@floegence/flowersec-core 0.26.0 → 2.0.0

package/dist/transport/webTransportAdapter.js

@@ -0,0 +1,519 @@
+import { CarrierError, } from "../v2/carrier.js";
+export function adaptWebTransportCarrierSessionV2(native, options) {
+    requireWebTransportSessionSurfaceV2(native);
+    return new WebTransportCarrierSessionAdapter(native, options);
+}
+export function hasWebTransportConstructorSurfaceV2(value) {
+    if (typeof value !== "function")
+        return false;
+    const prototype = value.prototype;
+    return typeof prototype === "object" && prototype !== null &&
+        typeof prototype.createBidirectionalStream === "function" &&
+        typeof prototype.close === "function" &&
+        "incomingBidirectionalStreams" in prototype &&
+        "datagrams" in prototype &&
+        "ready" in prototype &&
+        "closed" in prototype;
+}
+function requireWebTransportSessionSurfaceV2(value) {
+    const missing = [];
+    if (typeof value.createBidirectionalStream !== "function")
+        missing.push("outgoing bidirectional streams");
+    if (typeof value.incomingBidirectionalStreams?.getReader !== "function")
+        missing.push("incoming bidirectional streams");
+    if (typeof value.datagrams?.readable?.getReader !== "function")
+        missing.push("incoming DATAGRAMs");
+    if (typeof value.datagrams?.writable?.getWriter !== "function")
+        missing.push("outgoing DATAGRAMs");
+    if (typeof value.close !== "function")
+        missing.push("close");
+    if (typeof value.closed?.then !== "function")
+        missing.push("termination");
+    if (missing.length !== 0) {
+        throw new TypeError(`WebTransport runtime lacks required ${missing.join(", ")}`);
+    }
+}
+class WebTransportCarrierSessionAdapter {
+    native;
+    kind = "webtransport";
+    path;
+    inboundBidirectionalStreamCapacity;
+    unreliableDatagrams;
+    incoming;
+    incomingQueue = new IncomingWebTransportStreamQueue();
+    streams = new Set();
+    datagramsAdapter;
+    closed = false;
+    terminalError;
+    closePromise;
+    activeIncomingStreams = 0;
+    constructor(native, options) {
+        this.native = native;
+        if (!Number.isInteger(options.inboundBidirectionalStreamCapacity) || options.inboundBidirectionalStreamCapacity < 3) {
+            throw new RangeError("WebTransport carrier stream capacity must be at least 3");
+        }
+        this.path = options.path;
+        this.inboundBidirectionalStreamCapacity = options.inboundBidirectionalStreamCapacity;
+        this.incoming = native.incomingBidirectionalStreams.getReader();
+        this.datagramsAdapter = new WebTransportDatagramAdapter(native.datagrams, options.datagramMaxSize);
+        this.unreliableDatagrams = this.datagramsAdapter;
+        void this.pumpIncoming();
+        void native.closed.then(() => { this.terminate(new CarrierError("closed", "WebTransport carrier is closed")); }, (error) => {
+            this.terminate(carrierFailure("WebTransport closed with an error", error));
+        });
+    }
+    async openStream(options = {}) {
+        this.assertOpen();
+        if (options.signal?.aborted === true)
+            throw abortedCarrierError(options.signal.reason);
+        const pending = this.native.createBidirectionalStream();
+        let stream;
+        try {
+            stream = await carrierCall(raceAbort(pending, options.signal), "WebTransport failed to open a stream");
+        }
+        catch (error) {
+            if (isAborted(options.signal)) {
+                void pending.then((late) => abortNativeStream(late, abortedCarrierError()), () => undefined);
+            }
+            throw error;
+        }
+        try {
+            this.assertOpen();
+        }
+        catch (error) {
+            abortNativeStream(stream, asError(error));
+            throw error;
+        }
+        return this.track(stream);
+    }
+    async acceptStream(options = {}) {
+        this.assertOpen();
+        return await this.incomingQueue.shift(options.signal);
+    }
+    async waitTermination() {
+        try {
+            await this.native.closed;
+        }
+        catch (error) {
+            throw carrierFailure("WebTransport terminated with an error", error);
+        }
+    }
+    close() {
+        this.closePromise ??= this.closeOnce({ closeCode: 0, reason: "" });
+        return this.closePromise;
+    }
+    abort(error = { code: 6, reason: "carrier aborted" }) {
+        if (this.closed)
+            return;
+        this.terminate(new CarrierError("aborted", "WebTransport carrier aborted"));
+        try {
+            this.native.close({ closeCode: error.code, reason: error.reason });
+        }
+        catch (cause) {
+            this.terminalError = carrierFailure("WebTransport abort failed", cause);
+        }
+    }
+    async closeOnce(info) {
+        if (this.closed)
+            return;
+        this.terminate(new CarrierError("closed", "WebTransport carrier is closed"));
+        try {
+            this.native.close(info);
+            await this.native.closed;
+        }
+        catch (error) {
+            throw carrierFailure("WebTransport close failed", error);
+        }
+    }
+    assertOpen() {
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
+        if (this.closed)
+            throw new CarrierError("closed", "WebTransport carrier is closed");
+    }
+    track(native, incoming = false) {
+        if (incoming)
+            this.activeIncomingStreams += 1;
+        let stream;
+        stream = new WebTransportCarrierStreamAdapter(native, () => {
+            this.streams.delete(stream);
+            if (incoming)
+                this.activeIncomingStreams = Math.max(0, this.activeIncomingStreams - 1);
+        });
+        this.streams.add(stream);
+        return stream;
+    }
+    async pumpIncoming() {
+        try {
+            while (!this.closed) {
+                const result = await this.incoming.read();
+                if (result.done || result.value === undefined) {
+                    this.terminate(new CarrierError("closed", "WebTransport incoming streams closed"));
+                    return;
+                }
+                if (this.activeIncomingStreams >= this.inboundBidirectionalStreamCapacity) {
+                    abortNativeStream(result.value, new CarrierError("reset", "WebTransport inbound stream capacity exceeded"));
+                    continue;
+                }
+                this.incomingQueue.push(this.track(result.value, true));
+            }
+        }
+        catch (error) {
+            if (!this.closed)
+                this.terminate(carrierFailure("WebTransport stream accept failed", error));
+        }
+    }
+    terminate(error) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        if (error.code !== "closed")
+            this.terminalError = error;
+        this.incomingQueue.fail(error);
+        for (const stream of [...this.streams])
+            stream.abort(error);
+        this.streams.clear();
+        this.datagramsAdapter.abort(error);
+    }
+}
+class WebTransportCarrierStreamAdapter {
+    onRelease;
+    reader;
+    writer;
+    readClosed = false;
+    readStopError;
+    writeClosed = false;
+    terminalError;
+    closeWritePromise;
+    stopSendingPromise;
+    resetPromise;
+    released = false;
+    constructor(stream, onRelease) {
+        this.onRelease = onRelease;
+        this.reader = stream.readable.getReader();
+        this.writer = stream.writable.getWriter();
+    }
+    async read(options = {}) {
+        this.assertReadable();
+        if (this.readClosed)
+            return null;
+        const result = await carrierCall(raceAbort(this.reader.read(), options.signal), "WebTransport stream read failed", "reset");
+        if (result.done || result.value === undefined) {
+            this.readClosed = true;
+            this.releaseIfComplete();
+            return null;
+        }
+        return result.value.slice();
+    }
+    async write(data) {
+        this.assertNotTerminal();
+        if (this.writeClosed)
+            throw new CarrierError("write_closed", "WebTransport stream write side is closed");
+        await carrierCall(this.writer.write(data.slice()), "WebTransport stream write failed", "reset");
+        return data.byteLength;
+    }
+    closeWrite() {
+        if (this.closeWritePromise !== undefined)
+            return this.closeWritePromise;
+        this.assertNotTerminal();
+        this.writeClosed = true;
+        this.closeWritePromise = carrierCall(this.writer.close(), "WebTransport stream FIN failed", "reset")
+            .then(() => { this.releaseIfComplete(); });
+        return this.closeWritePromise;
+    }
+    stopSending() {
+        if (this.stopSendingPromise !== undefined)
+            return this.stopSendingPromise;
+        this.assertNotTerminal();
+        const stopped = new CarrierError("stop_sending", "WebTransport stream receive side stopped");
+        this.readClosed = true;
+        this.readStopError = stopped;
+        this.stopSendingPromise ??= carrierCall(this.reader.cancel(stopped), "WebTransport STOP_SENDING failed", "stop_sending").then(() => { this.releaseIfComplete(); });
+        return this.stopSendingPromise;
+    }
+    reset() {
+        this.resetPromise ??= this.resetOnce();
+        return this.resetPromise;
+    }
+    abort(error = new CarrierError("aborted", "WebTransport stream aborted")) {
+        if (this.terminalError !== undefined)
+            return;
+        this.terminalError = error instanceof CarrierError
+            ? error
+            : new CarrierError("aborted", "WebTransport stream aborted", error);
+        this.readClosed = true;
+        this.writeClosed = true;
+        void this.writer.abort(this.terminalError).catch(() => undefined);
+        void this.reader.cancel(this.terminalError).catch(() => undefined);
+        this.release();
+    }
+    async resetOnce() {
+        if (this.terminalError !== undefined)
+            return;
+        this.writeClosed = true;
+        this.readClosed = true;
+        const error = new CarrierError("reset", "WebTransport stream reset");
+        this.terminalError = error;
+        try {
+            await Promise.allSettled([this.writer.abort(error), this.reader.cancel(error)]);
+        }
+        finally {
+            this.release();
+        }
+    }
+    assertReadable() {
+        this.assertNotTerminal();
+        if (this.readStopError !== undefined)
+            throw this.readStopError;
+    }
+    assertNotTerminal() {
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
+    }
+    releaseIfComplete() {
+        if (this.readClosed && this.writeClosed)
+            this.release();
+    }
+    release() {
+        if (this.released)
+            return;
+        this.released = true;
+        this.onRelease();
+    }
+}
+class WebTransportDatagramAdapter {
+    maxDatagramSize;
+    readable;
+    writable;
+    incoming = new IncomingDatagramQueue();
+    terminalError;
+    constructor(native, configuredMaxSize) {
+        const maxDatagramSize = configuredMaxSize ?? native.maxDatagramSize;
+        if (!Number.isInteger(maxDatagramSize) || maxDatagramSize < 1) {
+            throw new TypeError("WebTransport runtime did not provide a valid DATAGRAM size");
+        }
+        this.maxDatagramSize = maxDatagramSize;
+        this.readable = native.readable.getReader();
+        this.writable = native.writable.getWriter();
+        void this.pumpIncoming();
+    }
+    async send(data, options = {}) {
+        this.assertOpen();
+        if (options.signal?.aborted === true)
+            throw abortedCarrierError(options.signal.reason);
+        if (options.expiresAt !== undefined && options.expiresAt <= Date.now())
+            return "dropped_expired";
+        if (data.byteLength < 1 || data.byteLength > this.maxDatagramSize)
+            return "dropped_carrier";
+        try {
+            await raceAbort(this.writable.write(data.slice()), options.signal);
+            return "accepted";
+        }
+        catch (error) {
+            if (isAborted(options.signal))
+                throw abortedCarrierError(error);
+            if (this.terminalError !== undefined)
+                throw this.terminalError;
+            return "dropped_carrier";
+        }
+    }
+    async receive(options = {}) {
+        this.assertOpen();
+        return await this.incoming.shift(options.signal);
+    }
+    abort(error) {
+        if (this.terminalError !== undefined)
+            return;
+        this.terminalError = error;
+        this.incoming.fail(error);
+        void this.writable.abort(error).catch(() => undefined);
+    }
+    assertOpen() {
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
+    }
+    async pumpIncoming() {
+        try {
+            while (this.terminalError === undefined) {
+                const result = await this.readable.read();
+                if (result.done || result.value === undefined) {
+                    this.abort(new CarrierError("closed", "WebTransport datagrams closed"));
+                    return;
+                }
+                if (result.value.byteLength < 1 || result.value.byteLength > this.maxDatagramSize)
+                    continue;
+                this.incoming.push(result.value.slice());
+            }
+        }
+        catch (error) {
+            if (this.terminalError === undefined) {
+                this.abort(carrierFailure("WebTransport datagram receive failed", error));
+            }
+        }
+    }
+}
+class IncomingWebTransportStreamQueue {
+    values = [];
+    waiters = new Set();
+    terminalError;
+    push(stream) {
+        if (this.terminalError !== undefined) {
+            stream.abort(this.terminalError);
+            return;
+        }
+        const waiter = this.waiters.values().next().value;
+        if (waiter === undefined)
+            this.values.push(stream);
+        else
+            waiter.deliver(stream);
+    }
+    shift(signal) {
+        if (signal?.aborted === true)
+            return Promise.reject(abortedCarrierError(signal.reason));
+        if (this.terminalError !== undefined)
+            return Promise.reject(this.terminalError);
+        const value = this.values.shift();
+        if (value !== undefined)
+            return Promise.resolve(value);
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const cleanup = () => {
+                this.waiters.delete(waiter);
+                signal?.removeEventListener("abort", abort);
+            };
+            const waiter = {
+                deliver: (stream) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    resolve(stream);
+                },
+                fail: (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    reject(error);
+                },
+            };
+            const abort = () => waiter.fail(abortedCarrierError(signal?.reason));
+            this.waiters.add(waiter);
+            signal?.addEventListener("abort", abort, { once: true });
+            if (signal?.aborted === true)
+                abort();
+        });
+    }
+    fail(error) {
+        if (this.terminalError !== undefined)
+            return;
+        this.terminalError = error;
+        for (const stream of this.values)
+            stream.abort(error);
+        this.values.length = 0;
+        for (const waiter of [...this.waiters])
+            waiter.fail(error);
+    }
+}
+class IncomingDatagramQueue {
+    values = [];
+    waiters = new Set();
+    terminalError;
+    push(value) {
+        if (this.terminalError !== undefined)
+            return;
+        const waiter = this.waiters.values().next().value;
+        if (waiter === undefined)
+            this.values.push(value);
+        else
+            waiter.deliver(value);
+    }
+    shift(signal) {
+        if (signal?.aborted === true)
+            return Promise.reject(abortedCarrierError(signal.reason));
+        if (this.terminalError !== undefined)
+            return Promise.reject(this.terminalError);
+        const value = this.values.shift();
+        if (value !== undefined)
+            return Promise.resolve(value);
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const cleanup = () => {
+                this.waiters.delete(waiter);
+                signal?.removeEventListener("abort", abort);
+            };
+            const waiter = {
+                deliver: (next) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    resolve(next);
+                },
+                fail: (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    reject(error);
+                },
+            };
+            const abort = () => waiter.fail(abortedCarrierError(signal?.reason));
+            this.waiters.add(waiter);
+            signal?.addEventListener("abort", abort, { once: true });
+            if (signal?.aborted === true)
+                abort();
+        });
+    }
+    fail(error) {
+        if (this.terminalError !== undefined)
+            return;
+        this.terminalError = error;
+        this.values.length = 0;
+        for (const waiter of [...this.waiters])
+            waiter.fail(error);
+    }
+}
+function abortNativeStream(stream, error) {
+    const reader = stream.readable.getReader();
+    const writer = stream.writable.getWriter();
+    void reader.cancel(error).catch(() => undefined);
+    void writer.abort(error).catch(() => undefined);
+}
+function abortedCarrierError(cause) {
+    return new CarrierError("aborted", "WebTransport operation aborted", cause);
+}
+function isAborted(signal) {
+    return signal?.aborted === true;
+}
+async function raceAbort(promise, signal) {
+    if (signal === undefined)
+        return await promise;
+    if (signal.aborted)
+        throw signal.reason;
+    return await new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        void promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+async function carrierCall(promise, message, code = "closed") {
+    try {
+        return await promise;
+    }
+    catch (error) {
+        if (error instanceof CarrierError)
+            throw error;
+        if (error instanceof DOMException && error.name === "AbortError" ||
+            error instanceof Error && error.name === "AbortError") {
+            throw new CarrierError("aborted", message, error);
+        }
+        throw new CarrierError(code, message, error);
+    }
+}
+function carrierFailure(message, cause) {
+    return cause instanceof CarrierError ? cause : new CarrierError("closed", message, cause);
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}

package/dist/utils/errors.d.ts

@@ -4,23 +4,5 @@ export declare class TimeoutError extends Error {
 export declare class AbortError extends Error {
     constructor(message?: string);
 }
-export type FlowersecPath = "auto" | "tunnel" | "direct";
-export type FlowersecStage = "validate" | "connect" | "attach" | "handshake" | "secure" | "yamux" | "rpc" | "close";
-export type FlowersecErrorCode = "timeout" | "canceled" | "invalid_version" | "invalid_input" | "invalid_option" | "invalid_endpoint_instance_id" | "invalid_psk" | "invalid_suite" | "missing_grant" | "missing_connect_info" | "missing_conn" | "missing_handler" | "missing_stream_kind" | "role_mismatch" | "missing_tunnel_url" | "missing_ws_url" | "missing_origin" | "missing_channel_id" | "missing_token" | "missing_init_exp" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "auth_tag_mismatch" | "resolve_failed" | "transport_policy_denied" | "credential_commit_failed" | "random_failed" | "upgrade_failed" | "dial_failed" | "attach_failed" | "too_many_connections" | "expected_attach" | "invalid_attach" | "invalid_token" | "channel_mismatch" | "init_exp_mismatch" | "idle_timeout_mismatch" | "token_replay" | "tenant_mismatch" | "policy_denied" | "policy_error" | "replace_rate_limited" | "handshake_failed" | "ping_failed" | "rekey_failed" | "mux_failed" | "accept_stream_failed" | "open_stream_failed" | "stream_hello_failed" | "rpc_failed" | "resource_exhausted" | "not_connected";
-export declare class FlowersecError extends Error {
-    readonly code: FlowersecErrorCode;
-    readonly stage: FlowersecStage;
-    readonly path: FlowersecPath;
-    readonly cause?: unknown;
-    constructor(args: Readonly<{
-        code: FlowersecErrorCode;
-        stage: FlowersecStage;
-        path: FlowersecPath;
-        message?: string;
-        cause?: unknown;
-    }>);
-}
-export declare function isTimeoutError(e: unknown): e is TimeoutError;
-export declare function isAbortError(e: unknown): e is AbortError;
-export declare function isFlowersecError(e: unknown): e is FlowersecError;
-export declare function throwIfAborted(signal?: AbortSignal, message?: string): void;
+export type ConnectErrorPath = "auto" | "tunnel" | "direct";
+export type ConnectErrorStage = "validate" | "connect" | "session" | "rpc" | "close";

package/dist/utils/errors.js

@@ -1,3 +1,4 @@
+import { ConnectError } from "../public/connectError.js";
 export class TimeoutError extends Error {
     constructor(message = "timeout") {
         super(message);
@@ -10,35 +11,87 @@ export class AbortError extends Error {
         this.name = "AbortError";
     }
 }
-export class FlowersecError extends Error {
-    code;
-    stage;
-    path;
-    cause;
-    constructor(args) {
-        const prefix = `${args.path} ${args.stage} (${args.code})`;
-        const message = args.message != null && args.message !== ""
-            ? `${prefix}: ${args.message}`
-            : prefix;
-        super(message, args.cause !== undefined ? { cause: args.cause } : undefined);
-        this.name = "FlowersecError";
-        this.code = args.code;
-        this.stage = args.stage;
-        this.path = args.path;
-        if (args.cause !== undefined)
-            this.cause = args.cause;
-    }
+const internalDetails = new WeakMap();
+/** @internal */
+export function createConnectErrorInternal(args) {
+    const error = new ConnectError(publicCode(args.code));
+    internalDetails.set(error, Object.freeze({
+        code: args.code,
+        stage: args.stage,
+        ...(args.cause === undefined ? {} : { cause: args.cause }),
+        diagnostics: Object.freeze((args.diagnostics ?? []).map((diagnostic) => Object.freeze({ ...diagnostic }))),
+    }));
+    return error;
+}
+/** @internal */
+export function connectErrorDetailsInternal(error) {
+    return internalDetails.get(error) ?? Object.freeze({
+        code: internalCode(error.code),
+        stage: "connect",
+        diagnostics: Object.freeze([]),
+    });
 }
+/** @internal */
 export function isTimeoutError(e) {
     return e instanceof TimeoutError;
 }
+/** @internal */
 export function isAbortError(e) {
     return e instanceof AbortError;
 }
-export function isFlowersecError(e) {
-    return e instanceof FlowersecError;
+/** @internal */
+export function isConnectError(e) {
+    return e instanceof ConnectError;
 }
+/** @internal */
 export function throwIfAborted(signal, message) {
     if (signal?.aborted)
         throw new AbortError(message);
 }
+function publicCode(code) {
+    switch (code) {
+        case "timeout": return "timeout";
+        case "canceled": return "canceled";
+        case "resolve_failed": return "resolve_failed";
+        case "credential_commit_failed": return "credential_spend_failed";
+        case "handshake_failed": return "handshake_failed";
+        case "rpc_failed": return "rpc_failed";
+        case "resource_exhausted": return "resource_exhausted";
+        case "not_connected": return "not_connected";
+        case "invalid_option": return "invalid_options";
+        case "timestamp_after_init_exp": return "expired_artifact";
+        case "dial_failed":
+        case "upgrade_failed":
+        case "attach_failed":
+        case "unsupported_capability":
+        case "too_many_connections":
+        case "policy_denied":
+        case "policy_error":
+        case "replace_rate_limited":
+        case "ping_failed":
+        case "rekey_failed":
+        case "mux_failed":
+        case "accept_stream_failed":
+        case "open_stream_failed":
+        case "stream_hello_failed":
+            return "connection_failed";
+        default:
+            return "invalid_input";
+    }
+}
+function internalCode(code) {
+    switch (code) {
+        case "invalid_input": return "invalid_input";
+        case "invalid_options": return "invalid_option";
+        case "expired_artifact": return "timestamp_after_init_exp";
+        case "resolve_failed": return "resolve_failed";
+        case "credential_spend_failed": return "credential_commit_failed";
+        case "connection_failed": return "dial_failed";
+        case "timeout": return "timeout";
+        case "canceled": return "canceled";
+        case "handshake_failed": return "handshake_failed";
+        case "rpc_failed": return "rpc_failed";
+        case "resource_exhausted": return "resource_exhausted";
+        case "not_connected": return "not_connected";
+    }
+}

package/dist/v2/admissionError.d.ts

@@ -0,0 +1,4 @@
+export declare class AdmissionSessionV2Error extends Error {
+    readonly reason: string;
+    constructor(reason: string, message: string);
+}

package/dist/v2/admissionError.js

@@ -0,0 +1,8 @@
+export class AdmissionSessionV2Error extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "AdmissionSessionV2Error";
+    }
+}