@floegence/flowersec-core 2.5.3 → 3.0.0

package/dist/v3/serverAdmission.d.ts

@@ -0,0 +1,38 @@
+import { AdmissionStatusV3, type ArtifactV3, type DecodedFSB3RequestV3 } from "./artifact.js";
+import type { CarrierSessionV3, CarrierStreamV3 } from "./carrier.js";
+import { type SessionProtocolRuntimeV3, type SessionV3 } from "./session.js";
+import type { RpcRouter } from "../rpc/server.js";
+export type AdmissionDecisionV3 = Readonly<{
+    accepted: true;
+    artifact: ArtifactV3;
+}> | Readonly<{
+    accepted: false;
+    status: AdmissionStatusV3.Reject | AdmissionStatusV3.Retryable;
+    reason: string;
+}>;
+export type AdmissionAuthorizerV3 = (request: DecodedFSB3RequestV3, signal?: AbortSignal) => Promise<AdmissionDecisionV3>;
+export declare function createAdmissionReasonRegistryV3(builtInReasons: readonly string[], deploymentReasons?: readonly string[]): ReadonlySet<string>;
+export type ReceivedSessionAdmissionV3 = Readonly<{
+    carrier: CarrierSessionV3;
+    stream: CarrierStreamV3;
+    rawFSB3: Uint8Array;
+    decoded: DecodedFSB3RequestV3;
+}>;
+export declare function receiveSessionAdmissionV3(carrier: CarrierSessionV3, signal?: AbortSignal): Promise<ReceivedSessionAdmissionV3>;
+export declare function rejectSessionAdmissionV3(received: ReceivedSessionAdmissionV3, decision: Extract<AdmissionDecisionV3, Readonly<{
+    accepted: false;
+}>>, admissionReasons: ReadonlySet<string>, signal?: AbortSignal): Promise<never>;
+export declare function acceptReceivedSessionV3(received: ReceivedSessionAdmissionV3, artifact: ArtifactV3, options: Readonly<{
+    runtime: SessionProtocolRuntimeV3;
+    admissionReasons: ReadonlySet<string>;
+    resolveRPCRouter?(request: DecodedFSB3RequestV3, signal?: AbortSignal): Promise<RpcRouter> | RpcRouter;
+    nowUnixSeconds?: () => number;
+    signal?: AbortSignal;
+}>): Promise<SessionV3>;
+export declare function acceptCarrierSessionV3(carrier: CarrierSessionV3, authorize: AdmissionAuthorizerV3, options: Readonly<{
+    runtime: SessionProtocolRuntimeV3;
+    admissionReasons: ReadonlySet<string>;
+    resolveRPCRouter?(request: DecodedFSB3RequestV3, signal?: AbortSignal): Promise<RpcRouter> | RpcRouter;
+    nowUnixSeconds?: () => number;
+    signal?: AbortSignal;
+}>): Promise<SessionV3>;

package/dist/v3/serverAdmission.js

@@ -0,0 +1,223 @@
+import { base64urlDecode } from "../utils/base64url.js";
+import { AdmissionStatusV3, buildFSB3RequestV3, decodeFSB3RequestV3, encodeFSA3ResponseV3, encodeFSB3RequestV3, validateArtifactV3, } from "./artifact.js";
+import { AdmissionSessionV3Error } from "./admissionError.js";
+import { configureServerWebSocketCarrierRoleV3 } from "./webSocketCarrier.js";
+import { establishSessionV3 } from "./session.js";
+export function createAdmissionReasonRegistryV3(builtInReasons, deploymentReasons = []) {
+    const registry = new Set();
+    for (const reason of [...builtInReasons, ...deploymentReasons]) {
+        if (registry.has(reason))
+            throw new TypeError(`duplicate Flowersec v3 admission reason: ${reason}`);
+        registry.add(reason);
+        encodeFSA3ResponseV3({
+            status: reason === "expired_artifact" ? AdmissionStatusV3.Retryable : AdmissionStatusV3.Reject,
+            reason,
+        }, registry);
+    }
+    return registry;
+}
+export async function receiveSessionAdmissionV3(carrier, signal) {
+    const stream = await carrier.acceptStream(signalOptions(signal));
+    try {
+        const rawFSB3 = await readFSB3(stream, signal);
+        return Object.freeze({ carrier, stream, rawFSB3, decoded: decodeFSB3RequestV3(rawFSB3) });
+    }
+    catch (error) {
+        stream.abort(asError(error));
+        carrier.abort({ code: 6, reason: "admission failed" });
+        throw error;
+    }
+}
+export async function rejectSessionAdmissionV3(received, decision, admissionReasons, signal) {
+    try {
+        await respondAdmission(received.stream, { status: decision.status, reason: decision.reason }, admissionReasons, signal);
+    }
+    finally {
+        received.carrier.abort({ code: 6, reason: "admission rejected" });
+    }
+    throw new AdmissionSessionV3Error(decision.reason, `Flowersec v3 admission rejected: ${decision.reason}`);
+}
+export async function acceptReceivedSessionV3(received, artifact, options) {
+    return await acceptCarrierBoundSessionV3(received, artifact, options);
+}
+async function acceptCarrierBoundSessionV3(received, artifact, options) {
+    try {
+        assertAdmissionCarrierBindingV3(received);
+        validateArtifactV3(artifact);
+        const expected = encodeFSB3RequestV3(buildFSB3RequestV3(artifact, received.decoded.request.chosen_candidate_id));
+        if (!equalBytes(expected, received.rawFSB3))
+            throw new Error("authorized artifact does not match admission");
+        if ((options.nowUnixSeconds?.() ?? Math.floor(Date.now() / 1_000)) >= artifact.session.init_expire_at_unix_s) {
+            return await rejectSessionAdmissionV3(received, {
+                accepted: false,
+                status: AdmissionStatusV3.Retryable,
+                reason: "expired_artifact",
+            }, options.admissionReasons, options.signal);
+        }
+        const rpcRouter = options.resolveRPCRouter === undefined
+            ? undefined
+            : await raceAbort(Promise.resolve().then(async () => await options.resolveRPCRouter(received.decoded, options.signal)), options.signal);
+        if (received.carrier.kind === "websocket") {
+            configureServerWebSocketCarrierRoleV3(received.carrier, false);
+        }
+        await respondAdmission(received.stream, { status: AdmissionStatusV3.Success, reason: "" }, options.admissionReasons, options.signal);
+        const binding = received.decoded.localAdmissionBinding;
+        return await establishSessionV3(received.carrier, {
+            role: "server",
+            path: artifact.path.kind,
+            channelID: artifact.session.channel_id,
+            sessionContractHash: base64urlDecode(artifact.session.contract_hash_b64u),
+            suite: artifact.session.default_suite,
+            psk: base64urlDecode(artifact.session.e2ee_psk_b64u),
+            maxInboundStreams: artifact.session.max_inbound_streams,
+            sessionContract: artifact.session,
+            idleTimeoutMs: artifact.session.idle_timeout_seconds * 1_000,
+            closeTimeoutMs: 5_000,
+            runtime: options.runtime,
+            ...(rpcRouter === undefined ? {} : { rpcRouter }),
+            localAdmissionBinding: binding,
+            peerAdmissionBinding: binding,
+            localEndpointInstanceID: "",
+            expectedPeerEndpointInstanceID: "",
+            deadlines: {
+                establishTimeoutMs: artifact.session.establish_timeout_seconds * 1_000,
+                rekeyPrepareTimeoutMs: artifact.session.rekey_prepare_timeout_seconds * 1_000,
+                rekeyCompletionTimeoutMs: artifact.session.rekey_completion_timeout_seconds * 1_000,
+            },
+        }, signalOptions(options.signal));
+    }
+    catch (error) {
+        received.stream.abort(asError(error));
+        received.carrier.abort({ code: 6, reason: "admission failed" });
+        throw error;
+    }
+}
+export async function acceptCarrierSessionV3(carrier, authorize, options) {
+    const received = await receiveSessionAdmissionV3(carrier, options.signal);
+    try {
+        assertAdmissionCarrierBindingV3(received);
+        const decision = await raceAbort(Promise.resolve().then(async () => await authorize(received.decoded, options.signal)), options.signal);
+        if (!decision.accepted) {
+            return await rejectSessionAdmissionV3(received, decision, options.admissionReasons, options.signal);
+        }
+        return await acceptCarrierBoundSessionV3(received, decision.artifact, options);
+    }
+    catch (error) {
+        received.stream.abort(asError(error));
+        carrier.abort({ code: 6, reason: "admission failed" });
+        throw error;
+    }
+}
+function assertAdmissionCarrierBindingV3(received) {
+    const chosen = received.decoded.request.candidates.find(({ id }) => id === received.decoded.request.chosen_candidate_id);
+    if (chosen?.carrier !== received.carrier.kind || received.decoded.request.pathKind !== received.carrier.path) {
+        throw new Error("admission carrier binding mismatch");
+    }
+}
+async function respondAdmission(stream, response, admissionReasons, signal) {
+    await writeAll(stream, encodeFSA3ResponseV3(response, admissionReasons), signal);
+    await raceAbort(stream.closeWrite(), signal);
+}
+async function readFSB3(stream, signal) {
+    const reader = new ExactReader(stream);
+    const header = await reader.readExactly(12, signal);
+    if (header[0] !== 0x46 ||
+        header[1] !== 0x53 ||
+        header[2] !== 0x42 ||
+        header[3] !== 0x33 ||
+        header[4] !== 3 ||
+        (header[5] !== 1 && header[5] !== 2) ||
+        header[6] !== 0 ||
+        header[7] !== 0) {
+        throw new Error("invalid FSB3 header");
+    }
+    const length = new DataView(header.buffer, header.byteOffset, header.byteLength).getUint32(8, false);
+    if (length < 1 || length > 32_768)
+        throw new Error("invalid FSB3 payload length");
+    const payload = await reader.readExactly(length, signal);
+    await reader.expectEOF(signal);
+    const raw = new Uint8Array(header.length + payload.length);
+    raw.set(header);
+    raw.set(payload, header.length);
+    return raw;
+}
+class ExactReader {
+    stream;
+    chunks = [];
+    offset = 0;
+    available = 0;
+    constructor(stream) {
+        this.stream = stream;
+    }
+    async readExactly(length, signal) {
+        while (this.available < length) {
+            const chunk = await raceAbort(this.stream.read(signalOptions(signal)), signal);
+            if (chunk === null)
+                throw new Error("truncated admission stream");
+            if (chunk.length === 0)
+                continue;
+            this.chunks.push(chunk);
+            this.available += chunk.length;
+        }
+        const result = new Uint8Array(length);
+        let written = 0;
+        while (written < length) {
+            const chunk = this.chunks[0];
+            const take = Math.min(length - written, chunk.length - this.offset);
+            result.set(chunk.subarray(this.offset, this.offset + take), written);
+            this.offset += take;
+            this.available -= take;
+            written += take;
+            if (this.offset === chunk.length) {
+                this.chunks.shift();
+                this.offset = 0;
+            }
+        }
+        return result;
+    }
+    async expectEOF(signal) {
+        if (this.available !== 0)
+            throw new Error("trailing bytes after FSB3");
+        while (true) {
+            const chunk = await raceAbort(this.stream.read(signalOptions(signal)), signal);
+            if (chunk === null)
+                return;
+            if (chunk.length !== 0)
+                throw new Error("trailing bytes after FSB3");
+        }
+    }
+}
+async function writeAll(stream, value, signal) {
+    let offset = 0;
+    while (offset < value.length) {
+        const written = await raceAbort(stream.write(value.subarray(offset), signalOptions(signal)), signal);
+        if (written < 1 || written > value.length - offset)
+            throw new Error("short admission write");
+        offset += written;
+    }
+}
+function signalOptions(signal) {
+    return signal === undefined ? {} : { signal };
+}
+async function raceAbort(promise, signal) {
+    if (signal === undefined)
+        return await promise;
+    if (signal.aborted)
+        throw signal.reason;
+    return await new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        void promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+function equalBytes(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < left.length; index += 1)
+        difference |= left[index] ^ right[index];
+    return difference === 0;
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}

package/dist/v3/session.d.ts

@@ -0,0 +1,318 @@
+import { RpcClient } from "../rpc/client.js";
+import { RpcRouter, type RpcServerOptions } from "../rpc/server.js";
+import type { InternalByteStreamV3 as ByteStreamV3, InternalIncomingStreamV3 as IncomingStreamV3, InternalRpcPeerV3, InternalSessionV3 as SessionV3Contract, OperationOptionsV3, PathKind, InternalStreamOpenOptionsV3, UnreliableMessageChannelV3 } from "./contract.js";
+import { type CarrierSessionV3, type CarrierStreamV3 } from "./carrier.js";
+import type { SessionContractV3 } from "./artifact.js";
+import { DirectionV3, InnerTypeV3, type EpochRootsV3, type RecordMaterialV3, type RecordHeaderV3, type CipherSuiteV3 } from "./protocol.js";
+type SessionTerminationV3 = Readonly<{
+    error: Error;
+}>;
+export type SessionRoleV3 = "client" | "server";
+export type SessionDeadlinePhaseV3 = "establish" | "rekey_prepare" | "rekey_completion";
+export type SessionDeadlineHandleV3 = Readonly<{
+    signal: AbortSignal;
+    cancel(): void;
+}>;
+export type SessionDeadlineFactoryV3 = (timeoutMs: number, phase: SessionDeadlinePhaseV3) => SessionDeadlineHandleV3;
+export type SessionDeadlinesV3 = Readonly<{
+    establishTimeoutMs: number;
+    rekeyPrepareTimeoutMs: number;
+    rekeyCompletionTimeoutMs: number;
+    factory?: SessionDeadlineFactoryV3;
+}>;
+export type SessionConfigV3 = Readonly<{
+    role: SessionRoleV3;
+    path: PathKind;
+    channelID: string;
+    sessionContractHash: Uint8Array;
+    suite: CipherSuiteV3;
+    psk: Uint8Array;
+    maxInboundStreams: number;
+    localAdmissionBinding: Uint8Array;
+    peerAdmissionBinding: Uint8Array;
+    /** Required by admitted APIs to bind runtime limits and keys to the signed contract. */
+    sessionContract?: SessionContractV3;
+    localEndpointInstanceID: string;
+    expectedPeerEndpointInstanceID: string;
+    rpcRouter?: RpcRouter;
+    rpcServerOptions?: RpcServerOptions;
+    deadlines?: SessionDeadlinesV3;
+    idleTimeoutMs?: number;
+    closeTimeoutMs?: number;
+    runtime: SessionProtocolRuntimeV3;
+}>;
+export type SessionProtocolRuntimeV3 = Readonly<{
+    entropy(length: number): Uint8Array;
+    monotonicMilliseconds(): number;
+}>;
+export declare class SessionV3Error extends Error {
+    readonly code: "aborted" | "closed" | "going_away" | "handshake" | "open_rejected" | "protocol" | "rekey_failed" | "resource_exhausted" | "stream_reset" | "timeout";
+    constructor(code: "aborted" | "closed" | "going_away" | "handshake" | "open_rejected" | "protocol" | "rekey_failed" | "resource_exhausted" | "stream_reset" | "timeout", message: string);
+}
+declare class SessionRpcPeerV3 implements InternalRpcPeerV3 {
+    private readonly outbound;
+    private readonly inbound;
+    constructor(outbound: RpcClient, inbound: RpcRouter);
+    call(typeId: number, payload: unknown, signal?: AbortSignal): Promise<{
+        payload: unknown;
+        error?: import("../rpc/wire.js").RpcError;
+    }>;
+    notify(typeId: number, payload: unknown): Promise<void>;
+    onNotify(typeId: number, handler: (payload: unknown) => void): () => void;
+    close(): void;
+}
+type HandshakeMaterial = Readonly<{
+    h3: Uint8Array;
+    sessionPRK: Uint8Array;
+    selectedFeatures: number;
+}>;
+export declare function establishSessionV3(carrier: CarrierSessionV3, config: SessionConfigV3, options?: OperationOptionsV3): Promise<SessionV3>;
+export declare class SessionV3 implements SessionV3Contract {
+    private readonly carrier;
+    private readonly control;
+    private readonly controlReader;
+    private readonly config;
+    readonly path: PathKind;
+    readonly endpointInstanceId: string | undefined;
+    readonly rpc: SessionRpcPeerV3;
+    readonly termination: Promise<SessionTerminationV3>;
+    readonly unreliableMessages: UnreliableMessageChannelV3 | undefined;
+    terminalError: Error | undefined;
+    private readonly role;
+    private readonly sendDirection;
+    private readonly receiveDirection;
+    private readonly h3;
+    private readonly sendRoots;
+    private readonly receiveRoots;
+    private sendEpoch;
+    private receiveEpoch;
+    private controlSendEpoch;
+    private controlSendSequence;
+    private controlReceiveEpoch;
+    private controlReceiveSequence;
+    private controlWriteTail;
+    private controlTerminalSealed;
+    private nextLogicalID;
+    private receivedGoAway;
+    private receivedGoAwayLastAccepted;
+    private receivedGoAwayReason;
+    private sentGoAway;
+    private sentGoAwayLastAccepted;
+    private sentGoAwayReason;
+    private closePromise;
+    private lifecycle;
+    private sentSessionClose;
+    private sessionCloseCommitted;
+    private readonly peerSessionClose;
+    private readonly streams;
+    private readonly releasedStreams;
+    private readonly releasedStreamCleanup;
+    private readonly peerLedger;
+    private readonly outboundLedger;
+    private readonly incoming;
+    private readonly outboundPermits;
+    private readonly inboundPermits;
+    private readonly pings;
+    private readonly backgroundTasks;
+    private nextPing;
+    private readonly rpcActivation;
+    private rpcStreamPromise;
+    private rpcServing;
+    private rekeyTail;
+    private nextTransition;
+    private receiveTransition;
+    private pendingSessionRekey;
+    private lastSessionRekeyACK;
+    private preparingSendEpoch;
+    private pendingReceiveEpoch;
+    private openFrozen;
+    private openGate;
+    private outboundFrontierChanged;
+    private activeInboundResponders;
+    private localResponderFrozen;
+    private peerResponderFrozen;
+    private responderChanged;
+    private idleWatchdogStarted;
+    private idleDeadlineMs;
+    private idleTimerCancel;
+    private readonly terminationState;
+    private readonly rpcRouter;
+    constructor(carrier: CarrierSessionV3, control: CarrierStreamV3, controlReader: ExactReader, config: SessionConfigV3, material: HandshakeMaterial);
+    openStream(kind: string, options?: InternalStreamOpenOptionsV3): Promise<ByteStreamV3>;
+    acceptStream(options?: OperationOptionsV3): Promise<IncomingStreamV3>;
+    probeLiveness(options?: OperationOptionsV3): Promise<number>;
+    rekey(options?: OperationOptionsV3): Promise<void>;
+    close(): Promise<void>;
+    start(): void;
+    rootForSend(epoch: number): EpochRootsV3;
+    rootForReceive(epoch: number): EpochRootsV3;
+    hasReceiveRoots(epoch: number): boolean;
+    installReceiveRoots(epoch: number, roots: EpochRootsV3): void;
+    transcriptHash(): Uint8Array;
+    receiveDirectionValue(): DirectionV3;
+    sendStreamRecord(stream: EncryptedStreamV3, type: InnerTypeV3, payload: Uint8Array, signal?: AbortSignal): Promise<void>;
+    readStreamRecord(stream: EncryptedStreamV3): Promise<Readonly<{
+        type: InnerTypeV3;
+        payload: Uint8Array;
+        header: RecordHeaderV3;
+    }>>;
+    localReset(stream: EncryptedStreamV3, error: Error): Promise<void>;
+    releaseStream(stream: EncryptedStreamV3): void;
+    private confirmControlDelivery;
+    private openLogicalStream;
+    private ensureRPCStream;
+    private acceptCarrierLoop;
+    private acceptCarrierStream;
+    private acceptCarrierStreamAfterFSS3;
+    private resetInboundBeforeDelivery;
+    private sendControl;
+    private sendControlResponse;
+    private sendControlCleanup;
+    private sendTerminalControl;
+    private writeControl;
+    private readControl;
+    private controlLoop;
+    private closeOnce;
+    waitTermination(): Promise<SessionTerminationV3>;
+    private rekeyOnce;
+    private rejectExhaustedRekey;
+    private receiveSessionRekey;
+    private enterInboundResponder;
+    private leaveInboundResponder;
+    private freezeInboundResponders;
+    private unfreezeInboundResponders;
+    private notifyResponderChanged;
+    private receiveSessionRekeyBeforeDeadline;
+    private validateSessionRekeySequence;
+    private receiveSessionRekeyACK;
+    private waitOpenGate;
+    resolveOutboundOpen(id: bigint): void;
+    private waitOutboundFrontier;
+    private commitOutboundReset;
+    private commitLocalReset;
+    private notifyOutboundFrontierChanged;
+    private isLocalLogicalID;
+    private localOpenHighWatermark;
+    private validGoAwayBoundary;
+    private sendGoAway;
+    private receiveGoAway;
+    private trackBackground;
+    private localOpeningAllowedAfterGoAway;
+    private acceptsPeerStreamAfterGoAway;
+    private cleanupEpochRoots;
+    streamEpochStateChanged(): void;
+    private cleanupRootMap;
+    private wipeAllRoots;
+    private startIdleWatchdog;
+    private markAuthenticatedActivity;
+    private scheduleIdleWatchdog;
+    private fail;
+    private assertOpen;
+    private beginClosing;
+}
+declare class EncryptedStreamV3 implements ByteStreamV3 {
+    readonly session: SessionV3;
+    readonly carrier: CarrierStreamV3;
+    readonly id: bigint;
+    readonly kind: string;
+    sendEpoch: number;
+    receiveEpoch: number;
+    private readonly permitRelease;
+    readonly reader: ExactReader;
+    readonly opened: Readonly<{
+        promise: Promise<void>;
+        resolve: (value: void | PromiseLike<void>) => void;
+        reject: (reason?: unknown) => void;
+        readonly settled: boolean;
+    }>;
+    readonly data: ByteQueue;
+    terminalError: Error | undefined;
+    sendSequence: bigint;
+    receiveSequence: bigint;
+    priorACK: Readonly<{
+        epoch: number;
+        sequence: bigint;
+    }> | undefined;
+    private sendTail;
+    private localFIN;
+    private remoteFIN;
+    private pumpStarted;
+    private permitReleased;
+    private closeWriteTask;
+    private pendingSendRekey;
+    private lastSendRekeyACK;
+    private receiveRekey;
+    private readonly sendMaterials;
+    private readonly receiveMaterials;
+    constructor(session: SessionV3, carrier: CarrierStreamV3, id: bigint, kind: string, sendEpoch: number, receiveEpoch: number, permitRelease: () => void, reader?: ExactReader);
+    read(options?: OperationOptionsV3): Promise<Uint8Array | null>;
+    write(payload: Uint8Array, options?: OperationOptionsV3): Promise<number>;
+    closeWrite(): Promise<void>;
+    reset(): Promise<void>;
+    close(): Promise<void>;
+    send(type: InnerTypeV3, payload: Uint8Array, signal?: AbortSignal): Promise<void>;
+    canRekeySend(): boolean;
+    hasRemoteFIN(): boolean;
+    startSendRekey(transition: bigint, epoch: number): Readonly<{
+        armed: Deferred<void>;
+        done: Deferred<void>;
+    }>;
+    waitReceiveRekey(transition: bigint, epoch: number, signal?: AbortSignal): Promise<void>;
+    publishReceiveRekey(transition: bigint, epoch: number): void;
+    startPump(): void;
+    markOpen(): void;
+    markTerminal(error: Error): boolean;
+    peerReset(error: Error): void;
+    carrierReset(): void;
+    abort(error?: Error): void;
+    releasePermit(): void;
+    sendMaterial(roots: EpochRootsV3, h3: Uint8Array, direction: DirectionV3): RecordMaterialV3;
+    receiveMaterial(roots: EpochRootsV3, h3: Uint8Array, direction: DirectionV3, epoch: number): RecordMaterialV3;
+    pruneReceiveMaterials(): void;
+    wipeRecordMaterials(): void;
+    transferReceiveMaterialsTo(destination: EncryptedStreamV3): void;
+    private pump;
+    private openedHash;
+    setOpenHash(value: Uint8Array): void;
+    private enqueueSend;
+    private waitSendRekey;
+    private receiveStreamKeyUpdate;
+    private receiveStreamKeyUpdateACK;
+    sendEpochsInUse(): readonly number[];
+    receiveEpochsInUse(): readonly number[];
+    private releaseIfClean;
+}
+declare class ExactReader {
+    private readonly stream;
+    private chunks;
+    private offset;
+    private bytes;
+    constructor(stream: Pick<CarrierStreamV3, "read">);
+    readExactly(length: number, signal?: AbortSignal): Promise<Uint8Array>;
+    readEOF(signal?: AbortSignal): Promise<void>;
+}
+declare class ByteQueue {
+    private readonly limit;
+    private readonly chunks;
+    private head;
+    private bytes;
+    private closed;
+    private error;
+    private readonly waiters;
+    private readonly capacityWaiters;
+    constructor(limit: number);
+    push(chunk: Uint8Array): void;
+    close(): void;
+    fail(error: Error): void;
+    waitForCapacity(required: number): Promise<void>;
+    read(signal?: AbortSignal): Promise<Uint8Array | null>;
+    private wake;
+    private wakeCapacity;
+}
+type Deferred<T> = Readonly<{
+    promise: Promise<T>;
+    resolve: (value: T | PromiseLike<T>) => void;
+    reject: (reason?: unknown) => void;
+    readonly settled: boolean;
+}>;
+export {};