@opentunnel/client 0.1.0 → 0.2.0

package/README.md

@@ -87,6 +87,11 @@ import { create, OpenTunnelStorage } from "@opentunnel/client"
 const client = create({ store: OpenTunnelStorage.memory() })
 ```
 
+A memory store loses the tunnel's token when the process exits, and tunnels do
+not expire, so a tunnel it created can no longer be deleted. Call
+`client.tunnel.remove()` before exiting, or use the default store for tunnels
+that should outlive the process.
+
 ## Backpressure
 
 The SDK stops reading from a local socket while more than 1 MiB is queued on

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opentunnel/client",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "OpenTunnel SDK for Bun: expose local services through a blind TLS tunnel",
   "license": "MIT",
   "repository": {
@@ -28,15 +28,15 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@opentunnel/protocol": "0.0.0",
-    "@peculiar/x509": "2.0.0",
-    "effect": "4.0.0-beta.42",
-    "reflect-metadata": "0.2.2"
+    "@opentunnel/protocol": "0.2.0",
+    "effect": "4.0.0-rc.112"
   },
   "devDependencies": {
+    "@peculiar/x509": "2.0.0",
+    "@types/bun": "1.3.13",
     "@types/node": "25.5.0",
     "@typescript/native-preview": "7.0.0-dev.20260328.1",
-    "typescript": "6.0.2",
-    "@types/bun": "1.3.13"
+    "reflect-metadata": "0.2.2",
+    "typescript": "6.0.2"
   }
 }

package/src/effect/api.ts

@@ -1,4 +1,4 @@
-import { Effect, Layer, ServiceMap } from "effect";
+import { Effect, Layer, Context } from "effect";
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";
 import { HttpApiClient } from "effect/unstable/httpapi";
 import { Api } from "@opentunnel/protocol/api/api";
@@ -11,7 +11,7 @@ interface OpenTunnelApi {
   readonly authorized: (token: Tunnel.Token) => Effect.Effect<Client>;
 }
 
-export class OpenTunnelApiClient extends ServiceMap.Service<OpenTunnelApiClient, OpenTunnelApi>()(
+export class OpenTunnelApiClient extends Context.Service<OpenTunnelApiClient, OpenTunnelApi>()(
   "@opentunnel/client/OpenTunnelApiClient",
 ) {
   static layer(options: { readonly api: URL | string }) {

package/src/effect/client.ts

@@ -1,12 +1,8 @@
-import "reflect-metadata";
-import { Cause, Effect, Layer, Queue, ServiceMap, Stream } from "effect";
-import {
-  Pkcs10CertificateRequestGenerator,
-  SubjectAlternativeNameExtension,
-} from "@peculiar/x509";
+import { Cause, Effect, Layer, Queue, Context, Stream } from "effect";
 import { CSR } from "@opentunnel/protocol/csr";
 import { Tunnel } from "@opentunnel/protocol/tunnel";
 import { OpenTunnelApiClient } from "./api.js";
+import { certificateRequest } from "./csr.js";
 import { OpenTunnelClientError } from "./errors.js";
 import { OpenTunnelStorage, type OpenTunnelStorage as Storage } from "./storage.js";
 import type {
@@ -37,7 +33,7 @@ export interface OpenTunnelClientOptions {
   readonly storage?: Storage;
 }
 
-export class OpenTunnelClient extends ServiceMap.Service<
+export class OpenTunnelClient extends Context.Service<
   OpenTunnelClient,
   OpenTunnelEffectClient
 >()("@opentunnel/client/OpenTunnelClient") {
@@ -60,10 +56,10 @@ export class OpenTunnelClient extends ServiceMap.Service<
           readonly pending: OpenTunnelPendingIdentity;
           readonly onProgress?: (stage: OpenTunnelProvisionStage) => void;
         }) {
-          const authorized = yield* api.authorized(Tunnel.Token.makeUnsafe(options.pending.token));
+          const authorized = yield* api.authorized(Tunnel.Token.make(options.pending.token));
           yield* Effect.sync(() => options.onProgress?.("requesting-certificate"));
           yield* authorized.tunnel["tunnel.bindCertificate"]({
-            params: { id: Tunnel.ID.makeUnsafe(options.pending.id) },
+            params: { id: Tunnel.ID.make(options.pending.id) },
             payload: { csr: options.pending.csr as CSR.Raw },
           }).pipe(
             // A resumed provision may already have an issuance in flight.
@@ -75,7 +71,7 @@ export class OpenTunnelClient extends ServiceMap.Service<
             while (true) {
               yield* Effect.sync(() => options.onProgress?.("waiting-certificate"));
               const value = yield* authorized.tunnel["tunnel.getCertificate"]({
-                params: { id: Tunnel.ID.makeUnsafe(options.pending.id) },
+                params: { id: Tunnel.ID.make(options.pending.id) },
               }).pipe(
                 Effect.mapError((cause) => clientError("Failed to read certificate", cause)),
               );
@@ -122,18 +118,7 @@ export class OpenTunnelClient extends ServiceMap.Service<
           });
           yield* Effect.sync(() => options.onProgress?.("generating-csr"));
           const csr = yield* Effect.tryPromise({
-            try: () =>
-              Pkcs10CertificateRequestGenerator.create({
-                name: `CN=${options.hostname}`,
-                extensions: [
-                  new SubjectAlternativeNameExtension([
-                    { type: "dns", value: options.hostname },
-                    { type: "dns", value: `*.${options.hostname}` },
-                  ]),
-                ],
-                signingAlgorithm: { name: "ECDSA", hash: "SHA-256" },
-                keys,
-              }),
+            try: () => certificateRequest(options.hostname, keys),
             catch: (cause) => clientError("Failed to generate certificate request", cause),
           });
           const exported = yield* Effect.tryPromise({
@@ -145,7 +130,7 @@ export class OpenTunnelClient extends ServiceMap.Service<
             hostname: options.hostname,
             token: options.token,
             privateKey: privateKeyPem(exported),
-            csr: csr.toString(),
+            csr,
           };
           yield* storage.savePending(options.profile, pending);
           return yield* completePending({
@@ -191,9 +176,9 @@ export class OpenTunnelClient extends ServiceMap.Service<
         ) {
           const existing = yield* get(input);
           if (!existing) return yield* create(input);
-          const authorized = yield* api.authorized(Tunnel.Token.makeUnsafe(existing.token));
+          const authorized = yield* api.authorized(Tunnel.Token.make(existing.token));
           const certificate = yield* authorized.tunnel["tunnel.getCertificate"]({
-            params: { id: Tunnel.ID.makeUnsafe(existing.id) },
+            params: { id: Tunnel.ID.make(existing.id) },
           }).pipe(
             Effect.mapError((cause) => clientError("Failed to read certificate", cause)),
           );
@@ -212,9 +197,9 @@ export class OpenTunnelClient extends ServiceMap.Service<
           if (state.type !== "failed") return existing;
           return yield* provision({
             profile: profileName(input),
-            id: Tunnel.ID.makeUnsafe(existing.id),
+            id: Tunnel.ID.make(existing.id),
             hostname: existing.hostname,
-            token: Tunnel.Token.makeUnsafe(existing.token),
+            token: Tunnel.Token.make(existing.token),
           });
         });
 
@@ -250,9 +235,9 @@ export class OpenTunnelClient extends ServiceMap.Service<
               const profile = profileName(input);
               const identity = yield* storage.load(profile);
               if (!identity) return;
-              const authorized = yield* api.authorized(Tunnel.Token.makeUnsafe(identity.token));
+              const authorized = yield* api.authorized(Tunnel.Token.make(identity.token));
               yield* authorized.tunnel["tunnel.remove"]({
-                params: { id: Tunnel.ID.makeUnsafe(identity.id) },
+                params: { id: Tunnel.ID.make(identity.id) },
               }).pipe(
                 Effect.mapError((cause) => clientError("Failed to remove tunnel", cause)),
               );

package/src/effect/csr.ts

@@ -0,0 +1,85 @@
+// A PKCS#10 certificate request for a tunnel: CN and SANs for the hostname and its wildcard, signed with the
+// tunnel's P-256 key. Encoded here with WebCrypto rather than an X.509 library, so the SDK carries no ASN.1
+// dependency whose schema registry can be split across duplicate installs in a consumer's tree.
+
+const der = (tag: number, ...contents: Uint8Array[]) => {
+  const body = concat(contents);
+  const length =
+    body.length < 0x80
+      ? [body.length]
+      : (() => {
+          const bytes: number[] = [];
+          for (let n = body.length; n > 0; n >>= 8) bytes.unshift(n & 0xff);
+          return [0x80 | bytes.length, ...bytes];
+        })();
+  return concat([new Uint8Array([tag, ...length]), body]);
+};
+
+const concat = (parts: readonly Uint8Array[]) => {
+  const out = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+};
+
+const sequence = (...contents: Uint8Array[]) => der(0x30, ...contents);
+const set = (...contents: Uint8Array[]) => der(0x31, ...contents);
+const utf8 = (value: string) => der(0x0c, new TextEncoder().encode(value));
+const dnsName = (value: string) => der(0x82, new TextEncoder().encode(value));
+
+const oid = (dotted: string) => {
+  const [first, second, ...rest] = dotted.split(".").map(Number);
+  const bytes = [first! * 40 + second!];
+  for (const arc of rest) {
+    const encoded = [arc & 0x7f];
+    for (let n = arc >> 7; n > 0; n >>= 7) encoded.unshift((n & 0x7f) | 0x80);
+    bytes.push(...encoded);
+  }
+  return der(0x06, new Uint8Array(bytes));
+};
+
+/** A DER INTEGER from unsigned big-endian bytes: leading zeros dropped, a zero prepended if the top bit is set. */
+const integer = (bytes: Uint8Array) => {
+  let start = 0;
+  while (start < bytes.length - 1 && bytes[start] === 0) start++;
+  const trimmed = bytes.subarray(start);
+  return der(0x02, trimmed[0]! & 0x80 ? concat([new Uint8Array([0]), trimmed]) : trimmed);
+};
+
+const COMMON_NAME = "2.5.4.3";
+const EXTENSION_REQUEST = "1.2.840.113549.1.9.14";
+const SUBJECT_ALT_NAME = "2.5.29.17";
+const ECDSA_WITH_SHA256 = "1.2.840.10045.4.3.2";
+
+export async function certificateRequest(hostname: string, keys: CryptoKeyPair): Promise<string> {
+  const publicKey = new Uint8Array(await crypto.subtle.exportKey("spki", keys.publicKey));
+  const info = sequence(
+    der(0x02, new Uint8Array([0])),
+    sequence(set(sequence(oid(COMMON_NAME), utf8(hostname)))),
+    publicKey,
+    der(
+      0xa0,
+      sequence(
+        oid(EXTENSION_REQUEST),
+        set(
+          sequence(
+            sequence(oid(SUBJECT_ALT_NAME), der(0x04, sequence(dnsName(hostname), dnsName(`*.${hostname}`)))),
+          ),
+        ),
+      ),
+    ),
+  );
+  // WebCrypto signs ECDSA as r‖s; X.509 wants SEQUENCE { r INTEGER, s INTEGER }.
+  const raw = new Uint8Array(
+    await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, keys.privateKey, info),
+  );
+  const signature = sequence(integer(raw.subarray(0, 32)), integer(raw.subarray(32)));
+  const request = sequence(info, sequence(oid(ECDSA_WITH_SHA256)), der(0x03, new Uint8Array([0]), signature));
+  const base64 = Buffer.from(request)
+    .toString("base64")
+    .replace(/.{1,64}/g, "$&\n");
+  return `-----BEGIN CERTIFICATE REQUEST-----\n${base64}-----END CERTIFICATE REQUEST-----`;
+}

package/src/effect/errors.ts

@@ -1,13 +1,13 @@
 import { Schema } from "effect";
 
-export class OpenTunnelClientError extends Schema.TaggedErrorClass<OpenTunnelClientError>()(
+export class OpenTunnelClientError extends Schema.TaggedError<OpenTunnelClientError>()(
   "OpenTunnelClientError",
-  { message: Schema.String, cause: Schema.optional(Schema.Defect) },
+  { message: Schema.String, cause: Schema.optional(Schema.Defect()) },
 ) {}
 
-export class OpenTunnelStorageError extends Schema.TaggedErrorClass<OpenTunnelStorageError>()(
+export class OpenTunnelStorageError extends Schema.TaggedError<OpenTunnelStorageError>()(
   "OpenTunnelStorageError",
-  { message: Schema.String, cause: Schema.optional(Schema.Defect) },
+  { message: Schema.String, cause: Schema.optional(Schema.Defect()) },
 ) {}
 
 export type OpenTunnelError = OpenTunnelClientError | OpenTunnelStorageError;

package/src/promise/client.ts

@@ -78,7 +78,7 @@ export function create(options: OpenTunnelClientOptions = {}): OpenTunnelPromise
   const runtime = ManagedRuntime.make(OpenTunnelClient.layer(effectOptions));
   const withClient = <A, E>(
     f: (client: OpenTunnelClient["Service"]) => Effect.Effect<A, E>,
-  ) => runtime.runPromise(Effect.flatMap(OpenTunnelClient.asEffect(), f));
+  ) => runtime.runPromise(Effect.flatMap(OpenTunnelClient, f));
 
   return {
     profile: { list: () => withClient((client) => client.profile.list()) },
@@ -95,7 +95,7 @@ export function create(options: OpenTunnelClientOptions = {}): OpenTunnelPromise
         const closeScope = () => runtime.runPromise(Scope.close(scope, Exit.void));
         const connection = await runtime
           .runPromise(
-            Effect.flatMap(OpenTunnelClient.asEffect(), (client) => client.tunnel.connect(input)).pipe(
+            Effect.flatMap(OpenTunnelClient, (client) => client.tunnel.connect(input)).pipe(
               Effect.provideService(Scope.Scope, scope),
             ),
           )