@corewire/core 0.0.0 → 1.0.0-beta.1

package/dist/crypto.d.mts

@@ -0,0 +1,111 @@
+declare namespace aes_d_exports {
+  export { decrypt$1 as decrypt, encrypt$1 as encrypt };
+}
+/**
+* AES-128-CTR fallback for legacy HAP pairing. It has no authentication tag; the pairing flow relies on Ed25519 signatures in the TLV payload.
+*
+* @param key - 16-byte AES key.
+* @param iv - 16-byte initialization vector.
+*/
+declare function encrypt$1(key: Buffer, iv: Buffer, plaintext: Buffer): Buffer;
+/**
+* Decrypts data using AES-128-CTR.
+*
+* @param key - 16-byte AES key.
+* @param iv - 16-byte initialization vector.
+*/
+declare function decrypt$1(key: Buffer, iv: Buffer, ciphertext: Buffer): Buffer;
+declare namespace chacha20_d_exports {
+  export { CHACHA20_AUTH_TAG_LENGTH, CHACHA20_NONCE_LENGTH, EncryptedData, decrypt, encrypt, padNonce };
+}
+/** Length in bytes of the Poly1305 authentication tag appended to ciphertext. */
+declare const CHACHA20_AUTH_TAG_LENGTH = 16;
+/** Required nonce length in bytes for ChaCha20-Poly1305. Shorter nonces are zero-padded. */
+declare const CHACHA20_NONCE_LENGTH = 12;
+/**
+* Decrypts a ChaCha20-Poly1305 sealed message and verifies its authentication tag.
+*
+* @param key - 256-bit encryption key.
+* @param nonce - Nonce (up to 12 bytes; shorter nonces are left-padded with zeros).
+* @param aad - Additional authenticated data, or null if none.
+* @param ciphertext - The encrypted payload (without the auth tag).
+* @param authTag - The 16-byte Poly1305 authentication tag.
+* @throws DecryptionError if the authentication tag does not match.
+*/
+declare function decrypt(key: Buffer, nonce: Buffer, aad: Buffer | null, ciphertext: Buffer, authTag: Buffer): Buffer;
+/**
+* Encrypts a plaintext message using ChaCha20-Poly1305 authenticated encryption.
+*
+* @param key - 256-bit encryption key.
+* @param nonce - Nonce (up to 12 bytes; shorter nonces are left-padded with zeros).
+* @param aad - Additional authenticated data, or null if none.
+* @returns The ciphertext and its Poly1305 authentication tag.
+*/
+declare function encrypt(key: Buffer, nonce: Buffer, aad: Buffer | null, plaintext: Buffer): EncryptedData;
+/** Left-pads a nonce with zero bytes to 12 bytes. A nonce of 12 bytes or more comes back unchanged. */
+declare function padNonce(nonce: Buffer): Buffer;
+/** Output of {@link encrypt}, with the authentication tag split from the ciphertext. */
+type EncryptedData = {
+  readonly ciphertext: Buffer; /** The 16-byte Poly1305 tag. */
+  readonly authTag: Buffer;
+};
+//#endregion
+//#region src/crypto/types.d.ts
+/** An Ed25519 key pair for signing, or a Curve25519 key pair for key exchange. */
+type KeyPair = {
+  readonly publicKey: Uint8Array;
+  readonly secretKey: Uint8Array;
+};
+declare namespace curve25519_d_exports {
+  export { generateKeyPair$1 as generateKeyPair, generateSharedSecKey };
+}
+/**
+* Generates a new Curve25519 key pair for Diffie-Hellman key exchange.
+*/
+declare function generateKeyPair$1(): KeyPair;
+/**
+* Derives a Curve25519 shared secret.
+*
+* @param priKey - Local private key.
+* @param pubKey - Remote public key.
+* @returns 32-byte shared secret.
+*/
+declare function generateSharedSecKey(priKey: Uint8Array, pubKey: Uint8Array): Uint8Array;
+declare namespace ed25519_d_exports {
+  export { generateKeyPair, sign, verify };
+}
+/**
+* Generates a new Ed25519 key pair for digital signature operations.
+*/
+declare function generateKeyPair(): KeyPair;
+/** Signs a message with an Ed25519 secret key and returns the 64-byte signature. */
+declare function sign(message: Uint8Array, secretKey: Uint8Array): Uint8Array;
+/** Checks a 64-byte Ed25519 signature over a message against the signer's public key. */
+declare function verify(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): boolean;
+declare namespace hkdf_d_exports {
+  export { HKDFOptions, derive, deriveEncryptionKeys };
+}
+/** Input of an HKDF derivation. */
+type HKDFOptions = {
+  /** A Node.js digest name, such as `sha512`. */readonly hash: string; /** The input key material, such as a Diffie-Hellman shared secret. */
+  readonly key: Buffer; /** Length of the derived key in bytes. */
+  readonly length: number; /** Salt for the extract step; may be empty. */
+  readonly salt: Buffer; /** Info for the expand step. */
+  readonly info: Buffer;
+};
+/** HKDF key derivation as defined in RFC 5869. */
+declare function derive(options: HKDFOptions): Buffer;
+/**
+* Derives 32-byte read and write keys with HKDF-SHA512. Salt and info strings depend on the protocol and stream.
+*
+* @param sharedSecret - Pair-verify or pair-setup shared secret.
+* @param salt - Protocol-specific salt, such as `Control-Salt`.
+* @param readInfo - Info string for the decrypt key.
+* @param writeInfo - Info string for the encrypt key.
+*/
+declare function deriveEncryptionKeys(sharedSecret: Buffer, salt: string, readInfo: string, writeInfo: string): {
+  readKey: Buffer;
+  writeKey: Buffer;
+};
+//#endregion
+export { aes_d_exports as AES, chacha20_d_exports as ChaCha20, curve25519_d_exports as Curve25519, ed25519_d_exports as Ed25519, hkdf_d_exports as HKDF, type HKDFOptions, type KeyPair };

package/dist/crypto.mjs

@@ -0,0 +1,3 @@
+import { c as curve25519_exports, d as chacha20_exports, i as ed25519_exports, m as aes_exports, r as hkdf_exports } from "./crypto-CXSIS6si.mjs";
+
+export { aes_exports as AES, chacha20_exports as ChaCha20, curve25519_exports as Curve25519, ed25519_exports as Ed25519, hkdf_exports as HKDF };

package/dist/discovery.d.mts

@@ -0,0 +1,110 @@
+import { r as Logger } from "./reporter-Dn7n2TXN.mjs";
+
+//#region src/discovery/types.d.ts
+/** One service instance that an mDNS scan found. */
+type DiscoveryResult = {
+  /** The mDNS host name, e.g. `Woonkamer-TV.local`. */readonly id: string;
+  readonly fqdn: string;
+  readonly address: string;
+  readonly txt: Readonly<Record<string, string>>;
+  readonly service: {
+    readonly port: number;
+    readonly protocol: "tcp" | "udp";
+    readonly type: string;
+  };
+};
+type DiscoverOptions = {
+  /** Reuse a scan that is less than 30 seconds old. Default: true. */readonly useCache?: boolean;
+};
+//#endregion
+//#region src/discovery/discovery.d.ts
+/**
+* Finds the services of one mDNS service type. Each protocol package knows its own service
+* type and what its TXT record means.
+*
+* Results stay cached for 30 seconds per service type, and concurrent scans for the same types
+* share one multicast query. All instances share the cache on purpose, so protocol packages and
+* `@corewire/devices` do not each flood the network with their own query.
+*/
+declare class Discovery {
+  #private;
+  get service(): string;
+  /** @param service - The mDNS service type, such as `_hap._tcp.local`. */
+  constructor(service: string);
+  find(useCache?: boolean): Promise<DiscoveryResult[]>;
+  /**
+  * Scans again until a device with this id answers. Skips the cache on every attempt.
+  *
+  * @param timeout - Delay in milliseconds between attempts.
+  * @throws {DiscoveryError} If the device does not answer within `tries` attempts.
+  */
+  findUntil(id: string, tries?: number, timeout?: number): Promise<DiscoveryResult>;
+  /**
+  * Queries one host with unicast DNS-SD, bypassing the cache.
+  *
+  * @param timeout - Discovery duration in seconds.
+  * @param wakePorts - Ports to knock on first, to wake a sleeping device.
+  */
+  findByAddress(address: string, timeout?: number, wakePorts?: readonly number[]): Promise<DiscoveryResult | null>;
+  /** Scans for several service types with one multicast query, shared with a scan in flight for the same types. */
+  static findServices(services: readonly string[], useCache?: boolean): Promise<Map<string, DiscoveryResult[]>>;
+  static clearCache(): void;
+  /** Knocks on each port to wake a sleeping device. */
+  static wake(address: string, ports: readonly number[]): Promise<void>;
+}
+//#endregion
+//#region src/discovery/mdns.d.ts
+/** An mDNS service instance, resolved to an address and port. */
+type MdnsService = {
+  readonly name: string;
+  readonly type: string;
+  readonly address: string;
+  readonly port: number;
+  readonly properties: Record<string, string>;
+};
+/**
+* Queries hosts with unicast DNS-SD. It knocks on the `wakePorts` of each host first, then
+* sends the queries to port 5353 of each host every second. It stops when `timeout` ends or
+* every host answered for every service.
+*
+* @param hosts - IP addresses of the hosts to query.
+* @param timeout - Duration in seconds.
+*/
+declare function mdnsUnicast(hosts: string[], services: string[], timeout?: number, wakePorts?: readonly number[]): Promise<MdnsService[]>;
+/**
+* Discovers services with multicast DNS-SD on every local interface. It binds port 5353 when
+* it can, plus one socket on a random port per interface.
+*
+* @param timeout - Duration in seconds.
+*/
+declare function mdnsMulticast(services: string[], timeout?: number): Promise<MdnsService[]>;
+//#endregion
+//#region src/discovery/responder.d.ts
+/** The service that an {@link MdnsResponder} advertises. */
+type AdvertisedService = {
+  /** The DNS-SD instance name, which controllers show to the user. */readonly instance: string; /** The service type, such as `_companion-link._tcp.local`. */
+  readonly type: string; /** The host name that the SRV and A records publish, ending in `.local`. */
+  readonly host: string; /** The TCP port the service listens on. */
+  readonly port: number; /** The properties of the TXT record. An empty value publishes the bare key. */
+  readonly txt: Record<string, string>;
+};
+/**
+* Advertises one service with PTR, SRV, TXT and A records every 2 seconds, and again on each
+* query that mentions its type. It does not parse DNS questions, so it suits quiet test networks.
+* A controller can need the instance name and TXT record of a real device before it lists the service.
+*/
+declare class MdnsResponder {
+  #private;
+  /**
+  * @param address - The local IPv4 address that the A record publishes.
+  */
+  constructor(logger: Logger, service: AdvertisedService, address?: string);
+  /** Returns the first non-internal IPv4 address of this host, or `0.0.0.0` if none is found. */
+  static localAddress(): string;
+  /** Binds the multicast socket and announces the service every 2 seconds. */
+  start(): void;
+  /** Stops announcing and closes the socket. */
+  stop(): void;
+}
+//#endregion
+export { type AdvertisedService, type DiscoverOptions, Discovery, type DiscoveryResult, MdnsResponder, type MdnsService, mdnsMulticast, mdnsUnicast };