@floegence/flowersec-core 3.2.1 → 4.0.0

package/dist/facade.js

@@ -1,19 +1,8 @@
-export * as v2 from "./v2/index.js";
 export { SessionError, UnreliableMessageError } from "./public/contract.js";
 export { createStreamMetadata, StreamMetadataError } from "./public/streamMetadata.js";
 export { HandlerRegistrationError, StreamHandlers, } from "./public/streamHandlers.js";
 export { ArtifactHandleV3 as Artifact, ArtifactParseErrorV3 as ArtifactError, createArtifactLeaseV3 as createArtifactLease, parseArtifactV3 as parseArtifact, } from "./v3/publicApi.js";
-/** @deprecated Use Artifact, ArtifactError, createArtifactLease, and parseArtifact. */
-export { ArtifactHandleV3, ArtifactParseErrorV3, createArtifactLeaseV3, parseArtifactV3, } from "./v3/publicApi.js";
 export { ArtifactLeaseV3 as ArtifactLease, ArtifactLeaseV3Error as ArtifactLeaseError, } from "./v3/artifactLease.js";
-/** @deprecated Use ArtifactLease and ArtifactLeaseError. */
-export { ArtifactLeaseV3, ArtifactLeaseV3Error } from "./v3/artifactLease.js";
 export { connectionDiagnosticV3 as connectionDiagnostic } from "./v3/connectionController.js";
-/** @deprecated Use connectionDiagnostic. */
-export { connectionDiagnosticV3 } from "./v3/connectionController.js";
 export { ConnectionControllerV3Error as ConnectionControllerError, } from "./v3/connectionController.js";
-/** @deprecated Use ConnectionControllerError. */
-export { ConnectionControllerV3Error } from "./v3/connectionController.js";
 export { ConnectErrorV3 as ConnectError } from "./v3/security.js";
-/** @deprecated Use ConnectError. */
-export { ConnectErrorV3 } from "./v3/security.js";

package/dist/generated/unicode151.d.ts

@@ -0,0 +1,2 @@
+export declare const UNICODE_15_1_VERSION = "15.1.0";
+export declare function unicode151Assigned(codePoint: number): boolean;

package/dist/generated/unicode151.js

@@ -0,0 +1,83 @@
+// Code generated by testdata/unicode15_1/generate_tables.mjs; DO NOT EDIT.
+export const UNICODE_15_1_VERSION = "15.1.0";
+const ASSIGNED_RANGES_HEX = "00000000037700037A00037F00038400038A00038C00038C00038E0003A10003A300052F00053100055600055900058A00058D00058F0005910005C7" +
+    "0005D00005EA0005EF0005F400060000070D00070F00074A00074D0007B10007C00007FA0007FD00082D00083000083E00084000085B00085E00085E" +
+    "00086000086A00087000088E00089000089100089800098300098500098C00098F0009900009930009A80009AA0009B00009B20009B20009B60009B9" +
+    "0009BC0009C40009C70009C80009CB0009CE0009D70009D70009DC0009DD0009DF0009E30009E60009FE000A01000A03000A05000A0A000A0F000A10" +
+    "000A13000A28000A2A000A30000A32000A33000A35000A36000A38000A39000A3C000A3C000A3E000A42000A47000A48000A4B000A4D000A51000A51" +
+    "000A59000A5C000A5E000A5E000A66000A76000A81000A83000A85000A8D000A8F000A91000A93000AA8000AAA000AB0000AB2000AB3000AB5000AB9" +
+    "000ABC000AC5000AC7000AC9000ACB000ACD000AD0000AD0000AE0000AE3000AE6000AF1000AF9000AFF000B01000B03000B05000B0C000B0F000B10" +
+    "000B13000B28000B2A000B30000B32000B33000B35000B39000B3C000B44000B47000B48000B4B000B4D000B55000B57000B5C000B5D000B5F000B63" +
+    "000B66000B77000B82000B83000B85000B8A000B8E000B90000B92000B95000B99000B9A000B9C000B9C000B9E000B9F000BA3000BA4000BA8000BAA" +
+    "000BAE000BB9000BBE000BC2000BC6000BC8000BCA000BCD000BD0000BD0000BD7000BD7000BE6000BFA000C00000C0C000C0E000C10000C12000C28" +
+    "000C2A000C39000C3C000C44000C46000C48000C4A000C4D000C55000C56000C58000C5A000C5D000C5D000C60000C63000C66000C6F000C77000C8C" +
+    "000C8E000C90000C92000CA8000CAA000CB3000CB5000CB9000CBC000CC4000CC6000CC8000CCA000CCD000CD5000CD6000CDD000CDE000CE0000CE3" +
+    "000CE6000CEF000CF1000CF3000D00000D0C000D0E000D10000D12000D44000D46000D48000D4A000D4F000D54000D63000D66000D7F000D81000D83" +
+    "000D85000D96000D9A000DB1000DB3000DBB000DBD000DBD000DC0000DC6000DCA000DCA000DCF000DD4000DD6000DD6000DD8000DDF000DE6000DEF" +
+    "000DF2000DF4000E01000E3A000E3F000E5B000E81000E82000E84000E84000E86000E8A000E8C000EA3000EA5000EA5000EA7000EBD000EC0000EC4" +
+    "000EC6000EC6000EC8000ECE000ED0000ED9000EDC000EDF000F00000F47000F49000F6C000F71000F97000F99000FBC000FBE000FCC000FCE000FDA" +
+    "0010000010C50010C70010C70010CD0010CD0010D000124800124A00124D00125000125600125800125800125A00125D00126000128800128A00128D" +
+    "0012900012B00012B20012B50012B80012BE0012C00012C00012C20012C50012C80012D60012D800131000131200131500131800135A00135D00137C" +
+    "0013800013990013A00013F50013F80013FD00140000169C0016A00016F800170000171500171F00173600174000175300176000176C00176E001770" +
+    "0017720017730017800017DD0017E00017E90017F00017F90018000018190018200018780018800018AA0018B00018F500190000191E00192000192B" +
+    "00193000193B00194000194000194400196D0019700019740019800019AB0019B00019C90019D00019DA0019DE001A1B001A1E001A5E001A60001A7C" +
+    "001A7F001A89001A90001A99001AA0001AAD001AB0001ACE001B00001B4C001B50001B7E001B80001BF3001BFC001C37001C3B001C49001C4D001C88" +
+    "001C90001CBA001CBD001CC7001CD0001CFA001D00001F15001F18001F1D001F20001F45001F48001F4D001F50001F57001F59001F59001F5B001F5B" +
+    "001F5D001F5D001F5F001F7D001F80001FB4001FB6001FC4001FC6001FD3001FD6001FDB001FDD001FEF001FF2001FF4001FF6001FFE002000002064" +
+    "00206600207100207400208E00209000209C0020A00020C00020D00020F000210000218B00219000242600244000244A002460002B73002B76002B95" +
+    "002B97002CF3002CF9002D25002D27002D27002D2D002D2D002D30002D67002D6F002D70002D7F002D96002DA0002DA6002DA8002DAE002DB0002DB6" +
+    "002DB8002DBE002DC0002DC6002DC8002DCE002DD0002DD6002DD8002DDE002DE0002E5D002E80002E99002E9B002EF3002F00002FD5002FF000303F" +
+    "0030410030960030990030FF00310500312F00313100318E0031900031E30031EF00321E00322000A48C00A49000A4C600A4D000A62B00A64000A6F7" +
+    "00A70000A7CA00A7D000A7D100A7D300A7D300A7D500A7D900A7F200A82C00A83000A83900A84000A87700A88000A8C500A8CE00A8D900A8E000A953" +
+    "00A95F00A97C00A98000A9CD00A9CF00A9D900A9DE00A9FE00AA0000AA3600AA4000AA4D00AA5000AA5900AA5C00AAC200AADB00AAF600AB0100AB06" +
+    "00AB0900AB0E00AB1100AB1600AB2000AB2600AB2800AB2E00AB3000AB6B00AB7000ABED00ABF000ABF900AC0000D7A300D7B000D7C600D7CB00D7FB" +
+    "00D80000FA6D00FA7000FAD900FB0000FB0600FB1300FB1700FB1D00FB3600FB3800FB3C00FB3E00FB3E00FB4000FB4100FB4300FB4400FB4600FBC2" +
+    "00FBD300FD8F00FD9200FDC700FDCF00FE1900FE2000FE5200FE5400FE6600FE6800FE6B00FE7000FE7400FE7600FEFC00FEFF00FEFF00FF0100FFBE" +
+    "00FFC200FFC700FFCA00FFCF00FFD200FFD700FFDA00FFDC00FFE000FFE600FFE800FFEE00FFF901000B01000D01002601002801003A01003C01003D" +
+    "01003F01004D01005001005D0100800100FA01010001010201010701013301013701018E01019001019C0101A00101A00101D00101FD01028001029C" +
+    "0102A00102D00102E00102FB01030001032301032D01034A01035001037A01038001039D01039F0103C30103C80103D501040001049D0104A00104A9" +
+    "0104B00104D30104D80104FB01050001052701053001056301056F01057A01057C01058A01058C0105920105940105950105970105A10105A30105B1" +
+    "0105B30105B90105BB0105BC0106000107360107400107550107600107670107800107850107870107B00107B20107BA010800010805010808010808" +
+    "01080A01083501083701083801083C01083C01083F01085501085701089E0108A70108AF0108E00108F20108F40108F50108FB01091B01091F010939" +
+    "01093F01093F0109800109B70109BC0109CF0109D2010A03010A05010A06010A0C010A13010A15010A17010A19010A35010A38010A3A010A3F010A48" +
+    "010A50010A58010A60010A9F010AC0010AE6010AEB010AF6010B00010B35010B39010B55010B58010B72010B78010B91010B99010B9C010BA9010BAF" +
+    "010C00010C48010C80010CB2010CC0010CF2010CFA010D27010D30010D39010E60010E7E010E80010EA9010EAB010EAD010EB0010EB1010EFD010F27" +
+    "010F30010F59010F70010F89010FB0010FCB010FE0010FF601100001104D01105201107501107F0110C20110CD0110CD0110D00110E80110F00110F9" +
+    "0111000111340111360111470111500111760111800111DF0111E10111F401120001121101121301124101128001128601128801128801128A01128D" +
+    "01128F01129D01129F0112A90112B00112EA0112F00112F901130001130301130501130C01130F01131001131301132801132A011330011332011333" +
+    "01133501133901133B01134401134701134801134B01134D01135001135001135701135701135D01136301136601136C01137001137401140001145B" +
+    "01145D0114610114800114C70114D00114D90115800115B50115B80115DD01160001164401165001165901166001166C0116800116B90116C00116C9" +
+    "01170001171A01171D01172B01173001174601180001183B0118A00118F20118FF01190601190901190901190C011913011915011916011918011935" +
+    "01193701193801193B0119460119500119590119A00119A70119AA0119D70119DA0119E4011A00011A47011A50011AA2011AB0011AF8011B00011B09" +
+    "011C00011C08011C0A011C36011C38011C45011C50011C6C011C70011C8F011C92011CA7011CA9011CB6011D00011D06011D08011D09011D0B011D36" +
+    "011D3A011D3A011D3C011D3D011D3F011D47011D50011D59011D60011D65011D67011D68011D6A011D8E011D90011D91011D93011D98011DA0011DA9" +
+    "011EE0011EF8011F00011F10011F12011F3A011F3E011F59011FB0011FB0011FC0011FF1011FFF01239901240001246E012470012474012480012543" +
+    "012F90012FF2013000013455014400014646016800016A38016A40016A5E016A60016A69016A6E016ABE016AC0016AC9016AD0016AED016AF0016AF5" +
+    "016B00016B45016B50016B59016B5B016B61016B63016B77016B7D016B8F016E40016E9A016F00016F4A016F4F016F87016F8F016F9F016FE0016FE4" +
+    "016FF0016FF10170000187F7018800018CD5018D00018D0801AFF001AFF301AFF501AFFB01AFFD01AFFE01B00001B12201B13201B13201B15001B152" +
+    "01B15501B15501B16401B16701B17001B2FB01BC0001BC6A01BC7001BC7C01BC8001BC8801BC9001BC9901BC9C01BCA301CF0001CF2D01CF3001CF46" +
+    "01CF5001CFC301D00001D0F501D10001D12601D12901D1EA01D20001D24501D2C001D2D301D2E001D2F301D30001D35601D36001D37801D40001D454" +
+    "01D45601D49C01D49E01D49F01D4A201D4A201D4A501D4A601D4A901D4AC01D4AE01D4B901D4BB01D4BB01D4BD01D4C301D4C501D50501D50701D50A" +
+    "01D50D01D51401D51601D51C01D51E01D53901D53B01D53E01D54001D54401D54601D54601D54A01D55001D55201D6A501D6A801D7CB01D7CE01DA8B" +
+    "01DA9B01DA9F01DAA101DAAF01DF0001DF1E01DF2501DF2A01E00001E00601E00801E01801E01B01E02101E02301E02401E02601E02A01E03001E06D" +
+    "01E08F01E08F01E10001E12C01E13001E13D01E14001E14901E14E01E14F01E29001E2AE01E2C001E2F901E2FF01E2FF01E4D001E4F901E7E001E7E6" +
+    "01E7E801E7EB01E7ED01E7EE01E7F001E7FE01E80001E8C401E8C701E8D601E90001E94B01E95001E95901E95E01E95F01EC7101ECB401ED0101ED3D" +
+    "01EE0001EE0301EE0501EE1F01EE2101EE2201EE2401EE2401EE2701EE2701EE2901EE3201EE3401EE3701EE3901EE3901EE3B01EE3B01EE4201EE42" +
+    "01EE4701EE4701EE4901EE4901EE4B01EE4B01EE4D01EE4F01EE5101EE5201EE5401EE5401EE5701EE5701EE5901EE5901EE5B01EE5B01EE5D01EE5D" +
+    "01EE5F01EE5F01EE6101EE6201EE6401EE6401EE6701EE6A01EE6C01EE7201EE7401EE7701EE7901EE7C01EE7E01EE7E01EE8001EE8901EE8B01EE9B" +
+    "01EEA101EEA301EEA501EEA901EEAB01EEBB01EEF001EEF101F00001F02B01F03001F09301F0A001F0AE01F0B101F0BF01F0C101F0CF01F0D101F0F5" +
+    "01F10001F1AD01F1E601F20201F21001F23B01F24001F24801F25001F25101F26001F26501F30001F6D701F6DC01F6EC01F6F001F6FC01F70001F776" +
+    "01F77B01F7D901F7E001F7EB01F7F001F7F001F80001F80B01F81001F84701F85001F85901F86001F88701F89001F8AD01F8B001F8B101F90001FA53" +
+    "01FA6001FA6D01FA7001FA7C01FA8001FA8801FA9001FABD01FABF01FAC501FACE01FADB01FAE001FAE801FAF001FAF801FB0001FB9201FB9401FBCA" +
+    "01FBF001FBF901FFFE02A6DF02A70002B73902B74002B81D02B82002CEA102CEB002EBE002EBF002EE5D02F80002FA1D02FFFE03134A0313500323AF" +
+    "03FFFE03FFFF04FFFE04FFFF05FFFE05FFFF06FFFE06FFFF07FFFE07FFFF08FFFE08FFFF09FFFE09FFFF0AFFFE0AFFFF0BFFFE0BFFFF0CFFFE0CFFFF" +
+    "0DFFFE0DFFFF0E00010E00010E00200E007F0E01000E01EF0EFFFE10FFFF";
+export function unicode151Assigned(codePoint) {
+    for (let offset = 0; offset < ASSIGNED_RANGES_HEX.length; offset += 12) {
+        const start = Number.parseInt(ASSIGNED_RANGES_HEX.slice(offset, offset + 6), 16);
+        const end = Number.parseInt(ASSIGNED_RANGES_HEX.slice(offset + 6, offset + 12), 16);
+        if (codePoint >= start && codePoint <= end)
+            return true;
+    }
+    return false;
+}

package/dist/interop/proxyServerPeer.js

@@ -1,10 +1,13 @@
-import { authorizeRuntime, createAcceptor, createEndpointSet, Issuer, parseArtifact, ProxyServer, SessionHandlers, } from "../node/v2.js";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { createAcceptor, parseArtifact, ProxyServer, SessionHandlers, } from "../node/index.js";
+import { testCertificatePEM, testPrivateKeyPEM } from "../testSupport/tlsFixture.js";
 const ORIGIN = "https://app.example";
 const args = process.argv.slice(2);
 if (args.length !== 2 || args[0] !== "--upstream" || args[1] === undefined) {
     throw new Error("usage: proxyServerPeer --upstream http://127.0.0.1:<port>");
 }
-void run(args[1]).catch((error) => {
+await run(args[1]).catch((error) => {
     console.error(error instanceof Error ? error.stack ?? error.message : String(error));
     process.exitCode = 1;
 });
@@ -34,7 +37,7 @@ async function run(upstream) {
     });
     const handlers = new SessionHandlers({ maxConcurrentStreams: 4 });
     proxy.register(handlers);
-    let record;
+    let trustedArtifact;
     const acceptor = await createAcceptor({
         listeners: [{
                 carrier: "websocket",
@@ -42,34 +45,26 @@ async function run(upstream) {
                 host: "127.0.0.1",
                 port: 0,
                 allowedOrigins: [ORIGIN],
+                tls: { certificate: testCertificatePEM, privateKey: testPrivateKeyPEM },
             }],
-        maxInboundStreams: 8,
-        authorize: async (request) => {
-            if (record === undefined)
-                throw new Error("authorization record is unavailable");
-            const artifact = parseArtifact(record.artifactJSON);
-            authorizeRuntime(request, record, "proxy-matrix-node");
-            return { decision: "allow", artifact };
-        },
+        maxInboundStreams: 16,
+        authorize: async () => trustedArtifact === undefined
+            ? { accepted: false, retryable: false, reason: "invalid_credential" }
+            : { accepted: true, artifact: trustedArtifact },
         resolveHandlers: () => handlers,
     });
     try {
         const address = acceptor.addresses()[0];
         if (address === undefined)
             throw new Error("Node ProxyServer listener did not bind");
-        const issued = new Issuer().issueDirect({
-            session: { channelId: "browser-proxy-node", maxInboundStreams: 8 },
-            endpoints: createEndpointSet(`ws://127.0.0.1:${address.port}/flowersec/v2/direct`),
-            rendezvousGroupId: "browser-proxy-node",
-            listenerAudience: "browser-proxy-matrix",
-            upstreamAddress: `${address.host}:${address.port}`,
-        });
-        record = issued.authorizationRecord();
+        const artifactJSON = await issueArtifact(`wss://localhost:${address.port}/flowersec/v3/direct`);
+        trustedArtifact = parseArtifact(artifactJSON);
         const acceptedPromise = acceptor.accept();
         process.stdout.write(`${JSON.stringify({
             runtime: "node-typescript",
-            artifact_json: new TextDecoder().decode(issued.artifactJSON()),
+            artifact_json: artifactJSON,
             origin: ORIGIN,
+            trust_pem: testCertificatePEM,
         })}\n`);
         const accepted = await acceptedPromise;
         const serving = accepted.serve().catch((error) => error);
@@ -81,3 +76,22 @@ async function run(upstream) {
         await acceptor.close();
     }
 }
+async function issueArtifact(endpoint) {
+    const child = spawn("go", ["run", "./internal/cmd/parity-artifact-issuer"], {
+        cwd: fileURLToPath(new URL("../../../flowersec-go", import.meta.url)),
+        env: { ...process.env, FLOWERSEC_SERVER_PARITY_PEER: "1" },
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    child.stdin.end(`${JSON.stringify({ mode: "direct", endpoint })}\n`);
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", (chunk) => stdout.push(chunk));
+    child.stderr.on("data", (chunk) => stderr.push(chunk));
+    const code = await new Promise((resolve) => child.once("exit", resolve));
+    if (code !== 0)
+        throw new Error(`proxy artifact issuer failed: ${Buffer.concat(stderr).toString("utf8")}`);
+    const response = JSON.parse(Buffer.concat(stdout).toString("utf8"));
+    if (response.artifact_json === undefined)
+        throw new Error("proxy artifact issuer omitted artifact");
+    return response.artifact_json;
+}

package/dist/interop/serverParityPeer.js

@@ -3,21 +3,14 @@ import { createPrivateKey, createPublicKey, X509Certificate } from "node:crypto"
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { createStreamMetadata, } from "../public/streamMetadata.js";
-import { createAcceptor, RPCHandlers, SessionHandlers } from "../node/acceptor.js";
-import { createTunnelRuntime } from "../node/tunnelRuntime.js";
-import { createArtifactLease } from "../public/artifactLease.js";
-import { parseArtifact } from "../public/artifact.js";
-import { connect } from "../node/connectSession.js";
-import { Issuer, createEndpointSet } from "../node/controlplane.js";
+import { RPCHandlers, SessionHandlersV3 } from "../node/acceptor.js";
 import { SessionError } from "../public/contract.js";
 import { createAcceptorV3 } from "../node/acceptorV3.js";
 import { createTunnelRuntimeV3 } from "../node/tunnelRuntimeV3.js";
 import { verifyTunnelAuthorizationGrantV3 } from "../node/runtimeAuthorizationV3.js";
 import { connectV3 } from "../node/connectSessionV3.js";
 import { createArtifactLeaseV3, parseArtifactV3 } from "../v3/publicApi.js";
-import { SessionHandlersV3 } from "../node/acceptor.js";
 const RUNTIME = "node-typescript";
-const PROTOCOL = process.env.FLOWERSEC_PARITY_PROTOCOL ?? "v2";
 const ORIGIN = process.env.FLOWERSEC_PARITY_ORIGIN ?? "https://client.example";
 const ECHO_RPC = 7001;
 const NOTIFY_RPC = 7002;
@@ -73,9 +66,7 @@ class ExecutedCases {
 }
 function createHandlers(path) {
     const rpcHandlers = new RPCHandlers();
-    const sessionHandlers = PROTOCOL === "v3"
-        ? new SessionHandlersV3({ maxConcurrentStreams: 16 })
-        : new SessionHandlers({ maxConcurrentStreams: 16 });
+    const sessionHandlers = new SessionHandlersV3({ maxConcurrentStreams: 16 });
     const notifications = new SignalQueue();
     const activeStreams = { value: 0 };
     const executed = new ExecutedCases();
@@ -339,16 +330,9 @@ function pem(label, encoded) {
     return `-----BEGIN ${label}-----\n${lines.join("\n")}\n-----END ${label}-----\n`;
 }
 async function connectArtifact(artifactJSON, relay, rpcHandlers) {
-    return await connect(createArtifactLease(parseArtifact(artifactJSON), async () => undefined), {
-        origin: relay.origin,
-        tls: { ca: relay.trust_pem },
-        rpcHandlers,
-    });
-}
-async function connectArtifactV3(artifactJSON, relay, rpcHandlers) {
     return await connectV3(createArtifactLeaseV3(parseArtifactV3(artifactJSON), async () => undefined), { origin: relay.origin, roots: relay.trust_pem, rpcHandlers });
 }
-async function issueV3(input) {
+async function issue(input) {
     const goRoot = fileURLToPath(new URL("../../../flowersec-go", import.meta.url));
     const child = spawn("go", ["run", "./internal/cmd/parity-artifact-issuer"], {
         cwd: goRoot,
@@ -366,69 +350,10 @@ async function issueV3(input) {
     return JSON.parse(Buffer.concat(stdout).toString("utf8"));
 }
 async function runServer(tls, carrier) {
-    if (PROTOCOL === "v3")
-        return await runServerV3(tls, carrier);
-    const issuedByLookup = new Map();
-    const state = createHandlers("direct");
-    const acceptor = await createAcceptor({
-        listeners: [directListenerOptions(carrier, tls)],
-        maxInboundStreams: 16,
-        authorize: async (request) => {
-            const artifact = issuedByLookup.get(request.lookupKey());
-            return artifact === undefined
-                ? { decision: "reject", reason: "invalid_credential" }
-                : { decision: "allow", artifact };
-        },
-        resolveHandlers: () => state.sessionHandlers,
-    });
-    try {
-        const address = acceptor.addresses()[0];
-        if (address === undefined)
-            throw new Error(`direct ${carrier} listener did not bind`);
-        const issued = new Issuer().issueDirect({
-            session: { channelId: "node-direct-parity", maxInboundStreams: 16 },
-            endpoints: createEndpointSet(endpointURL(carrier, "direct", address.port)),
-            rendezvousGroupId: "node-direct-parity",
-            listenerAudience: "server-parity",
-            upstreamAddress: "127.0.0.1:1",
-        });
-        const artifactJSON = decoder.decode(issued.artifactJSON());
-        issuedByLookup.set(issued.lookupKey(), parseArtifact(artifactJSON));
-        const accepting = acceptor.accept();
-        writeJSON({
-            type: "ready",
-            runtime: RUNTIME,
-            carrier,
-            path: "direct",
-            artifact_json: artifactJSON,
-            trust_pem: tls.tls.root_certificate_pem,
-            origin: ORIGIN,
-        });
-        const accepted = await accepting;
-        state.executed.record("admission");
-        const serving = accepted.serve().catch((error) => error);
-        if (process.env.FLOWERSEC_PARITY_CLIENT_PROFILE !== undefined) {
-            await externalServer(accepted.session, state);
-        }
-        else {
-            await exerciseServer(accepted.session, state, "direct", true, carrier);
-        }
-        await serving;
-        await accepted.close().catch(() => undefined);
-        if (state.activeStreams.value !== 0)
-            throw new Error(`direct server cleanup left ${state.activeStreams.value} streams`);
-        state.executed.record("cleanup");
-        writeJSON(result("server-result", "direct", state.executed.snapshot(), carrier));
-    }
-    finally {
-        await acceptor.close();
-    }
-}
-async function runServerV3(tls, carrier) {
     const state = createHandlers("direct");
     let trustedArtifact;
     const acceptor = await createAcceptorV3({
-        listeners: [directListenerOptionsV3(carrier, tls)],
+        listeners: [directListenerOptions(carrier, tls)],
         maxInboundStreams: 16,
         authorize: async () => trustedArtifact === undefined
             ? { accepted: false, retryable: false, reason: "invalid_credential" }
@@ -439,7 +364,7 @@ async function runServerV3(tls, carrier) {
         const address = acceptor.addresses()[0];
         if (address === undefined)
             throw new Error(`direct ${carrier} listener did not bind`);
-        const issued = await issueV3({ mode: "direct", endpoint: endpointURLV3(carrier, "direct", address.port) });
+        const issued = await issue({ mode: "direct", endpoint: endpointURL(carrier, "direct", address.port) });
         if (issued.artifact_json === undefined)
             throw new Error("v3 parity issuer omitted direct artifact");
         trustedArtifact = parseArtifactV3(issued.artifact_json);
@@ -476,9 +401,7 @@ async function runClient(input, carrier) {
         ready.artifact_json === "")
         throw new Error("invalid direct ready message");
     const state = createHandlers("direct");
-    const session = PROTOCOL === "v3"
-        ? await connectArtifactV3(ready.artifact_json, ready, state.rpcHandlers)
-        : await connectArtifact(ready.artifact_json, ready, state.rpcHandlers);
+    const session = await connectArtifact(ready.artifact_json, ready, state.rpcHandlers);
     state.executed.record("admission");
     await exerciseClient(session, state, "direct", carrier);
     await session.close().catch((error) => {
@@ -492,94 +415,12 @@ async function runClient(input, carrier) {
     writeJSON(result("client-result", "direct", state.executed.snapshot(), carrier));
 }
 async function runRelay(tls, input, carrier) {
-    if (PROTOCOL === "v3")
-        return await runRelayV3(tls, input, carrier);
-    const decisions = new Map();
-    const released = new Set();
-    const executed = new ExecutedCases();
-    const runtime = createTunnelRuntime({
-        listeners: [tunnelListenerOptions(carrier, tls)],
-        maxInboundStreams: 16,
-        maxPendingLegs: 16,
-        maxActivePairs: 8,
-        authorize: async (request) => decisions.get(request.lookupKey()) ?? {
-            decision: "reject",
-            reason: "invalid_credential",
-        },
-        release: (leaseId) => {
-            released.add(leaseId);
-        },
-    });
-    try {
-        await runtime.start();
-        const address = runtime.addresses()[0];
-        if (address === undefined)
-            throw new Error(`tunnel ${carrier} listener did not bind`);
-        writeJSON({
-            type: "relay-ready",
-            runtime: RUNTIME,
-            carrier,
-            path: "tunnel",
-            endpoint_url: endpointURL(carrier, "tunnel", address.port),
-            trust_pem: tls.tls.root_certificate_pem,
-            trust_roots_der: [tls.tls.root_certificate_der_base64],
-            server_certificate_der: tls.tls.leaf_certificate_der_base64,
-            origin: ORIGIN,
-        });
-        const configure = await input.next();
-        if (configure.type !== "configure" ||
-            !Array.isArray(configure.authorizations) ||
-            configure.authorizations.length === 0)
-            throw new Error("invalid tunnel relay configuration");
-        for (const item of configure.authorizations) {
-            if (item.decision !== "allow" ||
-                item.credentialId === "" ||
-                item.leaseId === "" ||
-                item.expectedPeerEndpointInstanceId === "" ||
-                item.expiresAtUnixSeconds <= Math.floor(Date.now() / 1000)) {
-                throw new Error("invalid secret-free tunnel authorization");
-            }
-            decisions.set(item.credentialId, {
-                decision: "allow",
-                credentialId: item.credentialId,
-                leaseId: item.leaseId,
-                expiresAtUnixSeconds: item.expiresAtUnixSeconds,
-                expectedPeerEndpointInstanceId: item.expectedPeerEndpointInstanceId,
-                allowReplacement: item.allowReplacement,
-            });
-        }
-        const close = await input.next();
-        if (close.type !== "close")
-            throw new Error("invalid tunnel relay close command");
-        executed.record("close");
-    }
-    finally {
-        await runtime.close();
-        executed.record("cancel");
-    }
-    if (released.size !== decisions.size)
-        throw new Error(`relay cleanup released ${released.size} of ${decisions.size} leases`);
-    executed.record("admission", "pairing", "opaque-forwarding");
-    if (carrier === "raw-quic")
-        executed.record("datagram-forwarding");
-    executed.record("cleanup");
-    writeJSON({
-        type: "relay-result",
-        runtime: RUNTIME,
-        carrier,
-        path: "tunnel",
-        cases: executed.snapshot(),
-        observed_plaintext: false,
-        released_leases: released.size,
-    });
-}
-async function runRelayV3(tls, input, carrier) {
     const authorizations = new Map();
     const verificationRecords = new Map();
     const released = new Set();
     const executed = new ExecutedCases();
     const runtime = createTunnelRuntimeV3({
-        listeners: [tunnelListenerOptionsV3(carrier, tls)],
+        listeners: [tunnelListenerOptions(carrier, tls)],
         maxInboundStreams: 16,
         maxPendingLegs: 16,
         maxActivePairs: 8,
@@ -605,7 +446,7 @@ async function runRelayV3(tls, input, carrier) {
             throw new Error(`tunnel ${carrier} listener did not bind`);
         writeJSON({
             type: "relay-ready", runtime: RUNTIME, carrier, path: "tunnel",
-            endpoint_url: endpointURLV3(carrier, "tunnel", address.port),
+            endpoint_url: endpointURL(carrier, "tunnel", address.port),
             trust_pem: tls.tls.root_certificate_pem,
             trust_roots_der: [tls.tls.root_certificate_der_base64],
             server_certificate_der: tls.tls.leaf_certificate_der_base64,
@@ -642,59 +483,10 @@ async function runRelayV3(tls, input, carrier) {
     });
 }
 async function runTunnelEndpointB(input, carrier) {
-    if (PROTOCOL === "v3")
-        return await runTunnelEndpointBV3(input, carrier);
     const envelope = await input.next();
     const { topology, relay } = envelope;
     validateTunnelDimensions(topology, relay, "endpoint_b", carrier);
-    const pair = new Issuer().issueTunnelPair({
-        session: { channelId: `parity-${topology.id}`, maxInboundStreams: 16 },
-        endpoints: createEndpointSet(relay.endpoint_url),
-        rendezvousGroupId: topology.id,
-        listenerAudience: "server-parity",
-        firstEndpointId: `${topology.id}-a`,
-        secondEndpointId: `${topology.id}-b`,
-    });
-    const firstJSON = decoder.decode(pair.first.artifactJSON());
-    const secondJSON = decoder.decode(pair.second.artifactJSON());
-    const ready = {
-        type: "endpoint-b-ready",
-        runtime: RUNTIME,
-        carrier,
-        path: "tunnel",
-        endpoint_a_artifact_json: firstJSON,
-        endpoint_b_artifact_json: secondJSON,
-        relay,
-        authorizations: [
-            authorizationWire(pair.first, firstJSON, "lease-endpoint-a"),
-            authorizationWire(pair.second, secondJSON, "lease-endpoint-b"),
-        ],
-    };
-    writeJSON(ready);
-    const command = await input.next();
-    if (command.type !== "connect")
-        throw new Error("endpoint B did not receive connect command");
-    const state = createHandlers("tunnel");
-    const session = await connectArtifact(secondJSON, relay, state.rpcHandlers);
-    state.executed.record("admission");
-    if (process.env.FLOWERSEC_PARITY_CLIENT_PROFILE !== undefined) {
-        await externalServer(session, state);
-    }
-    else {
-        await exerciseServer(session, state, "tunnel", false, carrier);
-    }
-    await session.close().catch(() => undefined);
-    state.executed.record("close");
-    if (state.activeStreams.value !== 0)
-        throw new Error(`endpoint B cleanup left ${state.activeStreams.value} streams`);
-    state.executed.record("cleanup");
-    writeJSON(result("endpoint-b-result", "tunnel", state.executed.snapshot(), carrier));
-}
-async function runTunnelEndpointBV3(input, carrier) {
-    const envelope = await input.next();
-    const { topology, relay } = envelope;
-    validateTunnelDimensions(topology, relay, "endpoint_b", carrier);
-    const issued = await issueV3({ mode: "tunnel", endpoint: relay.endpoint_url, topology_id: topology.id });
+    const issued = await issue({ mode: "tunnel", endpoint: relay.endpoint_url, topology_id: topology.id });
     if (issued.endpoint_a_artifact_json === undefined || issued.endpoint_b_artifact_json === undefined ||
         issued.authorizations === undefined || issued.verification_records === undefined) {
         throw new Error("v3 parity issuer omitted tunnel material");
@@ -710,7 +502,7 @@ async function runTunnelEndpointBV3(input, carrier) {
     if (command.type !== "connect")
         throw new Error("endpoint B did not receive connect command");
     const state = createHandlers("tunnel");
-    const session = await connectArtifactV3(ready.endpoint_b_artifact_json, relay, state.rpcHandlers);
+    const session = await connectArtifact(ready.endpoint_b_artifact_json, relay, state.rpcHandlers);
     state.executed.record("admission");
     if (process.env.FLOWERSEC_PARITY_CLIENT_PROFILE !== undefined) {
         await externalServer(session, state);
@@ -750,9 +542,7 @@ async function runTunnelEndpointA(input, carrier) {
         ready.endpoint_a_artifact_json === "")
         throw new Error("invalid endpoint B ready message");
     const state = createHandlers("tunnel");
-    const session = PROTOCOL === "v3"
-        ? await connectArtifactV3(ready.endpoint_a_artifact_json, ready.relay, state.rpcHandlers)
-        : await connectArtifact(ready.endpoint_a_artifact_json, ready.relay, state.rpcHandlers);
+    const session = await connectArtifact(ready.endpoint_a_artifact_json, ready.relay, state.rpcHandlers);
     state.executed.record("admission");
     await exerciseClient(session, state, "tunnel", carrier);
     await session.close().catch(() => undefined);
@@ -773,20 +563,6 @@ function validateTunnelDimensions(topology, relay, endpoint, carrier) {
         throw new Error("invalid tunnel topology dimensions");
     }
 }
-function authorizationWire(issued, artifactJSON, leaseId) {
-    const artifact = JSON.parse(artifactJSON);
-    if (!Number.isSafeInteger(artifact.session.init_expire_at_unix_s) ||
-        artifact.path.expected_peer_endpoint_instance_id === "")
-        throw new Error("issued tunnel artifact omitted relay claims");
-    return {
-        decision: "allow",
-        credentialId: issued.lookupKey(),
-        leaseId,
-        expiresAtUnixSeconds: artifact.session.init_expire_at_unix_s,
-        expectedPeerEndpointInstanceId: artifact.path.expected_peer_endpoint_instance_id,
-        allowReplacement: false,
-    };
-}
 function result(type, path, cases, carrier) {
     return {
         type,
@@ -819,11 +595,6 @@ function parseArguments(arguments_) {
     return { role, carrier: arguments_[2] };
 }
 function endpointURL(carrier, path, port) {
-    return carrier === "websocket"
-        ? `wss://localhost:${port}/flowersec/v2/${path}`
-        : `quic://127.0.0.1:${port}`;
-}
-function endpointURLV3(carrier, path, port) {
     return carrier === "websocket"
         ? `wss://localhost:${port}/flowersec/v3/${path}`
         : `quic://127.0.0.1:${port}`;
@@ -840,18 +611,6 @@ function tunnelListenerOptions(carrier, tls) {
         ? { carrier, host: "127.0.0.1", port: 0, tls: material, allowedOrigins: [ORIGIN] }
         : { carrier: "raw_quic", host: "127.0.0.1", port: 0, tls: material };
 }
-function directListenerOptionsV3(carrier, tls) {
-    const material = { certificate: tls.tls.certificate_chain_pem, privateKey: tls.tls.private_key_pem };
-    return carrier === "websocket"
-        ? { carrier, path: "direct", host: "127.0.0.1", port: 0, tls: material, allowedOrigins: [ORIGIN] }
-        : { carrier: "raw_quic", path: "direct", host: "127.0.0.1", port: 0, tls: material };
-}
-function tunnelListenerOptionsV3(carrier, tls) {
-    const material = { certificate: tls.tls.certificate_chain_pem, privateKey: tls.tls.private_key_pem };
-    return carrier === "websocket"
-        ? { carrier, host: "127.0.0.1", port: 0, tls: material, allowedOrigins: [ORIGIN] }
-        : { carrier: "raw_quic", host: "127.0.0.1", port: 0, tls: material };
-}
 async function main() {
     const { role, carrier } = parseArguments(process.argv.slice(2));
     switch (role) {

package/dist/node/acceptor.d.ts

@@ -1,10 +1,7 @@
-import { type JsonValue, type OperationOptions, type Session } from "../public/contract.js";
-import { type DirectAuthorizationDecision, type RuntimeAuthorizationRequest } from "./controlplane.js";
+import type { JsonValue } from "../public/contract.js";
 import { type StreamHandler, type StreamHandlerOptions } from "../public/streamHandlers.js";
-export type { RuntimeAuthorizationRequest } from "./controlplane.js";
 export { HandlerRegistrationError } from "../public/streamHandlers.js";
 export type { StreamHandler } from "../public/streamHandlers.js";
-export type AuthorizationDecision = DirectAuthorizationDecision;
 export type RPCHandlerResult = Readonly<{
     payload: JsonValue;
 }> | Readonly<{
@@ -25,15 +22,6 @@ export declare class RPCHandlers {
     handleRPC(typeId: number, handler: RPCHandler): void;
     handleNotification(typeId: number, handler: NotificationHandler): void;
 }
-export declare class SessionHandlers {
-    private readonly streamHandlerRegistrarBrand;
-    private readonly sessionHandlersV2Brand;
-    constructor(options?: SessionHandlerOptions);
-    handleRPC(typeId: number, handler: RPCHandler): void;
-    handleNotification(typeId: number, handler: NotificationHandler): void;
-    handleStream(kind: string, handler: StreamHandler): void;
-}
-/** Strict-v3 accepted-session handlers. */
 export declare class SessionHandlersV3 {
     private readonly streamHandlerRegistrarBrand;
     private readonly sessionHandlersV3Brand;
@@ -46,47 +34,3 @@ export type FrozenRPCHandlers = Readonly<{
     requests: ReadonlyMap<number, RPCHandler>;
     notifications: ReadonlyMap<number, NotificationHandler>;
 }>;
-export type AcceptorListener = Readonly<{
-    carrier: "websocket";
-    path: "direct";
-    host: string;
-    port: number;
-    tls?: Readonly<{
-        certificate: string;
-        privateKey: string;
-    }>;
-    allowedOrigins: readonly string[];
-}> | Readonly<{
-    carrier: "raw_quic";
-    path: "direct";
-    host: string;
-    port: number;
-    tls: Readonly<{
-        certificate: string;
-        privateKey: string;
-    }>;
-}>;
-export type AcceptorOptions = Readonly<{
-    listeners: readonly AcceptorListener[];
-    maxInboundStreams: number;
-    cleanupTimeoutMs?: number;
-    authorize(request: RuntimeAuthorizationRequest, options: OperationOptions): Promise<AuthorizationDecision>;
-    release?(leaseId: string): Promise<void> | void;
-    resolveHandlers?(request: RuntimeAuthorizationRequest, options: OperationOptions): Promise<SessionHandlers> | SessionHandlers;
-}>;
-export declare class AcceptedSession {
-    private constructor();
-    get session(): Session;
-    serve(options?: OperationOptions): Promise<void>;
-    close(): Promise<void>;
-}
-export declare class Acceptor {
-    private constructor();
-    addresses(): readonly Readonly<{
-        host: string;
-        port: number;
-    }>[];
-    accept(operation?: OperationOptions): Promise<AcceptedSession>;
-    close(): Promise<void>;
-}
-export declare function createAcceptor(options: AcceptorOptions): Promise<Acceptor>;