@camerontaylor/paseo-relay 0.12.0-fork.1 → 0.13.0-fork.1

package/dist/e2ee.d.ts

@@ -1,3 +1,5 @@
+export { openClientSecureChannel, openDaemonSecureChannel, PROTECTED_HANDSHAKE_FAILED_CLOSE_CODE, PROTECTED_MODE_REQUIRED_CLOSE_CODE, PROTECTED_MODE_REQUIRED_CLOSE_REASON, PROTECTED_RECORD_FAILED_CLOSE_CODE, SecureChannelRejectedError, } from "./secure-channel.js";
+export type { ClientSecureChannelOptions, DaemonSecureChannelOptions, SecureChannel, SecureChannelEvents, SecurityMode, } from "./secure-channel.js";
 export { createClientChannel, createDaemonChannel, EncryptedChannel } from "./encrypted-channel.js";
 export type { Transport, TransportMessage, EncryptedChannelEvents } from "./encrypted-channel.js";
 export { generateKeyPair, exportPublicKey, importPublicKey, exportSecretKey, importSecretKey, } from "./crypto.js";

package/dist/e2ee.js

@@ -1,3 +1,4 @@
+export { openClientSecureChannel, openDaemonSecureChannel, PROTECTED_HANDSHAKE_FAILED_CLOSE_CODE, PROTECTED_MODE_REQUIRED_CLOSE_CODE, PROTECTED_MODE_REQUIRED_CLOSE_REASON, PROTECTED_RECORD_FAILED_CLOSE_CODE, SecureChannelRejectedError, } from "./secure-channel.js";
 export { createClientChannel, createDaemonChannel, EncryptedChannel } from "./encrypted-channel.js";
 export { generateKeyPair, exportPublicKey, importPublicKey, exportSecretKey, importSecretKey, } from "./crypto.js";
 //# sourceMappingURL=e2ee.js.map

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export type { ConnectionRole, RelaySessionAttachment } from "./types.js";
 export { generateKeyPair, exportPublicKey, importPublicKey, deriveSharedKey, encrypt, decrypt, } from "./crypto.js";
 export { base64EncryptedWireByteLength, createClientChannel, createDaemonChannel, EncryptedChannel, maxBase64EncryptedPlaintextByteLength, } from "./encrypted-channel.js";
+export { maxSecuredPlaintextByteLength } from "./secure-channel.js";
 export type { Transport, EncryptedChannelEvents } from "./encrypted-channel.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,3 +1,4 @@
 export { generateKeyPair, exportPublicKey, importPublicKey, deriveSharedKey, encrypt, decrypt, } from "./crypto.js";
 export { base64EncryptedWireByteLength, createClientChannel, createDaemonChannel, EncryptedChannel, maxBase64EncryptedPlaintextByteLength, } from "./encrypted-channel.js";
+export { maxSecuredPlaintextByteLength } from "./secure-channel.js";
 //# sourceMappingURL=index.js.map

package/dist/noise/cipher-state.d.ts

@@ -0,0 +1,19 @@
+/** Noise spec §5.1 CipherState for ChaChaPoly. Nonce is 4 zero bytes then 64-bit little-endian n. */
+export declare const NOISE_TAG_BYTES = 16;
+export declare const NOISE_MAX_MESSAGE_BYTES = 65535;
+export declare class NoiseProtocolError extends Error {
+    constructor(message: string);
+}
+export declare class CipherState {
+    private k;
+    private n;
+    initializeKey(key: Uint8Array | null, nonce?: bigint): void;
+    hasKey(): boolean;
+    nonce(): bigint;
+    encryptWithAd(ad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+    decryptWithAd(ad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+    /** Reserves the next nonce synchronously so concurrent senders never share one. */
+    private takeNonce;
+    clear(): void;
+}
+//# sourceMappingURL=cipher-state.d.ts.map

package/dist/noise/cipher-state.js

@@ -0,0 +1,72 @@
+import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
+/** Noise spec §5.1 CipherState for ChaChaPoly. Nonce is 4 zero bytes then 64-bit little-endian n. */
+export const NOISE_TAG_BYTES = 16;
+export const NOISE_MAX_MESSAGE_BYTES = 65535;
+const MAX_NONCE = (1n << 64n) - 1n;
+export class NoiseProtocolError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "NoiseProtocolError";
+    }
+}
+export class CipherState {
+    constructor() {
+        this.k = null;
+        this.n = 0n;
+    }
+    initializeKey(key, nonce = 0n) {
+        this.k = key;
+        this.n = nonce;
+    }
+    hasKey() {
+        return this.k !== null;
+    }
+    nonce() {
+        return this.n;
+    }
+    encryptWithAd(ad, plaintext) {
+        if (this.k === null)
+            return plaintext;
+        const nonce = this.takeNonce();
+        return chacha20poly1305(this.k, nonce, ad).encrypt(plaintext);
+    }
+    decryptWithAd(ad, ciphertext) {
+        if (this.k === null)
+            return ciphertext;
+        if (this.n === MAX_NONCE)
+            throw new NoiseProtocolError("nonce exhausted");
+        let plaintext;
+        try {
+            plaintext = chacha20poly1305(this.k, encodeNonce(this.n), ad).decrypt(ciphertext);
+        }
+        catch {
+            throw new NoiseProtocolError("authentication failed");
+        }
+        // Only a successful authentication advances the receive counter.
+        this.n += 1n;
+        return plaintext;
+    }
+    /** Reserves the next nonce synchronously so concurrent senders never share one. */
+    takeNonce() {
+        if (this.n === MAX_NONCE)
+            throw new NoiseProtocolError("nonce exhausted");
+        const nonce = encodeNonce(this.n);
+        this.n += 1n;
+        return nonce;
+    }
+    clear() {
+        this.k?.fill(0);
+        this.k = null;
+        this.n = MAX_NONCE;
+    }
+}
+function encodeNonce(n) {
+    const nonce = new Uint8Array(12);
+    let value = n;
+    for (let i = 4; i < 12; i += 1) {
+        nonce[i] = Number(value & 0xffn);
+        value >>= 8n;
+    }
+    return nonce;
+}
+//# sourceMappingURL=cipher-state.js.map

package/dist/noise/index.d.ts

@@ -0,0 +1,45 @@
+import { CipherState } from "./cipher-state.js";
+export { CipherState, NoiseProtocolError, NOISE_MAX_MESSAGE_BYTES, NOISE_TAG_BYTES, } from "./cipher-state.js";
+export declare const NOISE_NK_PROTOCOL_NAME = "Noise_NK_25519_ChaChaPoly_SHA256";
+export declare const DH_BYTES = 32;
+export interface NoiseKeyPair {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}
+export interface NoiseInitiatorOptions {
+    /** Responder's static public key, trusted out of band. */
+    remoteStatic: Uint8Array;
+    prologue: Uint8Array;
+    /** Test injection only; production generates a fresh ephemeral. */
+    ephemeral?: NoiseKeyPair;
+}
+export interface NoiseResponderOptions {
+    localStatic: NoiseKeyPair;
+    prologue: Uint8Array;
+    /** Test injection only; production generates a fresh ephemeral. */
+    ephemeral?: NoiseKeyPair;
+}
+export interface TransportKeys {
+    /** Initiator → responder. */
+    send: CipherState;
+    /** Responder → initiator. */
+    receive: CipherState;
+}
+export interface NoiseHandshake {
+    /** Builds the next handshake message this side is due to write. */
+    writeMessage(payload: Uint8Array): Uint8Array;
+    /** Consumes the next handshake message this side is due to read; returns its payload. */
+    readMessage(message: Uint8Array): Uint8Array;
+    /** True once both handshake messages have been processed. */
+    isComplete(): boolean;
+    handshakeHash(): Uint8Array;
+    /** Derives transport keys, oriented for this side. Ends the handshake state. */
+    split(): {
+        send: CipherState;
+        receive: CipherState;
+    };
+}
+export declare function generateNoiseKeyPair(): NoiseKeyPair;
+export declare function createNoiseInitiator(options: NoiseInitiatorOptions): NoiseHandshake;
+export declare function createNoiseResponder(options: NoiseResponderOptions): NoiseHandshake;
+//# sourceMappingURL=index.d.ts.map

package/dist/noise/index.js

@@ -0,0 +1,179 @@
+/**
+ * Conforming Noise_NK_25519_ChaChaPoly_SHA256 (Noise Protocol Framework rev 34).
+ *
+ * The pattern is executed token by token from its definition, so the vector
+ * tests exercise the same code path as production. Only NK is provided; the
+ * daemon's static X25519 key is the responder's `s`, known to the initiator
+ * from pairing.
+ *
+ *   NK:
+ *     <- s
+ *     ...
+ *     -> e, es
+ *     <- e, ee
+ */
+import { x25519 } from "@noble/curves/ed25519.js";
+import { NoiseProtocolError, NOISE_MAX_MESSAGE_BYTES } from "./cipher-state.js";
+import { SymmetricState, concat } from "./symmetric-state.js";
+export { CipherState, NoiseProtocolError, NOISE_MAX_MESSAGE_BYTES, NOISE_TAG_BYTES, } from "./cipher-state.js";
+export const NOISE_NK_PROTOCOL_NAME = "Noise_NK_25519_ChaChaPoly_SHA256";
+export const DH_BYTES = 32;
+const NK_MESSAGES = [
+    ["e", "es"],
+    ["e", "ee"],
+];
+export function generateNoiseKeyPair() {
+    const secretKey = x25519.utils.randomSecretKey();
+    return { secretKey, publicKey: x25519.getPublicKey(secretKey) };
+}
+export function createNoiseInitiator(options) {
+    requireKeyLength(options.remoteStatic, "remote static key");
+    return new HandshakeState({
+        initiator: true,
+        prologue: options.prologue,
+        s: null,
+        rs: options.remoteStatic,
+        ephemeral: options.ephemeral ?? null,
+    });
+}
+export function createNoiseResponder(options) {
+    requireKeyLength(options.localStatic.publicKey, "local static public key");
+    requireKeyLength(options.localStatic.secretKey, "local static secret key");
+    return new HandshakeState({
+        initiator: false,
+        prologue: options.prologue,
+        s: options.localStatic,
+        rs: null,
+        ephemeral: options.ephemeral ?? null,
+    });
+}
+class HandshakeState {
+    constructor(params) {
+        this.symmetric = new SymmetricState(NOISE_NK_PROTOCOL_NAME);
+        this.re = null;
+        this.messageIndex = 0;
+        this.finished = false;
+        this.initiator = params.initiator;
+        this.s = params.s;
+        this.rs = params.rs;
+        this.e = params.ephemeral;
+        this.symmetric.mixHash(params.prologue);
+        // Pre-message "<- s": the responder's static public key.
+        const preMessageStatic = this.initiator ? this.rs : this.s?.publicKey;
+        if (!preMessageStatic)
+            throw new NoiseProtocolError("missing responder static key");
+        this.symmetric.mixHash(preMessageStatic);
+    }
+    writeMessage(payload) {
+        const tokens = this.nextTokens(this.initiator);
+        const parts = [];
+        for (const token of tokens) {
+            switch (token) {
+                case "e": {
+                    if (!this.e)
+                        this.e = generateNoiseKeyPair();
+                    parts.push(this.e.publicKey);
+                    this.symmetric.mixHash(this.e.publicKey);
+                    break;
+                }
+                case "es":
+                    this.mixDh(this.initiator ? this.e : this.s, this.initiator ? this.rs : this.re);
+                    break;
+                case "ee":
+                    this.mixDh(this.e, this.re);
+                    break;
+            }
+        }
+        parts.push(this.symmetric.encryptAndHash(payload));
+        const message = concat(...parts);
+        if (message.byteLength > NOISE_MAX_MESSAGE_BYTES) {
+            throw new NoiseProtocolError("handshake message too large");
+        }
+        this.advance();
+        return message;
+    }
+    readMessage(message) {
+        if (message.byteLength > NOISE_MAX_MESSAGE_BYTES) {
+            throw new NoiseProtocolError("handshake message too large");
+        }
+        const tokens = this.nextTokens(!this.initiator);
+        let offset = 0;
+        for (const token of tokens) {
+            switch (token) {
+                case "e": {
+                    if (message.byteLength < offset + DH_BYTES) {
+                        throw new NoiseProtocolError("handshake message truncated");
+                    }
+                    this.re = message.slice(offset, offset + DH_BYTES);
+                    offset += DH_BYTES;
+                    this.symmetric.mixHash(this.re);
+                    break;
+                }
+                case "es":
+                    this.mixDh(this.initiator ? this.e : this.s, this.initiator ? this.rs : this.re);
+                    break;
+                case "ee":
+                    this.mixDh(this.e, this.re);
+                    break;
+            }
+        }
+        const payload = this.symmetric.decryptAndHash(message.slice(offset));
+        this.advance();
+        return payload;
+    }
+    isComplete() {
+        return this.messageIndex >= NK_MESSAGES.length;
+    }
+    handshakeHash() {
+        return this.symmetric.handshakeHash();
+    }
+    split() {
+        if (!this.isComplete())
+            throw new NoiseProtocolError("handshake incomplete");
+        if (this.finished)
+            throw new NoiseProtocolError("handshake already split");
+        this.finished = true;
+        const [c1, c2] = this.symmetric.split();
+        this.e?.secretKey.fill(0);
+        this.e = null;
+        return this.initiator ? { send: c1, receive: c2 } : { send: c2, receive: c1 };
+    }
+    nextTokens(expectedWriterIsInitiator) {
+        if (this.isComplete() || this.finished)
+            throw new NoiseProtocolError("handshake complete");
+        const writerIsInitiator = this.messageIndex % 2 === 0;
+        if (writerIsInitiator !== expectedWriterIsInitiator) {
+            throw new NoiseProtocolError("handshake message out of turn");
+        }
+        return NK_MESSAGES[this.messageIndex];
+    }
+    advance() {
+        this.messageIndex += 1;
+    }
+    mixDh(local, remote) {
+        if (!local || !remote)
+            throw new NoiseProtocolError("missing DH key");
+        let shared;
+        try {
+            shared = x25519.getSharedSecret(local.secretKey, remote);
+        }
+        catch {
+            throw new NoiseProtocolError("invalid DH public key");
+        }
+        if (isAllZero(shared))
+            throw new NoiseProtocolError("invalid DH public key");
+        this.symmetric.mixKey(shared);
+        shared.fill(0);
+    }
+}
+function requireKeyLength(key, label) {
+    if (key.byteLength !== DH_BYTES)
+        throw new NoiseProtocolError(`${label} must be 32 bytes`);
+}
+function isAllZero(bytes) {
+    let acc = 0;
+    for (const byte of bytes)
+        acc |= byte;
+    return acc === 0;
+}
+//# sourceMappingURL=index.js.map

package/dist/noise/symmetric-state.d.ts

@@ -0,0 +1,15 @@
+import { CipherState } from "./cipher-state.js";
+export declare class SymmetricState {
+    readonly cipher: CipherState;
+    private ck;
+    private h;
+    constructor(protocolName: string);
+    mixKey(inputKeyMaterial: Uint8Array): void;
+    mixHash(data: Uint8Array): void;
+    handshakeHash(): Uint8Array;
+    encryptAndHash(plaintext: Uint8Array): Uint8Array;
+    decryptAndHash(ciphertext: Uint8Array): Uint8Array;
+    split(): [CipherState, CipherState];
+}
+export declare function concat(...parts: Uint8Array[]): Uint8Array;
+//# sourceMappingURL=symmetric-state.d.ts.map

package/dist/noise/symmetric-state.js

@@ -0,0 +1,71 @@
+import { sha256 } from "@noble/hashes/sha2.js";
+import { hmac } from "@noble/hashes/hmac.js";
+import { CipherState } from "./cipher-state.js";
+/** Noise spec §5.2 SymmetricState for SHA256 (HASHLEN 32). */
+const HASHLEN = 32;
+const EMPTY = new Uint8Array(0);
+export class SymmetricState {
+    constructor(protocolName) {
+        this.cipher = new CipherState();
+        const name = new TextEncoder().encode(protocolName);
+        if (name.byteLength <= HASHLEN) {
+            this.h = new Uint8Array(HASHLEN);
+            this.h.set(name);
+        }
+        else {
+            this.h = sha256(name);
+        }
+        this.ck = this.h.slice();
+        this.cipher.initializeKey(null);
+    }
+    mixKey(inputKeyMaterial) {
+        const [ck, tempK] = hkdf2(this.ck, inputKeyMaterial);
+        this.ck = ck;
+        this.cipher.initializeKey(tempK);
+    }
+    mixHash(data) {
+        this.h = sha256(concat(this.h, data));
+    }
+    handshakeHash() {
+        return this.h.slice();
+    }
+    encryptAndHash(plaintext) {
+        const ciphertext = this.cipher.encryptWithAd(this.h, plaintext);
+        this.mixHash(ciphertext);
+        return ciphertext;
+    }
+    decryptAndHash(ciphertext) {
+        const plaintext = this.cipher.decryptWithAd(this.h, ciphertext);
+        this.mixHash(ciphertext);
+        return plaintext;
+    }
+    split() {
+        const [k1, k2] = hkdf2(this.ck, EMPTY);
+        const c1 = new CipherState();
+        const c2 = new CipherState();
+        c1.initializeKey(k1);
+        c2.initializeKey(k2);
+        this.ck.fill(0);
+        this.cipher.clear();
+        return [c1, c2];
+    }
+}
+/** Noise spec §4.3 HKDF with two outputs: HMAC chain with 0x01 and 0x02 info bytes. */
+function hkdf2(chainingKey, inputKeyMaterial) {
+    const tempKey = hmac(sha256, chainingKey, inputKeyMaterial);
+    const output1 = hmac(sha256, tempKey, new Uint8Array([0x01]));
+    const output2 = hmac(sha256, tempKey, concat(output1, new Uint8Array([0x02])));
+    tempKey.fill(0);
+    return [output1, output2];
+}
+export function concat(...parts) {
+    const total = parts.reduce((sum, part) => sum + part.byteLength, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.byteLength;
+    }
+    return out;
+}
+//# sourceMappingURL=symmetric-state.js.map

package/dist/protected-records.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Authenticated application-frame framing over Noise transport messages.
+ *
+ * One application frame becomes one wire record. Every Noise transport message
+ * (chunk) carries, inside its authenticated plaintext, the frame kind, FIRST
+ * and FINAL flags, and the total frame length, so a relay cannot merge two
+ * records, split one across WebSocket messages, truncate a final chunk, or
+ * re-chunk a frame without an authentication failure or a framing violation.
+ * Transport AD is always empty, as in Noise §5.
+ *
+ *   chunk plaintext = kind(1) || flags(1) || totalLength(u32 BE) || data
+ *   wire record     = for each chunk: ciphertextLength(u16 BE) || ciphertext
+ */
+import { CipherState } from "./noise/index.js";
+export type FrameKind = "text" | "binary";
+/** Largest data payload a single chunk carries. */
+export declare const MAX_CHUNK_DATA_BYTES: number;
+/** Largest application frame a record may carry; bounds allocation before decryption. */
+export declare const MAX_FRAME_BYTES = 4294967295;
+export declare function chunkCount(frameBytes: number): number;
+/** Wire bytes a frame of `frameBytes` occupies once protected. */
+export declare function protectedRecordByteLength(frameBytes: number): number;
+export declare function encodeProtectedRecord(kind: FrameKind, frame: Uint8Array, sender: CipherState): Uint8Array;
+export interface DecodedFrame {
+    kind: FrameKind;
+    data: Uint8Array;
+}
+/**
+ * Decodes one wire record. Chunks are authenticated in order and the receive
+ * counter advances per authenticated chunk; any framing violation throws and
+ * nothing partial is returned. The caller must close the channel on error.
+ */
+export declare function decodeProtectedRecord(record: Uint8Array, receiver: CipherState): DecodedFrame;
+//# sourceMappingURL=protected-records.d.ts.map

package/dist/protected-records.js

@@ -0,0 +1,179 @@
+/**
+ * Authenticated application-frame framing over Noise transport messages.
+ *
+ * One application frame becomes one wire record. Every Noise transport message
+ * (chunk) carries, inside its authenticated plaintext, the frame kind, FIRST
+ * and FINAL flags, and the total frame length, so a relay cannot merge two
+ * records, split one across WebSocket messages, truncate a final chunk, or
+ * re-chunk a frame without an authentication failure or a framing violation.
+ * Transport AD is always empty, as in Noise §5.
+ *
+ *   chunk plaintext = kind(1) || flags(1) || totalLength(u32 BE) || data
+ *   wire record     = for each chunk: ciphertextLength(u16 BE) || ciphertext
+ */
+import { NoiseProtocolError, NOISE_MAX_MESSAGE_BYTES, NOISE_TAG_BYTES, } from "./noise/index.js";
+const KIND_TEXT = 0x00;
+const KIND_BINARY = 0x01;
+const FLAG_FIRST = 0x01;
+const FLAG_FINAL = 0x02;
+const HEADER_BYTES = 6;
+const LENGTH_PREFIX_BYTES = 2;
+const EMPTY_AD = new Uint8Array(0);
+/** Largest data payload a single chunk carries. */
+export const MAX_CHUNK_DATA_BYTES = NOISE_MAX_MESSAGE_BYTES - NOISE_TAG_BYTES - HEADER_BYTES;
+/** Largest application frame a record may carry; bounds allocation before decryption. */
+export const MAX_FRAME_BYTES = 4294967295;
+const CHUNK_OVERHEAD_BYTES = LENGTH_PREFIX_BYTES + HEADER_BYTES + NOISE_TAG_BYTES;
+export function chunkCount(frameBytes) {
+    return Math.max(1, Math.ceil(frameBytes / MAX_CHUNK_DATA_BYTES));
+}
+/** Wire bytes a frame of `frameBytes` occupies once protected. */
+export function protectedRecordByteLength(frameBytes) {
+    return frameBytes + chunkCount(frameBytes) * CHUNK_OVERHEAD_BYTES;
+}
+export function encodeProtectedRecord(kind, frame, sender) {
+    if (frame.byteLength > MAX_FRAME_BYTES)
+        throw new NoiseProtocolError("frame too large");
+    const chunks = chunkCount(frame.byteLength);
+    const out = new Uint8Array(protectedRecordByteLength(frame.byteLength));
+    let offset = 0;
+    for (let index = 0; index < chunks; index += 1) {
+        const start = index * MAX_CHUNK_DATA_BYTES;
+        const data = frame.subarray(start, Math.min(frame.byteLength, start + MAX_CHUNK_DATA_BYTES));
+        const plaintext = new Uint8Array(HEADER_BYTES + data.byteLength);
+        plaintext[0] = kind === "text" ? KIND_TEXT : KIND_BINARY;
+        plaintext[1] = (index === 0 ? FLAG_FIRST : 0) | (index === chunks - 1 ? FLAG_FINAL : 0);
+        writeU32(plaintext, 2, frame.byteLength);
+        plaintext.set(data, HEADER_BYTES);
+        const ciphertext = sender.encryptWithAd(EMPTY_AD, plaintext);
+        writeU16(out, offset, ciphertext.byteLength);
+        out.set(ciphertext, offset + LENGTH_PREFIX_BYTES);
+        offset += LENGTH_PREFIX_BYTES + ciphertext.byteLength;
+    }
+    return out;
+}
+/**
+ * Decodes one wire record. Chunks are authenticated in order and the receive
+ * counter advances per authenticated chunk; any framing violation throws and
+ * nothing partial is returned. The caller must close the channel on error.
+ */
+export function decodeProtectedRecord(record, receiver) {
+    let offset = 0;
+    let assembly = null;
+    while (offset < record.byteLength) {
+        if (assembly !== null && assembly.index >= assembly.expectedChunks) {
+            throw new NoiseProtocolError("unexpected chunk after final");
+        }
+        const { chunk, next } = readChunk(record, offset, receiver);
+        offset = next;
+        assembly =
+            assembly === null
+                ? startAssembly(chunk, record.byteLength)
+                : continueAssembly(assembly, chunk);
+    }
+    if (assembly === null)
+        throw new NoiseProtocolError("empty record");
+    if (assembly.index !== assembly.expectedChunks || assembly.written !== assembly.totalLength) {
+        throw new NoiseProtocolError("record incomplete");
+    }
+    return { kind: assembly.kind, data: assembly.frame };
+}
+function readChunk(record, offset, receiver) {
+    if (record.byteLength - offset < LENGTH_PREFIX_BYTES) {
+        throw new NoiseProtocolError("record truncated");
+    }
+    const ciphertextLength = readU16(record, offset);
+    const start = offset + LENGTH_PREFIX_BYTES;
+    if (ciphertextLength < NOISE_TAG_BYTES + HEADER_BYTES ||
+        ciphertextLength > NOISE_MAX_MESSAGE_BYTES) {
+        throw new NoiseProtocolError("invalid chunk length");
+    }
+    if (record.byteLength - start < ciphertextLength) {
+        throw new NoiseProtocolError("record truncated");
+    }
+    const plaintext = receiver.decryptWithAd(EMPTY_AD, record.subarray(start, start + ciphertextLength));
+    const flags = plaintext[1];
+    if ((flags & ~(FLAG_FIRST | FLAG_FINAL)) !== 0) {
+        throw new NoiseProtocolError("reserved flag set");
+    }
+    return {
+        chunk: {
+            kind: decodeKind(plaintext[0]),
+            isFirst: (flags & FLAG_FIRST) !== 0,
+            isFinal: (flags & FLAG_FINAL) !== 0,
+            totalLength: readU32(plaintext, 2),
+            data: plaintext.subarray(HEADER_BYTES),
+        },
+        next: start + ciphertextLength,
+    };
+}
+function startAssembly(chunk, recordByteLength) {
+    if (!chunk.isFirst)
+        throw new NoiseProtocolError("record does not start with FIRST");
+    // The claimed frame length fixes the record's exact wire length. Check it
+    // before allocating so a tiny authenticated header cannot demand gigabytes.
+    if (protectedRecordByteLength(chunk.totalLength) !== recordByteLength) {
+        throw new NoiseProtocolError("record length mismatch");
+    }
+    const assembly = {
+        kind: chunk.kind,
+        totalLength: chunk.totalLength,
+        expectedChunks: chunkCount(chunk.totalLength),
+        frame: new Uint8Array(chunk.totalLength),
+        written: 0,
+        index: 0,
+    };
+    return appendChunk(assembly, chunk);
+}
+function continueAssembly(assembly, chunk) {
+    if (chunk.isFirst)
+        throw new NoiseProtocolError("FIRST repeated inside record");
+    if (chunk.kind !== assembly.kind) {
+        throw new NoiseProtocolError("frame kind changed inside record");
+    }
+    if (chunk.totalLength !== assembly.totalLength) {
+        throw new NoiseProtocolError("frame length changed inside record");
+    }
+    return appendChunk(assembly, chunk);
+}
+function appendChunk(assembly, chunk) {
+    const isLastExpected = assembly.index === assembly.expectedChunks - 1;
+    if (chunk.isFinal !== isLastExpected)
+        throw new NoiseProtocolError("FINAL flag mismatch");
+    const expectedData = isLastExpected
+        ? assembly.totalLength - assembly.index * MAX_CHUNK_DATA_BYTES
+        : MAX_CHUNK_DATA_BYTES;
+    if (chunk.data.byteLength !== expectedData)
+        throw new NoiseProtocolError("chunk size mismatch");
+    assembly.frame.set(chunk.data, assembly.written);
+    assembly.written += chunk.data.byteLength;
+    assembly.index += 1;
+    return assembly;
+}
+function decodeKind(byte) {
+    if (byte === KIND_TEXT)
+        return "text";
+    if (byte === KIND_BINARY)
+        return "binary";
+    throw new NoiseProtocolError("invalid frame kind");
+}
+function writeU16(target, offset, value) {
+    target[offset] = (value >>> 8) & 0xff;
+    target[offset + 1] = value & 0xff;
+}
+function readU16(source, offset) {
+    return (source[offset] << 8) | source[offset + 1];
+}
+function writeU32(target, offset, value) {
+    target[offset] = (value >>> 24) & 0xff;
+    target[offset + 1] = (value >>> 16) & 0xff;
+    target[offset + 2] = (value >>> 8) & 0xff;
+    target[offset + 3] = value & 0xff;
+}
+function readU32(source, offset) {
+    return (((source[offset] << 24) >>> 0) +
+        (source[offset + 1] << 16) +
+        (source[offset + 2] << 8) +
+        source[offset + 3]);
+}
+//# sourceMappingURL=protected-records.js.map