@floegence/flowersec-core 2.3.5 → 2.3.7

package/dist/interop/proxyServerPeer.js

@@ -0,0 +1,83 @@
+import { authorizeRuntime, createAcceptor, createEndpointSet, Issuer, parseArtifact, ProxyServer, SessionHandlers, } from "../node/index.js";
+const ORIGIN = "https://app.example";
+const args = process.argv.slice(2);
+if (args.length !== 2 || args[0] !== "--upstream" || args[1] === undefined) {
+    throw new Error("usage: proxyServerPeer --upstream http://127.0.0.1:<port>");
+}
+void run(args[1]).catch((error) => {
+    console.error(error instanceof Error ? error.stack ?? error.message : String(error));
+    process.exitCode = 1;
+});
+async function run(upstream) {
+    const parsedUpstream = new URL(upstream);
+    if (parsedUpstream.protocol !== "http:" || parsedUpstream.hostname !== "127.0.0.1" || parsedUpstream.pathname !== "/") {
+        throw new Error("proxy peer upstream must be a loopback HTTP origin");
+    }
+    const proxy = new ProxyServer({
+        upstream,
+        upstreamOrigin: upstream,
+        allowedOrigins: [ORIGIN],
+        maxConcurrentStreams: 4,
+        maxJsonFrameBytes: 4096,
+        maxChunkBytes: 8,
+        maxBodyBytes: 8,
+        maxWebSocketFrameBytes: 32,
+        defaultHTTPRequestTimeoutMs: 1_000,
+        maxHTTPRequestTimeoutMs: 1_000,
+        extraRequestHeaders: ["cookie", "origin", "x-request-id"],
+        extraResponseHeaders: ["x-visible"],
+        blockedResponseHeaders: ["location"],
+        extraWebSocketHeaders: ["x-request-id"],
+        forbiddenCookieNames: ["secret"],
+        forbiddenCookieNamePrefixes: ["private_"],
+        onError: (error) => console.error(error instanceof Error ? error.message : String(error)),
+    });
+    const handlers = new SessionHandlers({ maxConcurrentStreams: 4 });
+    proxy.register(handlers);
+    let record;
+    const acceptor = await createAcceptor({
+        listeners: [{
+                carrier: "websocket",
+                path: "direct",
+                host: "127.0.0.1",
+                port: 0,
+                allowedOrigins: [ORIGIN],
+            }],
+        maxInboundStreams: 8,
+        authorize: async (request) => {
+            if (record === undefined)
+                throw new Error("authorization record is unavailable");
+            const artifact = parseArtifact(record.artifactJSON);
+            authorizeRuntime(request, record, "proxy-matrix-node");
+            return { decision: "allow", artifact };
+        },
+        resolveHandlers: () => handlers,
+    });
+    try {
+        const address = acceptor.addresses()[0];
+        if (address === undefined)
+            throw new Error("Node ProxyServer listener did not bind");
+        const issued = new Issuer().issueDirect({
+            session: { channelId: "browser-proxy-node", maxInboundStreams: 8 },
+            endpoints: createEndpointSet(`ws://127.0.0.1:${address.port}/flowersec/v2/direct`),
+            rendezvousGroupId: "browser-proxy-node",
+            listenerAudience: "browser-proxy-matrix",
+            upstreamAddress: `${address.host}:${address.port}`,
+        });
+        record = issued.authorizationRecord();
+        const acceptedPromise = acceptor.accept();
+        process.stdout.write(`${JSON.stringify({
+            runtime: "node-typescript",
+            artifact_json: new TextDecoder().decode(issued.artifactJSON()),
+            origin: ORIGIN,
+        })}\n`);
+        const accepted = await acceptedPromise;
+        const serving = accepted.serve().catch((error) => error);
+        await accepted.session.waitTermination().catch(() => undefined);
+        await serving;
+    }
+    finally {
+        await proxy.close();
+        await acceptor.close();
+    }
+}

package/dist/interop/serverParityPeer.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/interop/serverParityPeer.js

@@ -0,0 +1,608 @@
+import { createInterface } from "node:readline";
+import { createAcceptor, createArtifactLease, createEndpointSet, createStreamMetadata, createTunnelRuntime, connect, Issuer, parseArtifact, SessionError, SessionHandlers, } from "../node/index.js";
+const RUNTIME = "node-typescript";
+const ORIGIN = "https://client.example";
+const ECHO_RPC = 7001;
+const NOTIFY_RPC = 7002;
+const COMPLETE_RPC = 7003;
+const DATAGRAM_READY_RPC = 7005;
+const ECHO_KIND = "parity.echo";
+const RESET_KIND = "parity.reset";
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const TEST_CERT_DER_B64 = "MIIBjzCCAUGgAwIBAgIUW8hQEpQsUJN9a6qqF2g6hsNpSm8wBQYDK2VwMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0yNjA3MjAxOTAxMjFaFw0zNjA3MTcxOTAxMjFaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDAqMAUGAytlcAMhAAihki/Jec+1EaC6E6PsSxjMYFAazrgkNiUIlbj/+A/0o4GkMIGhMB0GA1UdDgQWBBQCuKxQmMQkAAy9KkfuD+WOmrrMbTAfBgNVHSMEGDAWgBQCuKxQmMQkAAy9KkfuD+WOmrrMbTAsBgNVHREEJTAjgglsb2NhbGhvc3SHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwBQYDK2VwA0EArZng3XitiH2E1pW/NTxQvEOBXJYpYE8coQmLV4yTjfI43CWHMG6lIrwk/so67oe6Z2R4iHGjUm3Tuy50Fl8hBw==";
+const TEST_KEY_DER_B64 = "MC4CAQAwBQYDK2VwBCIEICxYUWHqGoh0CBBohsaNg/NThm1n3UeWCzYuq6jS+Qi6";
+class SignalQueue {
+    #values = [];
+    #waiters = [];
+    push() {
+        const waiter = this.#waiters.shift();
+        if (waiter === undefined)
+            this.#values.push(undefined);
+        else
+            waiter();
+    }
+    async shift() {
+        if (this.#values.length > 0) {
+            this.#values.shift();
+            return;
+        }
+        await new Promise((resolve) => this.#waiters.push(resolve));
+    }
+}
+class PeerInput {
+    #lines = createInterface({
+        input: process.stdin,
+        crlfDelay: Infinity,
+    })[Symbol.asyncIterator]();
+    async next() {
+        const item = await this.#lines.next();
+        if (item.done || item.value.trim() === "")
+            throw new Error("peer stdin ended before the next protocol message");
+        return JSON.parse(item.value);
+    }
+}
+class ExecutedCases {
+    #cases = new Set();
+    record(...caseIds) {
+        for (const caseId of caseIds)
+            this.#cases.add(caseId);
+    }
+    snapshot() {
+        return [...this.#cases];
+    }
+}
+function createHandlers(path) {
+    const handlers = new SessionHandlers({ maxConcurrentStreams: 16 });
+    const notifications = new SignalQueue();
+    const activeStreams = { value: 0 };
+    const executed = new ExecutedCases();
+    handlers.handleRPC(ECHO_RPC, async (payload) => {
+        if (!validValuePayload(payload, "ping"))
+            return { error: { code: 400, message: "invalid echo payload" } };
+        executed.record("rpc");
+        return { payload };
+    });
+    handlers.handleRPC(COMPLETE_RPC, async (payload) => {
+        if (!validValuePayload(payload, "complete"))
+            return { error: { code: 400, message: "invalid completion payload" } };
+        executed.record("rekey", "liveness");
+        notifications.push();
+        return { payload };
+    });
+    handlers.handleRPC(DATAGRAM_READY_RPC, async (payload) => {
+        if (!validValuePayload(payload, "datagram-ready"))
+            return {
+                error: { code: 400, message: "invalid datagram barrier payload" },
+            };
+        notifications.push();
+        return { payload };
+    });
+    handlers.handleNotification(NOTIFY_RPC, (payload) => {
+        if (!validValuePayload(payload, "notify"))
+            throw new Error("invalid notification payload");
+        executed.record("notification");
+        notifications.push();
+    });
+    handlers.handleStream(ECHO_KIND, async (incoming) => {
+        activeStreams.value++;
+        try {
+            if (incoming.metadata.values.cell !== path)
+                throw new Error("invalid stream metadata");
+            executed.record("stream-metadata");
+            if (decoder.decode(await readAll(incoming.stream)) !== "hello")
+                throw new Error("invalid stream payload");
+            await writeAll(incoming.stream, encoder.encode("world"));
+            executed.record("stream-fin");
+        }
+        finally {
+            activeStreams.value--;
+        }
+    });
+    handlers.handleStream(RESET_KIND, async (incoming) => {
+        if (decoder.decode(await readAll(incoming.stream)) !== "reset")
+            throw new Error("invalid reset stream payload");
+        executed.record("stream-reset");
+        throw new Error("intentional parity reset");
+    });
+    return { handlers, notifications, activeStreams, executed };
+}
+function validValuePayload(payload, expected) {
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload))
+        return false;
+    return payload.value === expected;
+}
+async function writeAll(stream, bytes) {
+    let offset = 0;
+    while (offset < bytes.length) {
+        const written = await stream.write(bytes.subarray(offset));
+        if (written < 1 || written > bytes.length - offset)
+            throw new Error("invalid stream write count");
+        offset += written;
+    }
+}
+async function readAll(stream) {
+    const chunks = [];
+    let length = 0;
+    while (true) {
+        const chunk = await stream.read();
+        if (chunk === null)
+            break;
+        chunks.push(chunk);
+        length += chunk.length;
+    }
+    const output = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return output;
+}
+async function callBarrier(session, typeId, value, label = "peer") {
+    const result = await session.rpc.call(typeId, { value }, (payload) => payload);
+    if (!result.ok || !validValuePayload(result.payload, value))
+        throw new Error(`${label} RPC barrier ${typeId} failed: ${JSON.stringify(result)}`);
+}
+async function assertCancellableWait(session) {
+    const cancellation = new AbortController();
+    cancellation.abort();
+    try {
+        await session.waitTermination({ signal: cancellation.signal });
+    }
+    catch (error) {
+        if (error instanceof SessionError && error.code === "canceled")
+            return;
+        throw error;
+    }
+    throw new Error("termination wait ignored cancellation");
+}
+async function clientStreams(session, path, executed) {
+    const stream = await session.openStream(ECHO_KIND, {
+        metadata: createStreamMetadata({ cell: path }),
+    });
+    await writeAll(stream, encoder.encode("hello"));
+    await stream.closeWrite();
+    if (decoder.decode(await readAll(stream)) !== "world")
+        throw new Error("echo stream did not preserve metadata and FIN");
+    executed.record("stream-metadata", "stream-fin");
+    // Let the peer finish the echo handler before opening the reset stream. This
+    // barrier makes the handler lifecycle ordering explicit across runtimes.
+    await callBarrier(session, ECHO_RPC, "ping", "echo stream cleanup");
+    const reset = await session.openStream(RESET_KIND);
+    let resetObserved = false;
+    try {
+        await writeAll(reset, encoder.encode("reset"));
+        await reset.closeWrite();
+        await readAll(reset);
+        resetObserved = reset.terminalError !== undefined;
+    }
+    catch (error) {
+        resetObserved =
+            error instanceof SessionError && error.code === "stream_reset";
+    }
+    finally {
+        await reset.close().catch(() => undefined);
+    }
+    if (!resetObserved)
+        throw new Error("reset stream did not fail");
+    executed.record("stream-reset");
+}
+async function serverStreams(session, path, executed) {
+    const incoming = await session.acceptStream();
+    if (incoming.kind !== ECHO_KIND || incoming.metadata.values.cell !== path)
+        throw new Error("invalid echo stream metadata");
+    executed.record("stream-metadata");
+    if (decoder.decode(await readAll(incoming.stream)) !== "hello")
+        throw new Error("invalid echo stream payload");
+    await writeAll(incoming.stream, encoder.encode("world"));
+    await incoming.stream.closeWrite();
+    executed.record("stream-fin");
+    const reset = await session.acceptStream();
+    if (reset.kind !== RESET_KIND ||
+        decoder.decode(await readAll(reset.stream)) !== "reset")
+        throw new Error("invalid reset stream payload");
+    await reset.stream.reset();
+    await reset.stream.close().catch(() => undefined);
+    executed.record("stream-reset");
+}
+async function exerciseClient(session, state, path, carrier) {
+    await callBarrier(session, ECHO_RPC, "ping", "client");
+    state.executed.record("rpc");
+    await session.rpc.notify(NOTIFY_RPC, { value: "notify" });
+    await state.notifications.shift();
+    state.executed.record("notification");
+    await clientStreams(session, path, state.executed);
+    await assertCancellableWait(session);
+    state.executed.record("cancel");
+    await callBarrier(session, ECHO_RPC, "ping", "client cleanup");
+    await callBarrier(session, DATAGRAM_READY_RPC, "datagram-ready", "client datagram");
+    await exchangeDatagram(session, carrier, true);
+    if (carrier === "raw-quic")
+        state.executed.record("datagram");
+    await session.rekey();
+    state.executed.record("rekey");
+    await session.probeLiveness();
+    state.executed.record("liveness");
+    await callBarrier(session, COMPLETE_RPC, "complete", "client completion");
+    await session.rpc.notify(NOTIFY_RPC, { value: "notify" });
+}
+async function exerciseServer(session, state, path, streamsServed, carrier) {
+    await assertCancellableWait(session);
+    state.executed.record("cancel");
+    const streams = streamsServed
+        ? Promise.resolve()
+        : serverStreams(session, path, state.executed);
+    await state.notifications.shift();
+    await callBarrier(session, ECHO_RPC, "ping", "server");
+    state.executed.record("rpc");
+    await session.rpc.notify(NOTIFY_RPC, { value: "notify" });
+    await state.notifications.shift();
+    await exchangeDatagram(session, carrier, false);
+    if (carrier === "raw-quic")
+        state.executed.record("datagram");
+    await streams;
+    await session.waitTermination();
+    state.executed.record("close");
+}
+async function exchangeDatagram(session, carrier, initiator) {
+    if (carrier === "websocket")
+        return;
+    const channel = session.unreliableMessages;
+    if (channel === undefined)
+        throw new Error("raw QUIC session omitted unreliable messages");
+    const request = Uint8Array.of(1, 2, 3);
+    const response = Uint8Array.of(3, 2, 1);
+    if (initiator) {
+        const outcome = await channel.send(request, { expiresAtUnixMs: Date.now() + 2_000 });
+        if (outcome !== "accepted")
+            throw new Error(`raw QUIC datagram was ${outcome}`);
+    }
+    const received = await channel.receive();
+    const expected = initiator ? response : request;
+    if (received.length !== expected.length || !expected.every((value, index) => received[index] === value)) {
+        throw new Error("raw QUIC datagram payload mismatch");
+    }
+    if (!initiator) {
+        const outcome = await channel.send(response, { expiresAtUnixMs: Date.now() + 2_000 });
+        if (outcome !== "accepted")
+            throw new Error(`raw QUIC datagram was ${outcome}`);
+    }
+}
+function fixture() {
+    const certificate = pem("CERTIFICATE", TEST_CERT_DER_B64);
+    return {
+        tls: {
+            certificate_chain_pem: certificate,
+            private_key_pem: pem("PRIVATE KEY", TEST_KEY_DER_B64),
+            root_certificate_pem: certificate,
+            root_certificate_der_base64: TEST_CERT_DER_B64,
+            leaf_certificate_der_base64: TEST_CERT_DER_B64,
+        },
+    };
+}
+function pem(label, encoded) {
+    const lines = encoded.match(/.{1,64}/g);
+    if (lines === null)
+        throw new Error("invalid embedded TLS fixture");
+    return `-----BEGIN ${label}-----\n${lines.join("\n")}\n-----END ${label}-----\n`;
+}
+async function connectArtifact(artifactJSON, relay, handlers) {
+    return await connect(createArtifactLease(parseArtifact(artifactJSON), async () => undefined), {
+        origin: relay.origin,
+        tls: { ca: relay.trust_pem },
+        handlers,
+    });
+}
+async function runServer(tls, carrier) {
+    const issuedByLookup = new Map();
+    const state = createHandlers("direct");
+    const acceptor = await createAcceptor({
+        listeners: [directListenerOptions(carrier, tls)],
+        maxInboundStreams: 16,
+        authorize: async (request) => {
+            const artifact = issuedByLookup.get(request.lookupKey());
+            return artifact === undefined
+                ? { decision: "reject", reason: "invalid_credential" }
+                : { decision: "allow", artifact };
+        },
+        resolveHandlers: () => state.handlers,
+    });
+    try {
+        const address = acceptor.addresses()[0];
+        if (address === undefined)
+            throw new Error(`direct ${carrier} listener did not bind`);
+        const issued = new Issuer().issueDirect({
+            session: { channelId: "node-direct-parity", maxInboundStreams: 16 },
+            endpoints: createEndpointSet(endpointURL(carrier, "direct", address.port)),
+            rendezvousGroupId: "node-direct-parity",
+            listenerAudience: "server-parity",
+            upstreamAddress: "127.0.0.1:1",
+        });
+        const artifactJSON = decoder.decode(issued.artifactJSON());
+        issuedByLookup.set(issued.lookupKey(), parseArtifact(artifactJSON));
+        const accepting = acceptor.accept();
+        writeJSON({
+            type: "ready",
+            runtime: RUNTIME,
+            carrier,
+            path: "direct",
+            artifact_json: artifactJSON,
+            trust_pem: tls.tls.root_certificate_pem,
+            origin: ORIGIN,
+        });
+        const accepted = await accepting;
+        state.executed.record("admission");
+        const serving = accepted.serve().catch((error) => error);
+        await exerciseServer(accepted.session, state, "direct", true, carrier);
+        await serving;
+        await accepted.close().catch(() => undefined);
+        if (state.activeStreams.value !== 0)
+            throw new Error(`direct server cleanup left ${state.activeStreams.value} streams`);
+        state.executed.record("cleanup");
+        writeJSON(result("server-result", "direct", state.executed.snapshot(), carrier));
+    }
+    finally {
+        await acceptor.close();
+    }
+}
+async function runClient(input, carrier) {
+    const ready = await input.next();
+    if (ready.type !== "ready" ||
+        ready.carrier !== carrier ||
+        ready.path !== "direct" ||
+        ready.artifact_json === "")
+        throw new Error("invalid direct ready message");
+    const state = createHandlers("direct");
+    const session = await connectArtifact(ready.artifact_json, ready, state.handlers);
+    state.executed.record("admission");
+    await exerciseClient(session, state, "direct", carrier);
+    await session.close().catch((error) => {
+        if (!(error instanceof SessionError) || error.code !== "closed")
+            throw error;
+    });
+    state.executed.record("close");
+    if (state.activeStreams.value !== 0)
+        throw new Error(`direct client cleanup left ${state.activeStreams.value} streams`);
+    state.executed.record("cleanup");
+    writeJSON(result("client-result", "direct", state.executed.snapshot(), carrier));
+}
+async function runRelay(tls, input, carrier) {
+    const decisions = new Map();
+    const released = new Set();
+    const executed = new ExecutedCases();
+    const runtime = createTunnelRuntime({
+        listeners: [tunnelListenerOptions(carrier, tls)],
+        maxInboundStreams: 16,
+        maxPendingLegs: 16,
+        maxActivePairs: 8,
+        authorize: async (request) => decisions.get(request.lookupKey()) ?? {
+            decision: "reject",
+            reason: "invalid_credential",
+        },
+        release: (leaseId) => {
+            released.add(leaseId);
+        },
+    });
+    try {
+        await runtime.start();
+        const address = runtime.addresses()[0];
+        if (address === undefined)
+            throw new Error(`tunnel ${carrier} listener did not bind`);
+        writeJSON({
+            type: "relay-ready",
+            runtime: RUNTIME,
+            carrier,
+            path: "tunnel",
+            endpoint_url: endpointURL(carrier, "tunnel", address.port),
+            trust_pem: tls.tls.root_certificate_pem,
+            trust_roots_der: [tls.tls.root_certificate_der_base64],
+            server_certificate_der: tls.tls.leaf_certificate_der_base64,
+            origin: ORIGIN,
+        });
+        const configure = await input.next();
+        if (configure.type !== "configure" ||
+            !Array.isArray(configure.authorizations) ||
+            configure.authorizations.length === 0)
+            throw new Error("invalid tunnel relay configuration");
+        for (const item of configure.authorizations) {
+            if (item.decision !== "allow" ||
+                item.credentialId === "" ||
+                item.leaseId === "" ||
+                item.expectedPeerEndpointInstanceId === "" ||
+                item.expiresAtUnixSeconds <= Math.floor(Date.now() / 1000)) {
+                throw new Error("invalid secret-free tunnel authorization");
+            }
+            decisions.set(item.credentialId, {
+                decision: "allow",
+                credentialId: item.credentialId,
+                leaseId: item.leaseId,
+                expiresAtUnixSeconds: item.expiresAtUnixSeconds,
+                expectedPeerEndpointInstanceId: item.expectedPeerEndpointInstanceId,
+                allowReplacement: item.allowReplacement,
+            });
+        }
+        const close = await input.next();
+        if (close.type !== "close")
+            throw new Error("invalid tunnel relay close command");
+        executed.record("close");
+    }
+    finally {
+        await runtime.close();
+        executed.record("cancel");
+    }
+    if (released.size !== decisions.size)
+        throw new Error(`relay cleanup released ${released.size} of ${decisions.size} leases`);
+    executed.record("admission", "pairing", "opaque-forwarding");
+    if (carrier === "raw-quic")
+        executed.record("datagram-forwarding");
+    executed.record("cleanup");
+    writeJSON({
+        type: "relay-result",
+        runtime: RUNTIME,
+        carrier,
+        path: "tunnel",
+        cases: executed.snapshot(),
+        observed_plaintext: false,
+        released_leases: released.size,
+    });
+}
+async function runTunnelEndpointB(input, carrier) {
+    const envelope = await input.next();
+    const { topology, relay } = envelope;
+    validateTunnelDimensions(topology, relay, "endpoint_b", carrier);
+    const pair = new Issuer().issueTunnelPair({
+        session: { channelId: `parity-${topology.id}`, maxInboundStreams: 16 },
+        endpoints: createEndpointSet(relay.endpoint_url),
+        rendezvousGroupId: topology.id,
+        listenerAudience: "server-parity",
+        firstEndpointId: `${topology.id}-a`,
+        secondEndpointId: `${topology.id}-b`,
+    });
+    const firstJSON = decoder.decode(pair.first.artifactJSON());
+    const secondJSON = decoder.decode(pair.second.artifactJSON());
+    const ready = {
+        type: "endpoint-b-ready",
+        runtime: RUNTIME,
+        carrier,
+        path: "tunnel",
+        endpoint_a_artifact_json: firstJSON,
+        endpoint_b_artifact_json: secondJSON,
+        relay,
+        authorizations: [
+            authorizationWire(pair.first, firstJSON, "lease-endpoint-a"),
+            authorizationWire(pair.second, secondJSON, "lease-endpoint-b"),
+        ],
+    };
+    writeJSON(ready);
+    const command = await input.next();
+    if (command.type !== "connect")
+        throw new Error("endpoint B did not receive connect command");
+    const state = createHandlers("tunnel");
+    const session = await connectArtifact(secondJSON, relay, state.handlers);
+    state.executed.record("admission");
+    await exerciseServer(session, state, "tunnel", false, carrier);
+    await session.close().catch(() => undefined);
+    state.executed.record("close");
+    if (state.activeStreams.value !== 0)
+        throw new Error(`endpoint B cleanup left ${state.activeStreams.value} streams`);
+    state.executed.record("cleanup");
+    writeJSON(result("endpoint-b-result", "tunnel", state.executed.snapshot(), carrier));
+}
+async function runTunnelEndpointA(input, carrier) {
+    const envelope = await input.next();
+    validateTunnelDimensions(envelope.topology, envelope.endpoint_b.relay, "endpoint_a", carrier);
+    const ready = envelope.endpoint_b;
+    if (ready.type !== "endpoint-b-ready" ||
+        ready.carrier !== carrier ||
+        ready.path !== "tunnel" ||
+        ready.endpoint_a_artifact_json === "")
+        throw new Error("invalid endpoint B ready message");
+    const state = createHandlers("tunnel");
+    const session = await connectArtifact(ready.endpoint_a_artifact_json, ready.relay, state.handlers);
+    state.executed.record("admission");
+    await exerciseClient(session, state, "tunnel", carrier);
+    await session.close().catch(() => undefined);
+    state.executed.record("close");
+    if (state.activeStreams.value !== 0)
+        throw new Error(`endpoint A cleanup left ${state.activeStreams.value} streams`);
+    state.executed.record("cleanup");
+    writeJSON(result("endpoint-a-result", "tunnel", state.executed.snapshot(), carrier));
+}
+function validateTunnelDimensions(topology, relay, endpoint, carrier) {
+    if (topology[endpoint] !== RUNTIME ||
+        topology.tunnel_runtime !== relay.runtime ||
+        topology.ingress_carrier_a !== carrier ||
+        topology.ingress_carrier_b !== carrier ||
+        relay.type !== "relay-ready" ||
+        relay.carrier !== carrier ||
+        relay.path !== "tunnel") {
+        throw new Error("invalid tunnel topology dimensions");
+    }
+}
+function authorizationWire(issued, artifactJSON, leaseId) {
+    const artifact = JSON.parse(artifactJSON);
+    if (!Number.isSafeInteger(artifact.session.init_expire_at_unix_s) ||
+        artifact.path.expected_peer_endpoint_instance_id === "")
+        throw new Error("issued tunnel artifact omitted relay claims");
+    return {
+        decision: "allow",
+        credentialId: issued.lookupKey(),
+        leaseId,
+        expiresAtUnixSeconds: artifact.session.init_expire_at_unix_s,
+        expectedPeerEndpointInstanceId: artifact.path.expected_peer_endpoint_instance_id,
+        allowReplacement: false,
+    };
+}
+function result(type, path, cases, carrier) {
+    return {
+        type,
+        runtime: RUNTIME,
+        carrier,
+        path,
+        cases,
+    };
+}
+function writeJSON(value) {
+    process.stdout.write(`${JSON.stringify(value)}\n`);
+}
+function parseArguments(arguments_) {
+    const roles = new Set([
+        "server",
+        "client",
+        "relay",
+        "tunnel-endpoint-a",
+        "tunnel-endpoint-b",
+    ]);
+    const role = arguments_[0];
+    if (process.env.FLOWERSEC_SERVER_PARITY_PEER !== "1")
+        throw new Error("server parity peer is test-only");
+    if (arguments_.length !== 3 ||
+        !roles.has(role) ||
+        arguments_[1] !== "--carrier")
+        throw new Error("invalid server parity peer arguments");
+    if (arguments_[2] !== "websocket" && arguments_[2] !== "raw-quic")
+        throw new Error(`Node.js production carrier is unsupported by this peer: ${arguments_[2] ?? "missing"}`);
+    return { role, carrier: arguments_[2] };
+}
+function endpointURL(carrier, path, port) {
+    return carrier === "websocket"
+        ? `wss://localhost:${port}/flowersec/v2/${path}`
+        : `quic://127.0.0.1:${port}`;
+}
+function directListenerOptions(carrier, tls) {
+    const material = { certificate: tls.tls.certificate_chain_pem, privateKey: tls.tls.private_key_pem };
+    return carrier === "websocket"
+        ? { carrier, path: "direct", host: "127.0.0.1", port: 0, tls: material, allowedOrigins: [ORIGIN] }
+        : { carrier: "raw_quic", path: "direct", host: "127.0.0.1", port: 0, tls: material };
+}
+function tunnelListenerOptions(carrier, tls) {
+    const material = { certificate: tls.tls.certificate_chain_pem, privateKey: tls.tls.private_key_pem };
+    return carrier === "websocket"
+        ? { carrier, host: "127.0.0.1", port: 0, tls: material, allowedOrigins: [ORIGIN] }
+        : { carrier: "raw_quic", host: "127.0.0.1", port: 0, tls: material };
+}
+async function main() {
+    const { role, carrier } = parseArguments(process.argv.slice(2));
+    switch (role) {
+        case "server":
+            await runServer(fixture(), carrier);
+            break;
+        case "client":
+            await runClient(new PeerInput(), carrier);
+            break;
+        case "relay":
+            await runRelay(fixture(), new PeerInput(), carrier);
+            break;
+        case "tunnel-endpoint-a":
+            await runTunnelEndpointA(new PeerInput(), carrier);
+            break;
+        case "tunnel-endpoint-b":
+            await runTunnelEndpointB(new PeerInput(), carrier);
+            break;
+    }
+}
+await main().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});