@floegence/flowersec-core 3.2.1 → 5.0.0

package/dist/node/connectSession.js

@@ -1,93 +0,0 @@
-import { detectNodeRuntimeCapabilityV2 } from "./runtimeCapability.js";
-import { composeCandidateAttemptFactoryV2, SessionConnectorV2, } from "../connector/sessionConnector.js";
-import { createWebSocketCandidateFactoryV2 } from "../connector/adapters/webSocketCandidate.js";
-import { createRawQuicCandidateFactoryV2 } from "../connector/adapters/rawQuicCandidate.js";
-import { createNodeWsFactory } from "./wsFactory.js";
-import { projectSessionV2 } from "../v2/publicSession.js";
-import { ConnectError } from "../public/connectError.js";
-import { nodeSessionRuntimeV2 } from "./sessionRuntime.js";
-import { createConnectionControllerV2, } from "../connectionController.js";
-import { createRPCRouter, freezeRPCHandlers, } from "./acceptor.js";
-import { createNativeRawQuicDriver, NativeTransportUnavailableError, tryLoadNativeTransportAddon, } from "./nativeTransportAddon.js";
-import { createNodeRawQuicClientV2, normalizeCertificateChain } from "./rawQuicAdapter.js";
-export function createConnectionController(source, options) {
-    const normalized = normalizeNodeOptions(options);
-    const controllerOptions = options.maximumAttempts === undefined
-        ? {}
-        : { maximumAttempts: options.maximumAttempts };
-    return createConnectionControllerV2(source, async (lease, signal) => await connectWithRPCSnapshot(lease, normalized, signal), controllerOptions);
-}
-export async function connect(lease, options) {
-    const normalized = normalizeNodeOptions(options);
-    return await connectWithRPCSnapshot(lease, normalized, options.signal);
-}
-async function connectWithRPCSnapshot(lease, options, signal) {
-    const rpcRouter = options.rpcSnapshot === undefined
-        ? undefined
-        : createRPCRouter(options.rpcSnapshot);
-    // WebSocket sessions do not require the optional native raw QUIC addon. Load
-    // it only when a raw QUIC candidate is actually selected by the connector.
-    const nativeAddon = tryLoadNativeTransportAddon();
-    const rawQuicFactory = createRawQuicCandidateFactoryV2(async (candidate, artifact, signal) => {
-        if (nativeAddon === undefined)
-            throw new NativeTransportUnavailableError();
-        if (options.tls?.ca === undefined) {
-            throw new TypeError("raw QUIC requires explicit trust roots");
-        }
-        return await createNodeRawQuicClientV2(createNativeRawQuicDriver(nativeAddon), candidate, artifact, { ca: options.tls.ca }, signal, options.connectTimeoutMs);
-    });
-    const origin = options.origin;
-    let websocketFactory;
-    if (origin !== undefined) {
-        const wsFactory = createNodeWsFactory(options.tls);
-        websocketFactory = createWebSocketCandidateFactoryV2((url, subprotocol) => wsFactory(url, origin, subprotocol));
-    }
-    const connector = new SessionConnectorV2(lease, composeCandidateAttemptFactoryV2({
-        ...(websocketFactory === undefined ? {} : { websocket: websocketFactory }),
-        raw_quic: rawQuicFactory,
-    }), {
-        capability: detectNodeRuntimeCapabilityV2(nativeAddon !== undefined),
-        runtime: nodeSessionRuntimeV2,
-        ...(rpcRouter === undefined ? {} : { rpcRouter }),
-        ...(options.connectTimeoutMs === undefined ? {} : { connectTimeoutMs: options.connectTimeoutMs }),
-    });
-    const result = await connector.connect(signal === undefined ? {} : { signal });
-    return projectSessionV2(result.session);
-}
-function normalizeNodeOptions(options) {
-    try {
-        const origin = normalizeOrigin(options.origin);
-        if (options.connectTimeoutMs !== undefined &&
-            (!Number.isSafeInteger(options.connectTimeoutMs) || options.connectTimeoutMs < 1)) {
-            throw new RangeError("connectTimeoutMs must be a positive safe integer");
-        }
-        if (origin !== undefined)
-            createNodeWsFactory(options.tls);
-        if (options.tls?.ca !== undefined)
-            normalizeCertificateChain(options.tls.ca);
-        return Object.freeze({
-            ...(origin === undefined ? {} : { origin }),
-            ...(options.connectTimeoutMs === undefined ? {} : { connectTimeoutMs: options.connectTimeoutMs }),
-            ...(options.tls === undefined ? {} : { tls: options.tls }),
-            ...(options.rpcHandlers === undefined ? {} : { rpcSnapshot: freezeRPCHandlers(options.rpcHandlers) }),
-        });
-    }
-    catch {
-        throw new ConnectError("invalid_options");
-    }
-}
-function normalizeOrigin(input) {
-    if (input === undefined)
-        return undefined;
-    let parsed;
-    try {
-        parsed = new URL(input);
-    }
-    catch {
-        throw new TypeError("origin must be an absolute HTTP(S) origin");
-    }
-    if ((parsed.protocol !== "https:" && parsed.protocol !== "http:") || parsed.origin !== input || parsed.username !== "" || parsed.password !== "") {
-        throw new TypeError("origin must be an absolute HTTP(S) origin without path, query, or credentials");
-    }
-    return parsed.origin;
-}

package/dist/node/controlplane.d.ts

@@ -1,137 +0,0 @@
-import { type Artifact } from "../public/artifact.js";
-export type ControlPlaneErrorCode = "invalid_input" | "issuance_failed";
-export declare class ControlPlaneError extends Error {
-    readonly code: ControlPlaneErrorCode;
-    constructor(code: ControlPlaneErrorCode);
-}
-/** Validated listener URLs used when issuing opaque artifacts. */
-export declare class EndpointSet {
-    #private;
-    constructor(...urls: readonly string[]);
-}
-export declare function createEndpointSet(...urls: readonly string[]): EndpointSet;
-export type SessionOptions = Readonly<{
-    channelId: string;
-    expiresAtUnixSeconds?: number;
-    idleTimeoutSeconds?: number;
-    maxInboundStreams?: number;
-}>;
-export type Scope = Readonly<{
-    name: string;
-    version: number;
-    critical: boolean;
-    payload: Readonly<Record<string, unknown>>;
-}>;
-export type ArtifactMetadata = Readonly<{
-    scopes?: readonly Scope[];
-    correlationTags?: Readonly<Record<string, string>>;
-}>;
-export type DirectIssueOptions = Readonly<{
-    session: SessionOptions;
-    endpoints: EndpointSet;
-    rendezvousGroupId: string;
-    listenerAudience: string;
-    upstreamAddress: string;
-    metadata?: ArtifactMetadata;
-}>;
-export type TunnelIssueOptions = Readonly<{
-    session: SessionOptions;
-    endpoints: EndpointSet;
-    rendezvousGroupId: string;
-    listenerAudience: string;
-    firstEndpointId: string;
-    secondEndpointId: string;
-    allowReplacement?: boolean;
-    firstMetadata?: ArtifactMetadata;
-    secondMetadata?: ArtifactMetadata;
-}>;
-export declare class Issuer {
-    #private;
-    constructor();
-    issueDirect(options: DirectIssueOptions): IssuedArtifact;
-    issueTunnelPair(options: TunnelIssueOptions): IssuedTunnelPair;
-}
-export declare class IssuedArtifact {
-    #private;
-    artifactJSON(): Uint8Array;
-    authorizationRecord(): AuthorizationRecord;
-    lookupKey(): string;
-}
-export type IssuedTunnelPair = Readonly<{
-    first: IssuedArtifact;
-    second: IssuedArtifact;
-}>;
-export declare class AuthorizationRecord {
-    #private;
-    private constructor();
-    lookupKey(): string;
-    encode(): Uint8Array;
-    static parse(encoded: string | Uint8Array): AuthorizationRecord;
-}
-export declare class RuntimeAuthorizationRequest {
-    #private;
-    private constructor();
-    static parse(encoded: string | Uint8Array): RuntimeAuthorizationRequest;
-    lookupKey(): string;
-}
-export type DirectAuthorizationDecision = Readonly<{
-    decision: "allow";
-    artifact: Artifact;
-}> | Readonly<{
-    decision: "reject" | "retry";
-    reason: string;
-}>;
-export type TunnelAuthorizationDecision = Readonly<{
-    decision: "allow";
-    credentialId: string;
-    leaseId: string;
-    expiresAtUnixSeconds: number;
-    expectedPeerEndpointInstanceId: string;
-    allowReplacement?: boolean;
-}> | Readonly<{
-    decision: "reject" | "retry";
-    reason: string;
-}>;
-type DirectAllowDecision = Extract<DirectAuthorizationDecision, Readonly<{
-    decision: "allow";
-}>>;
-type DirectRuntimeAllowDecision = DirectAllowDecision & Readonly<{
-    leaseId: string;
-    expiresAtUnixSeconds: number;
-}>;
-type DirectDenyDecision = Extract<DirectAuthorizationDecision, Readonly<{
-    decision: "reject" | "retry";
-}>>;
-type TunnelAllowDecision = Extract<TunnelAuthorizationDecision, Readonly<{
-    decision: "allow";
-}>>;
-type TunnelDenyDecision = Extract<TunnelAuthorizationDecision, Readonly<{
-    decision: "reject" | "retry";
-}>>;
-export declare class AuthorizationResponse<Decision extends DirectAuthorizationDecision = DirectAuthorizationDecision> {
-    #private;
-    readonly decision: Decision["decision"];
-    readonly artifact: Decision extends DirectAllowDecision ? Artifact : undefined;
-    readonly leaseId: Decision extends DirectRuntimeAllowDecision ? string : undefined;
-    readonly expiresAtUnixSeconds: Decision extends DirectRuntimeAllowDecision ? number : undefined;
-    readonly reason: Decision extends DirectDenyDecision ? string : undefined;
-    json(): Uint8Array;
-}
-export declare class TunnelAuthorizationResponse<Decision extends TunnelAuthorizationDecision = TunnelAuthorizationDecision> {
-    #private;
-    readonly decision: Decision["decision"];
-    readonly credentialId: Decision extends TunnelAllowDecision ? string : undefined;
-    readonly leaseId: Decision extends TunnelAllowDecision ? string : undefined;
-    readonly expiresAtUnixSeconds: Decision extends TunnelAllowDecision ? number : undefined;
-    readonly expectedPeerEndpointInstanceId: Decision extends TunnelAllowDecision ? string : undefined;
-    readonly allowReplacement: Decision extends TunnelAllowDecision ? boolean | undefined : undefined;
-    readonly reason: Decision extends TunnelDenyDecision ? string : undefined;
-    json(): Uint8Array;
-}
-export declare function authorizeRuntime(request: RuntimeAuthorizationRequest, record: AuthorizationRecord, leaseId: string, nowUnixSeconds?: number): AuthorizationResponse<DirectRuntimeAllowDecision>;
-export declare function authorizeTunnelRuntime(request: RuntimeAuthorizationRequest, record: AuthorizationRecord, leaseId: string, nowUnixSeconds?: number): TunnelAuthorizationResponse<TunnelAllowDecision>;
-export declare function rejectRuntime(reason: string, retryable: boolean): AuthorizationResponse<DirectDenyDecision>;
-export declare function rejectTunnelRuntime(reason: string, retryable: boolean): TunnelAuthorizationResponse<TunnelDenyDecision>;
-export declare function parseAuthorizationRecord(encoded: string | Uint8Array): AuthorizationRecord;
-export declare function parseRuntimeAuthorizationRequest(encoded: string | Uint8Array): RuntimeAuthorizationRequest;
-export {};

package/dist/node/controlplane.js

@@ -1,443 +0,0 @@
-import { randomBytes as nodeRandomBytes, timingSafeEqual } from "node:crypto";
-import { buildFSB2RequestV2, canonicalizeCandidatesV2, computeSessionContractHashV2, decodeArtifactV2JSON, decodeFSB2RequestV2, encodeArtifactV2JSON, encodeFSB2RequestV2, } from "../v2/artifact.js";
-import { wrapArtifact } from "../public/artifact.js";
-import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
-import { sha256 } from "@noble/hashes/sha2.js";
-const MAX_RECORD_BYTES = 96 * 1024;
-const LEASE_ID = /^[A-Za-z0-9._~-]{1,128}$/u;
-const REASON = /^[a-z][a-z0-9_]*$/u;
-const PROFILE = "flowersec/2";
-export class ControlPlaneError extends Error {
-    code;
-    constructor(code) {
-        super(`Flowersec control-plane failed (code=${code})`);
-        this.code = code;
-        this.name = "ControlPlaneError";
-    }
-}
-/** Validated listener URLs used when issuing opaque artifacts. */
-export class EndpointSet {
-    #endpoints;
-    constructor(...urls) {
-        if (urls.length < 1 || urls.length > 4)
-            throw invalidInput();
-        const values = [];
-        for (const url of urls) {
-            if (url.length === 0 || url.trim() !== url)
-                throw invalidInput();
-            const separator = url.indexOf("://");
-            if (separator <= 0)
-                throw invalidInput();
-            const scheme = url.slice(0, separator).toLowerCase();
-            const carrier = scheme === "ws" || scheme === "wss"
-                ? "websocket"
-                : scheme === "quic"
-                    ? "raw_quic"
-                    : scheme === "https"
-                        ? "webtransport"
-                        : undefined;
-            if (carrier === undefined)
-                throw invalidInput();
-            values.push({ carrier, url });
-        }
-        this.#endpoints = Object.freeze(values);
-    }
-    /** @internal */
-    toCandidates(kind) {
-        const counts = new Map();
-        const candidates = this.#endpoints.map(({ carrier, url }) => {
-            const count = (counts.get(carrier) ?? 0) + 1;
-            counts.set(carrier, count);
-            const base = carrier === "websocket" ? "websocket" : carrier === "raw_quic" ? "raw-quic" : "webtransport";
-            return {
-                id: count === 1 ? base : `${base}-${count}`,
-                carrier,
-                url,
-                wire_profile: `flowersec-${kind}/2`,
-            };
-        });
-        try {
-            canonicalizeCandidatesV2(kind, candidates);
-        }
-        catch {
-            throw invalidInput();
-        }
-        return candidates;
-    }
-}
-export function createEndpointSet(...urls) {
-    return new EndpointSet(...urls);
-}
-export class Issuer {
-    #now;
-    #random;
-    constructor() {
-        this.#now = () => Math.floor(Date.now() / 1000);
-        this.#random = (size) => nodeRandomBytes(size);
-    }
-    issueDirect(options) {
-        const session = this.#session(options.session);
-        const candidates = options.endpoints.toCandidates("direct");
-        if (!validTCPAddress(options.upstreamAddress))
-            throw invalidInput();
-        const credential = this.#credential();
-        const artifact = {
-            v: 2, profile: PROFILE, session,
-            path: {
-                kind: "direct",
-                rendezvous_group_id: options.rendezvousGroupId,
-                listener_audience: options.listenerAudience,
-                routing_token: credential,
-                candidates,
-            },
-            scoped: metadataScopes(options.metadata),
-            correlation: metadataCorrelation(options.metadata),
-        };
-        return this.#issued(artifact, options.upstreamAddress, false);
-    }
-    issueTunnelPair(options) {
-        const session = this.#session(options.session);
-        const candidates = options.endpoints.toCandidates("tunnel");
-        if (!validID(options.firstEndpointId) || !validID(options.secondEndpointId) || options.firstEndpointId === options.secondEndpointId)
-            throw invalidInput();
-        const allowReplacement = options.allowReplacement ?? false;
-        const build = (role, local, peer, token, metadata) => this.#issued({
-            v: 2, profile: PROFILE, session,
-            path: {
-                kind: "tunnel", rendezvous_group_id: options.rendezvousGroupId,
-                listener_audience: options.listenerAudience, role,
-                local_endpoint_instance_id: local,
-                expected_peer_endpoint_instance_id: peer,
-                token, candidates,
-            },
-            scoped: metadataScopes(metadata), correlation: metadataCorrelation(metadata),
-        }, "", allowReplacement);
-        return {
-            first: build(1, options.firstEndpointId, options.secondEndpointId, this.#credential(), options.firstMetadata),
-            second: build(2, options.secondEndpointId, options.firstEndpointId, this.#credential(), options.secondMetadata),
-        };
-    }
-    #session(options) {
-        const now = this.#now();
-        const expires = options.expiresAtUnixSeconds ?? now + 60;
-        const idle = options.idleTimeoutSeconds ?? 60;
-        const max = options.maxInboundStreams ?? 32;
-        if (!validID(options.channelId) || !Number.isSafeInteger(expires) || expires <= now || expires > now + 300 ||
-            !Number.isSafeInteger(idle) || idle < 0 || idle > 0xffff_ffff || !Number.isSafeInteger(max) || max < 1 || max > 128)
-            throw invalidInput();
-        const psk = this.#random(32);
-        if (psk.length !== 32)
-            throw issuanceFailed();
-        const unsigned = {
-            channel_id: options.channelId, init_expire_at_unix_s: expires,
-            idle_timeout_seconds: idle, establish_timeout_seconds: 30,
-            rekey_prepare_timeout_seconds: 10, rekey_completion_timeout_seconds: 30,
-            max_inbound_streams: max, e2ee_psk_b64u: base64urlEncode(psk),
-            allowed_suites: [1, 2], default_suite: 1, selected_features: 0,
-        };
-        const hash = computeSessionContractHashV2({ ...unsigned, contract_hash_b64u: "A".repeat(43) }).hashBase64URL;
-        return { ...unsigned, contract_hash_b64u: hash };
-    }
-    #credential() {
-        const value = this.#random(32);
-        if (value.length !== 32)
-            throw issuanceFailed();
-        return base64urlEncode(value);
-    }
-    #issued(artifact, directUpstream, allowReplacement) {
-        try {
-            const bytes = encodeArtifactV2JSON(artifact);
-            return new IssuedArtifact(bytes, AuthorizationRecord.create(bytes, artifact, directUpstream, allowReplacement));
-        }
-        catch (error) {
-            if (error instanceof ControlPlaneError)
-                throw error;
-            throw invalidInput();
-        }
-    }
-}
-export class IssuedArtifact {
-    #artifact;
-    #record;
-    /** @internal */
-    constructor(artifact, record) {
-        this.#artifact = artifact.slice();
-        this.#record = record;
-    }
-    artifactJSON() { return this.#artifact.slice(); }
-    authorizationRecord() { return this.#record; }
-    lookupKey() { return this.#record.lookupKey(); }
-}
-export class AuthorizationRecord {
-    #artifact;
-    #artifactJSON;
-    #lookup;
-    #upstream;
-    #allowReplacement;
-    constructor(artifactJSON, artifact, upstream, allowReplacement) {
-        const credential = artifact.path.kind === "direct" ? artifact.path.routing_token : artifact.path.token;
-        if (artifact.path.kind === "direct" ? upstream === "" || allowReplacement : upstream !== "")
-            throw invalidInput();
-        this.#artifact = artifact;
-        this.#artifactJSON = artifactJSON.slice();
-        this.#lookup = base64urlEncode(sha256(new TextEncoder().encode(credential)));
-        this.#upstream = upstream;
-        this.#allowReplacement = allowReplacement;
-    }
-    /** @internal */
-    static create(artifactJSON, artifact, upstream, allowReplacement) {
-        return new AuthorizationRecord(artifactJSON, artifact, upstream, allowReplacement);
-    }
-    lookupKey() { return this.#lookup; }
-    encode() {
-        const wire = {
-            schema_version: 1,
-            artifact_base64url: base64urlEncode(this.#artifactJSON),
-            lookup_key: this.#lookup,
-            ...(this.#upstream === "" ? {} : { direct_upstream: this.#upstream }),
-            allow_replacement: this.#allowReplacement,
-        };
-        return new TextEncoder().encode(JSON.stringify(wire));
-    }
-    static parse(encoded) {
-        const bytes = typeof encoded === "string" ? new TextEncoder().encode(encoded) : encoded;
-        if (bytes.length === 0 || bytes.length > MAX_RECORD_BYTES)
-            throw invalidInput();
-        const wire = strictObject(bytes);
-        assertExactKeys(wire, ["schema_version", "artifact_base64url", "lookup_key", "direct_upstream", "allow_replacement"], ["direct_upstream"]);
-        if (wire.schema_version !== 1 || typeof wire.artifact_base64url !== "string" || typeof wire.lookup_key !== "string" || typeof wire.allow_replacement !== "boolean")
-            throw invalidInput();
-        const artifactJSON = base64urlDecode(wire.artifact_base64url);
-        const artifact = decodeArtifactV2JSON(artifactJSON);
-        const upstream = wire.direct_upstream === undefined ? "" : wire.direct_upstream;
-        if (typeof upstream !== "string")
-            throw invalidInput();
-        const record = AuthorizationRecord.create(artifactJSON, artifact, upstream, wire.allow_replacement);
-        if (record.lookupKey() !== wire.lookup_key)
-            throw invalidInput();
-        return record;
-    }
-    /** @internal */
-    get artifact() { return this.#artifact; }
-    /** @internal */
-    get artifactJSON() { return this.#artifactJSON.slice(); }
-    /** @internal */
-    get upstream() { return this.#upstream; }
-    /** @internal */
-    get allowReplacement() { return this.#allowReplacement; }
-}
-export class RuntimeAuthorizationRequest {
-    #decoded;
-    #lookup;
-    #carrier;
-    constructor(decoded, carrier) {
-        this.#decoded = decoded;
-        this.#carrier = carrier;
-        const credential = decoded.request.pathKind === "direct" ? decoded.request.routing_token : decoded.request.attach_token;
-        this.#lookup = base64urlEncode(sha256(new TextEncoder().encode(credential)));
-    }
-    /** @internal */
-    static fromDecoded(decoded, carrier) {
-        return new RuntimeAuthorizationRequest(decoded, carrier);
-    }
-    static parse(encoded) {
-        const wire = strictObject(typeof encoded === "string" ? new TextEncoder().encode(encoded) : encoded);
-        assertExactKeys(wire, ["fsb2_base64url", "carrier", "remote_address"]);
-        if (typeof wire.fsb2_base64url !== "string" || typeof wire.carrier !== "string" || typeof wire.remote_address !== "string" || !validObservedText(wire.remote_address))
-            throw invalidInput();
-        const decoded = decodeFSB2RequestV2(base64urlDecode(wire.fsb2_base64url));
-        const candidate = decoded.request.candidates.find((item) => item.id === decoded.request.chosen_candidate_id);
-        if (candidate === undefined || candidate.carrier !== wire.carrier)
-            throw invalidInput();
-        return new RuntimeAuthorizationRequest(decoded, candidate.carrier);
-    }
-    lookupKey() { return this.#lookup; }
-    /** @internal */ get decoded() { return this.#decoded; }
-    /** @internal */ get carrier() { return this.#carrier; }
-}
-/** @internal */
-export function runtimeAuthorizationRequestFromDecoded(decoded) {
-    const candidate = decoded.request.candidates.find((item) => item.id === decoded.request.chosen_candidate_id);
-    if (candidate === undefined)
-        throw invalidInput();
-    return RuntimeAuthorizationRequest.fromDecoded(decoded, candidate.carrier);
-}
-export class AuthorizationResponse {
-    #json;
-    #decision;
-    decision;
-    artifact;
-    leaseId;
-    expiresAtUnixSeconds;
-    reason;
-    /** @internal */
-    constructor(json, decision) {
-        this.#json = json.slice();
-        this.#decision = decision;
-        this.decision = decision.decision;
-        this.artifact = (decision.decision === "allow" ? decision.artifact : undefined);
-        this.leaseId = (decision.decision === "allow" && "leaseId" in decision ? decision.leaseId : undefined);
-        this.expiresAtUnixSeconds = (decision.decision === "allow" && "expiresAtUnixSeconds" in decision ? decision.expiresAtUnixSeconds : undefined);
-        this.reason = (decision.decision === "allow" ? undefined : decision.reason);
-    }
-    json() { return this.#json.slice(); }
-    /** @internal */
-    asDecision() { return this.#decision; }
-}
-export class TunnelAuthorizationResponse {
-    #json;
-    #decision;
-    decision;
-    credentialId;
-    leaseId;
-    expiresAtUnixSeconds;
-    expectedPeerEndpointInstanceId;
-    allowReplacement;
-    reason;
-    /** @internal */
-    constructor(json, decision) {
-        this.#json = json.slice();
-        this.#decision = decision;
-        this.decision = decision.decision;
-        this.credentialId = (decision.decision === "allow" ? decision.credentialId : undefined);
-        this.leaseId = (decision.decision === "allow" ? decision.leaseId : undefined);
-        this.expiresAtUnixSeconds = (decision.decision === "allow" ? decision.expiresAtUnixSeconds : undefined);
-        this.expectedPeerEndpointInstanceId = (decision.decision === "allow" ? decision.expectedPeerEndpointInstanceId : undefined);
-        this.allowReplacement = (decision.decision === "allow" ? decision.allowReplacement : undefined);
-        this.reason = (decision.decision === "allow" ? undefined : decision.reason);
-    }
-    json() { return this.#json.slice(); }
-    /** @internal */
-    asDecision() { return this.#decision; }
-}
-export function authorizeRuntime(request, record, leaseId, nowUnixSeconds = Math.floor(Date.now() / 1000)) {
-    if (!(request instanceof RuntimeAuthorizationRequest) || !(record instanceof AuthorizationRecord) || !LEASE_ID.test(leaseId) || request.lookupKey() !== record.lookupKey())
-        throw invalidInput();
-    const artifact = record.artifact;
-    if (nowUnixSeconds >= artifact.session.init_expire_at_unix_s)
-        throw invalidInput();
-    const expected = encodeFSB2RequestV2(buildFSB2RequestV2(artifact, request.decoded.request.chosen_candidate_id));
-    if (!bytesEqual(expected, request.decoded.raw))
-        throw invalidInput();
-    const base = { decision: "allow", credential_id: record.lookupKey(), lease_id: leaseId, expires_at: new Date(artifact.session.init_expire_at_unix_s * 1000).toISOString() };
-    if (artifact.path.kind !== "direct")
-        throw invalidInput();
-    base.direct = { session: sessionWire(artifact.session), upstream: { network: "tcp", address: record.upstream } };
-    return new AuthorizationResponse(new TextEncoder().encode(JSON.stringify(base)), {
-        decision: "allow",
-        artifact: wrapArtifact(artifact),
-        leaseId,
-        expiresAtUnixSeconds: artifact.session.init_expire_at_unix_s,
-    });
-}
-export function authorizeTunnelRuntime(request, record, leaseId, nowUnixSeconds = Math.floor(Date.now() / 1000)) {
-    if (!(request instanceof RuntimeAuthorizationRequest) || !(record instanceof AuthorizationRecord) || !LEASE_ID.test(leaseId) || request.lookupKey() !== record.lookupKey())
-        throw invalidInput();
-    const artifact = record.artifact;
-    if (artifact.path.kind !== "tunnel" || nowUnixSeconds >= artifact.session.init_expire_at_unix_s)
-        throw invalidInput();
-    const expected = encodeFSB2RequestV2(buildFSB2RequestV2(artifact, request.decoded.request.chosen_candidate_id));
-    if (!bytesEqual(expected, request.decoded.raw))
-        throw invalidInput();
-    const decision = {
-        decision: "allow",
-        credentialId: record.lookupKey(),
-        leaseId,
-        expiresAtUnixSeconds: artifact.session.init_expire_at_unix_s,
-        expectedPeerEndpointInstanceId: artifact.path.expected_peer_endpoint_instance_id,
-        allowReplacement: record.allowReplacement,
-    };
-    return new TunnelAuthorizationResponse(new TextEncoder().encode(JSON.stringify({
-        decision: "allow",
-        credential_id: decision.credentialId,
-        lease_id: decision.leaseId,
-        expires_at: new Date(decision.expiresAtUnixSeconds * 1000).toISOString(),
-        expected_peer_endpoint_instance_id: decision.expectedPeerEndpointInstanceId,
-        allow_replacement: decision.allowReplacement,
-    })), decision);
-}
-export function rejectRuntime(reason, retryable) {
-    if (!REASON.test(reason) || reason.length > 64)
-        throw invalidInput();
-    const decision = { decision: retryable ? "retry" : "reject", reason };
-    return new AuthorizationResponse(new TextEncoder().encode(JSON.stringify(decision)), decision);
-}
-export function rejectTunnelRuntime(reason, retryable) {
-    if (!REASON.test(reason) || reason.length > 64)
-        throw invalidInput();
-    const decision = { decision: retryable ? "retry" : "reject", reason };
-    return new TunnelAuthorizationResponse(new TextEncoder().encode(JSON.stringify(decision)), decision);
-}
-export function parseAuthorizationRecord(encoded) { return AuthorizationRecord.parse(encoded); }
-export function parseRuntimeAuthorizationRequest(encoded) { return RuntimeAuthorizationRequest.parse(encoded); }
-function sessionWire(session) {
-    return {
-        channel_id: session.channel_id, init_expire_at_unix_seconds: session.init_expire_at_unix_s,
-        idle_timeout_seconds: session.idle_timeout_seconds, establish_timeout_seconds: session.establish_timeout_seconds,
-        rekey_prepare_timeout_seconds: session.rekey_prepare_timeout_seconds,
-        rekey_completion_timeout_seconds: session.rekey_completion_timeout_seconds,
-        max_inbound_streams: session.max_inbound_streams, e2ee_psk_base64url: session.e2ee_psk_b64u,
-        allowed_suites: session.allowed_suites, default_suite: session.default_suite, selected_features: session.selected_features,
-    };
-}
-function metadataScopes(metadata) {
-    return (metadata?.scopes ?? []).map((scope) => ({ scope: scope.name, scope_version: scope.version, critical: scope.critical, payload: scope.payload }));
-}
-function metadataCorrelation(metadata) {
-    const tags = Object.entries(metadata?.correlationTags ?? {}).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => ({ key, value }));
-    return { v: 2, tags };
-}
-function validID(value) { return /^[A-Za-z0-9._~-]{1,128}$/u.test(value); }
-function validTCPAddress(value) {
-    if (value.length === 0 || /[\s/]/u.test(value))
-        return false;
-    let host;
-    let portText;
-    if (value.startsWith("[")) {
-        const closing = value.indexOf("]");
-        if (closing < 2 || value[closing + 1] !== ":")
-            return false;
-        host = value.slice(1, closing);
-        portText = value.slice(closing + 2);
-    }
-    else {
-        const separator = value.lastIndexOf(":");
-        if (separator <= 0 || value.indexOf(":") !== separator)
-            return false;
-        host = value.slice(0, separator);
-        portText = value.slice(separator + 1);
-    }
-    if (host.length === 0 || !/^\d{1,5}$/u.test(portText))
-        return false;
-    const port = Number(portText);
-    return port >= 1 && port <= 65_535;
-}
-function validObservedText(value) { return value.length > 0 && value.length <= 512 && !/[\u0000-\u001f\u007f]/u.test(value); }
-function bytesEqual(a, b) {
-    if (a.length !== b.length)
-        return false;
-    return timingSafeEqual(a, b);
-}
-function strictObject(bytes) {
-    let value;
-    try {
-        value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
-    }
-    catch {
-        throw invalidInput();
-    }
-    if (value === null || typeof value !== "object" || Array.isArray(value))
-        throw invalidInput();
-    return value;
-}
-function assertExactKeys(value, allowed, optional = []) {
-    const allowedSet = new Set(allowed);
-    for (const key of Object.keys(value))
-        if (!allowedSet.has(key))
-            throw invalidInput();
-    for (const key of allowed)
-        if (!optional.includes(key) && !(key in value))
-            throw invalidInput();
-}
-function invalidInput() { return new ControlPlaneError("invalid_input"); }
-function issuanceFailed() { return new ControlPlaneError("issuance_failed"); }

package/dist/node/rawQuicAdapter.d.ts

@@ -1,9 +0,0 @@
-import type { ArtifactV2, CanonicalArtifactCandidateV2 } from "../v2/artifact.js";
-import type { NativeCarrierSessionV2 } from "../v2/carrier.js";
-import type { NativeRawQuicDriver } from "./nativeTransportAddon.js";
-export type RawQuicTLSOptions = Readonly<{
-    ca: string | Uint8Array | readonly (string | Uint8Array)[];
-}>;
-export declare function createNodeRawQuicClientV2(driver: NativeRawQuicDriver, candidate: CanonicalArtifactCandidateV2, artifact: ArtifactV2, tls: RawQuicTLSOptions, signal: AbortSignal, handshakeTimeoutMs?: number): Promise<NativeCarrierSessionV2>;
-export declare function normalizeCertificateChain(input: string | Uint8Array | readonly (string | Uint8Array)[]): readonly Uint8Array[];
-export declare function normalizePrivateKey(input: string | Uint8Array): Uint8Array;