@floegence/flowersec-core 2.3.6 → 2.3.7

package/dist/node/nativeTransportAddon.d.ts

@@ -0,0 +1,94 @@
+import { type NativeCarrierSessionV2 } from "../v2/carrier.js";
+import type { PathKind } from "../v2/contract.js";
+export declare const NATIVE_TRANSPORT_CONTRACT_VERSION = 1;
+export type NativeRawQuicConnectOptions = Readonly<{
+    host: string;
+    port: number;
+    serverName: string;
+    path: PathKind;
+    trustRootsDer: readonly Uint8Array[];
+    inboundBidirectionalStreamCapacity: number;
+    handshakeTimeoutMs: number;
+}>;
+export type NativeRawQuicBindOptions = Readonly<{
+    host: string;
+    port: number;
+    path: PathKind;
+    certificateChainDer: readonly Uint8Array[];
+    privateKeyDer: Uint8Array;
+    inboundBidirectionalStreamCapacity: number;
+    handshakeTimeoutMs?: number;
+}>;
+export type NativeRawQuicListener = Readonly<{
+    address(): Readonly<{
+        host: string;
+        port: number;
+    }>;
+    accept(options?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<NativeCarrierSessionV2>;
+    close(): Promise<void>;
+}>;
+export type NativeRawQuicDriver = Readonly<{
+    connectRawQuic(options: NativeRawQuicConnectOptions, operation?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<NativeCarrierSessionV2>;
+    bindRawQuic(options: NativeRawQuicBindOptions): Promise<NativeRawQuicListener>;
+}>;
+type NativeOperation<T> = Readonly<{
+    result(): Promise<T>;
+    cancel(): void;
+}>;
+type NativeRawQuicStreamBinding = Readonly<{
+    read(): Promise<Uint8Array | null>;
+    write(data: Uint8Array): Promise<number>;
+    closeWrite(): Promise<void>;
+    stopSending(): Promise<void>;
+    reset(): Promise<void>;
+    abort(): void;
+}>;
+type NativeRawQuicSessionBinding = Readonly<{
+    kind: "raw_quic";
+    path: PathKind;
+    inboundBidirectionalStreamCapacity: number;
+    maxDatagramSize?: number;
+    localAddress(): Readonly<{
+        host: string;
+        port: number;
+    }>;
+    peerAddress(): Readonly<{
+        host: string;
+        port: number;
+    }>;
+    openStream(): NativeOperation<NativeRawQuicStreamBinding>;
+    acceptStream(): NativeOperation<NativeRawQuicStreamBinding>;
+    sendDatagram(data: Uint8Array): "accepted" | "dropped_budget" | "dropped_carrier" | "too_large" | "unavailable";
+    receiveDatagram(): NativeOperation<Uint8Array>;
+    waitTermination(): Promise<void>;
+    close(code?: number, reason?: string): Promise<void>;
+    abort(): void;
+}>;
+type NativeRawQuicListenerBinding = Readonly<{
+    address(): Readonly<{
+        host: string;
+        port: number;
+    }>;
+    accept(): NativeOperation<NativeRawQuicSessionBinding>;
+    close(): Promise<void>;
+    abort(): void;
+}>;
+export type NativeTransportAddonBinding = Readonly<{
+    contractVersion(): number;
+    connectRawQuic(options: NativeRawQuicConnectOptions): NativeOperation<NativeRawQuicSessionBinding>;
+    bindRawQuic(options: NativeRawQuicBindOptions): Promise<NativeRawQuicListenerBinding>;
+}>;
+export type NativeTransportAddon = NativeTransportAddonBinding;
+export declare class NativeTransportUnavailableError extends Error {
+    readonly code = "native_transport_unavailable";
+    constructor();
+}
+type RequireFunction = (specifier: string) => unknown;
+export declare function loadNativeTransportAddon(requireFunction?: RequireFunction): NativeTransportAddonBinding;
+export declare function tryLoadNativeTransportAddon(requireFunction?: RequireFunction): NativeTransportAddonBinding | undefined;
+export declare function createNativeRawQuicDriver(addon?: NativeTransportAddonBinding): NativeRawQuicDriver;
+export {};

package/dist/node/nativeTransportAddon.js

@@ -0,0 +1,166 @@
+import { createRequire } from "node:module";
+import { CarrierError, } from "../v2/carrier.js";
+export const NATIVE_TRANSPORT_CONTRACT_VERSION = 1;
+const NATIVE_PACKAGE = "@floegence/flowersec-node-native";
+export class NativeTransportUnavailableError extends Error {
+    code = "native_transport_unavailable";
+    constructor() {
+        super("Flowersec native transport is unavailable on this platform");
+        this.name = "NativeTransportUnavailableError";
+    }
+}
+export function loadNativeTransportAddon(requireFunction = createRequire(import.meta.url)) {
+    let candidate;
+    try {
+        candidate = requireFunction(NATIVE_PACKAGE);
+    }
+    catch {
+        throw new NativeTransportUnavailableError();
+    }
+    if (!isNativeTransportAddon(candidate)) {
+        throw new NativeTransportUnavailableError();
+    }
+    return candidate;
+}
+export function tryLoadNativeTransportAddon(requireFunction = createRequire(import.meta.url)) {
+    try {
+        return loadNativeTransportAddon(requireFunction);
+    }
+    catch (error) {
+        if (error instanceof NativeTransportUnavailableError)
+            return undefined;
+        throw error;
+    }
+}
+export function createNativeRawQuicDriver(addon = loadNativeTransportAddon()) {
+    return Object.freeze({
+        async connectRawQuic(options, operation = {}) {
+            const native = await settle(addon.connectRawQuic(options), operation.signal);
+            return wrapSession(native);
+        },
+        async bindRawQuic(options) {
+            const native = await addon.bindRawQuic(options);
+            return Object.freeze({
+                address: () => native.address(),
+                accept: async (operation = {}) => wrapSession(await settle(native.accept(), operation.signal)),
+                async close() {
+                    await native.close();
+                },
+            });
+        },
+    });
+}
+function isNativeTransportAddon(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const candidate = value;
+    let contractVersion;
+    try {
+        contractVersion = typeof candidate.contractVersion === "function"
+            ? candidate.contractVersion()
+            : -1;
+    }
+    catch {
+        return false;
+    }
+    return contractVersion === NATIVE_TRANSPORT_CONTRACT_VERSION &&
+        typeof candidate.connectRawQuic === "function" &&
+        typeof candidate.bindRawQuic === "function";
+}
+function wrapSession(native) {
+    const unreliableDatagrams = native.maxDatagramSize === undefined
+        ? undefined
+        : Object.freeze({
+            maxDatagramSize: native.maxDatagramSize,
+            async send(data, options = {}) {
+                throwIfAborted(options.signal);
+                if (options.expiresAt !== undefined && options.expiresAt <= Date.now()) {
+                    return "dropped_expired";
+                }
+                const outcome = native.sendDatagram(data);
+                switch (outcome) {
+                    case "accepted":
+                    case "dropped_budget":
+                    case "dropped_carrier":
+                        return outcome;
+                    case "too_large":
+                        throw new CarrierError("datagram_unavailable", "raw QUIC datagram exceeds the negotiated payload limit");
+                    case "unavailable":
+                        throw new CarrierError("datagram_unavailable", "raw QUIC datagrams are unavailable");
+                }
+            },
+            async receive(options = {}) {
+                return await settle(native.receiveDatagram(), options.signal);
+            },
+        });
+    return Object.freeze({
+        kind: native.kind,
+        path: native.path,
+        inboundBidirectionalStreamCapacity: native.inboundBidirectionalStreamCapacity,
+        ...(unreliableDatagrams === undefined ? {} : { unreliableDatagrams }),
+        async openStream(options = {}) {
+            return wrapStream(await settle(native.openStream(), options.signal));
+        },
+        async acceptStream(options = {}) {
+            return wrapStream(await settle(native.acceptStream(), options.signal));
+        },
+        async waitTermination() {
+            await native.waitTermination();
+        },
+        async close(error) {
+            await native.close(error?.code, error?.reason);
+        },
+        abort() {
+            native.abort();
+        },
+    });
+}
+function wrapStream(native) {
+    return Object.freeze({
+        read: async () => await native.read(),
+        write: async (data) => await native.write(data),
+        closeWrite: async () => await native.closeWrite(),
+        stopSending: async () => await native.stopSending(),
+        reset: async () => await native.reset(),
+        abort: () => native.abort(),
+    });
+}
+async function settle(operation, signal) {
+    if (signal?.aborted === true) {
+        operation.cancel();
+        throw new CarrierError("aborted", "native transport operation aborted");
+    }
+    if (signal === undefined)
+        return await operation.result();
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => signal.removeEventListener("abort", abort);
+        const abort = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            operation.cancel();
+            reject(new CarrierError("aborted", "native transport operation aborted"));
+        };
+        signal.addEventListener("abort", abort, { once: true });
+        void operation.result().then((value) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(value);
+        }, (error) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(error);
+        });
+    });
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted === true) {
+        throw new CarrierError("aborted", "native transport operation aborted");
+    }
+}

package/dist/node/proxyServer.d.ts

@@ -0,0 +1,31 @@
+import { SessionHandlers } from "./acceptor.js";
+export type ProxyServerOptions = Readonly<{
+    upstream: string;
+    upstreamOrigin: string;
+    allowedUpstreamHosts?: readonly string[];
+    allowedOrigins?: readonly string[];
+    maxConcurrentStreams?: number;
+    maxJsonFrameBytes?: number;
+    maxChunkBytes?: number;
+    maxBodyBytes?: number;
+    maxWebSocketFrameBytes?: number;
+    defaultHTTPRequestTimeoutMs?: number;
+    maxHTTPRequestTimeoutMs?: number;
+    extraRequestHeaders?: readonly string[];
+    extraResponseHeaders?: readonly string[];
+    blockedResponseHeaders?: readonly string[];
+    extraWebSocketHeaders?: readonly string[];
+    forbiddenCookieNames?: readonly string[];
+    forbiddenCookieNamePrefixes?: readonly string[];
+    onError?: (error: unknown) => void;
+}>;
+export declare class ProxyServerError extends Error {
+    readonly code: "invalid_options" | "handler_registration" | "closed";
+    constructor(code: "invalid_options" | "handler_registration" | "closed");
+}
+export declare class ProxyServer {
+    #private;
+    constructor(options: ProxyServerOptions);
+    register(handlers: SessionHandlers): void;
+    close(): Promise<void>;
+}