@gjsify/tls 0.23.0 → 0.24.2

package/lib/esm/browser.js

@@ -0,0 +1,2 @@
+import"./_virtual/_rolldown/runtime.js";import{checkServerIdentity as e}from"./internal/hostname.js";const t=`browser`;function callerFrame(e){if(!e)return;let t=[];for(let n of e.split(`
+`).slice(1)){let e=n.trim();if(e&&!(e.includes(`unsupported`)||e.includes(`callerFrame`))&&(t.push(e.replace(/^at\s+/,``)),t.length===2))break}return t[1]??t[0]}function unsupported(e){let n=callerFrame(Error().stack),r=Error(`[@gjsify/tls/${t}] tls.${e} is not available on the ${t} platform: a user agent terminates TLS below the JavaScript layer — there is no socket to wrap and no secure context to hand back.${n?` Called from ${n}.`:``}`);throw r.code=`ENOTSUP`,r.errno=-45,r.syscall=e,r.gjsifyModule=`tls`,r.gjsifyRuntime=t,n!==void 0&&(r.gjsifyImporter=n),r}const n=`TLSv1.2`,r=`TLSv1.3`,i=`TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384`;function getCiphers(){return[]}const a=[],o={GOOD:0,REVOKED:1,UNKNOWN:2},s={SUCCESSFUL:0,MALFORMED_REQUEST:1,INTERNAL_ERROR:2,TRY_LATER:3,SIG_REQUIRED:5,UNAUTHORIZED:6},c={TLS_UNIQUE:0,TLS_SERVER_END_POINT:1,TLS_EXPORTER:2};function hasOcspSupport(){return!1}function hasTlsSessionAccess(){return!1}function parseOcspResponse(e){return unsupported(`parseOcspResponse`)}var TLSSocket=class{constructor(){unsupported(`TLSSocket`)}},TLSServer=class{constructor(){unsupported(`TLSServer`)}};function connect(...e){return unsupported(`connect`)}function createServer(...e){return unsupported(`createServer`)}function createSecureContext(...e){return unsupported(`createSecureContext`)}const l={DEFAULT_MIN_VERSION:n,DEFAULT_MAX_VERSION:r,DEFAULT_CIPHERS:i,checkServerIdentity:e,getCiphers,rootCertificates:a,OcspCertStatus:o,OcspResponseStatus:s,TlsChannelBindingType:c,hasOcspSupport,hasTlsSessionAccess,parseOcspResponse,TLSSocket,TLSServer,Server:TLSServer,connect,createServer,createSecureContext};export{i as DEFAULT_CIPHERS,r as DEFAULT_MAX_VERSION,n as DEFAULT_MIN_VERSION,o as OcspCertStatus,s as OcspResponseStatus,TLSServer as Server,TLSServer,TLSSocket,c as TlsChannelBindingType,e as checkServerIdentity,connect,createSecureContext,createServer,l as default,getCiphers,hasOcspSupport,hasTlsSessionAccess,parseOcspResponse,a as rootCertificates};

package/lib/esm/index.js

@@ -1 +1 @@
-import"./_virtual/_rolldown/runtime.js";import{TlsChannelBindingType as e,hasTlsSessionAccess as t}from"./session-access.js";import{TLSSocket as n}from"./tls-socket.js";import{createSecureContext as r}from"./secure-context.js";import{connect as i}from"./connect.js";import{checkServerIdentity as a}from"./internal/hostname.js";import{TLSServer as o,createServer as s}from"./tls-server.js";import{OcspCertStatus as c,OcspResponseStatus as l,hasOcspSupport as u,parseOcspResponse as d}from"./ocsp.js";const f=`TLSv1.2`,p=`TLSv1.3`,m=`TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384`;function getCiphers(){return[`aes-128-gcm`,`aes-256-gcm`,`chacha20-poly1305`,`aes-128-cbc`,`aes-256-cbc`]}const h=[],g={TLSSocket:n,TLSServer:o,Server:o,connect:i,createServer:s,createSecureContext:r,checkServerIdentity:a,getCiphers,rootCertificates:h,DEFAULT_MIN_VERSION:f,DEFAULT_MAX_VERSION:p,DEFAULT_CIPHERS:m,parseOcspResponse:d,hasOcspSupport:u,OcspCertStatus:c,OcspResponseStatus:l,hasTlsSessionAccess:t,TlsChannelBindingType:e};export{m as DEFAULT_CIPHERS,p as DEFAULT_MAX_VERSION,f as DEFAULT_MIN_VERSION,c as OcspCertStatus,l as OcspResponseStatus,o as Server,o as TLSServer,n as TLSSocket,e as TlsChannelBindingType,a as checkServerIdentity,i as connect,r as createSecureContext,s as createServer,g as default,getCiphers,u as hasOcspSupport,t as hasTlsSessionAccess,d as parseOcspResponse,h as rootCertificates};
+import"./_virtual/_rolldown/runtime.js";import{checkServerIdentity as e}from"./internal/hostname.js";import{TlsChannelBindingType as t,hasTlsSessionAccess as n}from"./session-access.js";import{TLSSocket as r}from"./tls-socket.js";import{createSecureContext as i}from"./secure-context.js";import{connect as a}from"./connect.js";import{TLSServer as o,createServer as s}from"./tls-server.js";import{OcspCertStatus as c,OcspResponseStatus as l,hasOcspSupport as u,parseOcspResponse as d}from"./ocsp.js";const f=`TLSv1.2`,p=`TLSv1.3`,m=`TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384`;function getCiphers(){return[`aes-128-gcm`,`aes-256-gcm`,`chacha20-poly1305`,`aes-128-cbc`,`aes-256-cbc`]}const h=[],g={TLSSocket:r,TLSServer:o,Server:o,connect:a,createServer:s,createSecureContext:i,checkServerIdentity:e,getCiphers,rootCertificates:h,DEFAULT_MIN_VERSION:f,DEFAULT_MAX_VERSION:p,DEFAULT_CIPHERS:m,parseOcspResponse:d,hasOcspSupport:u,OcspCertStatus:c,OcspResponseStatus:l,hasTlsSessionAccess:n,TlsChannelBindingType:t};export{m as DEFAULT_CIPHERS,p as DEFAULT_MAX_VERSION,f as DEFAULT_MIN_VERSION,c as OcspCertStatus,l as OcspResponseStatus,o as Server,o as TLSServer,r as TLSSocket,t as TlsChannelBindingType,e as checkServerIdentity,a as connect,i as createSecureContext,s as createServer,g as default,getCiphers,u as hasOcspSupport,n as hasTlsSessionAccess,d as parseOcspResponse,h as rootCertificates};

package/lib/esm/tls-server.js

@@ -1 +1 @@
-import"./_virtual/_rolldown/runtime.js";import{TLSSocket as e}from"./tls-socket.js";import{createSecureContext as t}from"./secure-context.js";import{checkHostMatch as n,splitHost as r}from"./internal/hostname.js";import{parseClientHelloSni as i}from"./internal/sni-parser.js";import a from"@girs/gio-2.0";import o from"@girs/glib-2.0";import{Server as s}from"node:net";import{createNodeError as c,deferEmit as l}from"@gjsify/utils/core";var TLSServer=class extends s{_tlsCertificate=null;_tlsOptions;_sniContexts=new Map;_secureContext;constructor(e,n){super(),this._tlsOptions=e??{},this._secureContext=t(this._tlsOptions),this._tlsCertificate=this._secureContext.certificate,n&&this.on(`secureConnection`,n),this._tlsOptions.cert&&!this._tlsCertificate&&l(this,`error`,c(Error(`Failed to parse TLS certificate`),`createServer`,{}))}addContext(e,n){try{let r=t(n);this._sniContexts.set(e.toLowerCase(),r)}catch(e){this.emit(`error`,c(e,`addContext`,{}))}}_resolveSniContext(e,t){let i=this._secureContext;if(!e){t(i);return}let a=e.toLowerCase(),o=this._sniContexts.get(a);if(o){t(o);return}let s=r(a);for(let[e,r]of this._sniContexts)if(n(s,e)){t(r);return}if(this._tlsOptions.SNICallback)try{this._tlsOptions.SNICallback(e,(e,n)=>{if(e||!n){t(i);return}t(n)});return}catch{t(i);return}t(i)}listen(...e){return this.on(`connection`,e=>{this._upgradeTls(e)}),super.listen(...e)}_upgradeTls(t){let n=t._connection;if(!n){let e=Error(`Cannot upgrade socket: no underlying connection`);this.emit(`tlsClientError`,e,t),t.destroy();return}if(!this._tlsCertificate&&this._sniContexts.size===0&&!this._tlsOptions.SNICallback){let e=Error(`TLS server has no certificate configured`);this.emit(`tlsClientError`,e,t),t.destroy();return}let r=n,s=r.get_input_stream(),l=r.get_output_stream(),u=a.BufferedInputStream.new_sized(s,4096);u.fill_async(4096,o.PRIORITY_DEFAULT,null,(n,r)=>{let s=null;try{u.fill_finish(r),s=i(u.peek_buffer())}catch{}this._resolveSniContext(s,n=>{let r=n.certificate??this._tlsCertificate;if(!r){let e=Error(`SNI resolution returned no certificate`);this.emit(`tlsClientError`,e,t),t.destroy();return}try{let i=new a.SimpleIOStream({inputStream:u,outputStream:l}),s=a.TlsServerConnection.new(i,r);this._tlsOptions.requestCert?s.authenticationMode=this._tlsOptions.rejectUnauthorized===!1?a.TlsAuthenticationMode.REQUESTED:a.TlsAuthenticationMode.REQUIRED:s.authenticationMode=a.TlsAuthenticationMode.NONE;let d=!!this._tlsOptions.requestCert&&this._tlsOptions.rejectUnauthorized!==!1,f=this._secureContext.caCertificates;if(s.connect(`accept-certificate`,(e,t,n)=>{if(!d)return!0;if(f.length===0)return!1;for(let e of f)try{if(t.verify(null,e)===a.TlsCertificateFlags.NO_FLAGS)return!0}catch{}return!1}),this._tlsOptions.ALPNProtocols&&this._tlsOptions.ALPNProtocols.length>0)try{s.set_advertised_protocols(this._tlsOptions.ALPNProtocols)}catch{}let p=new a.Cancellable;s.handshake_async(o.PRIORITY_DEFAULT,p,(r,i)=>{try{s.handshake_finish(i);let t=new e;t.encrypted=!0,t.authorized=!0,t._secureContext=n,t._setupTlsStreams(s),t.alpnProtocol=t.getAlpnProtocol(),t._startReading(),this.emit(`secureConnection`,t)}catch(e){let n=c(e,`handshake`,{});this.emit(`tlsClientError`,n,t),t.destroy()}})}catch(e){let n=c(e,`tls_wrap`,{});this.emit(`tlsClientError`,n,t),t.destroy()}})})}};function createServer(e,t){return typeof e==`function`?new TLSServer(void 0,e):new TLSServer(e,t)}export{TLSServer,createServer};
+import"./_virtual/_rolldown/runtime.js";import{checkHostMatch as e,splitHost as t}from"./internal/hostname.js";import{TLSSocket as n}from"./tls-socket.js";import{createSecureContext as r}from"./secure-context.js";import{parseClientHelloSni as i}from"./internal/sni-parser.js";import a from"@girs/gio-2.0";import o from"@girs/glib-2.0";import{Server as s}from"node:net";import{createNodeError as c,deferEmit as l}from"@gjsify/utils/core";var TLSServer=class extends s{_tlsCertificate=null;_tlsOptions;_sniContexts=new Map;_secureContext;constructor(e,t){super(),this._tlsOptions=e??{},this._secureContext=r(this._tlsOptions),this._tlsCertificate=this._secureContext.certificate,t&&this.on(`secureConnection`,t),this._tlsOptions.cert&&!this._tlsCertificate&&l(this,`error`,c(Error(`Failed to parse TLS certificate`),`createServer`,{}))}addContext(e,t){try{let n=r(t);this._sniContexts.set(e.toLowerCase(),n)}catch(e){this.emit(`error`,c(e,`addContext`,{}))}}_resolveSniContext(n,r){let i=this._secureContext;if(!n){r(i);return}let a=n.toLowerCase(),o=this._sniContexts.get(a);if(o){r(o);return}let s=t(a);for(let[t,n]of this._sniContexts)if(e(s,t)){r(n);return}if(this._tlsOptions.SNICallback)try{this._tlsOptions.SNICallback(n,(e,t)=>{if(e||!t){r(i);return}r(t)});return}catch{r(i);return}r(i)}listen(...e){return this.on(`connection`,e=>{this._upgradeTls(e)}),super.listen(...e)}_upgradeTls(e){let t=e._connection;if(!t){let t=Error(`Cannot upgrade socket: no underlying connection`);this.emit(`tlsClientError`,t,e),e.destroy();return}if(!this._tlsCertificate&&this._sniContexts.size===0&&!this._tlsOptions.SNICallback){let t=Error(`TLS server has no certificate configured`);this.emit(`tlsClientError`,t,e),e.destroy();return}let r=t,s=r.get_input_stream(),l=r.get_output_stream(),u=a.BufferedInputStream.new_sized(s,4096);u.fill_async(4096,o.PRIORITY_DEFAULT,null,(t,r)=>{let s=null;try{u.fill_finish(r),s=i(u.peek_buffer())}catch{}this._resolveSniContext(s,t=>{let r=t.certificate??this._tlsCertificate;if(!r){let t=Error(`SNI resolution returned no certificate`);this.emit(`tlsClientError`,t,e),e.destroy();return}try{let i=new a.SimpleIOStream({inputStream:u,outputStream:l}),s=a.TlsServerConnection.new(i,r);this._tlsOptions.requestCert?s.authenticationMode=this._tlsOptions.rejectUnauthorized===!1?a.TlsAuthenticationMode.REQUESTED:a.TlsAuthenticationMode.REQUIRED:s.authenticationMode=a.TlsAuthenticationMode.NONE;let d=!!this._tlsOptions.requestCert&&this._tlsOptions.rejectUnauthorized!==!1,f=this._secureContext.caCertificates;if(s.connect(`accept-certificate`,(e,t,n)=>{if(!d)return!0;if(f.length===0)return!1;for(let e of f)try{if(t.verify(null,e)===a.TlsCertificateFlags.NO_FLAGS)return!0}catch{}return!1}),this._tlsOptions.ALPNProtocols&&this._tlsOptions.ALPNProtocols.length>0)try{s.set_advertised_protocols(this._tlsOptions.ALPNProtocols)}catch{}let p=new a.Cancellable;s.handshake_async(o.PRIORITY_DEFAULT,p,(r,i)=>{try{s.handshake_finish(i);let e=new n;e.encrypted=!0,e.authorized=!0,e._secureContext=t,e._setupTlsStreams(s),e.alpnProtocol=e.getAlpnProtocol(),e._startReading(),this.emit(`secureConnection`,e)}catch(t){let n=c(t,`handshake`,{});this.emit(`tlsClientError`,n,e),e.destroy()}})}catch(t){let n=c(t,`tls_wrap`,{});this.emit(`tlsClientError`,n,e),e.destroy()}})})}};function createServer(e,t){return typeof e==`function`?new TLSServer(void 0,e):new TLSServer(e,t)}export{TLSServer,createServer};

package/lib/types/browser.d.ts

@@ -0,0 +1,109 @@
+export declare const DEFAULT_MIN_VERSION = "TLSv1.2";
+export declare const DEFAULT_MAX_VERSION = "TLSv1.3";
+export declare const DEFAULT_CIPHERS = "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384";
+/**
+ * Pure RFC 6125 §6.4.3 hostname matching — identical on every runtime, so the
+ * browser entry uses the SAME implementation as the root entry instead of a
+ * stub. (`internal/hostname.ts` takes one type-only import and no platform
+ * dependency; see its header.)
+ */
+export { checkServerIdentity } from './internal/hostname.js';
+/**
+ * A browser exposes no TLS cipher list to JavaScript. Empty is the honest
+ * answer, not a placeholder — the UA negotiates ciphers below this layer.
+ */
+export declare function getCiphers(): string[];
+/**
+ * A browser exposes no trust store to JavaScript. Empty matches the GJS root
+ * entry, which also cannot enumerate the system store.
+ */
+export declare const rootCertificates: string[];
+/** Symbolic OCSP cert-status values per RFC 6960 §4.2.1. */
+export declare const OcspCertStatus: {
+    readonly GOOD: 0;
+    readonly REVOKED: 1;
+    readonly UNKNOWN: 2;
+};
+export type OcspCertStatus = (typeof OcspCertStatus)[keyof typeof OcspCertStatus];
+/** Symbolic OCSP responseStatus values per RFC 6960 §4.2.1. */
+export declare const OcspResponseStatus: {
+    readonly SUCCESSFUL: 0;
+    readonly MALFORMED_REQUEST: 1;
+    readonly INTERNAL_ERROR: 2;
+    readonly TRY_LATER: 3;
+    readonly SIG_REQUIRED: 5;
+    readonly UNAUTHORIZED: 6;
+};
+export type OcspResponseStatus = (typeof OcspResponseStatus)[keyof typeof OcspResponseStatus];
+/** Symbolic channel-binding type per RFC 5929 / RFC 9266. */
+export declare const TlsChannelBindingType: {
+    readonly TLS_UNIQUE: 0;
+    readonly TLS_SERVER_END_POINT: 1;
+    readonly TLS_EXPORTER: 2;
+};
+export type TlsChannelBindingType = (typeof TlsChannelBindingType)[keyof typeof TlsChannelBindingType];
+/**
+ * `false` on the browser platform — the OCSP bridge is a GJS-only Vala
+ * prebuild. Callers gate on this exactly as they do on Node.
+ */
+export declare function hasOcspSupport(): boolean;
+/**
+ * `false` on the browser platform — there is no `gnutls_session_t` to reach.
+ * Same contract as on Node / a GnuTLS-less build.
+ */
+export declare function hasTlsSessionAccess(): boolean;
+/**
+ * Parse a DER-encoded OCSP response. Throws when OCSP support is unavailable —
+ * the root entry's documented contract for an ungated call. Gate with
+ * `hasOcspSupport()`.
+ */
+export declare function parseOcspResponse(_bytes: Uint8Array): never;
+/** A TLS client socket. Nothing below this layer is reachable; throws `ENOTSUP`. */
+export declare class TLSSocket {
+    constructor();
+}
+/** A TLS listening socket. A browser cannot accept connections; throws `ENOTSUP`. */
+export declare class TLSServer {
+    constructor();
+}
+export { TLSServer as Server };
+export declare function connect(..._args: unknown[]): TLSSocket;
+export declare function createServer(..._args: unknown[]): TLSServer;
+export declare function createSecureContext(..._args: unknown[]): never;
+import { checkServerIdentity as _checkServerIdentity } from './internal/hostname.js';
+declare const tlsDefault: {
+    DEFAULT_MIN_VERSION: string;
+    DEFAULT_MAX_VERSION: string;
+    DEFAULT_CIPHERS: string;
+    checkServerIdentity: typeof _checkServerIdentity;
+    getCiphers: typeof getCiphers;
+    rootCertificates: string[];
+    OcspCertStatus: {
+        readonly GOOD: 0;
+        readonly REVOKED: 1;
+        readonly UNKNOWN: 2;
+    };
+    OcspResponseStatus: {
+        readonly SUCCESSFUL: 0;
+        readonly MALFORMED_REQUEST: 1;
+        readonly INTERNAL_ERROR: 2;
+        readonly TRY_LATER: 3;
+        readonly SIG_REQUIRED: 5;
+        readonly UNAUTHORIZED: 6;
+    };
+    TlsChannelBindingType: {
+        readonly TLS_UNIQUE: 0;
+        readonly TLS_SERVER_END_POINT: 1;
+        readonly TLS_EXPORTER: 2;
+    };
+    hasOcspSupport: typeof hasOcspSupport;
+    hasTlsSessionAccess: typeof hasTlsSessionAccess;
+    parseOcspResponse: typeof parseOcspResponse;
+    TLSSocket: typeof TLSSocket;
+    TLSServer: typeof TLSServer;
+    Server: typeof TLSServer;
+    connect: typeof connect;
+    createServer: typeof createServer;
+    createSecureContext: typeof createSecureContext;
+};
+export default tlsDefault;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/tls",
-    "version": "0.23.0",
+    "version": "0.24.2",
     "description": "Node.js tls module for Gjs",
     "type": "module",
     "module": "lib/esm/index.js",
@@ -9,6 +9,10 @@
         ".": {
             "types": "./lib/types/index.d.ts",
             "default": "./lib/esm/index.js"
+        },
+        "./browser": {
+            "types": "./lib/types/browser.d.ts",
+            "default": "./lib/esm/browser.js"
         }
     },
     "files": [
@@ -33,17 +37,17 @@
         "tls"
     ],
     "devDependencies": {
-        "@gjsify/cli": "^0.23.0",
-        "@gjsify/unit": "^0.23.0",
+        "@gjsify/cli": "^0.24.2",
+        "@gjsify/unit": "^0.24.2",
         "@types/node": "^25.9.2",
         "typescript": "^6.0.3"
     },
     "dependencies": {
         "@girs/gio-2.0": "^4.1.0",
         "@girs/glib-2.0": "^4.1.0",
-        "@gjsify/net": "^0.23.0",
-        "@gjsify/tls-native": "^0.23.0",
-        "@gjsify/utils": "^0.23.0"
+        "@gjsify/net": "^0.24.2",
+        "@gjsify/tls-native": "^0.24.2",
+        "@gjsify/utils": "^0.24.2"
     },
     "gjsify": {
         "runtimes": {