@floegence/flowersec-core 0.27.0 → 2.1.0

package/dist/endpoint/index.js

@@ -1,557 +0,0 @@
-import { Role as ControlRole, assertChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
-import { Role as TunnelRole } from "../gen/flowersec/tunnel/v1.gen.js";
-import { withAbortAndTimeout } from "../client-connect/common.js";
-import { assertTunnelGrantContract, assertValidPSK, prepareChannelId } from "../client-connect/contract.js";
-import { enforceTransportSecurity } from "../client-connect/transportSecurity.js";
-import { SDK_DEFAULTS } from "../defaults.js";
-import { serverHandshake, ServerHandshakeCache } from "../e2ee/handshake.js";
-import { decodeHandshakeFrame } from "../e2ee/framing.js";
-import { HANDSHAKE_TYPE_INIT, PROTOCOL_VERSION } from "../e2ee/constants.js";
-import { readStreamHello, writeStreamHello } from "../streamhello/streamHello.js";
-import { ByteReader } from "../yamux/byteReader.js";
-import { isYamuxPingTimeoutError } from "../yamux/errors.js";
-import { YamuxSession } from "../yamux/session.js";
-import { RpcServer } from "../rpc/server.js";
-import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
-import { AbortError, FlowersecError, TimeoutError, throwIfAborted } from "../utils/errors.js";
-import { WebSocketBinaryTransport } from "../ws-client/binaryTransport.js";
-export class Session {
-    secure;
-    mux;
-    path;
-    endpointInstanceId;
-    streams = [];
-    waiters = [];
-    terminalError;
-    constructor(path, secure, mux, endpointInstanceId) {
-        this.secure = secure;
-        this.mux = mux;
-        this.path = path;
-        this.endpointInstanceId = endpointInstanceId;
-    }
-    static create(path, secure, options = {}) {
-        let session;
-        const mux = new YamuxSession({
-            read: () => secure.read(),
-            write: (bytes) => secure.write(bytes),
-            close: () => secure.close(),
-        }, {
-            client: false,
-            ...(options.yamuxLimits === undefined ? {} : { limits: options.yamuxLimits }),
-            onIncomingStream: (stream) => session.pushStream(stream),
-            onTerminal: (error) => session.fail(error),
-        });
-        session = new Session(path, secure, mux, options.endpointInstanceId);
-        return session;
-    }
-    async openStream(kind, options = {}) {
-        const streamKind = normalizeStreamKind(kind, this.path);
-        const stream = await this.mux.openStream(options);
-        try {
-            await writeStreamHello((bytes) => stream.write(bytes), streamKind);
-            return stream;
-        }
-        catch (error) {
-            await stream.reset(asError(error));
-            throw new FlowersecError({ path: this.path, stage: "rpc", code: "stream_hello_failed", message: "failed to write stream hello", cause: error });
-        }
-    }
-    async acceptStream(options = {}) {
-        const stream = await this.acceptRawStream(options.signal);
-        try {
-            const reader = new ByteReader(() => stream.read());
-            const hello = await readStreamHello((length) => reader.readExactly(length));
-            return { kind: hello.kind, stream };
-        }
-        catch (error) {
-            await stream.reset(asError(error));
-            throw new FlowersecError({ path: this.path, stage: "rpc", code: "stream_hello_failed", message: "failed to read stream hello", cause: error });
-        }
-    }
-    async serveRPC(router, options = {}) {
-        while (true) {
-            const accepted = await this.acceptStream(options.signal === undefined ? {} : { signal: options.signal });
-            if (accepted.kind !== "rpc") {
-                await accepted.stream.reset(new Error(`unexpected stream kind ${accepted.kind}`));
-                continue;
-            }
-            const reader = new ByteReader(() => accepted.stream.read());
-            const server = new RpcServer({
-                readExactly: (length) => reader.readExactly(length),
-                write: (bytes) => accepted.stream.write(bytes),
-                close: (error) => { void accepted.stream.reset(asError(error)); },
-            }, options, router);
-            await server.serve(options.signal);
-            return;
-        }
-    }
-    async probeLiveness(timeoutMs = SDK_DEFAULTS.transport.handshakeTimeoutMs) {
-        try {
-            return await this.mux.probeLiveness(timeoutMs);
-        }
-        catch (error) {
-            throw new FlowersecError({
-                path: this.path,
-                stage: "yamux",
-                code: isYamuxPingTimeoutError(error) ? "timeout" : "ping_failed",
-                message: "endpoint liveness probe failed",
-                cause: error,
-            });
-        }
-    }
-    async rekey() {
-        try {
-            await this.secure.rekeyNow();
-        }
-        catch (error) {
-            throw new FlowersecError({ path: this.path, stage: "secure", code: "rekey_failed", message: "endpoint rekey failed", cause: error });
-        }
-    }
-    close() {
-        this.fail(new Error("endpoint session closed"));
-        this.mux.close();
-        this.secure.close();
-    }
-    pushStream(stream) {
-        const waiter = this.waiters.shift();
-        if (waiter == null) {
-            this.streams.push(stream);
-            return;
-        }
-        cleanupWaiter(waiter);
-        waiter.resolve(stream);
-    }
-    acceptRawStream(signal) {
-        if (signal?.aborted)
-            return Promise.reject(new AbortError("accept stream aborted"));
-        if (this.terminalError != null)
-            return Promise.reject(this.terminalError);
-        const stream = this.streams.shift();
-        if (stream != null)
-            return Promise.resolve(stream);
-        return new Promise((resolve, reject) => {
-            const waiter = { resolve, reject, ...(signal === undefined ? {} : { signal }) };
-            waiter.onAbort = () => {
-                const index = this.waiters.indexOf(waiter);
-                if (index >= 0)
-                    this.waiters.splice(index, 1);
-                cleanupWaiter(waiter);
-                reject(new AbortError("accept stream aborted"));
-            };
-            signal?.addEventListener("abort", waiter.onAbort, { once: true });
-            this.waiters.push(waiter);
-        });
-    }
-    fail(error) {
-        if (this.terminalError != null)
-            return;
-        this.terminalError = error;
-        for (const waiter of this.waiters.splice(0)) {
-            cleanupWaiter(waiter);
-            waiter.reject(error);
-        }
-    }
-}
-export async function acceptDirect(websocket, handshake, options = {}) {
-    const handshakeTimeoutMs = options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs;
-    if (!Number.isFinite(handshakeTimeoutMs) || handshakeTimeoutMs < 0) {
-        throw new FlowersecError({
-            path: "direct",
-            stage: "validate",
-            code: "invalid_option",
-            message: "handshakeTimeoutMs must be a non-negative number",
-        });
-    }
-    await enforceIncomingDirectTransport(options);
-    const deadline = createHandshakeDeadline(handshakeTimeoutMs);
-    const transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
-    return await establishSession("direct", transport, handshake, options, undefined, deadline);
-}
-export async function acceptDirectResolved(websocket, resolver, options = {}) {
-    const handshakeTimeoutMs = options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs;
-    if (!Number.isFinite(handshakeTimeoutMs) || handshakeTimeoutMs < 0) {
-        throw new FlowersecError({
-            path: "direct",
-            stage: "validate",
-            code: "invalid_option",
-            message: "handshakeTimeoutMs must be a non-negative number",
-        });
-    }
-    await enforceIncomingDirectTransport(options);
-    const deadline = createHandshakeDeadline(handshakeTimeoutMs);
-    const transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
-    let first;
-    try {
-        first = await runHandshakeStep(deadline, options.signal, () => transport.readBinary({
-            ...(options.signal === undefined ? {} : { signal: options.signal }),
-            timeoutMs: remainingHandshakeTimeoutMs(deadline),
-        }));
-    }
-    catch (error) {
-        transport.close();
-        throw endpointHandshakeError("direct", error, "failed to read handshake init");
-    }
-    let init;
-    let channelId;
-    try {
-        const decoded = decodeHandshakeFrame(first, options.maxHandshakePayload ?? SDK_DEFAULTS.e2ee.maxHandshakePayloadBytes);
-        if (decoded.handshakeType !== HANDSHAKE_TYPE_INIT)
-            throw new Error("expected handshake init");
-        init = JSON.parse(new TextDecoder().decode(decoded.payloadJsonUtf8));
-        if (init.version !== PROTOCOL_VERSION || init.role !== 1 || (init.suite !== 1 && init.suite !== 2))
-            throw new Error("invalid handshake init");
-        channelId = prepareChannelId(init.channel_id, "direct");
-        if (channelId !== init.channel_id) {
-            throw new FlowersecError({
-                path: "direct",
-                stage: "validate",
-                code: "invalid_input",
-                message: "channel_id must not have leading or trailing whitespace",
-            });
-        }
-    }
-    catch (error) {
-        transport.close();
-        if (error instanceof FlowersecError)
-            throw error;
-        throw new FlowersecError({ path: "direct", stage: "handshake", code: "handshake_failed", message: "invalid handshake init", cause: error });
-    }
-    let credential;
-    try {
-        credential = await runHandshakeStep(deadline, options.signal, () => resolver({
-            channelId,
-            version: init.version,
-            suite: init.suite,
-            clientFeatures: init.client_features >>> 0,
-        }));
-    }
-    catch (error) {
-        transport.close();
-        const interrupted = endpointHandshakeInterruption("direct", error);
-        if (interrupted != null)
-            throw interrupted;
-        throw new FlowersecError({ path: "direct", stage: "validate", code: "resolve_failed", message: "credential resolution failed", cause: error });
-    }
-    const replay = new PrefetchedTransport(transport, first);
-    return await establishSession("direct", replay, {
-        channelId,
-        suite: init.suite,
-        ...credential,
-    }, options, undefined, deadline);
-}
-export async function connectTunnel(grantInput, options) {
-    let grant;
-    try {
-        grant = assertChannelInitGrant(unwrapServerGrant(grantInput));
-    }
-    catch (error) {
-        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "invalid_input", message: "invalid ChannelInitGrant", cause: error });
-    }
-    assertTunnelGrantContract(grant, ControlRole.Role_server);
-    const channelId = prepareChannelId(grant.channel_id, "tunnel");
-    const tunnelUrl = grant.tunnel_url.trim();
-    if (tunnelUrl === "")
-        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_tunnel_url", message: "missing tunnel_url" });
-    if (grant.token.trim() === "")
-        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_token", message: "missing token" });
-    if (grant.channel_init_expire_at_unix_s <= 0)
-        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_init_exp", message: "missing channel init expiry" });
-    const origin = options.origin.trim();
-    if (origin === "")
-        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_origin", message: "missing origin" });
-    const connectTimeoutMs = options.connectTimeoutMs ?? SDK_DEFAULTS.transport.connectTimeoutMs;
-    if (!Number.isFinite(connectTimeoutMs) || connectTimeoutMs < 0) {
-        throw new FlowersecError({
-            path: "tunnel",
-            stage: "validate",
-            code: "invalid_option",
-            message: "connectTimeoutMs must be a non-negative number",
-        });
-    }
-    const handshakeTimeoutMs = options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs;
-    if (!Number.isFinite(handshakeTimeoutMs) || handshakeTimeoutMs < 0) {
-        throw new FlowersecError({
-            path: "tunnel",
-            stage: "validate",
-            code: "invalid_option",
-            message: "handshakeTimeoutMs must be a non-negative number",
-        });
-    }
-    const psk = assertValidPSK(grant.e2ee_psk_b64u, "tunnel");
-    await enforceTransportSecurity({ rawUrl: tunnelUrl, path: "tunnel", ...(options.transportSecurityPolicy === undefined ? {} : { policy: options.transportSecurityPolicy }) });
-    const endpointInstanceId = normalizeEndpointInstanceId(options.endpointInstanceId);
-    let transport;
-    try {
-        throwIfAborted(options.signal, "connect aborted");
-        const websocket = options.wsFactory(tunnelUrl, origin);
-        transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
-        await waitForOpen(websocket, connectTimeoutMs, options.signal);
-        throwIfAborted(options.signal, "connect aborted");
-        const attach = {
-            v: 1,
-            channel_id: channelId,
-            role: TunnelRole.Role_server,
-            token: grant.token.trim(),
-            endpoint_instance_id: endpointInstanceId,
-        };
-        websocket.send(JSON.stringify(attach));
-        return await establishSession("tunnel", transport, {
-            channelId,
-            suite: grant.default_suite,
-            psk,
-            initExpireAtUnixS: grant.channel_init_expire_at_unix_s,
-        }, options, endpointInstanceId);
-    }
-    catch (error) {
-        transport?.close();
-        if (error instanceof FlowersecError)
-            throw error;
-        if (error instanceof TimeoutError) {
-            throw new FlowersecError({ path: "tunnel", stage: "connect", code: "timeout", message: "endpoint tunnel connect timed out", cause: error });
-        }
-        if (error instanceof AbortError) {
-            throw new FlowersecError({ path: "tunnel", stage: "connect", code: "canceled", message: "endpoint tunnel connect canceled", cause: error });
-        }
-        throw new FlowersecError({ path: "tunnel", stage: "connect", code: "dial_failed", message: "endpoint tunnel connect failed", cause: error });
-    }
-}
-async function establishSession(path, transport, handshake, options, endpointInstanceId, deadline) {
-    let psk;
-    try {
-        psk = normalizePSK(handshake.psk, path);
-    }
-    catch (error) {
-        transport.close();
-        throw error;
-    }
-    try {
-        const startHandshake = () => serverHandshake(transport, options.handshakeCache ?? new ServerHandshakeCache(), {
-            channelId: prepareChannelId(handshake.channelId, path),
-            suite: handshake.suite,
-            psk,
-            serverFeatures: options.serverFeatures ?? 0,
-            initExpireAtUnixS: handshake.initExpireAtUnixS,
-            clockSkewSeconds: Math.ceil((options.handshakeClockSkewMs ?? SDK_DEFAULTS.transport.handshakeClockSkewMs) / 1000),
-            maxHandshakePayload: options.maxHandshakePayload ?? SDK_DEFAULTS.e2ee.maxHandshakePayloadBytes,
-            maxRecordBytes: options.maxRecordBytes ?? SDK_DEFAULTS.e2ee.maxRecordBytes,
-            outboundRecordChunkBytes: options.outboundRecordChunkBytes ?? SDK_DEFAULTS.e2ee.outboundRecordChunkBytes,
-            maxBufferedBytes: options.maxBufferedBytes ?? SDK_DEFAULTS.e2ee.maxInboundBufferedBytes,
-            maxOutboundBufferedBytes: options.maxOutboundBufferedBytes ?? SDK_DEFAULTS.e2ee.maxOutboundBufferedBytes,
-            timeoutMs: deadline == null
-                ? options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs
-                : remainingHandshakeTimeoutMs(deadline),
-            ...(options.signal === undefined ? {} : { signal: options.signal }),
-        });
-        const secure = deadline == null
-            ? await startHandshake()
-            : await runHandshakeStep(deadline, options.signal, startHandshake);
-        try {
-            if (handshake.commitAuthenticated != null) {
-                if (deadline == null) {
-                    await handshake.commitAuthenticated();
-                }
-                else {
-                    await runHandshakeStep(deadline, options.signal, handshake.commitAuthenticated);
-                }
-            }
-        }
-        catch (error) {
-            secure.close();
-            const interrupted = endpointHandshakeInterruption(path, error);
-            if (interrupted != null)
-                throw interrupted;
-            throw new FlowersecError({ path, stage: "handshake", code: "credential_commit_failed", message: "credential commit failed", cause: error });
-        }
-        try {
-            throwIfAborted(options.signal, "handshake canceled");
-            if (deadline != null)
-                remainingHandshakeTimeoutMs(deadline);
-            return Session.create(path, secure, {
-                ...(options.yamuxLimits === undefined ? {} : { yamuxLimits: options.yamuxLimits }),
-                ...(endpointInstanceId === undefined ? {} : { endpointInstanceId }),
-            });
-        }
-        catch (error) {
-            secure.close();
-            throw error;
-        }
-    }
-    catch (error) {
-        transport.close();
-        if (error instanceof FlowersecError)
-            throw error;
-        const interrupted = endpointHandshakeInterruption(path, error);
-        if (interrupted != null)
-            throw interrupted;
-        throw new FlowersecError({ path, stage: "handshake", code: "handshake_failed", message: "endpoint handshake failed", cause: error });
-    }
-    finally {
-        psk.fill(0);
-    }
-}
-class PrefetchedTransport {
-    inner;
-    first;
-    constructor(inner, first) {
-        this.inner = inner;
-        this.first = first;
-    }
-    readBinary(options) {
-        if (this.first != null) {
-            const first = this.first;
-            this.first = undefined;
-            return Promise.resolve(first);
-        }
-        return this.inner.readBinary(options);
-    }
-    writeBinary(frame, options) {
-        return this.inner.writeBinary(frame, options);
-    }
-    close() {
-        this.inner.close();
-    }
-}
-function normalizePSK(input, path) {
-    try {
-        const psk = typeof input === "string" ? base64urlDecode(input.trim()) : input.slice();
-        if (psk.length !== 32)
-            throw new Error("psk must be 32 bytes");
-        return psk;
-    }
-    catch (error) {
-        throw new FlowersecError({ path, stage: "validate", code: "invalid_psk", message: "invalid psk", cause: error });
-    }
-}
-function normalizeEndpointInstanceId(input) {
-    const value = input ?? randomEndpointInstanceId();
-    try {
-        const bytes = base64urlDecode(value);
-        if (bytes.length < 16 || bytes.length > 32)
-            throw new Error("endpoint instance ID must decode to 16..32 bytes");
-    }
-    catch (error) {
-        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "invalid_endpoint_instance_id", message: "invalid endpoint instance ID", cause: error });
-    }
-    return value;
-}
-function randomEndpointInstanceId() {
-    const bytes = new Uint8Array(24);
-    crypto.getRandomValues(bytes);
-    return base64urlEncode(bytes);
-}
-function normalizeStreamKind(kind, path) {
-    const value = kind.trim();
-    if (value === "")
-        throw new FlowersecError({ path, stage: "rpc", code: "missing_stream_kind", message: "missing stream kind" });
-    return value;
-}
-function unwrapServerGrant(input) {
-    if (typeof input !== "object" || input == null || Array.isArray(input))
-        return input;
-    const record = input;
-    return record["grant_server"] ?? input;
-}
-function webSocketTransportOptions(options) {
-    return options.webSocketLimits === undefined ? {} : { webSocketLimits: options.webSocketLimits };
-}
-async function enforceIncomingDirectTransport(options) {
-    const rawUrl = options.secureTransport === false ? "ws://127.0.0.1/" : "wss://127.0.0.1/";
-    await enforceTransportSecurity({ rawUrl, path: "direct", ...(options.transportSecurityPolicy === undefined ? {} : { policy: options.transportSecurityPolicy }) });
-}
-function waitForOpen(websocket, timeoutMs, signal) {
-    if (!Number.isFinite(timeoutMs) || timeoutMs < 0)
-        return Promise.reject(new RangeError("connectTimeoutMs must be non-negative"));
-    try {
-        throwIfAborted(signal, "connect aborted");
-    }
-    catch (error) {
-        return Promise.reject(error);
-    }
-    if (websocket.readyState === 1)
-        return Promise.resolve();
-    if (websocket.readyState >= 2)
-        return Promise.reject(new Error("websocket closed before open"));
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        let timer;
-        const cleanup = () => {
-            if (timer != null)
-                clearTimeout(timer);
-            websocket.removeEventListener("open", onOpen);
-            websocket.removeEventListener("error", onError);
-            websocket.removeEventListener("close", onClose);
-            signal?.removeEventListener("abort", onAbort);
-        };
-        const finish = (error) => {
-            if (settled)
-                return;
-            settled = true;
-            cleanup();
-            if (error == null)
-                resolve();
-            else
-                reject(error);
-        };
-        const onOpen = () => finish();
-        const onError = () => finish(new Error("websocket open failed"));
-        const onClose = () => finish(new Error("websocket closed before open"));
-        const onAbort = () => finish(new AbortError("connect aborted"));
-        websocket.addEventListener("open", onOpen);
-        websocket.addEventListener("error", onError);
-        websocket.addEventListener("close", onClose);
-        signal?.addEventListener("abort", onAbort, { once: true });
-        if (signal?.aborted) {
-            onAbort();
-        }
-        else if (websocket.readyState === 1) {
-            onOpen();
-        }
-        else if (websocket.readyState >= 2) {
-            onClose();
-        }
-        if (!settled && timeoutMs > 0)
-            timer = setTimeout(() => finish(new TimeoutError("websocket open timeout")), timeoutMs);
-    });
-}
-function cleanupWaiter(waiter) {
-    if (waiter.onAbort != null)
-        waiter.signal?.removeEventListener("abort", waiter.onAbort);
-}
-function createHandshakeDeadline(timeoutMs) {
-    return timeoutMs > 0 ? { expiresAtMs: Date.now() + timeoutMs } : {};
-}
-function remainingHandshakeTimeoutMs(deadline) {
-    if (deadline.expiresAtMs === undefined)
-        return 0;
-    const remaining = deadline.expiresAtMs - Date.now();
-    if (remaining <= 0)
-        throw new TimeoutError("handshake timeout");
-    return remaining;
-}
-async function runHandshakeStep(deadline, signal, operation) {
-    throwIfAborted(signal, "handshake canceled");
-    const timeoutMs = remainingHandshakeTimeoutMs(deadline);
-    const result = await withAbortAndTimeout(Promise.resolve().then(operation), {
-        timeoutMs,
-        ...(signal === undefined ? {} : { signal }),
-    });
-    throwIfAborted(signal, "handshake canceled");
-    remainingHandshakeTimeoutMs(deadline);
-    return result;
-}
-function endpointHandshakeInterruption(path, error) {
-    if (error instanceof TimeoutError) {
-        return new FlowersecError({ path, stage: "handshake", code: "timeout", message: "endpoint handshake timed out", cause: error });
-    }
-    if (error instanceof AbortError) {
-        return new FlowersecError({ path, stage: "handshake", code: "canceled", message: "endpoint handshake canceled", cause: error });
-    }
-    return undefined;
-}
-function endpointHandshakeError(path, error, message) {
-    return endpointHandshakeInterruption(path, error)
-        ?? new FlowersecError({ path, stage: "handshake", code: "handshake_failed", message, cause: error });
-}
-function asError(error) {
-    return error instanceof Error ? error : new Error(String(error));
-}

package/dist/endpoint/node.d.ts

@@ -1,9 +0,0 @@
-import type { WebSocketLike } from "../ws-client/binaryTransport.js";
-import { type DirectAcceptOptions, type DirectCredentialResolver, type DirectHandshakeCredential, type Session, type Suite, type TunnelEndpointOptions } from "./index.js";
-export declare function adaptNodeWebSocket(websocket: unknown): WebSocketLike;
-export declare function acceptDirectNode(websocket: unknown, handshake: Readonly<{
-    channelId: string;
-    suite: Suite;
-}> & DirectHandshakeCredential, options?: DirectAcceptOptions): Promise<Session>;
-export declare function acceptDirectResolvedNode(websocket: unknown, resolver: DirectCredentialResolver, options?: DirectAcceptOptions): Promise<Session>;
-export declare function connectTunnelEndpointNode(grant: unknown, options: Omit<TunnelEndpointOptions, "wsFactory">): Promise<Session>;

package/dist/endpoint/node.js

@@ -1,51 +0,0 @@
-import { createNodeWsFactory } from "../node/wsFactory.js";
-import { acceptDirect, acceptDirectResolved, connectTunnel, } from "./index.js";
-export function adaptNodeWebSocket(websocket) {
-    const raw = websocket;
-    if (raw == null || typeof raw.send !== "function" || typeof raw.close !== "function") {
-        throw new TypeError("a Node WebSocket is required");
-    }
-    if (typeof raw.addEventListener === "function" && typeof raw.removeEventListener === "function") {
-        return raw;
-    }
-    const listeners = new Map();
-    return {
-        get binaryType() { return String(raw.binaryType ?? "nodebuffer"); },
-        set binaryType(value) { raw.binaryType = value; },
-        get readyState() { return Number(raw.readyState); },
-        get bufferedAmount() { return Number(raw.bufferedAmount ?? 0); },
-        send(data) { raw.send(data); },
-        close(code, reason) { raw.close(code, reason); },
-        addEventListener(type, listener) {
-            const wrapped = (...args) => {
-                if (type === "message")
-                    listener({ data: args[0] });
-                else if (type === "close")
-                    listener({ code: args[0], reason: args[1]?.toString?.() ?? "" });
-                else
-                    listener(args[0]);
-            };
-            const byListener = listeners.get(type) ?? new Map();
-            byListener.set(listener, wrapped);
-            listeners.set(type, byListener);
-            raw.on(type, wrapped);
-        },
-        removeEventListener(type, listener) {
-            const byListener = listeners.get(type);
-            const wrapped = byListener?.get(listener);
-            if (wrapped == null)
-                return;
-            byListener.delete(listener);
-            raw.off(type, wrapped);
-        },
-    };
-}
-export function acceptDirectNode(websocket, handshake, options = {}) {
-    return acceptDirect(adaptNodeWebSocket(websocket), handshake, options);
-}
-export function acceptDirectResolvedNode(websocket, resolver, options = {}) {
-    return acceptDirectResolved(adaptNodeWebSocket(websocket), resolver, options);
-}
-export function connectTunnelEndpointNode(grant, options) {
-    return connectTunnel(grant, { ...options, wsFactory: createNodeWsFactory() });
-}

package/dist/gen/flowersec/controlplane/v1.gen.d.ts

@@ -1,36 +0,0 @@
-/** Endpoint role for tunnel attach. */
-export declare enum Role {
-    /** Client endpoint. */
-    Role_client = 1,
-    /** Server endpoint. */
-    Role_server = 2
-}
-/** E2EE cipher suite identifier. */
-export declare enum Suite {
-    /** P-256 + HKDF-SHA256 + AES-256-GCM. */
-    Suite_P256_HKDF_SHA256_AES_256_GCM = 2,
-    /** X25519 + HKDF-SHA256 + AES-256-GCM. */
-    Suite_X25519_HKDF_SHA256_AES_256_GCM = 1
-}
-/** Grant issued by controlplane to attach and start E2EE. */
-export interface ChannelInitGrant {
-    /** WebSocket URL of the tunnel server. */
-    tunnel_url: string;
-    /** Channel identifier shared by both endpoints. */
-    channel_id: string;
-    /** Unix timestamp when the grant expires. */
-    channel_init_expire_at_unix_s: number;
-    /** Server idle timeout hint in seconds. */
-    idle_timeout_seconds: number;
-    /** Role for this grant (client or server). */
-    role: Role;
-    /** Signed tunnel attach token. */
-    token: string;
-    /** Base64url-encoded 32-byte PSK. */
-    e2ee_psk_b64u: string;
-    /** Allowed E2EE cipher suites. */
-    allowed_suites: Suite[];
-    /** Default E2EE cipher suite. */
-    default_suite: Suite;
-}
-export declare function assertChannelInitGrant(v: unknown): ChannelInitGrant;