@floegence/flowersec-core 2.5.3 → 3.0.0

package/dist/node/acceptorV3.js

@@ -0,0 +1,227 @@
+import { projectSessionV3 } from "../v3/publicSession.js";
+import { acceptCarrierSessionV3, createAdmissionReasonRegistryV3, } from "../v3/serverAdmission.js";
+import { nodeSessionRuntimeV3 } from "../v3/nodeSessionRuntime.js";
+import { AdmissionStatusV3 } from "../v3/artifact.js";
+import { unwrapArtifactHandleV3, } from "../v3/publicApi.js";
+import { SessionHandlersV3, createRPCRouter, freezeSessionHandlersV3, } from "./acceptor.js";
+import { serveFrozenStreamHandlers } from "../public/streamHandlers.js";
+import { createNativeRawQuicDriverV3, loadNativeTransportAddon, } from "./nativeTransportAddon.js";
+import { startNodeRawQuicListenerV3, } from "./rawQuicServerV3.js";
+import { startNodeWebSocketListenerV3, } from "./webSocketServerV3.js";
+import { runtimeAuthorizationRequestV3FromDecoded, } from "./runtimeAuthorizationV3.js";
+const DEFAULT_ADMISSION_TIMEOUT_MS = 10_000;
+export class AcceptedSessionV3 {
+    constructor() { }
+    get session() {
+        return acceptedSessionStateV3(this).session;
+    }
+    async serve(options = {}) {
+        const state = acceptedSessionStateV3(this);
+        await serveFrozenStreamHandlers(state.handlers.streams, state.session, options, async () => await this.close());
+    }
+    async close() {
+        const state = acceptedSessionStateV3(this);
+        state.closePromise ??= state.session.close();
+        await state.closePromise;
+    }
+}
+export class AcceptorV3 {
+    constructor() { }
+    addresses() {
+        return acceptorState(this).listeners.map((listener) => listener.address());
+    }
+    async accept(options = {}) {
+        const state = acceptorState(this);
+        if (state.closed)
+            throw new Error("Flowersec v3 acceptor is closed");
+        const controller = new AbortController();
+        const unlinkExternal = linkAbort(options.signal, controller);
+        const unlinkClose = linkAbort(state.abort.signal, controller);
+        try {
+            const carrier = await acceptAny(state, controller.signal);
+            const admission = new AbortController();
+            const unlinkAdmission = linkAbort(controller.signal, admission);
+            const deadline = setTimeout(() => {
+                admission.abort(new Error("Flowersec v3 admission timed out"));
+            }, state.admissionTimeoutMs);
+            try {
+                let handlers;
+                const authorize = async (request, signal) => {
+                    const authorizationRequest = runtimeAuthorizationRequestV3FromDecoded(request);
+                    const decision = await state.authorize(authorizationRequest, signal === undefined ? {} : { signal });
+                    if (decision.accepted) {
+                        return { accepted: true, artifact: unwrapArtifactHandleV3(decision.artifact) };
+                    }
+                    return {
+                        accepted: false,
+                        status: decision.retryable
+                            ? AdmissionStatusV3.Retryable
+                            : AdmissionStatusV3.Reject,
+                        reason: decision.reason,
+                    };
+                };
+                const internal = await acceptCarrierSessionV3(carrier, authorize, {
+                    runtime: nodeSessionRuntimeV3,
+                    admissionReasons: state.admissionReasons,
+                    resolveRPCRouter: async (request, signal) => {
+                        const authorizationRequest = runtimeAuthorizationRequestV3FromDecoded(request);
+                        const registry = state.resolveHandlers === undefined
+                            ? new SessionHandlersV3()
+                            : await state.resolveHandlers(authorizationRequest, signal === undefined ? {} : { signal });
+                        if (signal?.aborted === true) {
+                            throw signal.reason instanceof Error ? signal.reason : new Error("Flowersec v3 admission canceled");
+                        }
+                        handlers = freezeSessionHandlersV3(registry);
+                        return createRPCRouter(handlers.rpc);
+                    },
+                    signal: admission.signal,
+                });
+                if (handlers === undefined)
+                    throw new Error("Flowersec v3 handlers were not resolved");
+                return createAcceptedSessionV3(projectSessionV3(internal), handlers);
+            }
+            catch (error) {
+                carrier.abort({ code: 6, reason: "admission failed" });
+                throw error;
+            }
+            finally {
+                clearTimeout(deadline);
+                unlinkAdmission();
+            }
+        }
+        finally {
+            unlinkExternal();
+            unlinkClose();
+        }
+    }
+    async close() {
+        const state = acceptorState(this);
+        const existing = closes.get(state);
+        if (existing !== undefined)
+            return await existing;
+        const closing = (async () => {
+            await Promise.resolve();
+            state.closed = true;
+            state.abort.abort(new Error("Flowersec v3 acceptor closed"));
+            const results = await Promise.allSettled(state.listeners.map(async (listener) => await listener.close()));
+            if (results.some(({ status }) => status === "rejected"))
+                throw new Error("Flowersec v3 acceptor cleanup failed");
+        })();
+        closes.set(state, closing);
+        return await closing;
+    }
+}
+const acceptorStatesV3 = new WeakMap();
+const closes = new WeakMap();
+const acceptedSessionStatesV3 = new WeakMap();
+export async function createAcceptorV3(options) {
+    validateOptions(options);
+    const admissionReasons = createAdmissionReasonRegistryV3(["expired_artifact"], options.admissionReasons);
+    const listeners = [];
+    let rawDriver;
+    try {
+        for (const listener of options.listeners) {
+            const running = listener.carrier === "websocket"
+                ? await startNodeWebSocketListenerV3({
+                    ...listener,
+                    inboundBidirectionalStreamCapacity: options.maxInboundStreams + 2,
+                })
+                : await startNodeRawQuicListenerV3(rawDriver ??= createNativeRawQuicDriverV3(loadNativeTransportAddon()), {
+                    ...listener,
+                    inboundBidirectionalStreamCapacity: options.maxInboundStreams + 2,
+                });
+            listeners.push(running);
+        }
+    }
+    catch (error) {
+        await Promise.allSettled(listeners.map(async (listener) => await listener.close()));
+        throw error;
+    }
+    const acceptor = new AcceptorV3();
+    acceptorStatesV3.set(acceptor, {
+        listeners: Object.freeze(listeners),
+        authorize: options.authorize,
+        ...(options.resolveHandlers === undefined ? {} : { resolveHandlers: options.resolveHandlers }),
+        admissionReasons,
+        admissionTimeoutMs: options.admissionTimeoutMs ?? DEFAULT_ADMISSION_TIMEOUT_MS,
+        abort: new AbortController(),
+        closed: false,
+        cursor: 0,
+    });
+    return Object.freeze(acceptor);
+}
+function createAcceptedSessionV3(session, handlers) {
+    const accepted = new AcceptedSessionV3();
+    acceptedSessionStatesV3.set(accepted, { session, handlers });
+    return Object.freeze(accepted);
+}
+function acceptedSessionStateV3(accepted) {
+    const state = acceptedSessionStatesV3.get(accepted);
+    if (state === undefined)
+        throw new Error("invalid Flowersec v3 accepted session");
+    return state;
+}
+function acceptorState(value) {
+    const state = acceptorStatesV3.get(value);
+    if (state === undefined)
+        throw new Error("invalid Flowersec v3 acceptor");
+    return state;
+}
+async function acceptAny(state, signal) {
+    if (state.listeners.length === 1)
+        return await state.listeners[0].accept({ signal });
+    const controller = new AbortController();
+    const unlink = linkAbort(signal, controller);
+    try {
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            let remaining = state.listeners.length;
+            const errors = [];
+            state.listeners.forEach((_, index) => {
+                const selected = state.listeners[(index + state.cursor) % state.listeners.length];
+                void selected.accept({ signal: controller.signal }).then((carrier) => {
+                    if (!settled) {
+                        settled = true;
+                        state.cursor = (state.cursor + 1) % state.listeners.length;
+                        controller.abort(new Error("listener race complete"));
+                        resolve(carrier);
+                    }
+                    else {
+                        carrier.abort({ code: 6, reason: "listener race lost" });
+                    }
+                }, (error) => {
+                    errors.push(error);
+                    remaining -= 1;
+                    if (!settled && remaining === 0) {
+                        settled = true;
+                        reject(new AggregateError(errors, "all Flowersec v3 listeners failed"));
+                    }
+                });
+            });
+        });
+    }
+    finally {
+        unlink();
+    }
+}
+function validateOptions(options) {
+    if (options.listeners.length === 0 ||
+        !Number.isSafeInteger(options.maxInboundStreams) || options.maxInboundStreams < 1 ||
+        options.maxInboundStreams > 128 || typeof options.authorize !== "function" ||
+        (options.admissionTimeoutMs !== undefined &&
+            (!Number.isSafeInteger(options.admissionTimeoutMs) ||
+                options.admissionTimeoutMs < 1 || options.admissionTimeoutMs > 600_000)) ||
+        (options.resolveHandlers !== undefined && typeof options.resolveHandlers !== "function") ||
+        options.listeners.some(({ path }) => path !== "direct")) {
+        throw new TypeError("invalid Flowersec v3 Acceptor options");
+    }
+}
+function linkAbort(source, target) {
+    if (source === undefined)
+        return () => undefined;
+    const abort = () => target.abort(source.reason);
+    source.addEventListener("abort", abort, { once: true });
+    if (source.aborted)
+        abort();
+    return () => source.removeEventListener("abort", abort);
+}

package/dist/node/connectSessionV3.d.ts

@@ -0,0 +1,21 @@
+import type { Session } from "../public/contract.js";
+import type { ArtifactLeaseV3 } from "../v3/artifactLease.js";
+import { type ArtifactSourceV3, type ConnectionControllerV3 } from "../v3/connectionController.js";
+import { type RPCHandlers } from "./acceptor.js";
+export type NodeTLSRootsV3 = string | Uint8Array | readonly (string | Uint8Array)[];
+export type SessionOptionsV3 = Readonly<{
+    origin?: string;
+    roots?: NodeTLSRootsV3;
+    signal?: AbortSignal;
+    connectTimeoutMs?: number;
+    rpcHandlers?: RPCHandlers;
+}>;
+export type ConnectionControllerOptionsV3 = Readonly<{
+    origin?: string;
+    roots?: NodeTLSRootsV3;
+    connectTimeoutMs?: number;
+    maximumAttempts?: number;
+    rpcHandlers?: RPCHandlers;
+}>;
+export declare function connectV3(lease: ArtifactLeaseV3, options: SessionOptionsV3): Promise<Session>;
+export declare function createConnectionControllerV3(source: ArtifactSourceV3, options: ConnectionControllerOptionsV3): ConnectionControllerV3<Session>;

package/dist/node/connectSessionV3.js

@@ -0,0 +1,73 @@
+import { SDK_DEFAULTS } from "../defaults.js";
+import { createConnectionControllerV3 as createCoreControllerV3, } from "../v3/connectionController.js";
+import { connectNodeWebSocketV3, detectNodeRuntimeCapabilityV3, } from "../v3/nodeRuntime.js";
+import { attemptClaimedArtifactLeaseV3, connectArtifactLeaseV3 } from "../v3/sessionConnector.js";
+import { readyNativeAdmissionV3, readyWebSocketAdmissionV3 } from "../v3/runtimeAdapters.js";
+import { ConnectErrorV3, TransportFailureV3 } from "../v3/security.js";
+import { nodeSessionRuntimeV3 } from "../v3/nodeSessionRuntime.js";
+import { createNativeRawQuicDriverV3, tryLoadNativeTransportAddon, } from "./nativeTransportAddon.js";
+import { createNodeRawQuicClientV3 } from "./rawQuicAdapterV3.js";
+import { createRPCRouter, freezeRPCHandlers, } from "./acceptor.js";
+export async function connectV3(lease, options) {
+    return await connectArtifactLeaseV3(lease, nodeRuntime(options), options.signal);
+}
+export function createConnectionControllerV3(source, options) {
+    const runtime = nodeRuntime(options);
+    const coreOptions = {
+        capabilitySnapshot: runtime.capabilitySnapshot,
+        projectSessionFailure,
+        ...(options.maximumAttempts === undefined ? {} : { maximumAttempts: options.maximumAttempts }),
+    };
+    return createCoreControllerV3(source, async (context) => await attemptClaimedArtifactLeaseV3(context, runtime), coreOptions);
+}
+function nodeRuntime(options) {
+    const connectTimeoutMilliseconds = options.connectTimeoutMs ?? SDK_DEFAULTS.transport.connectTimeoutMs;
+    if (!Number.isSafeInteger(connectTimeoutMilliseconds) || connectTimeoutMilliseconds < 1) {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
+    const addon = tryLoadNativeTransportAddon();
+    const rawQuic = addon === undefined ? undefined : createNativeRawQuicDriverV3(addon);
+    const capability = detectNodeRuntimeCapabilityV3(rawQuic !== undefined, options.origin !== undefined);
+    let rpcSnapshot;
+    try {
+        rpcSnapshot = options.rpcHandlers === undefined ? undefined : freezeRPCHandlers(options.rpcHandlers);
+    }
+    catch {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
+    return {
+        capabilitySnapshot: () => capability,
+        connectTimeoutMilliseconds,
+        protocolRuntime: nodeSessionRuntimeV3,
+        ...(rpcSnapshot === undefined ? {} : { createRPCRouter: () => createRPCRouter(rpcSnapshot) }),
+        dial: async (candidate, artifact, attemptNow, _capability, signal) => {
+            if (candidate.carrier === "websocket") {
+                if (options.origin === undefined)
+                    throw new TransportFailureV3("tls_unsupported");
+                const socket = await connectNodeWebSocketV3(candidate, attemptNow, {
+                    origin: options.origin,
+                    signal,
+                    ...(options.roots === undefined ? {} : { roots: options.roots }),
+                    timeoutMilliseconds: connectTimeoutMilliseconds,
+                });
+                return await readyWebSocketAdmissionV3(candidate, artifact, socket, signal);
+            }
+            if (candidate.carrier === "raw_quic" && rawQuic !== undefined) {
+                const carrier = await createNodeRawQuicClientV3(rawQuic, candidate, artifact, attemptNow, {
+                    signal,
+                    ...(options.roots === undefined ? {} : { roots: options.roots }),
+                    handshakeTimeoutMs: connectTimeoutMilliseconds,
+                });
+                return readyNativeAdmissionV3(candidate, carrier);
+            }
+            throw new TransportFailureV3("tls_unsupported");
+        },
+    };
+}
+function projectSessionFailure(error) {
+    const code = error.code;
+    const retryable = new Set([
+        "closed", "going_away", "timeout", "resource_exhausted", "stream_reset", "rekey_failed", "liveness_failed",
+    ]).has(String(code));
+    return new ConnectErrorV3("connection_failed", { kind: retryable ? "retryable" : "terminal" });
+}

package/dist/node/index.d.ts

@@ -1,11 +1,16 @@
-export { connect, createConnectionController } from "./connectSession.js";
-export { AcceptedSession, Acceptor, HandlerRegistrationError, RPCHandlers, SessionHandlers, createAcceptor, } from "./acceptor.js";
-export type { AcceptorListener, AcceptorOptions, AuthorizationDecision, RPCHandler, RPCHandlerResult, NotificationHandler, SessionHandlerOptions, } from "./acceptor.js";
-export { TunnelRuntime, createTunnelRuntime } from "./tunnelRuntime.js";
-export type { TunnelAuthorizationDecision, TunnelRuntimeListener, TunnelRuntimeOptions, } from "./tunnelRuntime.js";
-export type { ConnectionControllerOptions, SessionOptions, SessionTLSOptions, } from "./connectSession.js";
-export { AuthorizationRecord, AuthorizationResponse, TunnelAuthorizationResponse, ControlPlaneError, EndpointSet, IssuedArtifact, Issuer, RuntimeAuthorizationRequest, authorizeRuntime, authorizeTunnelRuntime, createEndpointSet, parseAuthorizationRecord, parseRuntimeAuthorizationRequest, rejectRuntime, rejectTunnelRuntime, } from "./controlplane.js";
-export type { ArtifactMetadata, ControlPlaneErrorCode, DirectIssueOptions, IssuedTunnelPair, Scope, SessionOptions as ControlPlaneSessionOptions, TunnelIssueOptions, } from "./controlplane.js";
-export { ProxyServer, ProxyServerError } from "./proxyServer.js";
-export type { ProxyServerOptions, StreamHandlerRegistrar } from "./proxyServer.js";
+export { AcceptedSessionV3 as AcceptedSession, AcceptedSessionV3, AcceptorV3 as Acceptor, AcceptorV3, createAcceptorV3 as createAcceptor, createAcceptorV3, } from "./acceptorV3.js";
+export type { AcceptorListenerV3 as AcceptorListener, AcceptorListenerV3, AcceptorAuthorizationDecisionV3 as AcceptorAuthorizationDecision, AcceptorAuthorizationDecisionV3, AcceptorAuthorizerV3 as AcceptorAuthorizer, AcceptorAuthorizerV3, AcceptorOptionsV3 as AcceptorOptions, AcceptorOptionsV3, } from "./acceptorV3.js";
+export { TunnelRuntimeV3 as TunnelRuntime, TunnelRuntimeV3, createTunnelRuntimeV3 as createTunnelRuntime, createTunnelRuntimeV3, } from "./tunnelRuntimeV3.js";
+export type { TunnelAuthorizationDecisionV3 as TunnelAuthorizationDecision, TunnelAuthorizationDecisionV3, TunnelRuntimeListenerV3 as TunnelRuntimeListener, TunnelRuntimeListenerV3, TunnelRuntimeOptionsV3 as TunnelRuntimeOptions, TunnelRuntimeOptionsV3, } from "./tunnelRuntimeV3.js";
+export { RuntimeAuthorizationRequestV3 as RuntimeAuthorizationRequest, RuntimeAuthorizationRequestV3, TunnelAuthorizationGrantV3 as TunnelAuthorizationGrant, TunnelAuthorizationGrantV3, verifyTunnelAuthorizationGrantV3 as verifyTunnelAuthorizationGrant, verifyTunnelAuthorizationGrantV3, } from "./runtimeAuthorizationV3.js";
+export type { TunnelAuthorizationGrantOptionsV3 as TunnelAuthorizationGrantOptions, TunnelAuthorizationGrantOptionsV3, } from "./runtimeAuthorizationV3.js";
 export * from "../facade.js";
+export * as v2 from "./v2.js";
+import type { NodeTLSRootsV3 } from "./connectSessionV3.js";
+export { connectV3 as connect, connectV3, createConnectionControllerV3 as createConnectionController, createConnectionControllerV3, } from "./connectSessionV3.js";
+export type { ConnectionControllerOptionsV3 as ConnectionControllerOptions, ConnectionControllerOptionsV3, NodeTLSRootsV3, SessionOptionsV3 as SessionOptions, SessionOptionsV3, } from "./connectSessionV3.js";
+export type SessionTLSOptions = Readonly<{
+    ca?: NodeTLSRootsV3;
+}>;
+export { HandlerRegistrationError, RPCHandlers, SessionHandlersV3 as SessionHandlers, } from "./acceptor.js";
+export type { NotificationHandler, RPCHandler, RPCHandlerResult, SessionHandlerOptions, } from "./acceptor.js";

package/dist/node/index.js

@@ -1,6 +1,7 @@
-export { connect, createConnectionController } from "./connectSession.js";
-export { AcceptedSession, Acceptor, HandlerRegistrationError, RPCHandlers, SessionHandlers, createAcceptor, } from "./acceptor.js";
-export { TunnelRuntime, createTunnelRuntime } from "./tunnelRuntime.js";
-export { AuthorizationRecord, AuthorizationResponse, TunnelAuthorizationResponse, ControlPlaneError, EndpointSet, IssuedArtifact, Issuer, RuntimeAuthorizationRequest, authorizeRuntime, authorizeTunnelRuntime, createEndpointSet, parseAuthorizationRecord, parseRuntimeAuthorizationRequest, rejectRuntime, rejectTunnelRuntime, } from "./controlplane.js";
-export { ProxyServer, ProxyServerError } from "./proxyServer.js";
+export { AcceptedSessionV3 as AcceptedSession, AcceptedSessionV3, AcceptorV3 as Acceptor, AcceptorV3, createAcceptorV3 as createAcceptor, createAcceptorV3, } from "./acceptorV3.js";
+export { TunnelRuntimeV3 as TunnelRuntime, TunnelRuntimeV3, createTunnelRuntimeV3 as createTunnelRuntime, createTunnelRuntimeV3, } from "./tunnelRuntimeV3.js";
+export { RuntimeAuthorizationRequestV3 as RuntimeAuthorizationRequest, RuntimeAuthorizationRequestV3, TunnelAuthorizationGrantV3 as TunnelAuthorizationGrant, TunnelAuthorizationGrantV3, verifyTunnelAuthorizationGrantV3 as verifyTunnelAuthorizationGrant, verifyTunnelAuthorizationGrantV3, } from "./runtimeAuthorizationV3.js";
 export * from "../facade.js";
+export * as v2 from "./v2.js";
+export { connectV3 as connect, connectV3, createConnectionControllerV3 as createConnectionController, createConnectionControllerV3, } from "./connectSessionV3.js";
+export { HandlerRegistrationError, RPCHandlers, SessionHandlersV3 as SessionHandlers, } from "./acceptor.js";

package/dist/node/nativeTransportAddon.d.ts

@@ -1,6 +1,7 @@
 import { type NativeCarrierSessionV2 } from "../v2/carrier.js";
 import type { PathKind } from "../v2/contract.js";
-export declare const NATIVE_TRANSPORT_CONTRACT_VERSION = 1;
+import type { NativeCarrierSessionV3 } from "../v3/carrier.js";
+export declare const NATIVE_TRANSPORT_CONTRACT_VERSION = 2;
 export type NativeRawQuicConnectOptions = Readonly<{
     host: string;
     port: number;
@@ -19,6 +20,23 @@ export type NativeRawQuicBindOptions = Readonly<{
     inboundBidirectionalStreamCapacity: number;
     handshakeTimeoutMs?: number;
 }>;
+type NativeRawQuicConnectOptionsV3Base = Readonly<{
+    host: string;
+    port: number;
+    serverName: string;
+    path: PathKind;
+    inboundBidirectionalStreamCapacity: number;
+    handshakeTimeoutMs: number;
+}>;
+export type NativeRawQuicConnectOptionsV3 = NativeRawQuicConnectOptionsV3Base & (Readonly<{
+    tlsMode: "ca";
+    trustRootsDer: readonly Uint8Array[];
+    activeLeafDerSha256?: never;
+}> | Readonly<{
+    tlsMode: "pin";
+    activeLeafDerSha256: readonly Uint8Array[];
+    trustRootsDer?: never;
+}>);
 export type NativeRawQuicListener = Readonly<{
     address(): Readonly<{
         host: string;
@@ -35,6 +53,22 @@ export type NativeRawQuicDriver = Readonly<{
     }>): Promise<NativeCarrierSessionV2>;
     bindRawQuic(options: NativeRawQuicBindOptions): Promise<NativeRawQuicListener>;
 }>;
+export type NativeRawQuicListenerV3 = Readonly<{
+    address(): Readonly<{
+        host: string;
+        port: number;
+    }>;
+    accept(options?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<NativeCarrierSessionV3>;
+    close(): Promise<void>;
+}>;
+export type NativeRawQuicDriverV3 = Readonly<{
+    connectRawQuic(options: NativeRawQuicConnectOptionsV3, operation?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<NativeCarrierSessionV3>;
+    bindRawQuic(options: NativeRawQuicBindOptions): Promise<NativeRawQuicListenerV3>;
+}>;
 type NativeOperation<T> = Readonly<{
     result(): Promise<T>;
     cancel(): void;
@@ -51,6 +85,7 @@ type NativeRawQuicStreamBinding = Readonly<{
 type NativeRawQuicSessionBinding = Readonly<{
     kind: "raw_quic";
     path: PathKind;
+    wireVersion: 2 | 3;
     inboundBidirectionalStreamCapacity: number;
     maxDatagramSize?: number;
     localAddress(): Readonly<{
@@ -82,6 +117,8 @@ export type NativeTransportAddonBinding = Readonly<{
     contractVersion(): number;
     connectRawQuic(options: NativeRawQuicConnectOptions): NativeOperation<NativeRawQuicSessionBinding>;
     bindRawQuic(options: NativeRawQuicBindOptions): Promise<NativeRawQuicListenerBinding>;
+    connectRawQuicV3(options: NativeRawQuicConnectOptionsV3): NativeOperation<NativeRawQuicSessionBinding>;
+    bindRawQuicV3(options: NativeRawQuicBindOptions): Promise<NativeRawQuicListenerBinding>;
 }>;
 export type NativeTransportAddon = NativeTransportAddonBinding;
 export declare class NativeTransportUnavailableError extends Error {
@@ -92,4 +129,5 @@ type RequireFunction = (specifier: string) => unknown;
 export declare function loadNativeTransportAddon(requireFunction?: RequireFunction): NativeTransportAddonBinding;
 export declare function tryLoadNativeTransportAddon(requireFunction?: RequireFunction): NativeTransportAddonBinding | undefined;
 export declare function createNativeRawQuicDriver(addon?: NativeTransportAddonBinding): NativeRawQuicDriver;
+export declare function createNativeRawQuicDriverV3(addon?: NativeTransportAddonBinding): NativeRawQuicDriverV3;
 export {};

package/dist/node/nativeTransportAddon.js

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import { CarrierError, } from "../v2/carrier.js";
-export const NATIVE_TRANSPORT_CONTRACT_VERSION = 1;
+export const NATIVE_TRANSPORT_CONTRACT_VERSION = 2;
 const NATIVE_PACKAGE = "@floegence/flowersec-node-native";
 const SERVER_PARITY_NATIVE_ADDON = "FLOWERSEC_SERVER_PARITY_NATIVE_ADDON";
 export class NativeTransportUnavailableError extends Error {
@@ -45,13 +45,31 @@ export function createNativeRawQuicDriver(addon = loadNativeTransportAddon()) {
     return Object.freeze({
         async connectRawQuic(options, operation = {}) {
             const native = await settle(addon.connectRawQuic(options), operation.signal);
-            return wrapSession(native);
+            return wrapSession(native, 2);
         },
         async bindRawQuic(options) {
             const native = await addon.bindRawQuic(options);
             return Object.freeze({
                 address: () => native.address(),
-                accept: async (operation = {}) => wrapSession(await settle(native.accept(), operation.signal)),
+                accept: async (operation = {}) => wrapSession(await settle(native.accept(), operation.signal), 2),
+                async close() {
+                    await native.close();
+                },
+            });
+        },
+    });
+}
+export function createNativeRawQuicDriverV3(addon = loadNativeTransportAddon()) {
+    return Object.freeze({
+        async connectRawQuic(options, operation = {}) {
+            const native = await settle(addon.connectRawQuicV3(options), operation.signal);
+            return wrapSession(native, 3);
+        },
+        async bindRawQuic(options) {
+            const native = await addon.bindRawQuicV3(options);
+            return Object.freeze({
+                address: () => native.address(),
+                accept: async (operation = {}) => wrapSession(await settle(native.accept(), operation.signal), 3),
                 async close() {
                     await native.close();
                 },
@@ -74,9 +92,15 @@ function isNativeTransportAddon(value) {
     }
     return contractVersion === NATIVE_TRANSPORT_CONTRACT_VERSION &&
         typeof candidate.connectRawQuic === "function" &&
-        typeof candidate.bindRawQuic === "function";
+        typeof candidate.bindRawQuic === "function" &&
+        typeof candidate.connectRawQuicV3 === "function" &&
+        typeof candidate.bindRawQuicV3 === "function";
 }
-function wrapSession(native) {
+function wrapSession(native, expectedWireVersion) {
+    if (native.wireVersion !== expectedWireVersion) {
+        native.abort();
+        throw new NativeTransportUnavailableError();
+    }
     const unreliableDatagrams = native.maxDatagramSize === undefined
         ? undefined
         : Object.freeze({

package/dist/node/rawQuicAdapterV3.d.ts

@@ -0,0 +1,10 @@
+import type { ArtifactV3, CanonicalArtifactCandidateV3 } from "../v3/artifact.js";
+import type { NativeCarrierSessionV3 } from "../v3/carrier.js";
+import type { NativeRawQuicDriverV3 } from "./nativeTransportAddon.js";
+type NodeTLSRootsV3 = string | Uint8Array | readonly (string | Uint8Array)[];
+export declare function createNodeRawQuicClientV3(driver: NativeRawQuicDriverV3, candidate: CanonicalArtifactCandidateV3, artifact: ArtifactV3, attemptNowUnixSeconds: number, options?: Readonly<{
+    roots?: NodeTLSRootsV3;
+    signal?: AbortSignal;
+    handshakeTimeoutMs?: number;
+}>): Promise<NativeCarrierSessionV3>;
+export {};

package/dist/node/rawQuicAdapterV3.js

@@ -0,0 +1,76 @@
+import { rootCertificates } from "node:tls";
+import { snapshotTransportSecurityPolicyV3, TransportFailureV3, } from "../v3/security.js";
+import { normalizeCertificateChain } from "./rawQuicAdapter.js";
+import { alpnForPathV3 } from "../v3/transportConstants.js";
+const DEFAULT_HANDSHAKE_TIMEOUT_MS = 10_000;
+export async function createNodeRawQuicClientV3(driver, candidate, artifact, attemptNowUnixSeconds, options = {}) {
+    if (candidate.carrier !== "raw_quic")
+        throw new TransportFailureV3("invalid_artifact");
+    if (candidate.wire_profile !== alpnForPathV3(artifact.path.kind)) {
+        throw new TransportFailureV3("invalid_artifact");
+    }
+    let url;
+    try {
+        url = new URL(candidate.normalized_url);
+    }
+    catch {
+        throw new TransportFailureV3("invalid_artifact");
+    }
+    if (url.protocol !== "quic:" || url.pathname !== "" || url.search !== "" || url.hash !== "" ||
+        url.username !== "" || url.password !== "") {
+        throw new TransportFailureV3("invalid_artifact");
+    }
+    const handshakeTimeoutMs = options.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS;
+    if (!Number.isSafeInteger(handshakeTimeoutMs) || handshakeTimeoutMs < 1 || handshakeTimeoutMs > 120_000) {
+        throw new TransportFailureV3("invalid_artifact");
+    }
+    const policy = snapshotTransportSecurityPolicyV3(candidate.tls, attemptNowUnixSeconds, ["ca", "pin"]);
+    const common = {
+        host: unbracket(url.hostname),
+        port: url.port === "" ? 443 : Number(url.port),
+        serverName: unbracket(url.hostname),
+        path: artifact.path.kind,
+        inboundBidirectionalStreamCapacity: artifact.session.max_inbound_streams + 2,
+        handshakeTimeoutMs,
+    };
+    const nativeOptions = policy.mode === "ca"
+        ? {
+            ...common,
+            tlsMode: "ca",
+            trustRootsDer: normalizeCertificateChain(options.roots ?? rootCertificates),
+        }
+        : {
+            ...common,
+            tlsMode: "pin",
+            activeLeafDerSha256: policy.activeLeafDerSHA256,
+        };
+    try {
+        return await driver.connectRawQuic(nativeOptions, {
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+        });
+    }
+    catch (error) {
+        if (error instanceof TransportFailureV3)
+            throw error;
+        if (options.signal?.aborted === true)
+            throw options.signal.reason;
+        const reason = error instanceof Error ? error.message : "";
+        switch (reason) {
+            case "pin_mismatch":
+                throw new TransportFailureV3("tls_failed", "pin_mismatch", error);
+            case "pin_certificate_invalid":
+            case "handshake_failed":
+            case "invalid_alpn":
+                throw new TransportFailureV3("tls_failed", "unknown", error);
+            case "invalid_tls_policy":
+            case "invalid_trust_roots":
+            case "invalid_limits":
+                throw new TransportFailureV3("invalid_artifact", undefined, error);
+            default:
+                throw new TransportFailureV3("connection_failed", undefined, error);
+        }
+    }
+}
+function unbracket(host) {
+    return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}

package/dist/node/rawQuicServerV3.d.ts

@@ -0,0 +1,24 @@
+import { type CarrierSessionV3 } from "../v3/carrier.js";
+import type { PathKind } from "../v3/contract.js";
+import type { NativeRawQuicDriverV3 } from "./nativeTransportAddon.js";
+export type NodeRawQuicListenerOptionsV3 = Readonly<{
+    host: string;
+    port: number;
+    path: PathKind;
+    tls: Readonly<{
+        certificate: string | Uint8Array;
+        privateKey: string | Uint8Array;
+    }>;
+    inboundBidirectionalStreamCapacity: number;
+}>;
+export type NodeRawQuicListenerV3 = Readonly<{
+    address(): Readonly<{
+        host: string;
+        port: number;
+    }>;
+    accept(options?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<CarrierSessionV3>;
+    close(): Promise<void>;
+}>;
+export declare function startNodeRawQuicListenerV3(driver: NativeRawQuicDriverV3, options: NodeRawQuicListenerOptionsV3): Promise<NodeRawQuicListenerV3>;

package/dist/node/rawQuicServerV3.js

@@ -0,0 +1,34 @@
+import { adaptNativeCarrierSessionV3 } from "../v3/carrier.js";
+import { normalizeCertificateChain, normalizePrivateKey } from "./rawQuicAdapter.js";
+export async function startNodeRawQuicListenerV3(driver, options) {
+    validateOptions(options);
+    let listener;
+    try {
+        listener = await driver.bindRawQuic({
+            host: options.host,
+            port: options.port,
+            path: options.path,
+            certificateChainDer: normalizeCertificateChain(options.tls.certificate),
+            privateKeyDer: normalizePrivateKey(options.tls.privateKey),
+            inboundBidirectionalStreamCapacity: options.inboundBidirectionalStreamCapacity,
+        });
+    }
+    catch (error) {
+        if (error instanceof TypeError)
+            throw error;
+        throw new Error("Flowersec raw QUIC v3 listener failed to bind");
+    }
+    return Object.freeze({
+        address: () => listener.address(),
+        accept: async (operation = {}) => adaptNativeCarrierSessionV3(await listener.accept(operation)),
+        close: async () => await listener.close(),
+    });
+}
+function validateOptions(options) {
+    if (!Number.isInteger(options.port) || options.port < 0 || options.port > 65_535 ||
+        !Number.isInteger(options.inboundBidirectionalStreamCapacity) ||
+        options.inboundBidirectionalStreamCapacity < 3 || options.inboundBidirectionalStreamCapacity > 130 ||
+        options.tls.certificate.length === 0 || options.tls.privateKey.length === 0) {
+        throw new TypeError("invalid Node raw QUIC v3 listener options");
+    }
+}