@floegence/flowersec-core 2.3.6 → 2.3.7

package/dist/node/rawQuicAdapter.js

@@ -0,0 +1,107 @@
+import { X509Certificate, createPrivateKey } from "node:crypto";
+const DEFAULT_HANDSHAKE_TIMEOUT_MS = 10_000;
+const CERTIFICATE_PEM_BEGIN = "-----BEGIN CERTIFICATE-----";
+const CERTIFICATE_PEM_END = "-----END CERTIFICATE-----";
+const MAX_CERTIFICATE_PEM_BYTES = 256 * 1024;
+const MAX_CERTIFICATE_CHAIN_LENGTH = 32;
+export async function createNodeRawQuicClientV2(driver, candidate, artifact, tls, signal, handshakeTimeoutMs = DEFAULT_HANDSHAKE_TIMEOUT_MS) {
+    const url = new URL(candidate.normalized_url);
+    if (candidate.carrier !== "raw_quic" || url.protocol !== "quic:" || url.port === "") {
+        throw new TypeError("invalid raw QUIC candidate");
+    }
+    const options = {
+        host: unbracket(url.hostname),
+        port: Number(url.port),
+        serverName: unbracket(url.hostname),
+        path: artifact.path.kind,
+        trustRootsDer: normalizeCertificateChain(tls.ca),
+        inboundBidirectionalStreamCapacity: artifact.session.max_inbound_streams + 2,
+        handshakeTimeoutMs,
+    };
+    return await driver.connectRawQuic(options, { signal });
+}
+export function normalizeCertificateChain(input) {
+    const values = Array.isArray(input) ? input : [input];
+    const certificates = [];
+    let totalInputBytes = 0;
+    for (const value of values) {
+        if (typeof value !== "string" && !(value instanceof Uint8Array)) {
+            throw new TypeError("invalid raw QUIC certificate");
+        }
+        totalInputBytes += typeof value === "string" ? Buffer.byteLength(value, "utf8") : value.byteLength;
+        if (totalInputBytes > MAX_CERTIFICATE_PEM_BYTES)
+            throw new TypeError("invalid raw QUIC certificate");
+        if (typeof value === "string") {
+            const blocks = splitCertificatePEM(value);
+            if (blocks.length === 0)
+                throw new TypeError("invalid raw QUIC certificate");
+            if (certificates.length + blocks.length > MAX_CERTIFICATE_CHAIN_LENGTH) {
+                throw new TypeError("invalid raw QUIC certificate");
+            }
+            for (const block of blocks)
+                certificates.push(parseCertificate(block));
+        }
+        else if (value instanceof Uint8Array && value.length > 0) {
+            if (certificates.length >= MAX_CERTIFICATE_CHAIN_LENGTH)
+                throw new TypeError("invalid raw QUIC certificate");
+            certificates.push(parseCertificate(value));
+        }
+        else {
+            throw new TypeError("invalid raw QUIC certificate");
+        }
+    }
+    if (certificates.length === 0)
+        throw new TypeError("raw QUIC requires explicit trust roots");
+    return certificates;
+}
+function splitCertificatePEM(value) {
+    if (Buffer.byteLength(value, "utf8") > MAX_CERTIFICATE_PEM_BYTES) {
+        throw new TypeError("invalid raw QUIC certificate");
+    }
+    const blocks = [];
+    let cursor = 0;
+    while (cursor < value.length) {
+        const begin = value.indexOf(CERTIFICATE_PEM_BEGIN, cursor);
+        if (begin < 0) {
+            if (value.slice(cursor).trim().length !== 0)
+                throw new TypeError("invalid raw QUIC certificate");
+            break;
+        }
+        if (value.slice(cursor, begin).trim().length !== 0)
+            throw new TypeError("invalid raw QUIC certificate");
+        const contentStart = begin + CERTIFICATE_PEM_BEGIN.length;
+        const end = value.indexOf(CERTIFICATE_PEM_END, contentStart);
+        if (end < 0 || value.indexOf(CERTIFICATE_PEM_BEGIN, contentStart) >= 0 && value.indexOf(CERTIFICATE_PEM_BEGIN, contentStart) < end) {
+            throw new TypeError("invalid raw QUIC certificate");
+        }
+        blocks.push(value.slice(begin, end + CERTIFICATE_PEM_END.length));
+        if (blocks.length > MAX_CERTIFICATE_CHAIN_LENGTH)
+            throw new TypeError("invalid raw QUIC certificate");
+        cursor = end + CERTIFICATE_PEM_END.length;
+    }
+    return blocks;
+}
+export function normalizePrivateKey(input) {
+    if ((typeof input === "string" && input.length === 0) ||
+        (input instanceof Uint8Array && input.length === 0)) {
+        throw new TypeError("invalid raw QUIC private key");
+    }
+    try {
+        const key = createPrivateKey(input);
+        return new Uint8Array(key.export({ format: "der", type: "pkcs8" }));
+    }
+    catch {
+        throw new TypeError("invalid raw QUIC private key");
+    }
+}
+function parseCertificate(input) {
+    try {
+        return new Uint8Array(new X509Certificate(input).raw);
+    }
+    catch {
+        throw new TypeError("invalid raw QUIC certificate");
+    }
+}
+function unbracket(host) {
+    return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}

package/dist/node/rawQuicServer.d.ts

@@ -0,0 +1,24 @@
+import type { CarrierSessionV2 } from "../v2/carrier.js";
+import type { PathKind } from "../v2/contract.js";
+import type { NativeRawQuicDriver } from "./nativeTransportAddon.js";
+export type NodeRawQuicServerOptions = Readonly<{
+    host: string;
+    port: number;
+    path: PathKind;
+    tls: Readonly<{
+        certificate: string | Uint8Array;
+        privateKey: string | Uint8Array;
+    }>;
+    inboundBidirectionalStreamCapacity: number;
+}>;
+export type NodeRawQuicServer = Readonly<{
+    address(): Readonly<{
+        host: string;
+        port: number;
+    }>;
+    accept(options?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<CarrierSessionV2>;
+    close(): Promise<void>;
+}>;
+export declare function startNodeRawQuicServer(driver: NativeRawQuicDriver, options: NodeRawQuicServerOptions): Promise<NodeRawQuicServer>;

package/dist/node/rawQuicServer.js

@@ -0,0 +1,37 @@
+import { adaptNativeCarrierSessionV2 } from "../v2/carrier.js";
+import { normalizeCertificateChain, normalizePrivateKey } from "./rawQuicAdapter.js";
+export async function startNodeRawQuicServer(driver, options) {
+    validateOptions(options);
+    let listener;
+    try {
+        listener = await driver.bindRawQuic({
+            host: options.host,
+            port: options.port,
+            path: options.path,
+            certificateChainDer: normalizeCertificateChain(options.tls.certificate),
+            privateKeyDer: normalizePrivateKey(options.tls.privateKey),
+            inboundBidirectionalStreamCapacity: options.inboundBidirectionalStreamCapacity,
+        });
+    }
+    catch (error) {
+        if (error instanceof TypeError)
+            throw error;
+        throw new Error("Flowersec raw QUIC listener failed to bind");
+    }
+    return {
+        address: () => listener.address(),
+        accept: async (operation = {}) => adaptNativeCarrierSessionV2(await listener.accept(operation)),
+        close: async () => await listener.close(),
+    };
+}
+function validateOptions(options) {
+    if (!Number.isInteger(options.port) || options.port < 0 || options.port > 65_535 ||
+        !Number.isInteger(options.inboundBidirectionalStreamCapacity) ||
+        options.inboundBidirectionalStreamCapacity < 3 ||
+        options.inboundBidirectionalStreamCapacity > 130) {
+        throw new TypeError("invalid Node raw QUIC listener options");
+    }
+    if (options.tls.certificate.length === 0 || options.tls.privateKey.length === 0) {
+        throw new TypeError("raw QUIC listener requires explicit TLS material");
+    }
+}

package/dist/node/runtimeCapability.d.ts

@@ -1,4 +1,11 @@
-export declare const NODE_RUNTIME_CAPABILITY_V2: Readonly<{
+export declare const NODE_RUNTIME_PROFILE_V2: Readonly<{
+    language: string;
+    runtime: string;
+    schemaVersion: 2;
+    tuples: readonly import("../v2/capability.js").RuntimeCapabilityTupleV2[];
+    unsupported: readonly import("../v2/capability.js").UnsupportedRuntimeCarrierV2[];
+}>;
+export declare function detectNodeRuntimeCapabilityV2(rawQuicAvailable: boolean): Readonly<{
     language: string;
     runtime: string;
     schemaVersion: 2;

package/dist/node/runtimeCapability.js

@@ -1,10 +1,24 @@
 import { defineRuntimeCapabilityDescriptorV2 } from "../v2/capability.js";
-export const NODE_RUNTIME_CAPABILITY_V2 = defineRuntimeCapabilityDescriptorV2("node", [
+const nodeWebSocketTuples = [
     { carrier: "websocket", datagrams: false, migration: false, networkMode: "dial", path: "direct", reliableStreams: true, sessionRole: "client" },
     { carrier: "websocket", datagrams: false, migration: false, networkMode: "dial", path: "tunnel", reliableStreams: true, sessionRole: "client" },
     { carrier: "websocket", datagrams: false, migration: false, networkMode: "dial", path: "tunnel", reliableStreams: true, sessionRole: "server" },
-    { carrier: "webtransport", datagrams: true, migration: false, networkMode: "dial", path: "direct", reliableStreams: true, sessionRole: "client" },
-    { carrier: "webtransport", datagrams: true, migration: false, networkMode: "dial", path: "tunnel", reliableStreams: true, sessionRole: "client" },
-    { carrier: "webtransport", datagrams: true, migration: false, networkMode: "dial", path: "tunnel", reliableStreams: true, sessionRole: "server" },
-    { carrier: "webtransport", datagrams: true, migration: false, networkMode: "listen", path: "direct", reliableStreams: true, sessionRole: "server" },
-], [{ carrier: "raw_quic", reason: "raw_quic_adapter_not_implemented" }]);
+    { carrier: "websocket", datagrams: false, migration: false, networkMode: "listen", path: "direct", reliableStreams: true, sessionRole: "server" },
+];
+export const NODE_RUNTIME_PROFILE_V2 = defineRuntimeCapabilityDescriptorV2("node", [
+    { carrier: "raw_quic", datagrams: true, migration: false, networkMode: "dial", path: "direct", reliableStreams: true, sessionRole: "client" },
+    { carrier: "raw_quic", datagrams: true, migration: false, networkMode: "dial", path: "tunnel", reliableStreams: true, sessionRole: "client" },
+    { carrier: "raw_quic", datagrams: true, migration: false, networkMode: "dial", path: "tunnel", reliableStreams: true, sessionRole: "server" },
+    { carrier: "raw_quic", datagrams: true, migration: false, networkMode: "listen", path: "direct", reliableStreams: true, sessionRole: "server" },
+    ...nodeWebSocketTuples,
+], [
+    { carrier: "webtransport", reason: "node_webtransport_driver_unavailable" },
+]);
+export function detectNodeRuntimeCapabilityV2(rawQuicAvailable) {
+    if (rawQuicAvailable)
+        return NODE_RUNTIME_PROFILE_V2;
+    return defineRuntimeCapabilityDescriptorV2("node", nodeWebSocketTuples, [
+        { carrier: "raw_quic", reason: "node_native_transport_unavailable" },
+        { carrier: "webtransport", reason: "node_webtransport_driver_unavailable" },
+    ]);
+}

package/dist/node/tunnelRuntime.d.ts

@@ -0,0 +1,42 @@
+import type { OperationOptions } from "../public/contract.js";
+import { TunnelAuthorizationResponse, type TunnelAuthorizationDecision as ControlPlaneTunnelAuthorizationDecision, type RuntimeAuthorizationRequest } from "./controlplane.js";
+export type TunnelAuthorizationDecision = ControlPlaneTunnelAuthorizationDecision;
+export type TunnelRuntimeListener = Readonly<{
+    carrier: "websocket";
+    host: string;
+    port: number;
+    tls: Readonly<{
+        certificate: string;
+        privateKey: string;
+    }>;
+    allowedOrigins: readonly string[];
+}> | Readonly<{
+    carrier: "raw_quic";
+    host: string;
+    port: number;
+    tls: Readonly<{
+        certificate: string;
+        privateKey: string;
+    }>;
+}>;
+export type TunnelRuntimeOptions = Readonly<{
+    listeners: readonly TunnelRuntimeListener[];
+    maxInboundStreams: number;
+    maxPendingLegs?: number;
+    maxActivePairs?: number;
+    maxConcurrentStreams?: number;
+    pairTimeoutMs?: number;
+    cleanupTimeoutMs?: number;
+    authorize(request: RuntimeAuthorizationRequest, options: OperationOptions): Promise<TunnelAuthorizationDecision | TunnelAuthorizationResponse>;
+    release?(leaseId: string): Promise<void> | void;
+}>;
+export declare class TunnelRuntime {
+    private constructor();
+    start(): Promise<void>;
+    addresses(): readonly Readonly<{
+        host: string;
+        port: number;
+    }>[];
+    close(): Promise<void>;
+}
+export declare function createTunnelRuntime(options: TunnelRuntimeOptions): TunnelRuntime;