@floegence/flowersec-core 3.2.1 → 4.0.0

package/dist/v2/handshake.js

@@ -1,470 +0,0 @@
-import { x25519 } from "@noble/curves/ed25519.js";
-import { p256 } from "@noble/curves/nist.js";
-import { expand, extract } from "@noble/hashes/hkdf.js";
-import { hmac } from "@noble/hashes/hmac.js";
-import { sha256 } from "@noble/hashes/sha2.js";
-import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
-import { concatBytes, readU32be, u32be } from "../utils/bin.js";
-import { CipherSuiteV2, ProtocolV2Error } from "./protocol.js";
-const encoder = new TextEncoder();
-const decoder = new TextDecoder("utf-8", { fatal: true });
-const CONTROL_PREFACE_BYTES = 16;
-const HANDSHAKE_HEADER_BYTES = 12;
-const MAX_HANDSHAKE_PAYLOAD_BYTES = 8_192;
-const registryIDPattern = /^[A-Za-z0-9._~-]+$/;
-const KNOWN_FEATURES_V2 = 0x00000001;
-export var HandshakeMessageTypeV2;
-(function (HandshakeMessageTypeV2) {
-    HandshakeMessageTypeV2[HandshakeMessageTypeV2["ClientInit"] = 1] = "ClientInit";
-    HandshakeMessageTypeV2[HandshakeMessageTypeV2["ServerFinished"] = 2] = "ServerFinished";
-    HandshakeMessageTypeV2[HandshakeMessageTypeV2["ClientFinished"] = 3] = "ClientFinished";
-})(HandshakeMessageTypeV2 || (HandshakeMessageTypeV2 = {}));
-export function encodeControlPrefaceV2() {
-    const out = new Uint8Array(CONTROL_PREFACE_BYTES);
-    out.set(encoder.encode("FSC2"));
-    out[4] = 2;
-    out[5] = 1;
-    return out;
-}
-export function parseControlPrefaceV2(raw) {
-    if (raw.length !== CONTROL_PREFACE_BYTES ||
-        raw[0] !== 0x46 || raw[1] !== 0x53 || raw[2] !== 0x43 || raw[3] !== 0x32 ||
-        raw[4] !== 2 || raw[5] !== 1 || raw.subarray(6).some((value) => value !== 0)) {
-        throw new ProtocolV2Error("invalid FSC2 control preface");
-    }
-}
-export function encodeHandshakeFrameV2(type, payload) {
-    if (type < HandshakeMessageTypeV2.ClientInit ||
-        type > HandshakeMessageTypeV2.ClientFinished ||
-        payload.length < 1 ||
-        payload.length > MAX_HANDSHAKE_PAYLOAD_BYTES) {
-        throw new ProtocolV2Error("invalid FSH2 handshake frame");
-    }
-    const out = new Uint8Array(HANDSHAKE_HEADER_BYTES + payload.length);
-    out.set(encoder.encode("FSH2"));
-    out[4] = 2;
-    out[5] = type;
-    out.set(u32be(payload.length), 8);
-    out.set(payload, HANDSHAKE_HEADER_BYTES);
-    return out;
-}
-export function decodeHandshakeFrameV2(raw) {
-    if (raw.length < HANDSHAKE_HEADER_BYTES ||
-        raw[0] !== 0x46 || raw[1] !== 0x53 || raw[2] !== 0x48 || raw[3] !== 0x32 ||
-        raw[4] !== 2 || raw[6] !== 0 || raw[7] !== 0) {
-        throw new ProtocolV2Error("invalid FSH2 handshake frame");
-    }
-    const type = raw[5];
-    const length = readU32be(raw, 8);
-    if (type < HandshakeMessageTypeV2.ClientInit ||
-        type > HandshakeMessageTypeV2.ClientFinished ||
-        length < 1 || length > MAX_HANDSHAKE_PAYLOAD_BYTES ||
-        raw.length !== HANDSHAKE_HEADER_BYTES + length) {
-        throw new ProtocolV2Error("invalid FSH2 handshake frame");
-    }
-    const payload = raw.slice(HANDSHAKE_HEADER_BYTES);
-    try {
-        decoder.decode(payload);
-    }
-    catch {
-        throw new ProtocolV2Error("invalid FSH2 UTF-8 payload");
-    }
-    return { type, payload, raw: raw.slice() };
-}
-export function encodeClientInitV2(message) {
-    validateClientInit(message);
-    return encodeCanonicalHandshake(HandshakeMessageTypeV2.ClientInit, {
-        channel_id: message.channelID,
-        client_admission_binding_b64u: encode32(message.clientAdmissionBinding),
-        client_endpoint_instance_id: message.clientEndpointInstanceID,
-        client_eph_pub_b64u: base64urlEncode(message.clientEphemeralPublic),
-        client_role: message.clientRole,
-        max_inbound_streams: message.maxInboundStreams,
-        nonce_c_b64u: encode32(message.nonceC),
-        profile: message.profile,
-        selected_features: message.selectedFeatures,
-        session_contract_hash_b64u: encode32(message.sessionContractHash),
-        suite: message.suite,
-    });
-}
-export function decodeClientInitV2(raw) {
-    const value = decodeCanonicalObject(raw, HandshakeMessageTypeV2.ClientInit, [
-        "channel_id", "client_admission_binding_b64u", "client_endpoint_instance_id", "client_eph_pub_b64u",
-        "client_role", "max_inbound_streams", "nonce_c_b64u", "profile", "selected_features",
-        "session_contract_hash_b64u", "suite",
-    ]);
-    const message = {
-        profile: requireString(value.profile),
-        channelID: requireString(value.channel_id),
-        sessionContractHash: decode32(value.session_contract_hash_b64u),
-        clientRole: requireInteger(value.client_role, 1),
-        suite: requireSuite(value.suite),
-        clientEphemeralPublic: decodeBase64(value.client_eph_pub_b64u),
-        nonceC: decode32(value.nonce_c_b64u),
-        selectedFeatures: requireInteger(value.selected_features, 0xffffffff),
-        maxInboundStreams: requireInteger(value.max_inbound_streams, 0xffff),
-        clientAdmissionBinding: decode32(value.client_admission_binding_b64u),
-        clientEndpointInstanceID: requireString(value.client_endpoint_instance_id),
-    };
-    validateClientInit(message);
-    requireCanonical(raw, encodeClientInitV2(message));
-    return message;
-}
-export function encodeServerFinishedCoreV2(core, suite) {
-    const normalized = { ...core, suite };
-    validateServerCore(normalized);
-    return encodeCanonicalHandshake(HandshakeMessageTypeV2.ServerFinished, serverCoreWire(normalized));
-}
-export function encodeServerFinishedV2(message, suite) {
-    const core = { ...message.core, suite };
-    validateServerCore(core);
-    assertBytes("server confirm", message.serverConfirm, 32);
-    return encodeCanonicalHandshake(HandshakeMessageTypeV2.ServerFinished, {
-        handshake_id: base64urlEncode(core.handshakeID),
-        max_inbound_streams: core.maxInboundStreams,
-        nonce_s_b64u: encode32(core.nonceS),
-        selected_features: core.selectedFeatures,
-        server_admission_binding_b64u: encode32(core.serverAdmissionBinding),
-        server_confirm_b64u: encode32(message.serverConfirm),
-        server_endpoint_instance_id: core.serverEndpointInstanceID,
-        server_eph_pub_b64u: base64urlEncode(core.serverEphemeralPublic),
-        session_contract_hash_b64u: encode32(core.sessionContractHash),
-    });
-}
-export function decodeServerFinishedV2(raw, suite) {
-    const value = decodeCanonicalObject(raw, HandshakeMessageTypeV2.ServerFinished, [
-        "handshake_id", "max_inbound_streams", "nonce_s_b64u", "selected_features",
-        "server_admission_binding_b64u", "server_confirm_b64u", "server_endpoint_instance_id",
-        "server_eph_pub_b64u", "session_contract_hash_b64u",
-    ]);
-    const core = {
-        suite,
-        handshakeID: decodeBase64(value.handshake_id),
-        serverEphemeralPublic: decodeBase64(value.server_eph_pub_b64u),
-        nonceS: decode32(value.nonce_s_b64u),
-        sessionContractHash: decode32(value.session_contract_hash_b64u),
-        selectedFeatures: requireInteger(value.selected_features, 0xffffffff),
-        maxInboundStreams: requireInteger(value.max_inbound_streams, 0xffff),
-        serverAdmissionBinding: decode32(value.server_admission_binding_b64u),
-        serverEndpointInstanceID: requireString(value.server_endpoint_instance_id),
-    };
-    const message = { core, serverConfirm: decode32(value.server_confirm_b64u) };
-    validateServerCore(core);
-    requireCanonical(raw, encodeServerFinishedV2(message, suite));
-    return message;
-}
-export function encodeClientFinishedCoreV2(handshakeID) {
-    validateHandshakeID(handshakeID);
-    return encodeCanonicalHandshake(HandshakeMessageTypeV2.ClientFinished, {
-        handshake_id: base64urlEncode(handshakeID),
-    });
-}
-export function encodeClientFinishedV2(message) {
-    validateHandshakeID(message.handshakeID);
-    assertBytes("client confirm", message.clientConfirm, 32);
-    return encodeCanonicalHandshake(HandshakeMessageTypeV2.ClientFinished, {
-        client_confirm_b64u: encode32(message.clientConfirm),
-        handshake_id: base64urlEncode(message.handshakeID),
-    });
-}
-export function decodeClientFinishedV2(raw) {
-    const value = decodeCanonicalObject(raw, HandshakeMessageTypeV2.ClientFinished, [
-        "client_confirm_b64u", "handshake_id",
-    ]);
-    const message = {
-        handshakeID: decodeBase64(value.handshake_id),
-        clientConfirm: decode32(value.client_confirm_b64u),
-    };
-    validateHandshakeID(message.handshakeID);
-    requireCanonical(raw, encodeClientFinishedV2(message));
-    return message;
-}
-export function generateEphemeralKeyV2(suite, entropy) {
-    let privateKey;
-    if (suite === CipherSuiteV2.ChaCha20Poly1305) {
-        privateKey = requireEntropy(entropy, 32);
-    }
-    else if (suite === CipherSuiteV2.AES256GCM) {
-        do
-            privateKey = requireEntropy(entropy, 32);
-        while (!p256.utils.isValidSecretKey(privateKey));
-    }
-    else {
-        return invalidSuite();
-    }
-    return { privateKey, publicKey: ephemeralPublicKeyV2(suite, privateKey) };
-}
-function requireEntropy(entropy, length) {
-    const output = entropy(length);
-    assertBytes("session entropy", output, length);
-    return output.slice();
-}
-export function ephemeralPublicKeyV2(suite, privateKey) {
-    assertBytes("ephemeral private key", privateKey, 32);
-    try {
-        if (suite === CipherSuiteV2.ChaCha20Poly1305)
-            return x25519.getPublicKey(privateKey);
-        if (suite === CipherSuiteV2.AES256GCM)
-            return p256.getPublicKey(privateKey, false);
-    }
-    catch {
-        throw new ProtocolV2Error("invalid v2 ephemeral private key");
-    }
-    return invalidSuite();
-}
-export function computeSharedSecretV2(suite, privateKey, peerPublicKey) {
-    assertBytes("ephemeral private key", privateKey, 32);
-    validateEphemeralPublic(suite, peerPublicKey);
-    let shared;
-    try {
-        if (suite === CipherSuiteV2.ChaCha20Poly1305) {
-            shared = x25519.getSharedSecret(privateKey, peerPublicKey);
-        }
-        else if (suite === CipherSuiteV2.AES256GCM) {
-            const point = p256.getSharedSecret(privateKey, peerPublicKey, false);
-            if (point.length !== 65 || point[0] !== 4)
-                throw new Error("invalid P-256 point");
-            shared = point.slice(1, 33);
-        }
-        else {
-            return invalidSuite();
-        }
-    }
-    catch {
-        throw new ProtocolV2Error("invalid v2 ECDH shared secret");
-    }
-    if (shared.length !== 32 || shared.every((value) => value === 0)) {
-        throw new ProtocolV2Error("invalid v2 ECDH shared secret");
-    }
-    return shared;
-}
-export function deriveHandshakePRKV2(psk, sharedSecret) {
-    assertBytes("handshake PSK", psk, 32);
-    assertBytes("ECDH shared secret", sharedSecret, 32);
-    if (sharedSecret.every((value) => value === 0))
-        throw new ProtocolV2Error("invalid v2 ECDH shared secret");
-    return extract(sha256, sharedSecret, psk);
-}
-export function computeHandshakeH0V2(fsc2Raw, clientInitRaw) {
-    parseControlPrefaceV2(fsc2Raw);
-    decodeClientInitV2(clientInitRaw);
-    return sha256(concatBytes([
-        encoder.encode("flowersec-v2-handshake\0"),
-        fsc2Raw,
-        lengthPrefixed(clientInitRaw),
-    ]));
-}
-export function computeHandshakeH1V2(h0, serverCoreRaw) {
-    assertBytes("H0", h0, 32);
-    const frame = decodeHandshakeFrameV2(serverCoreRaw);
-    if (frame.type !== HandshakeMessageTypeV2.ServerFinished)
-        throw new ProtocolV2Error("invalid v2 transcript");
-    return sha256(concatBytes([h0, lengthPrefixed(serverCoreRaw)]));
-}
-export function computeServerConfirmV2(handshakePRK, h1) {
-    return computeConfirm(handshakePRK, h1, "flowersec v2 server finished");
-}
-export function computeHandshakeH2V2(h1, serverFinishedRaw, clientCoreRaw) {
-    assertBytes("H1", h1, 32);
-    if (decodeHandshakeFrameV2(serverFinishedRaw).type !== HandshakeMessageTypeV2.ServerFinished ||
-        decodeHandshakeFrameV2(clientCoreRaw).type !== HandshakeMessageTypeV2.ClientFinished) {
-        throw new ProtocolV2Error("invalid v2 transcript");
-    }
-    return sha256(concatBytes([h1, lengthPrefixed(serverFinishedRaw), lengthPrefixed(clientCoreRaw)]));
-}
-export function computeClientConfirmV2(handshakePRK, h2) {
-    return computeConfirm(handshakePRK, h2, "flowersec v2 client finished");
-}
-export function computeHandshakeH3V2(h2, clientFinishedRaw) {
-    assertBytes("H2", h2, 32);
-    decodeClientFinishedV2(clientFinishedRaw);
-    return sha256(concatBytes([h2, lengthPrefixed(clientFinishedRaw)]));
-}
-export function deriveSessionPRKV2(h3, handshakePRK) {
-    assertBytes("H3", h3, 32);
-    assertBytes("handshake PRK", handshakePRK, 32);
-    return extract(sha256, handshakePRK, h3);
-}
-export function validateClientInitV2(message, expected) {
-    validateClientInit(message);
-    if (message.channelID !== expected.channelID ||
-        message.suite !== expected.suite ||
-        message.maxInboundStreams !== expected.maxInboundStreams ||
-        !bytesEqual(message.sessionContractHash, expected.sessionContractHash) ||
-        !validAdmissionBinding(expected.path, message.clientAdmissionBinding, expected.admissionBinding) ||
-        !validExpectedEndpoint(expected.path, message.clientEndpointInstanceID, expected.expectedEndpointInstanceID)) {
-        throw new ProtocolV2Error("v2 handshake binding mismatch");
-    }
-}
-export function validateServerFinishedV2(message, expected) {
-    validateServerCore(message.core);
-    if (message.core.suite !== expected.suite ||
-        message.core.maxInboundStreams !== expected.maxInboundStreams ||
-        !bytesEqual(message.core.sessionContractHash, expected.sessionContractHash) ||
-        !validAdmissionBinding(expected.path, message.core.serverAdmissionBinding, expected.admissionBinding) ||
-        !validExpectedEndpoint(expected.path, message.core.serverEndpointInstanceID, expected.expectedEndpointInstanceID)) {
-        throw new ProtocolV2Error("v2 handshake binding mismatch");
-    }
-}
-function serverCoreWire(core) {
-    return {
-        handshake_id: base64urlEncode(core.handshakeID),
-        max_inbound_streams: core.maxInboundStreams,
-        nonce_s_b64u: encode32(core.nonceS),
-        selected_features: core.selectedFeatures,
-        server_admission_binding_b64u: encode32(core.serverAdmissionBinding),
-        server_endpoint_instance_id: core.serverEndpointInstanceID,
-        server_eph_pub_b64u: base64urlEncode(core.serverEphemeralPublic),
-        session_contract_hash_b64u: encode32(core.sessionContractHash),
-    };
-}
-function validateClientInit(message) {
-    if (message.profile !== "flowersec/2" ||
-        !validRegistryID(message.channelID, false) ||
-        message.clientRole !== 1 ||
-        (message.selectedFeatures & ~KNOWN_FEATURES_V2) !== 0 ||
-        message.maxInboundStreams < 1 || message.maxInboundStreams > 128 ||
-        !validRegistryID(message.clientEndpointInstanceID, true)) {
-        throw new ProtocolV2Error("invalid v2 client init");
-    }
-    assertBytes("session contract hash", message.sessionContractHash, 32);
-    assertBytes("client nonce", message.nonceC, 32);
-    assertBytes("client admission binding", message.clientAdmissionBinding, 32);
-    validateEphemeralPublic(message.suite, message.clientEphemeralPublic);
-}
-function validateServerCore(core) {
-    validateHandshakeID(core.handshakeID);
-    if ((core.selectedFeatures & ~KNOWN_FEATURES_V2) !== 0 ||
-        core.maxInboundStreams < 1 || core.maxInboundStreams > 128 ||
-        !validRegistryID(core.serverEndpointInstanceID, true)) {
-        throw new ProtocolV2Error("invalid v2 server finished");
-    }
-    assertBytes("session contract hash", core.sessionContractHash, 32);
-    assertBytes("server nonce", core.nonceS, 32);
-    assertBytes("server admission binding", core.serverAdmissionBinding, 32);
-    validateEphemeralPublic(core.suite, core.serverEphemeralPublic);
-}
-function validateEphemeralPublic(suite, value) {
-    try {
-        if (suite === CipherSuiteV2.ChaCha20Poly1305) {
-            assertBytes("X25519 public key", value, 32);
-            return;
-        }
-        if (suite === CipherSuiteV2.AES256GCM) {
-            if (value.length !== 65 || value[0] !== 4)
-                throw new Error("invalid P-256 public key");
-            p256.Point.fromBytes(value);
-            return;
-        }
-    }
-    catch {
-        throw new ProtocolV2Error("invalid v2 ephemeral public key");
-    }
-    invalidSuite();
-}
-function encodeCanonicalHandshake(type, value) {
-    return encodeHandshakeFrameV2(type, encoder.encode(JSON.stringify(value)));
-}
-function decodeCanonicalObject(raw, type, fields) {
-    const frame = decodeHandshakeFrameV2(raw);
-    if (frame.type !== type)
-        throw new ProtocolV2Error("unexpected FSH2 message type");
-    let value;
-    try {
-        value = JSON.parse(decoder.decode(frame.payload));
-    }
-    catch {
-        throw new ProtocolV2Error("invalid FSH2 JSON payload");
-    }
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw new ProtocolV2Error("invalid FSH2 JSON object");
-    }
-    const object = value;
-    const keys = Object.keys(object);
-    if (keys.length !== fields.length || fields.some((field) => !Object.hasOwn(object, field))) {
-        throw new ProtocolV2Error("invalid FSH2 JSON fields");
-    }
-    return object;
-}
-function requireCanonical(actual, canonical) {
-    if (!bytesEqual(actual, canonical))
-        throw new ProtocolV2Error("non-canonical FSH2 message");
-}
-function requireString(value) {
-    if (typeof value !== "string")
-        throw new ProtocolV2Error("invalid FSH2 string");
-    return value;
-}
-function requireInteger(value, max) {
-    if (!Number.isInteger(value) || value < 0 || value > max) {
-        throw new ProtocolV2Error("invalid FSH2 integer");
-    }
-    return value;
-}
-function requireSuite(value) {
-    if (value !== CipherSuiteV2.ChaCha20Poly1305 && value !== CipherSuiteV2.AES256GCM)
-        return invalidSuite();
-    return value;
-}
-function decodeBase64(value) {
-    const text = requireString(value);
-    try {
-        return base64urlDecode(text);
-    }
-    catch {
-        throw new ProtocolV2Error("invalid FSH2 base64url");
-    }
-}
-function decode32(value) {
-    const decoded = decodeBase64(value);
-    assertBytes("FSH2 field", decoded, 32);
-    return decoded;
-}
-function encode32(value) {
-    assertBytes("FSH2 field", value, 32);
-    return base64urlEncode(value);
-}
-function validateHandshakeID(value) {
-    if (value.length < 16 || value.length > 32)
-        throw new ProtocolV2Error("invalid v2 handshake ID");
-}
-function computeConfirm(handshakePRK, transcript, label) {
-    assertBytes("handshake PRK", handshakePRK, 32);
-    assertBytes("handshake transcript", transcript, 32);
-    const key = expand(sha256, handshakePRK, concatBytes([encoder.encode(label), transcript]), 32);
-    return hmac(sha256, key, transcript);
-}
-function lengthPrefixed(raw) {
-    return concatBytes([u32be(raw.length), raw]);
-}
-function validRegistryID(value, allowEmpty) {
-    return (allowEmpty && value === "") || (value.length >= 1 && value.length <= 128 && registryIDPattern.test(value));
-}
-function validAdmissionBinding(path, actual, expected) {
-    assertBytes("actual admission binding", actual, 32);
-    assertBytes("expected admission binding", expected, 32);
-    if (path === "direct" || !expected.every((value) => value === 0))
-        return bytesEqual(actual, expected);
-    return !actual.every((value) => value === 0);
-}
-function validExpectedEndpoint(path, actual, expected) {
-    if (path === "direct")
-        return actual === "" && expected === "";
-    return validRegistryID(actual, false) && validRegistryID(expected, false) && actual === expected;
-}
-function bytesEqual(left, right) {
-    if (left.length !== right.length)
-        return false;
-    let difference = 0;
-    for (let index = 0; index < left.length; index++)
-        difference |= left[index] ^ right[index];
-    return difference === 0;
-}
-function assertBytes(name, value, length) {
-    if (!(value instanceof Uint8Array) || value.length !== length) {
-        throw new ProtocolV2Error(`${name} must be ${length} bytes`);
-    }
-}
-function invalidSuite() {
-    throw new ProtocolV2Error("invalid v2 cipher suite");
-}

package/dist/v2/index.d.ts

@@ -1,14 +0,0 @@
-export type { ByteStream, IncomingStream, JsonObject, JsonPrimitive, JsonValue, OperationOptions, RpcPeer, RpcResult, SessionErrorCode, StreamOpenOptions, UnreliableMessageChannel, UnreliableMessageSendOptions, UnreliableMessageSendResult, SessionTermination, Session, } from "../public/contract.js";
-export { SessionError, UnreliableMessageError } from "../public/contract.js";
-export { createStreamMetadata, StreamMetadataError } from "../public/streamMetadata.js";
-export type { StreamMetadata } from "../public/streamMetadata.js";
-export { HandlerRegistrationError, LegacyStreamHandlers as StreamHandlers, } from "../public/streamHandlers.js";
-export type { StreamHandler, StreamHandlerOptions, } from "../public/streamHandlers.js";
-export { ArtifactLeaseError, createArtifactLease, } from "../public/artifactLease.js";
-export type { ArtifactLease } from "../public/artifactLease.js";
-export { Artifact, ArtifactError, parseArtifact } from "../public/artifact.js";
-export type { ArtifactErrorCode } from "../public/artifact.js";
-export type { ConnectErrorCode } from "../public/connectError.js";
-export { ConnectError } from "../public/connectError.js";
-export { ConnectionControllerError } from "../connectionController.js";
-export type { ArtifactSource, ArtifactSourceResult, ConnectionController, ConnectionControllerFailure, ConnectionControllerOptions, ConnectionSnapshot, ConnectionState, RetryDisposition, } from "../connectionController.js";

package/dist/v2/index.js

@@ -1,7 +0,0 @@
-export { SessionError, UnreliableMessageError } from "../public/contract.js";
-export { createStreamMetadata, StreamMetadataError } from "../public/streamMetadata.js";
-export { HandlerRegistrationError, LegacyStreamHandlers as StreamHandlers, } from "../public/streamHandlers.js";
-export { ArtifactLeaseError, createArtifactLease, } from "../public/artifactLease.js";
-export { Artifact, ArtifactError, parseArtifact } from "../public/artifact.js";
-export { ConnectError } from "../public/connectError.js";
-export { ConnectionControllerError } from "../connectionController.js";

package/dist/v2/opaqueArtifact.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/v2/opaqueArtifact.js

@@ -1,2 +0,0 @@
-/** @internal */
-export { Artifact, ArtifactError, parseArtifact, unwrapArtifact, wrapArtifact, } from "../public/artifact.js";

package/dist/v2/protocol.d.ts

@@ -1,99 +0,0 @@
-export declare class ProtocolV2Error extends Error {
-}
-export declare enum DirectionV2 {
-    ClientToServer = 1,
-    ServerToClient = 2
-}
-export declare enum CipherSuiteV2 {
-    ChaCha20Poly1305 = 1,
-    AES256GCM = 2
-}
-export type EpochRootsV2 = Readonly<{
-    epochSecret: Uint8Array;
-    controlRoot: Uint8Array;
-    streamRoot: Uint8Array;
-    setupRoot: Uint8Array;
-    rekeyRoot: Uint8Array;
-}>;
-export type RecordMaterialV2 = Readonly<{
-    secret: Uint8Array;
-    recordKey: Uint8Array;
-    noncePrefix: Uint8Array;
-}>;
-export type SetupPrefaceV2 = Readonly<{
-    openerRole: 1 | 2;
-    logicalStreamID: bigint;
-    initialSendEpoch: number;
-    setupMAC: Uint8Array;
-}>;
-export type RecordHeaderV2 = Readonly<{
-    epoch: number;
-    sequence: bigint;
-    ciphertextLength: number;
-}>;
-export type OpenPayloadV2 = Readonly<{
-    logicalStreamID: bigint;
-    fss2Hash: Uint8Array;
-    kind: string;
-    metadata: Uint8Array;
-}>;
-export declare enum InnerTypeV2 {
-    Open = 1,
-    OpenACK = 2,
-    OpenReject = 3,
-    Data = 4,
-    FIN = 5,
-    StreamKeyUpdate = 6,
-    SessionReady = 16,
-    Ping = 17,
-    Pong = 18,
-    SessionKeyUpdate = 19,
-    StreamReset = 20,
-    GoAway = 21,
-    SessionClose = 22,
-    SessionReadyACK = 23,
-    SessionKeyUpdateACK = 24,
-    StreamKeyUpdateACK = 25,
-    SessionReadyConfirm = 26
-}
-export type InnerRecordV2 = Readonly<{
-    type: InnerTypeV2;
-    payload: Uint8Array;
-}>;
-export type OpenRejectV2 = Readonly<{
-    openHash: Uint8Array;
-    reason: number;
-    knownReason: boolean;
-}>;
-export type StreamKeyUpdateACKV2 = Readonly<{
-    logicalStreamID: bigint;
-    transition: bigint;
-    epoch: number;
-}>;
-export declare function deriveEpochZero(sessionPRK: Uint8Array, direction: DirectionV2): EpochRootsV2;
-export declare function deriveEpochRoots(epochSecret: Uint8Array): EpochRootsV2;
-export declare function deriveNextEpoch(rekeyRoot: Uint8Array, h3: Uint8Array, direction: DirectionV2, nextEpoch: number): Uint8Array;
-export declare function deriveStreamMaterial(streamRoot: Uint8Array, h3: Uint8Array, logicalStreamID: bigint, direction: DirectionV2, epoch: number): RecordMaterialV2;
-export declare function deriveControlMaterial(controlRoot: Uint8Array, h3: Uint8Array, direction: DirectionV2, epoch: number): RecordMaterialV2;
-export declare function computeSetupMAC(setupRoot: Uint8Array, h3: Uint8Array, preface: SetupPrefaceV2): Uint8Array;
-export declare function encodeSetupPreface(preface: SetupPrefaceV2): Uint8Array;
-export declare function decodeSetupPrefaceV2(raw: Uint8Array): SetupPrefaceV2;
-export declare function verifySetupMAC(setupRoot: Uint8Array, h3: Uint8Array, preface: SetupPrefaceV2): boolean;
-export declare function computeFSS2HashV2(raw: Uint8Array): Uint8Array;
-export declare function encodeRecordHeader(header: RecordHeaderV2): Uint8Array;
-export declare function decodeRecordHeader(raw: Uint8Array): RecordHeaderV2;
-export declare function buildDataInner(payload: Uint8Array): Uint8Array;
-export declare function encodeInnerRecordV2(type: InnerTypeV2, payload: Uint8Array): Uint8Array;
-export declare function decodeInnerRecordV2(raw: Uint8Array): InnerRecordV2;
-export declare function encodeOpenPayload(payload: OpenPayloadV2): Uint8Array;
-export declare function decodeOpenPayload(raw: Uint8Array): OpenPayloadV2;
-export declare function computeOpenHashV2(rawOpenPayload: Uint8Array): Uint8Array;
-export declare function encodeOpenACKV2(openHash: Uint8Array): Uint8Array;
-export declare function decodeOpenACKV2(raw: Uint8Array): Uint8Array;
-export declare function encodeOpenRejectV2(openHash: Uint8Array, reason: number): Uint8Array;
-export declare function decodeOpenRejectV2(raw: Uint8Array): OpenRejectV2;
-export declare function encodeStreamKeyUpdateACKV2(value: StreamKeyUpdateACKV2): Uint8Array;
-export declare function decodeStreamKeyUpdateACKV2(raw: Uint8Array): StreamKeyUpdateACKV2;
-export declare function buildRecordAAD(h3: Uint8Array, logicalStreamID: bigint, direction: DirectionV2, rawHeader: Uint8Array): Uint8Array;
-export declare function sealRecord(suite: CipherSuiteV2, material: RecordMaterialV2, h3: Uint8Array, logicalStreamID: bigint, direction: DirectionV2, header: RecordHeaderV2, plaintext: Uint8Array): Uint8Array;
-export declare function openRecord(suite: CipherSuiteV2, material: RecordMaterialV2, h3: Uint8Array, logicalStreamID: bigint, direction: DirectionV2, header: RecordHeaderV2, ciphertext: Uint8Array): Uint8Array;