@floegence/flowersec-core 3.2.0 → 4.0.0

package/dist/node/webSocketServer.js

@@ -1,135 +0,0 @@
-import { createServer as createHTTPServer } from "node:http";
-import { createServer as createHTTPSServer } from "node:https";
-import { createRequire } from "node:module";
-import { isIP } from "node:net";
-import { createServerWebSocketCarrierSessionV2 } from "../transport/webSocketAdapter.js";
-import { WebSocketBinaryTransport } from "../ws-client/binaryTransport.js";
-import { defaultWsMaxPayload } from "./wsDefaults.js";
-export async function startNodeWebSocketServer(options) {
-    validateOptions(options);
-    const protocol = options.path === "direct" ? "flowersec.direct.v2" : "flowersec.tunnel.v2";
-    const endpoint = "/flowersec/v2/" + options.path;
-    const require = createRequire(import.meta.url);
-    const wsModule = require("ws");
-    const WebSocketServer = wsModule.WebSocketServer;
-    const server = options.tls === undefined
-        ? createHTTPServer()
-        : createHTTPSServer({ key: options.tls.privateKey, cert: options.tls.certificate, minVersion: "TLSv1.3", maxVersion: "TLSv1.3" });
-    const sessions = new SessionQueue();
-    const sockets = new Set();
-    const wss = new WebSocketServer({
-        noServer: true,
-        perMessageDeflate: false,
-        maxPayload: defaultWsMaxPayload({}),
-        handleProtocols(protocols) { return protocols.has(protocol) ? protocol : false; },
-    });
-    server.on("upgrade", (request, socket, head) => {
-        const origin = request.headers.origin;
-        const requested = request.headers["sec-websocket-protocol"];
-        const remote = request.socket.remoteAddress;
-        const local = request.socket.localAddress;
-        const plaintextAllowed = options.tls === undefined && options.path === "direct" && isLoopback(remote) && isLoopback(local);
-        if (request.url !== endpoint || typeof origin !== "string" || !options.allowedOrigins.includes(origin) || requested !== protocol || (options.tls === undefined && !plaintextAllowed)) {
-            socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
-            socket.destroy();
-            return;
-        }
-        wss.handleUpgrade(request, socket, head, (webSocket) => wss.emit("connection", webSocket));
-    });
-    wss.on("connection", (socket) => {
-        sockets.add(socket);
-        socket.once("close", () => sockets.delete(socket));
-        const transport = new WebSocketBinaryTransport(socket);
-        sessions.push(createServerWebSocketCarrierSessionV2(transport, {
-            path: options.path,
-            inboundBidirectionalStreamCapacity: options.inboundBidirectionalStreamCapacity,
-        }));
-    });
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(options.port, options.host, resolve);
-    });
-    let closed = false;
-    return {
-        address() {
-            const address = server.address();
-            if (address === null || typeof address === "string")
-                throw new Error("Node WebSocket server is not listening");
-            return Object.freeze({ host: address.address, port: address.port });
-        },
-        async accept(acceptOptions = {}) { return await sessions.shift(acceptOptions.signal); },
-        async close() {
-            if (closed)
-                return;
-            closed = true;
-            sessions.close();
-            for (const socket of sockets)
-                socket.close();
-            wss.close();
-            await new Promise((resolve, reject) => server.close((error) => error === undefined ? resolve() : reject(error)));
-        },
-    };
-}
-function validateOptions(options) {
-    if (!Number.isInteger(options.port) || options.port < 0 || options.port > 65_535 || options.allowedOrigins.length === 0) {
-        throw new TypeError("invalid Node WebSocket listener options");
-    }
-    if (options.tls === undefined && (options.path !== "direct" || !isLoopback(options.host))) {
-        throw new TypeError("plaintext WebSocket is restricted to direct loopback listeners");
-    }
-}
-function isLoopback(address) {
-    if (address === undefined)
-        return false;
-    if (address === "::1")
-        return true;
-    if (isIP(address) === 4)
-        return address.startsWith("127.");
-    return address.toLowerCase().startsWith("::ffff:127.");
-}
-class SessionQueue {
-    values = [];
-    waiters = new Set();
-    closed = false;
-    push(value) {
-        if (this.closed) {
-            void value.close();
-            return;
-        }
-        const waiter = this.waiters.values().next().value;
-        if (waiter === undefined)
-            this.values.push(value);
-        else {
-            this.waiters.delete(waiter);
-            waiter.resolve(value);
-        }
-    }
-    async shift(signal) {
-        if (signal?.aborted === true)
-            throw new Error("accept canceled");
-        const value = this.values.shift();
-        if (value !== undefined)
-            return value;
-        if (this.closed)
-            throw new Error("WebSocket listener is closed");
-        return await new Promise((resolve, reject) => {
-            const waiter = { resolve: (session) => { cleanup(); resolve(session); }, reject };
-            const abort = () => { this.waiters.delete(waiter); reject(new Error("accept canceled")); };
-            const cleanup = () => signal?.removeEventListener("abort", abort);
-            this.waiters.add(waiter);
-            signal?.addEventListener("abort", abort, { once: true });
-        });
-    }
-    close() {
-        if (this.closed)
-            return;
-        this.closed = true;
-        const error = new Error("WebSocket listener is closed");
-        for (const waiter of this.waiters)
-            waiter.reject(error);
-        this.waiters.clear();
-        for (const value of this.values)
-            void value.close();
-        this.values.length = 0;
-    }
-}

package/dist/public/artifact.d.ts

@@ -1,11 +0,0 @@
-export declare class Artifact {
-    private readonly artifactBrand;
-    private constructor();
-}
-export type ArtifactErrorCode = "artifact_too_large" | "invalid_artifact" | "invalid_candidate";
-/** A stable, redacted failure returned while parsing an opaque artifact. */
-export declare class ArtifactError extends Error {
-    readonly code: ArtifactErrorCode;
-    constructor(code: ArtifactErrorCode);
-}
-export declare function parseArtifact(input: string | Uint8Array): Artifact;

package/dist/public/artifact.js

@@ -1,44 +0,0 @@
-import { ArtifactV2Error, decodeArtifactV2JSON } from "../v2/artifact.js";
-const artifactValues = new WeakMap();
-export class Artifact {
-    constructor() { }
-}
-/** A stable, redacted failure returned while parsing an opaque artifact. */
-export class ArtifactError extends Error {
-    code;
-    constructor(code) {
-        super(`Flowersec artifact parsing failed (code=${code})`);
-        this.code = code;
-        this.name = "ArtifactError";
-    }
-}
-export function parseArtifact(input) {
-    try {
-        return wrapArtifact(decodeArtifactV2JSON(input));
-    }
-    catch (error) {
-        if (error instanceof ArtifactV2Error) {
-            switch (error.code) {
-                case "artifact_too_large":
-                case "invalid_candidate":
-                    throw new ArtifactError(error.code);
-                default:
-                    throw new ArtifactError("invalid_artifact");
-            }
-        }
-        throw new ArtifactError("invalid_artifact");
-    }
-}
-/** @internal */
-export function wrapArtifact(value) {
-    const artifact = new Artifact();
-    artifactValues.set(artifact, value);
-    return Object.freeze(artifact);
-}
-/** @internal */
-export function unwrapArtifact(artifact) {
-    const value = artifactValues.get(artifact);
-    if (value === undefined)
-        throw new TypeError("invalid Flowersec artifact handle");
-    return value;
-}

package/dist/public/artifactLease.d.ts

@@ -1,10 +0,0 @@
-import { type Artifact } from "./artifact.js";
-export declare class ArtifactLeaseError extends Error {
-    readonly code = "already_consumed";
-    constructor();
-}
-export declare class ArtifactLease {
-    #private;
-    private constructor();
-}
-export declare function createArtifactLease(artifact: Artifact, commitSpend: (signal?: AbortSignal) => Promise<void>): ArtifactLease;

package/dist/public/artifactLease.js

@@ -1,41 +0,0 @@
-import { validateArtifactV2 } from "../v2/artifact.js";
-import { unwrapArtifact } from "./artifact.js";
-export class ArtifactLeaseError extends Error {
-    code = "already_consumed";
-    constructor() {
-        super("Flowersec artifact lease has already been consumed");
-        this.name = "ArtifactLeaseError";
-    }
-}
-export class ArtifactLease {
-    #artifactLeaseBrand = undefined;
-    constructor() {
-        Object.freeze(this);
-    }
-    /** @internal */
-    static create() {
-        return new ArtifactLease();
-    }
-}
-const artifactLeaseStates = new WeakMap();
-export function createArtifactLease(artifact, commitSpend) {
-    validateArtifactV2(unwrapArtifact(artifact));
-    const lease = ArtifactLease.create();
-    artifactLeaseStates.set(lease, { artifact, state: "idle", commitSpend });
-    return lease;
-}
-/** @internal Connector-owned access to validated lease material. */
-export function artifactLeaseArtifact(lease) {
-    const leaseState = artifactLeaseStates.get(lease);
-    if (leaseState === undefined)
-        throw new ArtifactLeaseError();
-    return leaseState.artifact;
-}
-/** @internal Connector-owned durable spend transition. */
-export async function commitArtifactLeaseSpend(lease, signal) {
-    const leaseState = artifactLeaseStates.get(lease);
-    if (leaseState === undefined || leaseState.state !== "idle")
-        throw new ArtifactLeaseError();
-    leaseState.state = "consumed";
-    await leaseState.commitSpend(signal);
-}

package/dist/public/connectError.d.ts

@@ -1,6 +0,0 @@
-export type ConnectErrorCode = "invalid_input" | "invalid_options" | "expired_artifact" | "resolve_failed" | "credential_spend_failed" | "connection_failed" | "timeout" | "canceled" | "handshake_failed" | "rpc_failed" | "resource_exhausted" | "not_connected";
-/** A stable connection failure that retains no carrier or credential details. */
-export declare class ConnectError extends Error {
-    readonly code: ConnectErrorCode;
-    constructor(code: ConnectErrorCode);
-}

package/dist/public/connectError.js

@@ -1,9 +0,0 @@
-/** A stable connection failure that retains no carrier or credential details. */
-export class ConnectError extends Error {
-    code;
-    constructor(code) {
-        super(`Flowersec connection failed (code=${code})`);
-        this.code = code;
-        this.name = "ConnectError";
-    }
-}

package/dist/transport/webSocketAdapter.d.ts

@@ -1,31 +0,0 @@
-import { type CarrierSessionV2 } from "../v2/carrier.js";
-import type { OperationOptionsV2, PathKind } from "../v2/contract.js";
-export type WebSocketBinaryTransportV2 = Readonly<{
-    readBinary(options?: Readonly<{
-        signal?: AbortSignal;
-        timeoutMs?: number;
-    }>): Promise<Uint8Array>;
-    writeBinary(data: Uint8Array, options?: OperationOptionsV2): Promise<void>;
-    flush(options?: OperationOptionsV2): Promise<void>;
-    close(): void;
-}>;
-export type WebSocketResourcePolicyV2 = Readonly<{
-    maxConcurrentStreams?: number;
-    maxFrameBytes?: number;
-    preferredWriteBytes?: number;
-    maxStreamWriteQueueBytes?: number;
-    maxStreamReceiveBytes?: number;
-    maxSessionReceiveBytes?: number;
-}>;
-export declare function createWebSocketCarrierSessionV2(transport: WebSocketBinaryTransportV2, options: Readonly<{
-    path: PathKind;
-    client: boolean;
-    inboundBidirectionalStreamCapacity: number;
-    resourcePolicy?: WebSocketResourcePolicyV2;
-}>): CarrierSessionV2;
-export declare function createServerWebSocketCarrierSessionV2(transport: WebSocketBinaryTransportV2, options: Readonly<{
-    path: PathKind;
-    inboundBidirectionalStreamCapacity: number;
-    resourcePolicy?: WebSocketResourcePolicyV2;
-}>): CarrierSessionV2;
-export declare function configureServerWebSocketCarrierRoleV2(carrier: CarrierSessionV2, client: boolean): void;

package/dist/transport/webSocketAdapter.js

@@ -1,370 +0,0 @@
-import { YamuxSession } from "../yamux/session.js";
-import { CarrierError } from "../v2/carrier.js";
-export function createWebSocketCarrierSessionV2(transport, options) {
-    return new WebSocketYamuxCarrierSession(transport, options);
-}
-export function createServerWebSocketCarrierSessionV2(transport, options) {
-    requireCapacity(options.inboundBidirectionalStreamCapacity);
-    const carrier = new ServerWebSocketAdmissionCarrier(transport, options);
-    serverAdmissionCarriers.set(carrier, carrier);
-    return carrier;
-}
-const serverAdmissionCarriers = new WeakMap();
-export function configureServerWebSocketCarrierRoleV2(carrier, client) {
-    const server = serverAdmissionCarriers.get(carrier);
-    if (server === undefined)
-        throw new CarrierError("closed", "WebSocket carrier is not a server admission carrier");
-    server.configureRole(client);
-}
-class ServerWebSocketAdmissionCarrier {
-    transport;
-    options;
-    kind = "websocket";
-    path;
-    inboundBidirectionalStreamCapacity;
-    unreliableDatagrams = undefined;
-    admissionAvailable = true;
-    active;
-    closed = false;
-    client = false;
-    constructor(transport, options) {
-        this.transport = transport;
-        this.options = options;
-        this.path = options.path;
-        this.inboundBidirectionalStreamCapacity = options.inboundBidirectionalStreamCapacity;
-    }
-    async openStream(options = {}) {
-        return await this.activate().openStream(options);
-    }
-    async acceptStream(options = {}) {
-        throwIfAborted(options.signal);
-        if (this.closed)
-            throw new CarrierError("closed", "WebSocket carrier is closed");
-        if (this.admissionAvailable) {
-            this.admissionAvailable = false;
-            return new WebSocketAdmissionStream(this.transport);
-        }
-        return await this.activate().acceptStream(options);
-    }
-    async close() {
-        if (this.closed)
-            return;
-        this.closed = true;
-        if (this.active === undefined)
-            this.transport.close();
-        else
-            await this.active.close();
-    }
-    abort() {
-        if (this.closed)
-            return;
-        this.closed = true;
-        if (this.active === undefined)
-            this.transport.close();
-        else
-            this.active.abort();
-    }
-    async waitTermination() {
-        if (this.closed && this.active === undefined)
-            return;
-        await this.activate().waitTermination();
-    }
-    configureRole(client) {
-        if (this.closed || this.active !== undefined)
-            throw new CarrierError("closed", "WebSocket carrier is already active");
-        this.client = client;
-    }
-    activate() {
-        if (this.closed)
-            throw new CarrierError("closed", "WebSocket carrier is closed");
-        if (this.admissionAvailable) {
-            throw new CarrierError("closed", "WebSocket admission has not completed");
-        }
-        this.active ??= createWebSocketCarrierSessionV2(this.transport, {
-            path: this.options.path,
-            client: this.client,
-            inboundBidirectionalStreamCapacity: this.options.inboundBidirectionalStreamCapacity,
-            ...(this.options.resourcePolicy === undefined ? {} : { resourcePolicy: this.options.resourcePolicy }),
-        });
-        return this.active;
-    }
-}
-class WebSocketAdmissionStream {
-    transport;
-    readComplete = false;
-    writeComplete = false;
-    outbound = [];
-    constructor(transport) {
-        this.transport = transport;
-    }
-    async read(options = {}) {
-        if (this.readComplete)
-            return null;
-        this.readComplete = true;
-        return await this.transport.readBinary(options);
-    }
-    async write(data, options = {}) {
-        throwIfAborted(options.signal);
-        if (this.writeComplete)
-            throw new CarrierError("write_closed", "admission response is closed");
-        this.outbound.push(data.slice());
-        return data.length;
-    }
-    async closeWrite() {
-        if (this.writeComplete)
-            return;
-        this.writeComplete = true;
-        const length = this.outbound.reduce((total, chunk) => total + chunk.length, 0);
-        const response = new Uint8Array(length);
-        let offset = 0;
-        for (const chunk of this.outbound) {
-            response.set(chunk, offset);
-            offset += chunk.length;
-        }
-        this.outbound.length = 0;
-        await this.transport.writeBinary(response);
-    }
-    async stopSending() {
-        this.transport.close();
-    }
-    async reset() {
-        this.transport.close();
-    }
-    abort() {
-        this.transport.close();
-    }
-}
-class WebSocketYamuxCarrierSession {
-    transport;
-    kind = "websocket";
-    path;
-    inboundBidirectionalStreamCapacity;
-    unreliableDatagrams = undefined;
-    incoming = new IncomingStreamQueue();
-    yamux;
-    termination = deferred();
-    terminalError;
-    closed = false;
-    constructor(transport, options) {
-        this.transport = transport;
-        requireCapacity(options.inboundBidirectionalStreamCapacity);
-        this.path = options.path;
-        this.inboundBidirectionalStreamCapacity = options.inboundBidirectionalStreamCapacity;
-        const duplex = {
-            read: async () => await transport.readBinary(),
-            write: async (chunk) => await transport.writeBinary(chunk),
-            close: () => transport.close(),
-        };
-        const policy = options.resourcePolicy ?? {};
-        this.yamux = new YamuxSession(duplex, {
-            client: options.client,
-            limits: {
-                maxActiveStreams: Math.max(policy.maxConcurrentStreams ?? this.inboundBidirectionalStreamCapacity, this.inboundBidirectionalStreamCapacity),
-                maxInboundStreams: this.inboundBidirectionalStreamCapacity,
-                ...(policy.maxFrameBytes === undefined ? {} : { maxFrameBytes: policy.maxFrameBytes }),
-                ...(policy.preferredWriteBytes === undefined ? {} : { preferredOutboundFrameBytes: policy.preferredWriteBytes }),
-                ...(policy.maxStreamWriteQueueBytes === undefined ? {} : { maxStreamWriteQueueBytes: policy.maxStreamWriteQueueBytes }),
-                ...(policy.maxStreamReceiveBytes === undefined ? {} : { maxStreamReceiveBytes: policy.maxStreamReceiveBytes }),
-                ...(policy.maxSessionReceiveBytes === undefined ? {} : { maxSessionReceiveBytes: policy.maxSessionReceiveBytes }),
-            },
-            onIncomingStream: (stream) => this.incoming.push(new YamuxCarrierStreamAdapter(stream)),
-            onTerminal: (error) => {
-                const failure = error instanceof CarrierError
-                    ? error
-                    : new CarrierError("closed", "WebSocket carrier terminated", error);
-                this.closed = true;
-                this.terminalError = failure;
-                this.incoming.fail(failure);
-                this.termination.resolve();
-            },
-        });
-    }
-    async openStream(options = {}) {
-        this.assertOpen();
-        try {
-            return new YamuxCarrierStreamAdapter(await this.yamux.openStream(options));
-        }
-        catch (error) {
-            throw error instanceof CarrierError ? error : new CarrierError("closed", "WebSocket stream open failed", error);
-        }
-    }
-    async acceptStream(options = {}) {
-        this.assertOpen();
-        return await this.incoming.shift(options.signal);
-    }
-    async close() {
-        if (this.closed)
-            return;
-        await this.transport.flush().catch(() => undefined);
-        this.closeLocally();
-    }
-    abort() {
-        this.closeLocally();
-    }
-    async waitTermination() {
-        await this.termination.promise;
-        if (this.terminalError !== undefined)
-            throw this.terminalError;
-    }
-    assertOpen() {
-        if (this.terminalError !== undefined)
-            throw this.terminalError;
-        if (this.closed)
-            throw new CarrierError("closed", "WebSocket carrier is closed");
-    }
-    closeLocally() {
-        if (this.closed)
-            return;
-        this.closed = true;
-        const failure = new CarrierError("closed", "WebSocket carrier is closed");
-        this.incoming.fail(failure);
-        this.yamux.close();
-        this.termination.resolve();
-    }
-}
-class YamuxCarrierStreamAdapter {
-    stream;
-    constructor(stream) {
-        this.stream = stream;
-    }
-    async read(options = {}) {
-        try {
-            return await abortable(this.stream.read(), options.signal, () => this.stream.abort());
-        }
-        catch (error) {
-            throw error instanceof CarrierError ? error : new CarrierError("reset", "WebSocket stream read failed", error);
-        }
-    }
-    async write(data, options = {}) {
-        throwIfAborted(options.signal);
-        try {
-            await abortable(this.stream.write(data), options.signal, () => this.stream.abort());
-        }
-        catch (error) {
-            throw error instanceof CarrierError ? error : new CarrierError("reset", "WebSocket stream write failed", error);
-        }
-        return data.length;
-    }
-    async closeWrite() {
-        await this.stream.close();
-    }
-    async reset() {
-        await this.stream.reset();
-    }
-    async stopSending() {
-        throw new CarrierError("stop_sending_unavailable", "WebSocket/Yamux cannot stop only the receive side of a bidirectional stream");
-    }
-    abort(error) {
-        this.stream.abort(error);
-    }
-}
-class IncomingStreamQueue {
-    values = [];
-    waiters = new Set();
-    terminalError;
-    push(value) {
-        if (this.terminalError !== undefined) {
-            value.abort(this.terminalError);
-            return;
-        }
-        const waiter = this.waiters.values().next().value;
-        if (waiter === undefined)
-            this.values.push(value);
-        else {
-            this.waiters.delete(waiter);
-            waiter.deliver(value);
-        }
-    }
-    shift(signal) {
-        throwIfAborted(signal);
-        if (this.terminalError !== undefined)
-            return Promise.reject(this.terminalError);
-        const value = this.values.shift();
-        if (value !== undefined)
-            return Promise.resolve(value);
-        return new Promise((resolve, reject) => {
-            let settled = false;
-            const cleanup = () => {
-                this.waiters.delete(waiter);
-                signal?.removeEventListener("abort", abort);
-            };
-            const waiter = {
-                deliver: (stream) => {
-                    if (settled)
-                        return;
-                    settled = true;
-                    cleanup();
-                    resolve(stream);
-                },
-                fail: (error) => {
-                    if (settled)
-                        return;
-                    settled = true;
-                    cleanup();
-                    reject(error);
-                },
-            };
-            const abort = () => waiter.fail(new CarrierError("aborted", "carrier operation aborted"));
-            this.waiters.add(waiter);
-            signal?.addEventListener("abort", abort, { once: true });
-            if (signal?.aborted === true)
-                abort();
-        });
-    }
-    fail(error) {
-        if (this.terminalError !== undefined)
-            return;
-        this.terminalError = error;
-        for (const stream of this.values)
-            stream.abort(error);
-        this.values.length = 0;
-        for (const waiter of this.waiters)
-            waiter.fail(error);
-        this.waiters.clear();
-    }
-}
-function deferred() {
-    let resolve;
-    const promise = new Promise((resolvePromise) => { resolve = resolvePromise; });
-    return { promise, resolve };
-}
-function requireCapacity(value) {
-    if (!Number.isInteger(value) || value < 3 || value > 130) {
-        throw new RangeError("inboundBidirectionalStreamCapacity must be an integer from 3 to 130");
-    }
-}
-function throwIfAborted(signal) {
-    if (signal?.aborted === true)
-        throw new CarrierError("aborted", "carrier operation aborted");
-}
-async function abortable(promise, signal, onAbort) {
-    if (signal === undefined)
-        return await promise;
-    throwIfAborted(signal);
-    return await new Promise((resolve, reject) => {
-        let settled = false;
-        const cleanup = () => signal.removeEventListener("abort", abort);
-        const abort = () => {
-            if (settled)
-                return;
-            settled = true;
-            cleanup();
-            onAbort();
-            reject(new CarrierError("aborted", "carrier operation aborted"));
-        };
-        signal.addEventListener("abort", abort, { once: true });
-        void promise.then((value) => {
-            if (settled)
-                return;
-            settled = true;
-            cleanup();
-            resolve(value);
-        }, (error) => {
-            if (settled)
-                return;
-            settled = true;
-            cleanup();
-            reject(error);
-        });
-    });
-}