ee_ready"}` yet). In that case,
+     * the daemon should re-send `{type:"e2ee_ready"}` without changing keys.
+     */
+    daemonKeyPair?: KeyPair;
+}
+/**
+ * Creates an encrypted channel as the initiator (client).
+ *
+ * The client:
+ * 1. Receives daemon's public key via QR code
+ * 2. Generates own keypair
+ * 3. Sends e2ee_hello with own public key
+ * 4. Derives shared key and starts encrypted communication
+ */
+export declare function createClientChannel(transport: Transport, daemonPublicKeyB64: string, events?: EncryptedChannelEvents): Promise<EncryptedChannel>;
+/**
+ * Creates an encrypted channel as the responder (daemon).
+ *
+ * The daemon:
+ * 1. Has pre-generated keypair (public key was in QR)
+ * 2. Waits for client's e2ee_hello with their public key
+ * 3. Derives shared key and starts encrypted communication
+ */
+export declare function createDaemonChannel(transport: Transport, daemonKeyPair: KeyPair, events?: EncryptedChannelEvents): Promise<EncryptedChannel>;
+/**
+ * Encrypted channel that wraps a transport with E2EE.
+ */
+export declare class EncryptedChannel {
+    private transport;
+    private sharedKey;
+    private state;
+    private events;
+    private options;
+    private pendingSends;
+    private onOpenCallbacks;
+    private onCloseCallbacks;
+    constructor(transport: Transport, sharedKey: SharedKey, events?: EncryptedChannelEvents, options?: EncryptedChannelOptions);
+    setState(state: ChannelState): void;
+    private handleMessage;
+    send(data: string | ArrayBuffer): Promise<void>;
+    private flushPendingSends;
+    private handleDaemonRehello;
+    close(code?: number, reason?: string): void;
+    isOpen(): boolean;
+    onTransitionToOpen(cb: () => void): void;
+    onClose(cb: () => void): void;
+}
+export {};
+//# sourceMappingURL=encrypted-channel.d.ts.map

package/node_modules/@bytetrue/byspace-relay/dist/encrypted-channel.js

@@ -0,0 +1,350 @@
+/// <reference lib="dom" />
+/**
+ * Encrypted channel that wraps a WebSocket-like transport.
+ *
+ * Handles ECDH handshake and encrypts/decrypts all messages.
+ * Works identically for daemon and client sides.
+ */
+import { generateKeyPair, exportPublicKey, importPublicKey, deriveSharedKey, encrypt, decrypt, } from "./crypto.js";
+import { arrayBufferToBase64, base64ToArrayBuffer } from "./base64.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isE2EEHelloMessage(value) {
+    return (isRecord(value) &&
+        value.type === "e2ee_hello" &&
+        typeof value.key === "string" &&
+        value.key.trim().length > 0);
+}
+function isE2EEReadyMessage(value) {
+    return isRecord(value) && value.type === "e2ee_ready";
+}
+function buildInvalidHelloError(rawText, parsed) {
+    const parsedRecord = isRecord(parsed) ? parsed : null;
+    const rawType = parsedRecord?.type;
+    function describeType(value) {
+        if (typeof value === "string")
+            return value;
+        if (value === undefined)
+            return "undefined";
+        return typeof value;
+    }
+    const receivedType = describeType(rawType);
+    const hasKey = typeof parsedRecord?.key === "string" && parsedRecord.key.trim().length > 0;
+    const compact = rawText.replace(/\s+/g, " ").trim();
+    const preview = compact.length > 160 ? `${compact.slice(0, 157)}...` : compact;
+    return new Error(`Invalid hello message (receivedType=${receivedType}, hasKey=${hasKey}, preview=${JSON.stringify(preview)})`);
+}
+const HANDSHAKE_RETRY_MS = 1000;
+const MAX_PENDING_SENDS = 200;
+const REHANDSHAKE_KEY_MISMATCH_CLOSE_CODE = 1008;
+const REHANDSHAKE_KEY_MISMATCH_CLOSE_REASON = "E2EE re-handshake key mismatch";
+function hasUnref(timeout) {
+    return (typeof timeout === "object" &&
+        timeout !== null &&
+        "unref" in timeout &&
+        typeof timeout.unref === "function");
+}
+/**
+ * Creates an encrypted channel as the initiator (client).
+ *
+ * The client:
+ * 1. Receives daemon's public key via QR code
+ * 2. Generates own keypair
+ * 3. Sends e2ee_hello with own public key
+ * 4. Derives shared key and starts encrypted communication
+ */
+export async function createClientChannel(transport, daemonPublicKeyB64, events = {}) {
+    const keyPair = generateKeyPair();
+    const daemonPublicKey = importPublicKey(daemonPublicKeyB64);
+    const sharedKey = deriveSharedKey(keyPair.secretKey, daemonPublicKey);
+    const channel = new EncryptedChannel(transport, sharedKey, events);
+    // Send e2ee_hello with our public key
+    const ourPublicKeyB64 = exportPublicKey(keyPair.publicKey);
+    const hello = { type: "e2ee_hello", key: ourPublicKeyB64 };
+    const helloText = JSON.stringify(hello);
+    let retry = null;
+    const emitSendError = (error) => {
+        const err = error instanceof Error ? error : new Error(String(error));
+        events.onerror?.(err);
+    };
+    const sendHello = () => {
+        try {
+            transport.send(helloText);
+            return true;
+        }
+        catch (error) {
+            // This can happen during daemon restarts while the socket transitions
+            // through CLOSING/CLOSED states. Report it but do not throw from timers.
+            emitSendError(error);
+            return false;
+        }
+    };
+    const clearRetry = () => {
+        if (retry) {
+            clearInterval(retry);
+            retry = null;
+        }
+    };
+    channel.onTransitionToOpen(() => clearRetry());
+    channel.onClose(() => clearRetry());
+    sendHello();
+    retry = setInterval(() => {
+        if (channel.isOpen()) {
+            clearRetry();
+            return;
+        }
+        sendHello();
+    }, HANDSHAKE_RETRY_MS);
+    // Avoid keeping Node processes alive (e.g. tests) if the handshake is stuck.
+    if (hasUnref(retry)) {
+        retry.unref();
+    }
+    return channel;
+}
+/**
+ * Creates an encrypted channel as the responder (daemon).
+ *
+ * The daemon:
+ * 1. Has pre-generated keypair (public key was in QR)
+ * 2. Waits for client's e2ee_hello with their public key
+ * 3. Derives shared key and starts encrypted communication
+ */
+export async function createDaemonChannel(transport, daemonKeyPair, events = {}) {
+    return new Promise((resolve, reject) => {
+        const bufferedMessages = [];
+        const shouldIgnorePostHelloPlaintext = (data) => {
+            try {
+                const text = typeof data === "string" ? data : new TextDecoder().decode(data);
+                const parsed = JSON.parse(text);
+                return isE2EEHelloMessage(parsed) || isE2EEReadyMessage(parsed);
+            }
+            catch {
+                return false;
+            }
+        };
+        const handleHello = async (data) => {
+            try {
+                const helloText = typeof data === "string" ? data : new TextDecoder().decode(data);
+                let parsed;
+                try {
+                    parsed = JSON.parse(helloText);
+                }
+                catch {
+                    throw buildInvalidHelloError(helloText);
+                }
+                if (!isE2EEHelloMessage(parsed)) {
+                    throw buildInvalidHelloError(helloText, parsed);
+                }
+                const msg = parsed;
+                // Buffer any subsequent messages that arrive while we're doing async
+                // WebCrypto work to derive the shared key. Without this, it's possible
+                // for the next message (already encrypted) to be misinterpreted as a
+                // second hello, causing the handshake to fail.
+                const bufferNext = (next) => {
+                    bufferedMessages.push(next);
+                };
+                Object.assign(transport, { onmessage: bufferNext });
+                const clientPublicKey = importPublicKey(msg.key);
+                const sharedKey = deriveSharedKey(daemonKeyPair.secretKey, clientPublicKey);
+                const channel = new EncryptedChannel(transport, sharedKey, events, { daemonKeyPair });
+                transport.send(JSON.stringify({ type: "e2ee_ready" }));
+                channel.setState("open");
+                events.onopen?.();
+                for (const buffered of bufferedMessages) {
+                    if (shouldIgnorePostHelloPlaintext(buffered))
+                        continue;
+                    transport.onmessage?.(buffered);
+                }
+                resolve(channel);
+            }
+            catch (error) {
+                reject(error);
+            }
+        };
+        Object.assign(transport, {
+            onmessage: handleHello,
+            onerror: (error) => {
+                reject(error);
+            },
+            onclose: (code, reason) => {
+                reject(new Error(`Connection closed during handshake: ${code} ${reason}`));
+            },
+        });
+    });
+}
+/**
+ * Encrypted channel that wraps a transport with E2EE.
+ */
+export class EncryptedChannel {
+    constructor(transport, sharedKey, events = {}, options = {}) {
+        this.state = "handshaking";
+        this.pendingSends = [];
+        this.onOpenCallbacks = [];
+        this.onCloseCallbacks = [];
+        this.transport = transport;
+        this.sharedKey = sharedKey;
+        this.events = events;
+        this.options = options;
+        Object.assign(transport, {
+            onmessage: (data) => this.handleMessage(data),
+            onclose: (code, reason) => {
+                this.state = "closed";
+                this.events.onclose?.(code, reason);
+                for (const cb of this.onCloseCallbacks)
+                    cb();
+            },
+            onerror: (error) => {
+                this.events.onerror?.(error);
+            },
+        });
+    }
+    setState(state) {
+        this.state = state;
+    }
+    async handleMessage(data) {
+        if (this.state === "handshaking") {
+            try {
+                const text = typeof data === "string" ? data : new TextDecoder().decode(data);
+                const parsed = JSON.parse(text);
+                if (isE2EEReadyMessage(parsed)) {
+                    this.state = "open";
+                    this.events.onopen?.();
+                    for (const cb of this.onOpenCallbacks)
+                        cb();
+                    await this.flushPendingSends();
+                }
+            }
+            catch {
+                // ignore non-ready handshake traffic
+            }
+            return;
+        }
+        if (this.state !== "open")
+            return;
+        try {
+            const ciphertext = await (async () => {
+                // Handle (or ignore) any stray plaintext handshake traffic.
+                try {
+                    const text = typeof data === "string" ? data : new TextDecoder().decode(data);
+                    if (text.trim().startsWith("{")) {
+                        const parsed = JSON.parse(text);
+                        if (isE2EEHelloMessage(parsed)) {
+                            if (this.options.daemonKeyPair) {
+                                await this.handleDaemonRehello(parsed.key);
+                            }
+                            return null;
+                        }
+                        if (isE2EEReadyMessage(parsed)) {
+                            return null;
+                        }
+                        // Any other JSON-looking payload is plaintext app traffic, which
+                        // means the peer is not encrypting (or we are out of sync).
+                        throw new Error("Received plaintext frame on encrypted channel");
+                    }
+                }
+                catch (error) {
+                    // If we detected plaintext protocol mismatch, fail hard.
+                    if (error instanceof Error && error.message.includes("plaintext frame")) {
+                        throw error;
+                    }
+                    // Otherwise ignore JSON parse/TextDecoder failures and fall back to
+                    // decoding ciphertext below.
+                }
+                if (typeof data === "string") {
+                    return base64ToArrayBuffer(data);
+                }
+                // Some WebSocket implementations deliver text frames as ArrayBuffer.
+                // Our protocol always transmits ciphertext as base64 text.
+                try {
+                    const decoded = new TextDecoder().decode(data);
+                    return base64ToArrayBuffer(decoded);
+                }
+                catch {
+                    return data;
+                }
+            })();
+            if (ciphertext) {
+                const plaintext = decrypt(this.sharedKey, ciphertext);
+                this.events.onmessage?.(plaintext);
+            }
+        }
+        catch (error) {
+            const err = error instanceof Error ? error : new Error(String(error));
+            // Treat decryption/protocol errors as fatal so the peer can reconnect and
+            // re-handshake. Emitting an error event here can cause higher-level code
+            // to tear down the session without triggering a clean reconnect.
+            try {
+                this.transport.close(1011, err.message);
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+    async send(data) {
+        if (this.state === "handshaking") {
+            if (this.pendingSends.length >= MAX_PENDING_SENDS) {
+                this.pendingSends.shift();
+            }
+            this.pendingSends.push(data);
+            return;
+        }
+        if (this.state !== "open") {
+            throw new Error("Channel not open");
+        }
+        const ciphertext = encrypt(this.sharedKey, data);
+        // Send as base64 for WebSocket text compatibility
+        this.transport.send(arrayBufferToBase64(ciphertext));
+    }
+    async flushPendingSends() {
+        if (this.state !== "open")
+            return;
+        const pending = this.pendingSends;
+        this.pendingSends = [];
+        for (const item of pending) {
+            await this.send(item);
+        }
+    }
+    async handleDaemonRehello(clientKeyB64) {
+        if (!this.options.daemonKeyPair)
+            return;
+        const clientPublicKey = importPublicKey(clientKeyB64);
+        const nextSharedKey = deriveSharedKey(this.options.daemonKeyPair.secretKey, clientPublicKey);
+        // If it's the same client key (handshake retry), re-send
+        // "ready" but do not re-key. Re-keying here would desync
+        // the channel and cause decrypt failures.
+        if (keysEqual(nextSharedKey, this.sharedKey)) {
+            this.transport.send(JSON.stringify({ type: "e2ee_ready" }));
+            return;
+        }
+        // A different key on an already-open encrypted channel is not an
+        // authenticated reconnect. Close and require a fresh transport instead of
+        // allowing the relay to switch this channel to an attacker-chosen key.
+        this.state = "closed";
+        this.transport.close(REHANDSHAKE_KEY_MISMATCH_CLOSE_CODE, REHANDSHAKE_KEY_MISMATCH_CLOSE_REASON);
+    }
+    close(code = 1000, reason = "Normal closure") {
+        this.state = "closed";
+        this.transport.close(code, reason);
+    }
+    isOpen() {
+        return this.state === "open";
+    }
+    onTransitionToOpen(cb) {
+        this.onOpenCallbacks.push(cb);
+    }
+    onClose(cb) {
+        this.onCloseCallbacks.push(cb);
+    }
+}
+function keysEqual(a, b) {
+    if (a.byteLength !== b.byteLength)
+        return false;
+    let difference = 0;
+    for (let i = 0; i < a.byteLength; i += 1) {
+        difference |= a[i] ^ b[i];
+    }
+    return difference === 0;
+}
+//# sourceMappingURL=encrypted-channel.js.map

package/node_modules/@bytetrue/byspace-relay/dist/index.d.ts

@@ -0,0 +1,5 @@
+export type { ConnectionRole, RelaySessionAttachment } from "./types.js";
+export { generateKeyPair, exportPublicKey, importPublicKey, deriveSharedKey, encrypt, decrypt, } from "./crypto.js";
+export { createClientChannel, createDaemonChannel, EncryptedChannel } from "./encrypted-channel.js";
+export type { Transport, EncryptedChannelEvents } from "./encrypted-channel.js";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@bytetrue/byspace-relay/dist/index.js

@@ -0,0 +1,3 @@
+export { generateKeyPair, exportPublicKey, importPublicKey, deriveSharedKey, encrypt, decrypt, } from "./crypto.js";
+export { createClientChannel, createDaemonChannel, EncryptedChannel } from "./encrypted-channel.js";
+//# sourceMappingURL=index.js.map

package/node_modules/@bytetrue/byspace-relay/dist/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Relay connection types and interfaces.
+ *
+ * The relay bridges two WebSocket connections:
+ * - Server (daemon): The BySpace server connecting to the relay
+ * - Client (app): The mobile/web app connecting to the relay
+ *
+ * Messages are forwarded bidirectionally without modification.
+ */
+export type ConnectionRole = "server" | "client";
+export interface RelaySessionAttachment {
+    serverId: string;
+    role: ConnectionRole;
+    /**
+     * Relay protocol version carried by this socket.
+     * v1: single server/client socket pair
+     * v2: control + per-client data sockets
+     */
+    version?: "1" | "2";
+    /**
+     * Unique id for the connection. Allows the daemon to create an
+     * independent socket + E2EE channel per connected connection.
+     */
+    connectionId?: string | null;
+    createdAt: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/node_modules/@bytetrue/byspace-relay/dist/types.js

@@ -0,0 +1,11 @@
+/**
+ * Relay connection types and interfaces.
+ *
+ * The relay bridges two WebSocket connections:
+ * - Server (daemon): The BySpace server connecting to the relay
+ * - Client (app): The mobile/web app connecting to the relay
+ *
+ * Messages are forwarded bidirectionally without modification.
+ */
+export {};
+//# sourceMappingURL=types.js.map