@floegence/flowersec-core 0.27.0 → 2.1.0

package/dist/streamio/index.js

@@ -1,87 +0,0 @@
-import { DEFAULT_MAX_JSON_FRAME_BYTES, readJsonFrame, writeJsonFrame } from "../framing/jsonframe.js";
-import { AbortError, throwIfAborted } from "../utils/errors.js";
-import { ByteReader } from "../yamux/byteReader.js";
-function abortReasonToError(signal) {
-    const r = signal.reason;
-    if (r instanceof Error)
-        return r;
-    if (typeof r === "string" && r !== "")
-        return new AbortError(r);
-    return new AbortError("aborted");
-}
-function bindAbortToStream(stream, signal) {
-    const onAbort = () => {
-        void Promise.resolve(stream.reset(abortReasonToError(signal))).catch(() => {
-            // The read/write operation reports the authoritative abort to its caller.
-        });
-    };
-    if (signal.aborted) {
-        onAbort();
-        return;
-    }
-    signal.addEventListener("abort", onAbort, { once: true });
-}
-// readMaybe reads the next chunk or null on EOF.
-export async function readMaybe(stream) {
-    return await stream.read();
-}
-// createByteReader adapts a YamuxStream to a ByteReader (EOF is handled by YamuxStream.read()).
-export function createByteReader(stream, opts = {}) {
-    if (opts.signal != null)
-        bindAbortToStream(stream, opts.signal);
-    return new ByteReader(() => stream.read());
-}
-// readExactly reads n bytes (or throws on EOF/error). If signal aborts, the caller is expected to reset/close the stream.
-export async function readExactly(reader, n, opts = {}) {
-    throwIfAborted(opts.signal, "read aborted");
-    return await reader.readExactly(n);
-}
-// readNBytes reads exactly n bytes and returns them as a single contiguous buffer.
-export async function readNBytes(reader, n, opts = {}) {
-    const total = Math.max(0, Math.floor(n));
-    const out = new Uint8Array(total);
-    if (total === 0)
-        return out;
-    const chunkSize = Math.max(1, Math.floor(opts.chunkSize ?? 64 * 1024));
-    let off = 0;
-    while (off < total) {
-        throwIfAborted(opts.signal, "read aborted");
-        const take = Math.min(chunkSize, total - off);
-        const chunk = await reader.readExactly(take);
-        out.set(chunk, off);
-        off += chunk.length;
-        opts.onProgress?.(off);
-    }
-    return out;
-}
-function normalizeMaxJsonFrameBytes(maxBytes) {
-    const value = maxBytes ?? DEFAULT_MAX_JSON_FRAME_BYTES;
-    if (!Number.isFinite(value) || value < 0) {
-        throw new Error("maxJsonFrameBytes must be a non-negative finite number");
-    }
-    return Math.floor(value);
-}
-export function createJsonFrameChannel(stream, opts = {}) {
-    const reader = createByteReader(stream, opts.signal == null ? {} : { signal: opts.signal });
-    const defaultMaxBytes = normalizeMaxJsonFrameBytes(opts.maxJsonFrameBytes);
-    return {
-        stream,
-        reader,
-        writeFrame: async (value) => {
-            await writeJsonFrame(stream, value);
-        },
-        readFrame: async (readOpts = {}) => {
-            const raw = await readJsonFrame(reader, normalizeMaxJsonFrameBytes(readOpts.maxBytes ?? defaultMaxBytes));
-            if (readOpts.assert != null)
-                return readOpts.assert(raw);
-            return raw;
-        },
-        close: async () => {
-            await stream.close();
-        },
-    };
-}
-export async function openJsonFrameChannel(client, kind, opts = {}) {
-    const stream = await client.openStream(kind, opts.signal == null ? {} : { signal: opts.signal });
-    return createJsonFrameChannel(stream, opts);
-}

package/dist/tunnel-client/connect.d.ts

@@ -1,9 +0,0 @@
-import { type ConnectOptionsBase } from "../client-connect/connectCore.js";
-import type { ClientInternal } from "../client.js";
-export type TunnelConnectOptions = ConnectOptionsBase & Readonly<{
-    /** Type-only marker to prevent mixing direct and tunnel option types. */
-    __mode?: "tunnel";
-    /** Optional caller-provided endpoint instance ID (base64url). */
-    endpointInstanceId?: string;
-}>;
-export declare function connectTunnel(input: unknown, opts: TunnelConnectOptions): Promise<ClientInternal>;

package/dist/tunnel-client/connect.js

@@ -1,147 +0,0 @@
-import { Role as TunnelRole } from "../gen/flowersec/tunnel/v1.gen.js";
-import { assertChannelInitGrant, Role as ControlRole } from "../gen/flowersec/controlplane/v1.gen.js";
-import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
-import { FlowersecError } from "../utils/errors.js";
-import { randomBytes } from "../client-connect/common.js";
-import { connectCore } from "../client-connect/connectCore.js";
-import { assertTunnelGrantContract, assertValidPSK, prepareChannelId } from "../client-connect/contract.js";
-function isRecord(v) {
-    return typeof v === "object" && v != null && !Array.isArray(v);
-}
-function hasOwn(o, key) {
-    return Object.prototype.hasOwnProperty.call(o, key);
-}
-// connectTunnel attaches to a tunnel and returns an RPC-ready session.
-export async function connectTunnel(input, opts) {
-    if (input == null) {
-        throw new FlowersecError({ stage: "validate", code: "missing_grant", path: "tunnel", message: "missing grant" });
-    }
-    if (isRecord(input)) {
-        // Align missing/invalid field codes with Go: missing fields map to specific stable codes.
-        const okTypes = (!hasOwn(input, "role") || (typeof input["role"] === "number" && Number.isSafeInteger(input["role"]))) &&
-            (!hasOwn(input, "tunnel_url") || typeof input["tunnel_url"] === "string") &&
-            (!hasOwn(input, "channel_id") || typeof input["channel_id"] === "string") &&
-            (!hasOwn(input, "token") || typeof input["token"] === "string") &&
-            (!hasOwn(input, "channel_init_expire_at_unix_s") ||
-                (typeof input["channel_init_expire_at_unix_s"] === "number" && Number.isSafeInteger(input["channel_init_expire_at_unix_s"]))) &&
-            (!hasOwn(input, "e2ee_psk_b64u") || typeof input["e2ee_psk_b64u"] === "string") &&
-            (!hasOwn(input, "default_suite") || (typeof input["default_suite"] === "number" && Number.isSafeInteger(input["default_suite"])));
-        if (okTypes) {
-            const role = input["role"];
-            if (role === undefined || role !== ControlRole.Role_client) {
-                throw new FlowersecError({ stage: "validate", code: "role_mismatch", path: "tunnel", message: "expected role=client" });
-            }
-            if (!hasOwn(input, "tunnel_url")) {
-                throw new FlowersecError({ stage: "validate", code: "missing_tunnel_url", path: "tunnel", message: "missing tunnel_url" });
-            }
-            if (!hasOwn(input, "channel_id")) {
-                throw new FlowersecError({ stage: "validate", code: "missing_channel_id", path: "tunnel", message: "missing channel_id" });
-            }
-            if (!hasOwn(input, "token")) {
-                throw new FlowersecError({ stage: "validate", code: "missing_token", path: "tunnel", message: "missing token" });
-            }
-            if (!hasOwn(input, "channel_init_expire_at_unix_s")) {
-                throw new FlowersecError({ stage: "validate", code: "missing_init_exp", path: "tunnel", message: "missing channel_init_expire_at_unix_s" });
-            }
-            if (!hasOwn(input, "e2ee_psk_b64u")) {
-                throw new FlowersecError({ stage: "validate", code: "invalid_psk", path: "tunnel", message: "missing e2ee_psk_b64u" });
-            }
-            if (!hasOwn(input, "default_suite")) {
-                throw new FlowersecError({ stage: "validate", code: "invalid_suite", path: "tunnel", message: "missing default_suite" });
-            }
-        }
-        const suite = input["default_suite"];
-        // Keep "invalid_suite" as the stable error code even when the IDL validator rejects the enum value.
-        if (typeof suite === "number" && Number.isSafeInteger(suite) && suite !== 1 && suite !== 2) {
-            throw new FlowersecError({ stage: "validate", code: "invalid_suite", path: "tunnel", message: "invalid suite" });
-        }
-        const allowed = input["allowed_suites"];
-        if (Array.isArray(allowed)) {
-            for (const v of allowed) {
-                if (typeof v === "number" && Number.isSafeInteger(v) && v !== 1 && v !== 2) {
-                    throw new FlowersecError({ stage: "validate", code: "invalid_suite", path: "tunnel", message: "invalid suite" });
-                }
-            }
-        }
-    }
-    let checkedGrant;
-    try {
-        checkedGrant = assertChannelInitGrant(input);
-    }
-    catch (e) {
-        throw new FlowersecError({ stage: "validate", code: "invalid_input", path: "tunnel", message: "invalid ChannelInitGrant", cause: e });
-    }
-    const tunnelUrl = checkedGrant.tunnel_url.trim();
-    if (tunnelUrl === "") {
-        throw new FlowersecError({ stage: "validate", code: "missing_tunnel_url", path: "tunnel", message: "missing tunnel_url" });
-    }
-    const channelId = prepareChannelId(checkedGrant.channel_id, "tunnel");
-    const token = checkedGrant.token.trim();
-    if (token === "") {
-        throw new FlowersecError({ stage: "validate", code: "missing_token", path: "tunnel", message: "missing token" });
-    }
-    if (checkedGrant.channel_init_expire_at_unix_s <= 0) {
-        throw new FlowersecError({
-            stage: "validate",
-            code: "missing_init_exp",
-            path: "tunnel",
-            message: "missing channel_init_expire_at_unix_s",
-        });
-    }
-    assertTunnelGrantContract(checkedGrant, ControlRole.Role_client);
-    const e2eePskB64u = assertValidPSK(checkedGrant.e2ee_psk_b64u, "tunnel");
-    const idleTimeoutSeconds = checkedGrant.idle_timeout_seconds;
-    const endpointInstanceId = opts.endpointInstanceId ?? base64urlEncode(randomBytes(24));
-    let eidBytes;
-    try {
-        eidBytes = base64urlDecode(endpointInstanceId);
-    }
-    catch (e) {
-        throw new FlowersecError({
-            stage: "validate",
-            code: "invalid_endpoint_instance_id",
-            path: "tunnel",
-            message: "invalid endpointInstanceId",
-            cause: e
-        });
-    }
-    if (eidBytes.length < 16 || eidBytes.length > 32) {
-        throw new FlowersecError({
-            stage: "validate",
-            code: "invalid_endpoint_instance_id",
-            path: "tunnel",
-            message: "endpointInstanceId must decode to 16..32 bytes"
-        });
-    }
-    const attach = {
-        v: 1,
-        channel_id: channelId,
-        role: TunnelRole.Role_client,
-        token,
-        endpoint_instance_id: endpointInstanceId
-    };
-    const attachJson = JSON.stringify(attach);
-    const liveness = opts.liveness ?? defaultLiveness(idleTimeoutSeconds);
-    return await connectCore({
-        path: "tunnel",
-        wsUrl: tunnelUrl,
-        channelId,
-        e2eePskB64u,
-        defaultSuite: checkedGrant.default_suite,
-        opts: { ...opts, liveness },
-        attach: { attachJson, endpointInstanceId }
-    });
-}
-function defaultLiveness(idleTimeoutSeconds) {
-    if (!Number.isFinite(idleTimeoutSeconds) || idleTimeoutSeconds <= 0)
-        return false;
-    const idleMs = Math.floor(idleTimeoutSeconds * 1000);
-    if (idleMs <= 0)
-        return false;
-    let interval = Math.floor(idleMs / 2);
-    if (interval < 500)
-        interval = 500;
-    if (interval >= idleMs)
-        interval = Math.floor(idleMs / 2);
-    return { intervalMs: interval, timeoutMs: Math.min(10_000, interval) };
-}

package/dist/tunnel-client/index.d.ts

@@ -1 +0,0 @@
-export * from "./connect.js";

package/dist/tunnel-client/index.js

@@ -1 +0,0 @@
-export * from "./connect.js";

package/dist/ws/index.d.ts

@@ -1 +0,0 @@
-export * from "../ws-client/binaryTransport.js";

package/dist/ws/index.js

@@ -1 +0,0 @@
-export * from "../ws-client/binaryTransport.js";