@floegence/flowersec-core 0.26.0 → 2.0.0

package/dist/v2/carrier.js

@@ -0,0 +1,405 @@
+export class CarrierError extends Error {
+    code;
+    cause;
+    constructor(code, message, cause) {
+        super(message);
+        this.code = code;
+        this.cause = cause;
+        this.name = "CarrierError";
+    }
+}
+function deferred() {
+    let resolvePromise;
+    const promise = new Promise((resolve) => { resolvePromise = resolve; });
+    return { promise, resolve: (value) => resolvePromise(value) };
+}
+export function adaptNativeCarrierSessionV2(native) {
+    return new NativeCarrierSessionAdapter(native);
+}
+export function createMemoryCarrierPairV2(options) {
+    const maxPendingStreams = options.maxPendingStreams ?? 128;
+    if (!Number.isInteger(maxPendingStreams) || maxPendingStreams < 1 || maxPendingStreams > 1_024) {
+        throw new RangeError("maxPendingStreams must be an integer from 1 to 1024");
+    }
+    requireInboundBidirectionalStreamCapacity(options.inboundBidirectionalStreamCapacity);
+    const link = new MemoryCarrierLink(options.kind, options.path, options.inboundBidirectionalStreamCapacity, maxPendingStreams);
+    const left = new MemoryCarrierSession(link, 0);
+    const right = new MemoryCarrierSession(link, 1);
+    link.attach(left, right);
+    return [left, right];
+}
+class MemoryCarrierLink {
+    kind;
+    path;
+    inboundBidirectionalStreamCapacity;
+    maxPendingStreams;
+    sessions;
+    closedError;
+    streams = new Set();
+    termination = deferred();
+    constructor(kind, path, inboundBidirectionalStreamCapacity, maxPendingStreams) {
+        this.kind = kind;
+        this.path = path;
+        this.inboundBidirectionalStreamCapacity = inboundBidirectionalStreamCapacity;
+        this.maxPendingStreams = maxPendingStreams;
+    }
+    attach(left, right) {
+        this.sessions = [left, right];
+    }
+    assertOpen() {
+        if (this.closedError !== undefined)
+            throw this.closedError;
+    }
+    open(side) {
+        this.assertOpen();
+        const sessions = this.sessions;
+        if (sessions === undefined)
+            throw new Error("memory carrier is not attached");
+        const peer = sessions[side === 0 ? 1 : 0];
+        if (peer.pendingCount() >= this.maxPendingStreams) {
+            throw new CarrierError("closed", "carrier incoming stream queue exhausted");
+        }
+        const state = new MemoryStreamState(() => {
+            this.streams.delete(local);
+            this.streams.delete(remote);
+        });
+        const local = new MemoryCarrierStream(state, side);
+        const remote = new MemoryCarrierStream(state, side === 0 ? 1 : 0);
+        this.streams.add(local);
+        this.streams.add(remote);
+        peer.enqueue(remote);
+        return local;
+    }
+    close() {
+        if (this.closedError !== undefined)
+            return;
+        this.closedError = new CarrierError("closed", "carrier session closed");
+        for (const stream of [...this.streams])
+            stream.failFromSession(this.closedError);
+        this.streams.clear();
+        for (const session of this.sessions ?? [])
+            session.fail(this.closedError);
+        this.termination.resolve();
+    }
+    waitTermination() {
+        return this.termination.promise;
+    }
+}
+class MemoryCarrierSession {
+    link;
+    side;
+    kind;
+    path;
+    inboundBidirectionalStreamCapacity;
+    unreliableDatagrams = undefined;
+    incoming = new AsyncQueue();
+    closed = false;
+    constructor(link, side) {
+        this.link = link;
+        this.side = side;
+        this.kind = link.kind;
+        this.path = link.path;
+        this.inboundBidirectionalStreamCapacity = link.inboundBidirectionalStreamCapacity;
+    }
+    async openStream(options = {}) {
+        throwIfAborted(options.signal);
+        this.assertOpen();
+        return this.link.open(this.side);
+    }
+    async acceptStream(options = {}) {
+        this.assertOpen();
+        return await this.incoming.shift(options.signal);
+    }
+    async close() {
+        this.link.close();
+    }
+    async waitTermination() {
+        await this.link.waitTermination();
+    }
+    abort() {
+        this.link.close();
+    }
+    enqueue(stream) {
+        if (this.closed) {
+            void stream.reset();
+            return;
+        }
+        this.incoming.push(stream);
+    }
+    pendingCount() {
+        return this.incoming.size;
+    }
+    fail(error) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.incoming.fail(error);
+    }
+    assertOpen() {
+        if (this.closed)
+            throw new CarrierError("closed", "carrier session closed");
+        this.link.assertOpen();
+    }
+}
+class MemoryStreamState {
+    onClean;
+    inbound = [new AsyncQueue(), new AsyncQueue()];
+    writeClosed = [false, false];
+    readStopped = [false, false];
+    terminalError;
+    cleaned = false;
+    constructor(onClean) {
+        this.onClean = onClean;
+    }
+    finishIfClosed() {
+        if (!this.cleaned && this.writeClosed[0] && this.writeClosed[1]) {
+            this.cleaned = true;
+            this.onClean();
+        }
+    }
+    reset() {
+        if (this.terminalError !== undefined)
+            return;
+        this.terminalError = new CarrierError("reset", "carrier stream reset");
+        this.inbound[0].fail(this.terminalError);
+        this.inbound[1].fail(this.terminalError);
+        if (!this.cleaned) {
+            this.cleaned = true;
+            this.onClean();
+        }
+    }
+    stopSending(side) {
+        if (this.terminalError !== undefined || this.readStopped[side])
+            return;
+        this.readStopped[side] = true;
+        this.inbound[side].fail(new CarrierError("stop_sending", "carrier stream receive side stopped"));
+    }
+    fail(error) {
+        if (this.terminalError !== undefined)
+            return;
+        this.terminalError = error;
+        this.inbound[0].fail(error);
+        this.inbound[1].fail(error);
+    }
+}
+class MemoryCarrierStream {
+    state;
+    side;
+    constructor(state, side) {
+        this.state = state;
+        this.side = side;
+    }
+    async read(options = {}) {
+        this.assertNotTerminal();
+        return await this.state.inbound[this.side].shift(options.signal);
+    }
+    async write(data, options = {}) {
+        throwIfAborted(options.signal);
+        this.assertNotTerminal();
+        if (!(data instanceof Uint8Array))
+            throw new TypeError("carrier stream write requires Uint8Array");
+        if (this.state.writeClosed[this.side]) {
+            throw new CarrierError("write_closed", "carrier stream write side is closed");
+        }
+        const peer = this.side === 0 ? 1 : 0;
+        if (this.state.readStopped[peer]) {
+            throw new CarrierError("stop_sending", "carrier peer stopped receiving this stream");
+        }
+        this.state.inbound[peer].push(data.slice());
+        return data.length;
+    }
+    async closeWrite() {
+        this.assertNotTerminal();
+        if (this.state.writeClosed[this.side])
+            return;
+        this.state.writeClosed[this.side] = true;
+        const peer = this.side === 0 ? 1 : 0;
+        this.state.inbound[peer].push(null);
+        this.state.finishIfClosed();
+    }
+    async reset() {
+        this.state.reset();
+    }
+    async stopSending() {
+        this.state.stopSending(this.side);
+    }
+    abort() {
+        this.state.reset();
+    }
+    failFromSession(error) {
+        this.state.fail(error);
+    }
+    assertNotTerminal() {
+        if (this.state.terminalError !== undefined)
+            throw this.state.terminalError;
+    }
+}
+class AsyncQueue {
+    values = [];
+    head = 0;
+    waiters = new Set();
+    terminalError;
+    get size() {
+        return this.values.length - this.head;
+    }
+    push(value) {
+        if (this.terminalError !== undefined)
+            return;
+        const waiter = this.waiters.values().next().value;
+        if (waiter !== undefined) {
+            waiter.deliver(value);
+            return;
+        }
+        this.values.push(value);
+    }
+    shift(signal) {
+        throwIfAborted(signal);
+        if (this.terminalError !== undefined)
+            return Promise.reject(this.terminalError);
+        if (this.head < this.values.length) {
+            const value = this.values[this.head++];
+            this.compact();
+            return Promise.resolve(value);
+        }
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const cleanup = () => {
+                this.waiters.delete(waiter);
+                signal?.removeEventListener("abort", onAbort);
+            };
+            const waiter = {
+                deliver: (value) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    resolve(value);
+                },
+                fail: (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    reject(error);
+                },
+            };
+            const onAbort = () => waiter.fail(abortedError());
+            this.waiters.add(waiter);
+            signal?.addEventListener("abort", onAbort, { once: true });
+            if (signal?.aborted === true)
+                onAbort();
+        });
+    }
+    fail(error) {
+        if (this.terminalError !== undefined)
+            return;
+        this.terminalError = error;
+        this.values.length = 0;
+        this.head = 0;
+        for (const waiter of [...this.waiters])
+            waiter.fail(error);
+    }
+    compact() {
+        if (this.head > 1_024 && this.head * 2 > this.values.length) {
+            this.values.splice(0, this.head);
+            this.head = 0;
+        }
+    }
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted === true)
+        throw abortedError();
+}
+function abortedError() {
+    return new CarrierError("aborted", "carrier operation aborted");
+}
+class NativeCarrierSessionAdapter {
+    native;
+    kind;
+    path;
+    inboundBidirectionalStreamCapacity;
+    unreliableDatagrams;
+    constructor(native) {
+        this.native = native;
+        this.kind = native.kind;
+        this.path = native.path;
+        this.inboundBidirectionalStreamCapacity = native.inboundBidirectionalStreamCapacity;
+        this.unreliableDatagrams = native.unreliableDatagrams;
+    }
+    async openStream(options = {}) {
+        return new NativeCarrierStreamAdapter(await this.native.openStream(options));
+    }
+    async acceptStream(options = {}) {
+        return new NativeCarrierStreamAdapter(await this.native.acceptStream(options));
+    }
+    async waitTermination() {
+        await this.native.waitTermination();
+    }
+    async close() {
+        await this.native.close();
+    }
+    abort(error) {
+        this.native.abort(error);
+    }
+}
+function requireInboundBidirectionalStreamCapacity(value) {
+    if (!Number.isInteger(value) || value < 3 || value > 130) {
+        throw new RangeError("inboundBidirectionalStreamCapacity must be an integer from 3 to 130");
+    }
+}
+class NativeCarrierStreamAdapter {
+    native;
+    constructor(native) {
+        this.native = native;
+    }
+    async read(options = {}) {
+        return await abortable(this.native.read(), options.signal, () => this.native.abort());
+    }
+    async write(data, options = {}) {
+        throwIfAborted(options.signal);
+        return await abortable(this.native.write(data), options.signal, () => this.native.abort());
+    }
+    async closeWrite() {
+        await this.native.closeWrite();
+    }
+    async reset() {
+        await this.native.reset();
+    }
+    async stopSending() {
+        await this.native.stopSending();
+    }
+    abort(error) {
+        this.native.abort(error);
+    }
+}
+async function abortable(promise, signal, onAbort) {
+    if (signal === undefined)
+        return await promise;
+    throwIfAborted(signal);
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => signal.removeEventListener("abort", abort);
+        const abort = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            onAbort();
+            reject(abortedError());
+        };
+        signal.addEventListener("abort", abort, { once: true });
+        void promise.then((value) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(value);
+        }, (error) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(error);
+        });
+    });
+}

package/dist/v2/contract.d.ts

@@ -0,0 +1,37 @@
+import type { RpcClient } from "../rpc/client.js";
+export interface InternalByteStreamV2 {
+    readonly id: bigint;
+    readonly kind: string;
+    readonly terminalError: Error | undefined;
+    read(options?: OperationOptionsV2): Promise<Uint8Array | null>;
+    write(data: Uint8Array, options?: OperationOptionsV2): Promise<number>;
+    closeWrite(): Promise<void>;
+    reset(): Promise<void>;
+    close(): Promise<void>;
+}
+export interface InternalIncomingStreamV2 {
+    readonly id: bigint;
+    readonly kind: string;
+    readonly metadata: JsonObjectV2;
+    readonly stream: InternalByteStreamV2;
+}
+export interface InternalSessionV2 {
+    readonly path: PathKind;
+    readonly endpointInstanceId: string | undefined;
+    readonly rpc: RpcClient;
+    readonly termination: Promise<Readonly<{
+        error: Error;
+    }>>;
+    readonly unreliableMessages?: UnreliableMessageChannelV2 | undefined;
+    openStream(kind: string, options?: InternalStreamOpenOptionsV2): Promise<InternalByteStreamV2>;
+    acceptStream(options?: OperationOptionsV2): Promise<InternalIncomingStreamV2>;
+    rekey(options?: OperationOptionsV2): Promise<void>;
+    probeLiveness(options?: OperationOptionsV2): Promise<number>;
+    waitTermination(): Promise<Readonly<{
+        error: Error;
+    }>>;
+    close(): Promise<void>;
+}
+export type InternalStreamOpenOptionsV2 = OperationOptionsV2 & Readonly<{
+    metadata?: JsonObjectV2;
+}>;

package/dist/v2/contract.js

@@ -0,0 +1 @@
+/** @internal */ export { SessionError } from "../public/contract.js";

package/dist/v2/handshake.d.ts

@@ -0,0 +1,80 @@
+import { CipherSuiteV2 } from "./protocol.js";
+export declare enum HandshakeMessageTypeV2 {
+    ClientInit = 1,
+    ServerFinished = 2,
+    ClientFinished = 3
+}
+export type HandshakeFrameV2 = Readonly<{
+    type: HandshakeMessageTypeV2;
+    payload: Uint8Array;
+    raw: Uint8Array;
+}>;
+export type ClientInitV2 = Readonly<{
+    profile: "flowersec/2";
+    channelID: string;
+    sessionContractHash: Uint8Array;
+    clientRole: 1;
+    suite: CipherSuiteV2;
+    clientEphemeralPublic: Uint8Array;
+    nonceC: Uint8Array;
+    selectedFeatures: number;
+    maxInboundStreams: number;
+    clientAdmissionBinding: Uint8Array;
+    clientEndpointInstanceID: string;
+}>;
+export type ServerFinishedCoreV2 = Readonly<{
+    suite: CipherSuiteV2;
+    handshakeID: Uint8Array;
+    serverEphemeralPublic: Uint8Array;
+    nonceS: Uint8Array;
+    sessionContractHash: Uint8Array;
+    selectedFeatures: number;
+    maxInboundStreams: number;
+    serverAdmissionBinding: Uint8Array;
+    serverEndpointInstanceID: string;
+}>;
+export type ServerFinishedV2 = Readonly<{
+    core: ServerFinishedCoreV2;
+    serverConfirm: Uint8Array;
+}>;
+export type ClientFinishedV2 = Readonly<{
+    handshakeID: Uint8Array;
+    clientConfirm: Uint8Array;
+}>;
+export type HandshakeExpectationsV2 = Readonly<{
+    path: "direct" | "tunnel";
+    channelID: string;
+    sessionContractHash: Uint8Array;
+    suite: CipherSuiteV2;
+    maxInboundStreams: number;
+    admissionBinding: Uint8Array;
+    expectedEndpointInstanceID: string;
+}>;
+export declare function encodeControlPrefaceV2(): Uint8Array;
+export declare function parseControlPrefaceV2(raw: Uint8Array): void;
+export declare function encodeHandshakeFrameV2(type: HandshakeMessageTypeV2, payload: Uint8Array): Uint8Array;
+export declare function decodeHandshakeFrameV2(raw: Uint8Array): HandshakeFrameV2;
+export declare function encodeClientInitV2(message: ClientInitV2): Uint8Array;
+export declare function decodeClientInitV2(raw: Uint8Array): ClientInitV2;
+export declare function encodeServerFinishedCoreV2(core: ServerFinishedCoreV2, suite: CipherSuiteV2): Uint8Array;
+export declare function encodeServerFinishedV2(message: ServerFinishedV2, suite: CipherSuiteV2): Uint8Array;
+export declare function decodeServerFinishedV2(raw: Uint8Array, suite: CipherSuiteV2): ServerFinishedV2;
+export declare function encodeClientFinishedCoreV2(handshakeID: Uint8Array): Uint8Array;
+export declare function encodeClientFinishedV2(message: ClientFinishedV2): Uint8Array;
+export declare function decodeClientFinishedV2(raw: Uint8Array): ClientFinishedV2;
+export declare function generateEphemeralKeyV2(suite: CipherSuiteV2, entropy: (length: number) => Uint8Array): Readonly<{
+    privateKey: Uint8Array;
+    publicKey: Uint8Array;
+}>;
+export declare function ephemeralPublicKeyV2(suite: CipherSuiteV2, privateKey: Uint8Array): Uint8Array;
+export declare function computeSharedSecretV2(suite: CipherSuiteV2, privateKey: Uint8Array, peerPublicKey: Uint8Array): Uint8Array;
+export declare function deriveHandshakePRKV2(psk: Uint8Array, sharedSecret: Uint8Array): Uint8Array;
+export declare function computeHandshakeH0V2(fsc2Raw: Uint8Array, clientInitRaw: Uint8Array): Uint8Array;
+export declare function computeHandshakeH1V2(h0: Uint8Array, serverCoreRaw: Uint8Array): Uint8Array;
+export declare function computeServerConfirmV2(handshakePRK: Uint8Array, h1: Uint8Array): Uint8Array;
+export declare function computeHandshakeH2V2(h1: Uint8Array, serverFinishedRaw: Uint8Array, clientCoreRaw: Uint8Array): Uint8Array;
+export declare function computeClientConfirmV2(handshakePRK: Uint8Array, h2: Uint8Array): Uint8Array;
+export declare function computeHandshakeH3V2(h2: Uint8Array, clientFinishedRaw: Uint8Array): Uint8Array;
+export declare function deriveSessionPRKV2(h3: Uint8Array, handshakePRK: Uint8Array): Uint8Array;
+export declare function validateClientInitV2(message: ClientInitV2, expected: HandshakeExpectationsV2): void;
+export declare function validateServerFinishedV2(message: ServerFinishedV2, expected: HandshakeExpectationsV2): void;