@floegence/flowersec-core 0.27.0 → 2.0.0

package/dist/connector/adapters/webSocketCandidate.js

@@ -0,0 +1,116 @@
+import { createWebSocketCarrierSessionV2 } from "../../transport/webSocketAdapter.js";
+import { WebSocketBinaryTransport } from "../../ws-client/binaryTransport.js";
+export function createWebSocketCandidateFactoryV2(factory) {
+    return {
+        create(candidate, artifact) {
+            if (candidate.carrier !== "websocket")
+                throw new Error(`unsupported WebSocket carrier ${candidate.carrier}`);
+            return new WebSocketCandidateAttempt(candidate, artifact, factory);
+        },
+    };
+}
+class WebSocketCandidateAttempt {
+    candidate;
+    artifact;
+    factory;
+    socket;
+    transport;
+    aborted = false;
+    finalized = false;
+    constructor(candidate, artifact, factory) {
+        this.candidate = candidate;
+        this.artifact = artifact;
+        this.factory = factory;
+    }
+    async ready(signal) {
+        if (this.aborted)
+            throw new Error("WebSocket candidate aborted");
+        const path = this.artifact.path.kind;
+        const subprotocol = path === "direct" ? "flowersec.direct.v2" : "flowersec.tunnel.v2";
+        const socket = this.factory(this.candidate.normalized_url, subprotocol);
+        this.socket = socket;
+        await waitForOpen(socket, subprotocol, signal);
+        if (this.aborted)
+            throw new Error("WebSocket candidate aborted");
+        const transport = new WebSocketBinaryTransport(socket);
+        this.transport = transport;
+        const inboundBidirectionalStreamCapacity = this.artifact.session.max_inbound_streams + 2;
+        return {
+            candidate: this.candidate,
+            kind: "websocket",
+            path,
+            inboundBidirectionalStreamCapacity,
+            openAdmissionChannel: async () => ({
+                framing: "message",
+                write: async (data, options = {}) => await transport.writeBinary(data, options),
+                read: async (options = {}) => await transport.readBinary(options),
+                abort: () => transport.close(),
+            }),
+            finalize: () => {
+                if (this.finalized)
+                    throw new Error("WebSocket candidate already finalized");
+                this.finalized = true;
+                return createWebSocketCarrierSessionV2(transport, {
+                    path,
+                    client: this.artifact.path.kind !== "tunnel" || this.artifact.path.role !== 2,
+                    inboundBidirectionalStreamCapacity,
+                });
+            },
+            close: async () => transport.close(),
+            abort: () => transport.close(),
+        };
+    }
+    abort() {
+        this.aborted = true;
+        this.transport?.close();
+        this.socket?.close();
+    }
+}
+function waitForOpen(socket, expectedProtocol, signal) {
+    if (socket.readyState === 1) {
+        validateSubprotocol(socket, expectedProtocol);
+        return Promise.resolve();
+    }
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => {
+            socket.removeEventListener("open", open);
+            socket.removeEventListener("error", error);
+            socket.removeEventListener("close", close);
+            signal?.removeEventListener("abort", abort);
+        };
+        const finish = (failure) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            failure === undefined ? resolve() : reject(failure);
+        };
+        const open = () => {
+            try {
+                validateSubprotocol(socket, expectedProtocol);
+                finish();
+            }
+            catch (cause) {
+                finish(asError(cause));
+            }
+        };
+        const error = () => finish(new Error("WebSocket candidate failed before ready"));
+        const close = () => finish(new Error("WebSocket candidate closed before ready"));
+        const abort = () => { socket.close(); finish(new Error("WebSocket candidate aborted")); };
+        socket.addEventListener("open", open);
+        socket.addEventListener("error", error);
+        socket.addEventListener("close", close);
+        signal?.addEventListener("abort", abort, { once: true });
+        if (signal?.aborted === true)
+            abort();
+    });
+}
+function validateSubprotocol(socket, expected) {
+    if (socket.protocol !== undefined && socket.protocol !== expected) {
+        throw new Error(`unexpected WebSocket subprotocol ${socket.protocol}`);
+    }
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}

package/dist/connector/adapters/webTransportCandidate.d.ts

@@ -0,0 +1,5 @@
+import type { ArtifactV2, CanonicalArtifactCandidateV2 } from "../../v2/artifact.js";
+import { type NativeCarrierSessionV2 } from "../../v2/carrier.js";
+import type { CandidateAttemptFactoryV2 } from "../sessionConnector.js";
+export type WebTransportClientFactoryV2 = (candidate: CanonicalArtifactCandidateV2, artifact: ArtifactV2, signal: AbortSignal) => Promise<NativeCarrierSessionV2>;
+export declare function createWebTransportCandidateFactoryV2(factory: WebTransportClientFactoryV2): CandidateAttemptFactoryV2;

package/dist/connector/adapters/webTransportCandidate.js

@@ -0,0 +1,73 @@
+import { adaptNativeCarrierSessionV2, } from "../../v2/carrier.js";
+export function createWebTransportCandidateFactoryV2(factory) {
+    return {
+        create(candidate, artifact) {
+            if (candidate.carrier !== "webtransport") {
+                throw new Error(`unsupported WebTransport carrier ${candidate.carrier}`);
+            }
+            return new WebTransportCandidateAttempt(candidate, artifact, factory);
+        },
+    };
+}
+class WebTransportCandidateAttempt {
+    candidate;
+    artifact;
+    factory;
+    controller = new AbortController();
+    carrier;
+    finalized = false;
+    constructor(candidate, artifact, factory) {
+        this.candidate = candidate;
+        this.artifact = artifact;
+        this.factory = factory;
+    }
+    async ready(signal) {
+        const unlink = linkAbort(signal, this.controller);
+        try {
+            const carrier = await this.factory(this.candidate, this.artifact, this.controller.signal);
+            this.carrier = carrier;
+            return {
+                candidate: this.candidate,
+                kind: carrier.kind,
+                path: carrier.path,
+                inboundBidirectionalStreamCapacity: carrier.inboundBidirectionalStreamCapacity,
+                openAdmissionChannel: async (channelSignal) => {
+                    const options = channelSignal === undefined ? {} : { signal: channelSignal };
+                    const stream = carrier.kind === "webtransport"
+                        ? await carrier.acceptStream(options)
+                        : await carrier.openStream(options);
+                    return {
+                        framing: "stream",
+                        stream,
+                        abort: (error) => stream.abort(error),
+                    };
+                },
+                finalize: () => {
+                    if (this.finalized)
+                        throw new Error("WebTransport candidate already finalized");
+                    this.finalized = true;
+                    return adaptNativeCarrierSessionV2(carrier);
+                },
+                close: async () => await carrier.close(),
+                abort: () => carrier.abort({ code: 6, reason: "candidate aborted" }),
+            };
+        }
+        finally {
+            unlink();
+        }
+    }
+    abort() {
+        this.controller.abort(new Error("WebTransport candidate aborted"));
+        this.carrier?.abort({ code: 6, reason: "candidate aborted" });
+    }
+}
+function linkAbort(parent, child) {
+    if (parent === undefined)
+        return () => undefined;
+    const abort = () => child.abort(parent.reason);
+    if (parent.aborted)
+        abort();
+    else
+        parent.addEventListener("abort", abort, { once: true });
+    return () => parent.removeEventListener("abort", abort);
+}

package/dist/connector/admissionCommit.d.ts

@@ -0,0 +1,31 @@
+import { type CanonicalArtifactCandidateV2 } from "../v2/artifact.js";
+import type { CarrierSessionV2, NativeCarrierStreamV2 } from "../v2/carrier.js";
+import type { CarrierKind, OperationOptionsV2, PathKind } from "../v2/contract.js";
+import type { SessionConfigV2 } from "../v2/session.js";
+import { type ArtifactLeaseV2 } from "../v2/artifactLease.js";
+export declare class CredentialCommitError extends Error {
+    constructor(cause: unknown);
+}
+export type ClientAdmissionChannelV2 = Readonly<{
+    framing: "message";
+    write(data: Uint8Array, options?: OperationOptionsV2): Promise<void>;
+    read(options?: OperationOptionsV2): Promise<Uint8Array>;
+    abort(error: Error): void;
+}> | Readonly<{
+    framing: "stream";
+    stream: NativeCarrierStreamV2;
+    abort(error: Error): void;
+}>;
+export type ReadyAdmissionTransportV2 = Readonly<{
+    candidate: CanonicalArtifactCandidateV2;
+    kind: CarrierKind;
+    path: PathKind;
+    inboundBidirectionalStreamCapacity: number;
+    openAdmissionChannel(signal?: AbortSignal): Promise<ClientAdmissionChannelV2>;
+    finalize(): CarrierSessionV2;
+    close(): Promise<void>;
+    abort(): void;
+}>;
+export declare function commitClientAdmissionV2(ready: ReadyAdmissionTransportV2, lease: ArtifactLeaseV2, assertCredentialValid: () => void, rawFSB2: Uint8Array, config: SessionConfigV2, signal?: AbortSignal): Promise<CarrierSessionV2>;
+export declare function requireExactCarrierCapacityV2(physical: number, logical: number): void;
+export declare function validateOutboundAdmissionV2(rawFSB2: Uint8Array, config: SessionConfigV2, carrier: CarrierKind): void;

package/dist/connector/admissionCommit.js

@@ -0,0 +1,239 @@
+import { AdmissionStatusV2, computeSessionContractHashV2, decodeFSB2RequestV2, decodeFSA2ResponseV2, } from "../v2/artifact.js";
+import { AdmissionSessionV2Error } from "../v2/admissionError.js";
+import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
+import { commitArtifactLeaseSpendV2, } from "../v2/artifactLease.js";
+export class CredentialCommitError extends Error {
+    constructor(cause) {
+        super("durable credential spend failed", { cause });
+        this.name = "CredentialCommitError";
+    }
+}
+export async function commitClientAdmissionV2(ready, lease, assertCredentialValid, rawFSB2, config, signal) {
+    throwIfAborted(signal);
+    requireReadyTransportBinding(ready, config);
+    validateOutboundAdmissionV2(rawFSB2, config, ready.kind);
+    const channel = await ready.openAdmissionChannel(signal);
+    try {
+        assertCredentialValid();
+        try {
+            await commitArtifactLeaseSpendV2(lease, signal);
+        }
+        catch (error) {
+            throw new CredentialCommitError(error);
+        }
+        assertCredentialValid();
+        throwIfAborted(signal);
+        const rawFSA2 = channel.framing === "message"
+            ? await exchangeMessage(channel, rawFSB2, signal)
+            : await exchangeStream(channel.stream, rawFSB2, signal);
+        requireAdmissionSuccessV2(rawFSA2);
+        return ready.finalize();
+    }
+    catch (error) {
+        const failure = asError(error);
+        channel.abort(failure);
+        ready.abort();
+        throw error;
+    }
+}
+function requireReadyTransportBinding(ready, config) {
+    if (ready.candidate.carrier !== ready.kind) {
+        throw new AdmissionSessionV2Error("carrier_mismatch", "ready carrier does not match its artifact candidate");
+    }
+    if (ready.path !== config.path) {
+        throw new AdmissionSessionV2Error("path_mismatch", "ready carrier path does not match SessionV2 path");
+    }
+    requireExactCarrierCapacityV2(ready.inboundBidirectionalStreamCapacity, config.maxInboundStreams);
+}
+async function exchangeMessage(channel, rawFSB2, signal) {
+    const options = signalOptions(signal);
+    await channel.write(rawFSB2, options);
+    return await channel.read(options);
+}
+async function exchangeStream(stream, rawFSB2, signal) {
+    await writeAll(stream, rawFSB2, signal);
+    await raceAbort(stream.closeWrite(), signal);
+    const reader = new NativeExactReader(stream);
+    const header = await reader.readExactly(8, signal);
+    const reasonLength = new DataView(header.buffer, header.byteOffset, header.byteLength).getUint16(6, false);
+    if (reasonLength > 64)
+        throw new AdmissionSessionV2Error("invalid_fsa2", "FSA2 reason exceeds limit");
+    const rawFSA2 = concat(header, await reader.readExactly(reasonLength, signal));
+    await reader.expectCleanEOF(signal);
+    return rawFSA2;
+}
+export function requireExactCarrierCapacityV2(physical, logical) {
+    if (!validLogicalStreamCapacity(logical) || physical !== logical + 2) {
+        throw new AdmissionSessionV2Error("stream_capacity_mismatch", "carrier inbound bidirectional stream capacity does not match SessionV2 logical limit");
+    }
+}
+export function validateOutboundAdmissionV2(rawFSB2, config, carrier) {
+    let decoded;
+    try {
+        decoded = decodeFSB2RequestV2(rawFSB2);
+    }
+    catch (error) {
+        throw new AdmissionSessionV2Error("invalid_fsb2", error instanceof Error ? error.message : "invalid FSB2 request");
+    }
+    const request = decoded.request;
+    if (request.pathKind !== config.path) {
+        throw new AdmissionSessionV2Error("path_mismatch", "FSB2 path does not match SessionV2 path");
+    }
+    validateSessionContract(config);
+    const expectedRole = request.pathKind === "tunnel" && request.role === 2 ? "server" : "client";
+    if (config.role !== expectedRole) {
+        throw new AdmissionSessionV2Error("role_mismatch", "FSB2 role does not match SessionV2 role");
+    }
+    if (request.channel_id !== config.channelID ||
+        request.session_contract_hash_b64u !== base64urlEncode(config.sessionContractHash)) {
+        throw new AdmissionSessionV2Error("session_config_mismatch", "FSB2 session identity does not match SessionV2 config");
+    }
+    if (request.pathKind === "tunnel" && request.endpoint_instance_id !== config.localEndpointInstanceID) {
+        throw new AdmissionSessionV2Error("endpoint_mismatch", "FSB2 endpoint identity does not match SessionV2 config");
+    }
+    if (!bytesEqual(decoded.localAdmissionBinding, config.localAdmissionBinding)) {
+        throw new AdmissionSessionV2Error("admission_binding_mismatch", "FSB2 admission binding does not match SessionV2 config");
+    }
+    if (request.pathKind === "direct" && !bytesEqual(decoded.localAdmissionBinding, config.peerAdmissionBinding)) {
+        throw new AdmissionSessionV2Error("peer_admission_binding_mismatch", "direct FSB2 admission binding does not match SessionV2 peer binding");
+    }
+    const candidate = request.candidates.find((entry) => entry.id === request.chosen_candidate_id);
+    if (candidate?.carrier !== carrier) {
+        throw new AdmissionSessionV2Error("carrier_mismatch", "FSB2 chosen candidate does not match the carrier");
+    }
+}
+function validateSessionContract(config) {
+    const contract = config.sessionContract;
+    if (contract === undefined) {
+        throw new AdmissionSessionV2Error("session_config_mismatch", "admitted SessionV2 requires a validated session contract");
+    }
+    let hash;
+    let hashBase64URL;
+    let psk;
+    try {
+        hashBase64URL = computeSessionContractHashV2(contract).hashBase64URL;
+        hash = base64urlDecode(hashBase64URL);
+        psk = base64urlDecode(contract.e2ee_psk_b64u);
+    }
+    catch (error) {
+        throw new AdmissionSessionV2Error("session_config_mismatch", error instanceof Error ? error.message : "invalid session contract");
+    }
+    if (contract.contract_hash_b64u !== hashBase64URL ||
+        !bytesEqual(hash, config.sessionContractHash) ||
+        contract.channel_id !== config.channelID ||
+        contract.max_inbound_streams !== config.maxInboundStreams ||
+        contract.default_suite !== config.suite ||
+        !contract.allowed_suites.includes(config.suite) ||
+        !bytesEqual(psk, config.psk) ||
+        contract.selected_features !== 0 ||
+        (config.idleTimeoutMs ?? 60_000) !== contract.idle_timeout_seconds * 1_000 ||
+        (config.deadlines?.establishTimeoutMs ?? 30_000) !== contract.establish_timeout_seconds * 1_000 ||
+        (config.deadlines?.rekeyPrepareTimeoutMs ?? 10_000) !== contract.rekey_prepare_timeout_seconds * 1_000 ||
+        (config.deadlines?.rekeyCompletionTimeoutMs ?? 30_000) !== contract.rekey_completion_timeout_seconds * 1_000) {
+        throw new AdmissionSessionV2Error("session_config_mismatch", "SessionV2 config does not match the signed session contract");
+    }
+}
+function requireAdmissionSuccessV2(rawFSA2) {
+    const response = decodeFSA2ResponseV2(rawFSA2);
+    if (response.status !== AdmissionStatusV2.Success) {
+        throw new AdmissionSessionV2Error(response.reason, `Flowersec v2 admission rejected: ${response.reason}`);
+    }
+}
+class NativeExactReader {
+    stream;
+    chunks = [];
+    offset = 0;
+    bytes = 0;
+    constructor(stream) {
+        this.stream = stream;
+    }
+    async readExactly(length, signal) {
+        while (this.bytes < length) {
+            throwIfAborted(signal);
+            const chunk = await raceAbort(this.stream.read(), signal);
+            if (chunk === null)
+                throw new AdmissionSessionV2Error("truncated_fsa2", "unexpected admission EOF");
+            if (chunk.length === 0)
+                continue;
+            this.chunks.push(chunk);
+            this.bytes += chunk.length;
+        }
+        const output = new Uint8Array(length);
+        let written = 0;
+        while (written < length) {
+            const chunk = this.chunks[0];
+            const take = Math.min(length - written, chunk.length - this.offset);
+            output.set(chunk.subarray(this.offset, this.offset + take), written);
+            written += take;
+            this.offset += take;
+            this.bytes -= take;
+            if (this.offset === chunk.length) {
+                this.chunks.shift();
+                this.offset = 0;
+            }
+        }
+        return output;
+    }
+    async expectCleanEOF(signal) {
+        if (this.bytes !== 0)
+            throw new AdmissionSessionV2Error("invalid_fsa2", "trailing bytes after FSA2");
+        while (true) {
+            throwIfAborted(signal);
+            const chunk = await raceAbort(this.stream.read(), signal);
+            if (chunk === null)
+                return;
+            if (chunk.length !== 0)
+                throw new AdmissionSessionV2Error("invalid_fsa2", "trailing bytes after FSA2");
+        }
+    }
+}
+async function writeAll(stream, value, signal) {
+    let offset = 0;
+    while (offset < value.length) {
+        throwIfAborted(signal);
+        const written = await raceAbort(stream.write(value.subarray(offset)), signal);
+        if (written < 1 || written > value.length - offset) {
+            throw new AdmissionSessionV2Error("short_write", "short admission write");
+        }
+        offset += written;
+    }
+}
+function signalOptions(signal) {
+    return signal === undefined ? {} : { signal };
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted === true)
+        throw new AdmissionSessionV2Error("aborted", "admission aborted");
+}
+async function raceAbort(promise, signal) {
+    if (signal === undefined)
+        return await promise;
+    throwIfAborted(signal);
+    return await new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason instanceof Error
+            ? signal.reason
+            : new AdmissionSessionV2Error("aborted", "admission aborted"));
+        signal.addEventListener("abort", abort, { once: true });
+        void promise.then((value) => { signal.removeEventListener("abort", abort); resolve(value); }, (error) => { signal.removeEventListener("abort", abort); reject(error); });
+    });
+}
+function concat(left, right) {
+    const output = new Uint8Array(left.length + right.length);
+    output.set(left);
+    output.set(right, left.length);
+    return output;
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+function validLogicalStreamCapacity(logical) {
+    return Number.isInteger(logical) && logical >= 1 && logical <= 128;
+}
+function bytesEqual(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let different = 0;
+    for (let index = 0; index < left.length; index++)
+        different |= left[index] ^ right[index];
+    return different === 0;
+}

package/dist/connector/sessionAcceptor.d.ts

@@ -0,0 +1,16 @@
+import { AdmissionStatusV2, type ArtifactV2, type DecodedFSB2RequestV2 } from "../v2/artifact.js";
+import { type NativeCarrierSessionV2 } from "../v2/carrier.js";
+import type { SessionProtocolRuntimeV2, SessionV2 as InternalSessionV2 } from "../v2/session.js";
+export type AdmissionDecisionV2 = Readonly<{
+    accepted: true;
+    artifact: ArtifactV2;
+}> | Readonly<{
+    accepted: false;
+    status: AdmissionStatusV2.Reject | AdmissionStatusV2.Retryable;
+    reason: string;
+}>;
+export type AdmissionAuthorizerV2 = (request: DecodedFSB2RequestV2, signal?: AbortSignal) => Promise<AdmissionDecisionV2>;
+export declare function acceptNativeSessionV2(carrier: NativeCarrierSessionV2, authorize: AdmissionAuthorizerV2, options: Readonly<{
+    runtime: SessionProtocolRuntimeV2;
+    signal?: AbortSignal;
+}>): Promise<InternalSessionV2>;

package/dist/connector/sessionAcceptor.js

@@ -0,0 +1,114 @@
+import { AdmissionStatusV2, decodeFSB2RequestV2, encodeFSA2ResponseV2, } from "../v2/artifact.js";
+import { adaptNativeCarrierSessionV2 } from "../v2/carrier.js";
+import { establishSessionV2 } from "../v2/session.js";
+import { AdmissionSessionV2Error } from "../v2/admissionError.js";
+import { sessionConfigFromArtifactV2 } from "./sessionConfig.js";
+export async function acceptNativeSessionV2(carrier, authorize, options) {
+    const admission = carrier.kind === "webtransport"
+        ? await carrier.openStream(signalOptions(options.signal))
+        : await carrier.acceptStream(signalOptions(options.signal));
+    try {
+        const rawFSB2 = await readFSB2(admission, options.signal);
+        const decoded = decodeFSB2RequestV2(rawFSB2);
+        const decision = await authorize(decoded, options.signal);
+        const response = decision.accepted
+            ? { status: AdmissionStatusV2.Success, reason: "" }
+            : { status: decision.status, reason: decision.reason };
+        await writeAll(admission, encodeFSA2ResponseV2(response), options.signal);
+        await raceAbort(admission.closeWrite(), options.signal);
+        if (!decision.accepted) {
+            throw new AdmissionSessionV2Error(decision.reason, `Flowersec v2 admission rejected: ${decision.reason}`);
+        }
+        return await establishSessionV2(adaptNativeCarrierSessionV2(carrier), sessionConfigFromArtifactV2(decision.artifact, rawFSB2, options.runtime, undefined, "server"), signalOptions(options.signal));
+    }
+    catch (error) {
+        admission.abort(asError(error));
+        carrier.abort({ code: 6, reason: "admission failed" });
+        throw error;
+    }
+}
+async function readFSB2(stream, signal) {
+    const reader = new NativeReader(stream);
+    const header = await reader.readExactly(12, signal);
+    const length = new DataView(header.buffer, header.byteOffset, header.byteLength).getUint32(8, false);
+    if (length < 1 || length > 32_768)
+        throw new Error("invalid FSB2 payload length");
+    const payload = await reader.readExactly(length, signal);
+    await reader.expectEOF(signal);
+    const raw = new Uint8Array(header.length + payload.length);
+    raw.set(header);
+    raw.set(payload, header.length);
+    return raw;
+}
+class NativeReader {
+    stream;
+    chunks = [];
+    offset = 0;
+    available = 0;
+    constructor(stream) {
+        this.stream = stream;
+    }
+    async readExactly(length, signal) {
+        while (this.available < length) {
+            const chunk = await raceAbort(this.stream.read(), signal);
+            if (chunk === null)
+                throw new Error("truncated admission stream");
+            if (chunk.length === 0)
+                continue;
+            this.chunks.push(chunk);
+            this.available += chunk.length;
+        }
+        const result = new Uint8Array(length);
+        let written = 0;
+        while (written < length) {
+            const chunk = this.chunks[0];
+            const take = Math.min(length - written, chunk.length - this.offset);
+            result.set(chunk.subarray(this.offset, this.offset + take), written);
+            this.offset += take;
+            this.available -= take;
+            written += take;
+            if (this.offset === chunk.length) {
+                this.chunks.shift();
+                this.offset = 0;
+            }
+        }
+        return result;
+    }
+    async expectEOF(signal) {
+        if (this.available !== 0)
+            throw new Error("trailing bytes after FSB2");
+        while (true) {
+            const chunk = await raceAbort(this.stream.read(), signal);
+            if (chunk === null)
+                return;
+            if (chunk.length !== 0)
+                throw new Error("trailing bytes after FSB2");
+        }
+    }
+}
+async function writeAll(stream, value, signal) {
+    let offset = 0;
+    while (offset < value.length) {
+        const written = await raceAbort(stream.write(value.subarray(offset)), signal);
+        if (written < 1 || written > value.length - offset)
+            throw new Error("short admission write");
+        offset += written;
+    }
+}
+function signalOptions(signal) {
+    return signal === undefined ? {} : { signal };
+}
+async function raceAbort(promise, signal) {
+    if (signal === undefined)
+        return await promise;
+    if (signal.aborted)
+        throw signal.reason;
+    return await new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        void promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}

package/dist/connector/sessionConfig.d.ts

@@ -0,0 +1,3 @@
+import { type ArtifactV2 } from "../v2/artifact.js";
+import type { SessionConfigV2, SessionDeadlineFactoryV2, SessionProtocolRuntimeV2 } from "../v2/session.js";
+export declare function sessionConfigFromArtifactV2(artifact: ArtifactV2, rawFSB2: Uint8Array, runtime: SessionProtocolRuntimeV2, deadlineFactory?: SessionDeadlineFactoryV2, role?: SessionConfigV2["role"]): SessionConfigV2;

package/dist/connector/sessionConfig.js

@@ -0,0 +1,30 @@
+import { admissionBindingV2 } from "../v2/artifact.js";
+import { base64urlDecode } from "../utils/base64url.js";
+const SESSION_CLOSE_TIMEOUT_MS = 5_000;
+export function sessionConfigFromArtifactV2(artifact, rawFSB2, runtime, deadlineFactory, role) {
+    const localBinding = admissionBindingV2(rawFSB2);
+    const tunnel = artifact.path.kind === "tunnel" ? artifact.path : undefined;
+    return {
+        role: role ?? (tunnel?.role === 2 ? "server" : "client"),
+        path: artifact.path.kind,
+        channelID: artifact.session.channel_id,
+        sessionContractHash: base64urlDecode(artifact.session.contract_hash_b64u),
+        suite: artifact.session.default_suite,
+        psk: base64urlDecode(artifact.session.e2ee_psk_b64u),
+        maxInboundStreams: artifact.session.max_inbound_streams,
+        sessionContract: artifact.session,
+        idleTimeoutMs: artifact.session.idle_timeout_seconds * 1_000,
+        closeTimeoutMs: SESSION_CLOSE_TIMEOUT_MS,
+        runtime,
+        localAdmissionBinding: localBinding,
+        peerAdmissionBinding: tunnel === undefined ? localBinding : new Uint8Array(32),
+        localEndpointInstanceID: tunnel?.local_endpoint_instance_id ?? "",
+        expectedPeerEndpointInstanceID: tunnel?.expected_peer_endpoint_instance_id ?? "",
+        deadlines: {
+            establishTimeoutMs: artifact.session.establish_timeout_seconds * 1_000,
+            rekeyPrepareTimeoutMs: artifact.session.rekey_prepare_timeout_seconds * 1_000,
+            rekeyCompletionTimeoutMs: artifact.session.rekey_completion_timeout_seconds * 1_000,
+            ...(deadlineFactory === undefined ? {} : { factory: deadlineFactory }),
+        },
+    };
+}