@genation/bridge-peer 0.1.1 → 0.1.3

package/GenationBridgePeer.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |spec|
   spec.name = "GenationBridgePeer"
-  spec.version = "0.1.1"
+  spec.version = "0.1.3"
   spec.summary = "Native secure identity and shared Rust crypto host for Bridge peers"
   spec.license = { :type => "Apache-2.0" }
   spec.author = "Genation"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genation/bridge-peer",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Node.js, Electron, and React Native peer SDK for Genation Bridge",
   "type": "module",
   "license": "Apache-2.0",
@@ -46,7 +46,7 @@
     }
   },
   "dependencies": {
-    "@genation/bridge-contracts": "0.1.1",
+    "@genation/bridge-contracts": "0.1.3",
     "jose": "^6.2.10",
     "zod": "^4.3.6"
   },

package/src/node/crypto-core/javascript/provider.js

@@ -14,6 +14,7 @@ import { loadBridgeCryptoCore } from "./mod.js";
       return Object.freeze({
         beginHandshake: ()=>session.begin_handshake(),
         finishHandshake: (message)=>session.finish_handshake(message),
+        finishHandshakeWithPayload: (message)=>session.finish_handshake_with_payload(message),
         encrypt: (aad, plaintext)=>session.encrypt(aad, plaintext),
         decrypt: (aad, ciphertext)=>session.decrypt(aad, ciphertext),
         close: ()=>{
@@ -29,6 +30,7 @@ import { loadBridgeCryptoCore } from "./mod.js";
       let closed = false;
       return Object.freeze({
         acceptHandshake: (message)=>session.accept_handshake(message),
+        acceptHandshakeWithPayload: (message, payload)=>session.accept_handshake_with_payload(message, payload),
         encrypt: (aad, plaintext)=>session.encrypt(aad, plaintext),
         decrypt: (aad, ciphertext)=>session.decrypt(aad, ciphertext),
         close: ()=>{

package/src/node/crypto-core/pkg/wasm/genation_bridge_crypto_wasm.d.ts

@@ -27,6 +27,10 @@ export class Initiator {
      * Read handshake message two.
      */
     finish_handshake(message: Uint8Array): void;
+    /**
+     * Read handshake message two and return its authenticated payload.
+     */
+    finish_handshake_with_payload(message: Uint8Array): Uint8Array;
     /**
      * Create an invoking-peer state.
      */
@@ -43,6 +47,10 @@ export class Responder {
      * Read handshake one, write handshake two, and enter transport mode.
      */
     accept_handshake(message: Uint8Array): Uint8Array;
+    /**
+     * Read handshake one and authenticate a payload inside handshake two.
+     */
+    accept_handshake_with_payload(message: Uint8Array, payload: Uint8Array): Uint8Array;
     /**
      * Dispose session state.
      */
@@ -83,9 +91,11 @@ export interface InitOutput {
     readonly initiator_decrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
     readonly initiator_encrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
     readonly initiator_finish_handshake: (a: number, b: number, c: number) => [number, number];
+    readonly initiator_finish_handshake_with_payload: (a: number, b: number, c: number) => [number, number, number, number];
     readonly initiator_new: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
     readonly noise_profile: () => [number, number];
     readonly responder_accept_handshake: (a: number, b: number, c: number) => [number, number, number, number];
+    readonly responder_accept_handshake_with_payload: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
     readonly responder_close: (a: number) => void;
     readonly responder_decrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
     readonly responder_encrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];

package/src/node/crypto-core/pkg/wasm/genation_bridge_crypto_wasm.js

@@ -83,6 +83,22 @@ export class Initiator {
             throw takeFromExternrefTable0(ret[0]);
         }
     }
+    /**
+     * Read handshake message two and return its authenticated payload.
+     * @param {Uint8Array} message
+     * @returns {Uint8Array}
+     */
+    finish_handshake_with_payload(message) {
+        const ptr0 = passArray8ToWasm0(message, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.initiator_finish_handshake_with_payload(this.__wbg_ptr, ptr0, len0);
+        if (ret[3]) {
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        var v2 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v2;
+    }
     /**
      * Create an invoking-peer state.
      * @param {Uint8Array} prologue
@@ -137,6 +153,25 @@ export class Responder {
         wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
         return v2;
     }
+    /**
+     * Read handshake one and authenticate a payload inside handshake two.
+     * @param {Uint8Array} message
+     * @param {Uint8Array} payload
+     * @returns {Uint8Array}
+     */
+    accept_handshake_with_payload(message, payload) {
+        const ptr0 = passArray8ToWasm0(message, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(payload, wasm.__wbindgen_malloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.responder_accept_handshake_with_payload(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+        if (ret[3]) {
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        var v3 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v3;
+    }
     /**
      * Dispose session state.
      */

package/src/node/crypto-core/pkg/wasm/genation_bridge_crypto_wasm_bg.wasm.d.ts

@@ -9,9 +9,11 @@ export const initiator_close: (a: number) => void;
 export const initiator_decrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
 export const initiator_encrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
 export const initiator_finish_handshake: (a: number, b: number, c: number) => [number, number];
+export const initiator_finish_handshake_with_payload: (a: number, b: number, c: number) => [number, number, number, number];
 export const initiator_new: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
 export const noise_profile: () => [number, number];
 export const responder_accept_handshake: (a: number, b: number, c: number) => [number, number, number, number];
+export const responder_accept_handshake_with_payload: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
 export const responder_close: (a: number) => void;
 export const responder_decrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
 export const responder_encrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];

package/src/relay/runtime.js

@@ -2,7 +2,10 @@ import { buildInvocationAad, buildSessionPrologue, permitsCapability } from "@ge
 import { BridgePeerError } from "../core/mod.js";
 import { decodeBase64url, encodeBase64url, parseRelayGrantClaims } from "./encoding.js";
 import { RelayFrameChannel } from "./frame-channel.js";
+import { createUnarySessionCache } from "./unary-session-cache.js";
 const encoder = new TextEncoder();
+const unaryReuseHandshakePayload = encoder.encode("bridge.unary-reuse.v1");
+const unaryReuseSessionPrefix = "sesr1_";
 const bridgeCodes = new Set([
   "OK",
   "TARGET_OFFLINE",
@@ -23,6 +26,9 @@ const bridgeCodes = new Set([
 const newId = (prefix)=>`${prefix}_${crypto.randomUUID()}`;
 const remaining = (deadlineAt)=>Math.max(1, deadlineAt - Date.now());
 const maxStreamPlaintextChunkBytes = 48 * 1_024;
+/** Maximum number of completed direct unary sessions retained by one live peer. */ const maxIdleUnarySessions = 32;
+/** Short initiator idle window used for immediate sequential unary bursts. */ const unarySessionIdleMs = 1_000;
+/** Responder margin that remains open after the initiator stops session reuse. */ const unaryResponderIdleMs = 2_000;
 const encodeResponseMetadata = (response)=>{
   const value = Object.freeze({
     status: response.status,
@@ -118,6 +124,7 @@ const obtainGrant = async (input, identity)=>{
     throw new BridgePeerError("GRANT_FAILED");
   }
 };
+const equalBytes = (left, right)=>left.length === right.length && left.every((value, index)=>value === right[index]);
 class RelayConnection {
   #input;
   #channel;
@@ -136,6 +143,11 @@ class RelayConnection {
   #activeIncomingReaders = new Set();
   #activeResponders = new Set();
   #exposureReplacements = new Map();
+  #idleUnarySessions = createUnarySessionCache({
+    capacity: maxIdleUnarySessions,
+    idleMs: unarySessionIdleMs,
+    close: (session)=>session.machine.close()
+  });
   constructor(input){
     this.#input = input.request;
     this.#channel = input.channel;
@@ -181,39 +193,49 @@ class RelayConnection {
       ]));
   }
   async invokeUnary(input) {
-    const session = await this.#openSession(input, false, undefined, input.signal);
-    try {
+    const sessionKey = `${input.targetPeer}\u0000${input.capability}`;
+    for(let attempt = 0; attempt < 2; attempt += 1){
       const invocationId = newId("inv");
-      const header = this.#startHeader(session.context, invocationId, input, false);
-      const ciphertext = encodeBase64url(session.machine.encrypt(buildInvocationAad(header), input.payload));
-      let dispatched = false;
-      const cancel = ()=>{
-        if (dispatched) void this.#sendCancel(session, header).catch(()=>undefined);
-      };
-      input.signal?.addEventListener("abort", cancel, {
-        once: true
-      });
+      const session = this.#idleUnarySessions.take(sessionKey) ?? await this.#openSession(input, false, undefined, input.signal, true);
+      let reusable = false;
       try {
-        assertNotAborted(input.signal);
-        this.#channel.send({
-          ...header,
-          ciphertext
+        const header = this.#startHeader(session.context, invocationId, input, false);
+        const ciphertext = encodeBase64url(session.machine.encrypt(buildInvocationAad(header), input.payload));
+        let dispatched = false;
+        const cancel = ()=>{
+          if (dispatched) void this.#sendCancel(session, header).catch(()=>undefined);
+        };
+        input.signal?.addEventListener("abort", cancel, {
+          once: true
         });
-        dispatched = true;
-        if (input.signal?.aborted) cancel();
-        const terminal = await this.#channel.waitFor((frame)=>frame.type === "invoke.result" && frame.invocationId === invocationId || frame.type === "relay.error" && frame.error.correlationId === invocationId, remaining(input.deadlineAt), input.signal);
-        if (terminal.type === "relay.error") throw relayFailure(terminal);
-        const plaintext = session.machine.decrypt(buildInvocationAad(terminal), decodeBase64url(terminal.ciphertext));
-        if (terminal.outcome !== "succeeded") {
-          throw new BridgePeerError(terminal.bridgeCode);
+        try {
+          assertNotAborted(input.signal);
+          this.#channel.send({
+            ...header,
+            ciphertext
+          });
+          dispatched = true;
+          if (input.signal?.aborted) cancel();
+          const terminal = await this.#channel.waitFor((frame)=>frame.type === "invoke.result" && frame.invocationId === invocationId || frame.type === "relay.error" && frame.error.correlationId === invocationId, remaining(input.deadlineAt), input.signal);
+          if (terminal.type === "relay.error") {
+            if (attempt === 0 && terminal.error.bridgeCode === "CONNECTION_LOST" && terminal.error.retryable) continue;
+            throw relayFailure(terminal);
+          }
+          const plaintext = session.machine.decrypt(buildInvocationAad(terminal), decodeBase64url(terminal.ciphertext));
+          reusable = session.reusable;
+          if (terminal.outcome !== "succeeded") {
+            throw new BridgePeerError(terminal.bridgeCode);
+          }
+          return plaintext;
+        } finally{
+          input.signal?.removeEventListener("abort", cancel);
         }
-        return plaintext;
       } finally{
-        input.signal?.removeEventListener("abort", cancel);
+        if (reusable && !this.#closed) this.#idleUnarySessions.put(sessionKey, session);
+        else session.machine.close();
       }
-    } finally{
-      session.machine.close();
     }
+    throw new BridgePeerError("CONNECTION_LOST", true);
   }
   async invokeStream(input) {
     const session = await this.#openSession(input, true, undefined, input.signal);
@@ -434,13 +456,14 @@ class RelayConnection {
     for (const timer of this.#exposureReplacements.values())clearTimeout(timer);
     this.#exposureReplacements.clear();
     this.#releaseIncoming();
+    this.#idleUnarySessions.clear();
     this.#exposures.clear();
     this.#channel.close();
     return Promise.resolve();
   }
-  async #openSession(input, stream, expectedTargetEpoch, signal) {
+  async #openSession(input, stream, expectedTargetEpoch, signal, requestUnaryReuse = false) {
     assertNotAborted(signal);
-    const sessionId = newId("ses");
+    const sessionId = newId(requestUnaryReuse ? "sesr1" : "ses");
     this.#channel.send({
       version: "json.v1",
       type: "session.open",
@@ -474,11 +497,13 @@ class RelayConnection {
         message: encodeBase64url(machine.beginHandshake())
       });
       const second = await this.#channel.waitFor((frame)=>frame.type === "session.handshake" && frame.step === 2 && frame.context.sessionId === sessionId, remaining(input.deadlineAt), signal);
-      machine.finishHandshake(decodeBase64url(second.message));
+      const handshake = decodeBase64url(second.message);
+      const negotiatedPayload = machine.finishHandshakeWithPayload === undefined ? (machine.finishHandshake(handshake), undefined) : machine.finishHandshakeWithPayload(handshake);
       assertNotAborted(signal);
       return Object.freeze({
         context: ready.context,
-        machine
+        machine,
+        reusable: requestUnaryReuse && negotiatedPayload !== undefined && equalBytes(negotiatedPayload, unaryReuseHandshakePayload)
       });
     } catch (error) {
       machine.close();
@@ -573,7 +598,9 @@ class RelayConnection {
     this.#activeResponders.add(machine);
     try {
       const first = await this.#channel.waitFor((frame)=>frame.type === "session.handshake" && frame.step === 1 && frame.context.sessionId === incoming.context.sessionId, this.#timeoutMs);
-      const second = machine.acceptHandshake(decodeBase64url(first.message));
+      const reuseRequested = incoming.context.sessionId.startsWith(unaryReuseSessionPrefix) && machine.acceptHandshakeWithPayload !== undefined;
+      const firstMessage = decodeBase64url(first.message);
+      const second = reuseRequested ? machine.acceptHandshakeWithPayload(firstMessage, unaryReuseHandshakePayload) : machine.acceptHandshake(firstMessage);
       this.#channel.send({
         version: "json.v1",
         type: "session.handshake",
@@ -583,10 +610,19 @@ class RelayConnection {
         step: 2,
         message: encodeBase64url(second)
       });
-      const start = await this.#channel.waitFor((frame)=>frame.type === "invoke.start" && frame.sessionId === incoming.context.sessionId, this.#timeoutMs);
-      if (start.stream) {
-        await this.#handleIncomingStream(machine, exposure, start);
-      } else await this.#handleIncomingUnary(machine, exposure, start);
+      while(!this.#closed){
+        const start = await this.#channel.waitFor((frame)=>frame.type === "invoke.start" && frame.sessionId === incoming.context.sessionId, unaryResponderIdleMs);
+        const currentExposure = this.#exposures.get(incoming.capability);
+        if (currentExposure === undefined || currentExposure.stream !== start.stream) {
+          return;
+        }
+        if (start.stream) {
+          await this.#handleIncomingStream(machine, currentExposure, start);
+          return;
+        }
+        await this.#handleIncomingUnary(machine, currentExposure, start);
+        if (start.fanoutId !== undefined || !reuseRequested) return;
+      }
     } finally{
       this.#activeResponders.delete(machine);
       machine.close();
@@ -831,6 +867,7 @@ class RelayConnection {
     if (this.#heartbeatTimer !== undefined) clearTimeout(this.#heartbeatTimer);
     if (this.#renewalTimer !== undefined) clearTimeout(this.#renewalTimer);
     this.#releaseIncoming();
+    this.#idleUnarySessions.clear();
     this.#input.onDisconnect(new BridgePeerError("CONNECTION_LOST", true));
   }
   #releaseIncoming() {

package/src/relay/unary-session-cache.js

@@ -0,0 +1,51 @@
+/** One exclusive idle-value cache with bounded capacity and expiry. */ /** Creates a cache that grants one caller exclusive ownership of each stored value. */ export const createUnarySessionCache = (options)=>{
+  if (!Number.isSafeInteger(options.capacity) || options.capacity <= 0) {
+    throw new Error("invalid_unary_session_capacity");
+  }
+  if (!Number.isSafeInteger(options.idleMs) || options.idleMs <= 0) {
+    throw new Error("invalid_unary_session_idle_ms");
+  }
+  const entries = new Map();
+  let closed = false;
+  const remove = (key, expected)=>{
+    const entry = entries.get(key);
+    if (entry === undefined || expected !== undefined && entry !== expected) return;
+    entries.delete(key);
+    clearTimeout(entry.timer);
+    options.close(entry.value);
+  };
+  return Object.freeze({
+    take: (key)=>{
+      const entry = entries.get(key);
+      if (entry === undefined) return undefined;
+      entries.delete(key);
+      clearTimeout(entry.timer);
+      return entry.value;
+    },
+    put: (key, value)=>{
+      if (closed) {
+        options.close(value);
+        return;
+      }
+      remove(key);
+      while(entries.size >= options.capacity){
+        remove(entries.keys().next().value);
+      }
+      const entry = {
+        value,
+        timer: setTimeout(()=>remove(key, entry), options.idleMs)
+      };
+      entries.set(key, entry);
+    },
+    clear: ()=>{
+      if (closed) return;
+      closed = true;
+      for (const key of [
+        ...entries.keys()
+      ])remove(key);
+    },
+    get size () {
+      return entries.size;
+    }
+  });
+};