@floegence/flowersec-core 2.5.4 → 3.0.0

package/dist/v3/artifact.d.ts

@@ -0,0 +1,145 @@
+import { FLOWERSEC_V3_PROFILE } from "./transportConstants.js";
+export type ArtifactCarrierV3 = "websocket" | "raw_quic" | "webtransport";
+export type ArtifactPathKindV3 = "direct" | "tunnel";
+export type CertificatePinV3 = Readonly<{
+    algorithm: "sha-256";
+    not_after_unix_s: number;
+    value_b64u: string;
+}>;
+export type TransportSecurityPolicyV3 = Readonly<{
+    mode: "ca";
+}> | Readonly<{
+    mode: "pin";
+    pins: readonly CertificatePinV3[];
+}>;
+export type ArtifactCandidateV3 = Readonly<{
+    id: string;
+    carrier: ArtifactCarrierV3;
+    url: string;
+    wire_profile: string;
+    tls: TransportSecurityPolicyV3;
+    normalized_url?: string;
+}>;
+export type CanonicalArtifactCandidateV3 = Readonly<{
+    carrier: ArtifactCarrierV3;
+    id: string;
+    normalized_url: string;
+    tls: TransportSecurityPolicyV3;
+    wire_profile: string;
+}>;
+export type SessionContractV3 = Readonly<{
+    channel_id: string;
+    init_expire_at_unix_s: number;
+    idle_timeout_seconds: number;
+    establish_timeout_seconds: number;
+    rekey_prepare_timeout_seconds: number;
+    rekey_completion_timeout_seconds: number;
+    max_inbound_streams: number;
+    e2ee_psk_b64u: string;
+    allowed_suites: readonly number[];
+    default_suite: number;
+    selected_features: number;
+    contract_hash_b64u: string;
+}>;
+export type DirectArtifactPathV3 = Readonly<{
+    kind: "direct";
+    rendezvous_group_id: string;
+    listener_audience: string;
+    routing_token: string;
+    candidates: readonly ArtifactCandidateV3[];
+}>;
+export type TunnelArtifactPathV3 = Readonly<{
+    kind: "tunnel";
+    rendezvous_group_id: string;
+    listener_audience: string;
+    role: 1 | 2;
+    local_endpoint_instance_id: string;
+    expected_peer_endpoint_instance_id: string;
+    token: string;
+    candidates: readonly ArtifactCandidateV3[];
+}>;
+export type ScopeMetadataV3 = Readonly<{
+    scope: string;
+    scope_version: number;
+    critical: boolean;
+    payload: Readonly<Record<string, unknown>>;
+}>;
+export type CorrelationTagV3 = Readonly<{
+    key: string;
+    value: string;
+}>;
+export type CorrelationContextV3 = Readonly<{
+    v: 3;
+    tags: readonly CorrelationTagV3[];
+}>;
+export type ArtifactV3 = Readonly<{
+    v: 3;
+    profile: typeof FLOWERSEC_V3_PROFILE;
+    session: SessionContractV3;
+    path: DirectArtifactPathV3 | TunnelArtifactPathV3;
+    scoped: readonly ScopeMetadataV3[];
+    correlation: CorrelationContextV3;
+}>;
+type CommonFSB3RequestV3 = Readonly<{
+    profile: typeof FLOWERSEC_V3_PROFILE;
+    channel_id: string;
+    session_contract_hash_b64u: string;
+    rendezvous_group_id: string;
+    candidates: readonly CanonicalArtifactCandidateV3[];
+    candidate_set_hash_b64u: string;
+    chosen_candidate_id: string;
+    listener_audience: string;
+}>;
+export type DirectFSB3RequestV3 = CommonFSB3RequestV3 & Readonly<{
+    pathKind: "direct";
+    routing_token: string;
+}>;
+export type TunnelFSB3RequestV3 = CommonFSB3RequestV3 & Readonly<{
+    pathKind: "tunnel";
+    role: 1 | 2;
+    endpoint_instance_id: string;
+    attach_token: string;
+}>;
+export type FSB3RequestV3 = DirectFSB3RequestV3 | TunnelFSB3RequestV3;
+export type DecodedFSB3RequestV3 = Readonly<{
+    request: FSB3RequestV3;
+    raw: Uint8Array;
+    localAdmissionBinding: Uint8Array;
+}>;
+export declare enum AdmissionStatusV3 {
+    Success = 0,
+    Reject = 1,
+    Retryable = 2
+}
+export type AdmissionResponseV3 = Readonly<{
+    status: AdmissionStatusV3;
+    reason: string;
+}>;
+export type ArtifactV3ErrorCode = "artifact_too_large" | "fsb3_payload_too_large" | "invalid_artifact" | "invalid_candidate" | "invalid_fsa3" | "invalid_fsb3" | "noncanonical_fsb3";
+export declare class ArtifactV3Error extends Error {
+    readonly code: ArtifactV3ErrorCode;
+    constructor(code: ArtifactV3ErrorCode, message: string);
+}
+export type LabeledHashV3 = Readonly<{
+    canonicalJSON: string;
+    hash: Uint8Array;
+    hashBase64URL: string;
+}>;
+export type CanonicalCandidateSetV3 = LabeledHashV3 & Readonly<{
+    candidates: readonly CanonicalArtifactCandidateV3[];
+}>;
+export declare function computeSessionContractHashV3(session: SessionContractV3): LabeledHashV3;
+export declare function canonicalizeCandidatesV3(kind: ArtifactPathKindV3, candidates: readonly ArtifactCandidateV3[]): CanonicalCandidateSetV3;
+export declare function decodeArtifactV3JSON(raw: string | Uint8Array): ArtifactV3;
+export declare function encodeArtifactV3JSON(artifact: ArtifactV3): Uint8Array;
+export declare function validateArtifactV3(artifact: ArtifactV3): CanonicalCandidateSetV3;
+export declare function buildFSB3RequestV3(artifact: ArtifactV3, chosenCandidateID: string): FSB3RequestV3;
+export declare function encodeFSB3RequestV3(request: FSB3RequestV3): Uint8Array;
+export declare function decodeFSB3RequestV3(raw: Uint8Array): DecodedFSB3RequestV3;
+export declare function admissionBindingV3(rawFSB3: Uint8Array): Uint8Array;
+export declare function acceptorAdmissionsHashV3(framesByCandidateID: ReadonlyMap<string, Uint8Array>): Uint8Array;
+export declare function encodeFSA3ResponseV3(response: AdmissionResponseV3, admissionReasons?: ReadonlySet<string>): Uint8Array;
+export declare function decodeFSA3ResponseV3(raw: Uint8Array): AdmissionResponseV3;
+export declare function tlsPolicyDigestV3(policy: TransportSecurityPolicyV3): LabeledHashV3;
+export declare function activePinsV3(policy: TransportSecurityPolicyV3, attemptNowUnixSeconds: number): readonly CertificatePinV3[];
+export {};