@peers-app/peers-sdk 0.27.3 → 0.27.5

package/dist/device/connection.js

@@ -14,12 +14,10 @@ const socket_type_1 = require("./socket.type");
  * Authenticated RPC connection between two Peers devices.
  *
  * The handshake (`doHandshake` on the client, `completeHandshake` on the
- * server) authenticates both identities with signed, boxed messages. When both
- * sockets support it, the handshake also agrees on per-connection frame-cipher
- * keys (`frame-cipher.ts`) and arms the socket, after which every frame on the
- * wire is sealed and the legacy per-message sign+box envelope is skipped.
- * Against a peer that does not advertise `frameCrypto` the connection falls
- * back to the legacy behaviour and logs a warning.
+ * server) authenticates both identities with signed, boxed messages and agrees
+ * on per-connection frame-cipher keys (`frame-cipher.ts`), then arms the
+ * socket: every frame after the handshake is sealed. A peer that does not
+ * offer frame encryption (a build before 0.25.7) is refused.
  */
 class Connection {
     localDevice;
@@ -32,23 +30,9 @@ class Connection {
         publicKey: "",
         publicBoxKey: "",
     };
-    /**
-     * @deprecated Legacy transport classification, only consulted when the frame
-     * cipher is not armed. Removed once legacy peers are no longer supported.
-     */
-    secureLocal = false;
-    /** @deprecated See {@link Connection.secureLocal}. */
-    secureRemote = false;
-    /**
-     * Legacy per-message encryption override. Ignored once the frame cipher is
-     * armed. `"dont-encrypt-traffic-after-handshake"` is honoured only under
-     * `NODE_ENV=test`.
-     * @deprecated Removed with the legacy path.
-     */
-    overrideEncryption;
     /** Trust assigned to the remote identity once the handshake completes. */
     trustLevel = socket_type_1.TrustLevel.Unknown;
-    /** Server-side hook fired shortly after a successful handshake. */
+    /** Server-side hook fired shortly after the successful handshake reply has been sent. */
     onHandshakeComplete;
     /** RPC timeout for {@link Connection.emit}. */
     timeoutMs = 60_000; // 60 seconds
@@ -66,6 +50,8 @@ class Connection {
     pendingClientHandshake;
     /** Server side: keys to arm for sending right after the handshake response frame. */
     pendingSendArm;
+    /** Bumped by every {@link Connection.reset}, so a handshake can tell it was cut short. */
+    handshakeGeneration = 0;
     constructor(socket, localDevice, localDeviceServerAddresses, getTrustLevel = () => Promise.resolve(socket_type_1.TrustLevel.Unknown)) {
         this.localDevice = localDevice;
         this.localDeviceServerAddresses = localDeviceServerAddresses;
@@ -76,7 +62,7 @@ class Connection {
         if (!socket.id) {
             socket.id = (0, utils_1.newid)();
         }
-        // Streams bypass RPC verification; hold them until the handshake decides.
+        // Stream frames bypass RPC verification; only sealed ones may reach a Connection.
         socket.setPlaintextStreamsAllowed?.(false);
         // Only the server side of a connection should expose these methods
         this.exposeRPC("close", () => {
@@ -100,10 +86,6 @@ class Connection {
             // carries the server's ephemeral key), and the reply callback needs the
             // transport hint that arms the send cipher after this exact frame.
             this.socket.on("completeHandshake", this.handleCompleteHandshakeRPC);
-            this.exposeRPC("requestSecure", () => {
-                this.secureRemote = true;
-                return !this.encryptTraffic;
-            });
         }
     }
     /** True once the remote identity has been authenticated by the handshake. */
@@ -114,29 +96,6 @@ class Connection {
     get frameCipherArmed() {
         return this.socket.frameCipherArmed === true;
     }
-    /**
-     * Whether to apply the legacy per-message envelope (sign + box) to RPC payloads.
-     *
-     * Always false once the frame cipher is armed: the frame layer already gives
-     * confidentiality, integrity, and sender binding for every frame. Otherwise
-     * (legacy peer) the transport classification below applies:
-     * - skipped when both sides agreed the transport is secure (`secureLocal && secureRemote`)
-     * - applied on plain `ws` / `http`
-     */
-    get encryptTraffic() {
-        if (this.socket.frameCipherArmed) {
-            return false;
-        }
-        if (this.overrideEncryption === "dont-encrypt-traffic-after-handshake" &&
-            process.env.NODE_ENV === "test") {
-            return false;
-        }
-        if (this.overrideEncryption === "encrypt-traffic-regardless-of-protocol") {
-            return true;
-        }
-        // Encrypt only if EITHER side is using an insecure protocol
-        return !(this.secureLocal && this.secureRemote);
-    }
     /** Copy of the authenticated remote device identity (empty before the handshake). */
     get remoteDeviceInfo() {
         return { ...this._remoteDeviceInfo };
@@ -145,20 +104,33 @@ class Connection {
     get connectionId() {
         return this.socket.id || "";
     }
-    get supportsFrameCrypto() {
-        return typeof this.socket.armFrameCipher === "function";
-    }
-    warnLegacyPeer(deviceId) {
-        console.warn(`[Connection] Peer ${deviceId} does not support frame encryption; using legacy per-message encryption`, { connectionId: this.connectionId, transport: this.socket.transportType ?? "unknown" });
+    /** The socket's frame-cipher arming; throws when the transport can't encrypt frames. */
+    requireFrameCipher() {
+        const arm = this.socket.armFrameCipher;
+        if (typeof arm !== "function") {
+            throw new Error("This transport can't encrypt frames, so it can't carry a connection");
+        }
+        return arm.bind(this.socket);
     }
     handleCompleteHandshakeRPC = async (args, callback) => {
         try {
+            const generation = this.handshakeGeneration;
             const [handshakeBox] = args;
             const response = await this.completeHandshake(handshakeBox);
+            this.assertHandshakeCurrent(generation);
             const boxed = this.localDevice.signAndBoxDataForDevice(response, this._remoteDeviceInfo);
             const armAfter = this.pendingSendArm;
             this.pendingSendArm = undefined;
-            callback(null, boxed, armAfter ? { armFrameCipherAfter: armAfter } : undefined);
+            await callback(null, boxed, armAfter ? { armFrameCipherAfter: armAfter } : undefined);
+            // The reply may wait on backpressure or span several frames. Start application RPCs
+            // only once the final frame has gone out and the send cipher has armed.
+            if (this.onHandshakeComplete) {
+                setTimeout(() => {
+                    if (generation === this.handshakeGeneration && this.socket.connected !== false) {
+                        this.onHandshakeComplete?.(this._remoteDeviceInfo);
+                    }
+                }, 10);
+            }
         }
         catch (e) {
             console.error("Error handling completeHandshake", e);
@@ -239,13 +211,16 @@ class Connection {
     }
     /** Calls a remote RPC handler and resolves with its result (rejects on error or timeout). */
     emit(eventName, ...args) {
+        return this.request(eventName, args);
+    }
+    /**
+     * Sends one RPC. `onReply`, when given, runs synchronously while the reply frame is
+     * processed, before any later frame from the peer; its return value (or throw) settles
+     * the call.
+     */
+    request(eventName, args, onReply) {
         return new Promise((resolve, reject) => {
             try {
-                // Legacy per-message envelope; skipped when the frame cipher is armed
-                // or both sides agreed the transport is secure.
-                if (this._verified && this.encryptTraffic) {
-                    args = this.localDevice.signAndBoxDataForDevice(args, this._remoteDeviceInfo);
-                }
                 const timeoutMs = this.timeoutMs;
                 const timeoutPid = setTimeout(() => {
                     reject(`${eventName} timed out after ${timeoutMs}ms`);
@@ -254,16 +229,17 @@ class Connection {
                     try {
                         clearTimeout(timeoutPid);
                         if (err) {
-                            err = this.localDevice.unwrapResponse(err);
                             return reject(err);
                         }
-                        if (eventName === "requestSecure") {
-                            this.secureRemote = this.localDevice.unwrapResponse(result);
-                            result = this.secureRemote;
-                        }
-                        else if (this._verified && this.encryptTraffic) {
-                            // this purposely results in an error if the client is not securing the data when it should be
-                            result = this.localDevice.openBoxedAndSignedData(result);
+                        if (onReply) {
+                            let value;
+                            try {
+                                value = onReply(result);
+                            }
+                            catch (e) {
+                                return reject(e);
+                            }
+                            return resolve(value);
                         }
                         resolve(result);
                     }
@@ -284,8 +260,7 @@ class Connection {
     }
     /**
      * Registers an RPC handler. Events other than the handshake set are rejected
-     * until the connection is verified; payloads use the legacy envelope only
-     * when {@link Connection.encryptTraffic} is true.
+     * until the connection is verified.
      */
     on(eventName, handler) {
         const safeEvents = [
@@ -300,31 +275,12 @@ class Connection {
                 console.error(`Ignoring event from unverified connection: ${eventName}`);
                 return callback(`Connection not verified.  Handshake must be completed successfully before calling ${eventName}`);
             }
-            let result;
             try {
-                // Legacy per-message envelope; skipped when the frame cipher is armed
-                // or both sides agreed the transport is secure.
-                if (this._verified && this.encryptTraffic) {
-                    args = this.localDevice.openBoxedAndSignedData(args);
-                }
-                result = await handler(...args);
-                if (this._verified && this.encryptTraffic) {
-                    result = this.localDevice.signAndBoxDataForDevice(result, this._remoteDeviceInfo);
-                }
-                callback(null, result);
+                callback(null, await handler(...args));
             }
             catch (e) {
                 console.error(`Error handling ${eventName}(${JSON.stringify(args)})`, e);
-                let rpcError = { error: e.message, errorType: "RPC_ERROR" };
-                if (this._verified && this.encryptTraffic) {
-                    try {
-                        rpcError = this.localDevice.signAndBoxDataForDevice(rpcError, this._remoteDeviceInfo);
-                    }
-                    catch (e) {
-                        console.error("Error signing and boxing RPC error", e);
-                    }
-                }
-                callback(rpcError);
+                callback({ error: e.message, errorType: "RPC_ERROR" });
             }
         });
     }
@@ -346,50 +302,54 @@ class Connection {
             publicBoxKey: "",
         };
         this._verified = false;
-        this.secureLocal = false;
-        this.secureRemote = false;
         this.trustLevel = socket_type_1.TrustLevel.Unknown;
         this.pendingClientHandshake?.ephemeralSecretKey.fill(0);
         this.pendingClientHandshake = undefined;
         this.pendingSendArm = undefined;
-        this.socket.setPlaintextStreamsAllowed?.(false);
+        this.handshakeGeneration++;
     }
     /**
-     * Client side: builds the signed handshake (advertising frame-cipher support
-     * with a fresh ephemeral key when the socket can arm one) and boxes it to the
-     * remote device.
+     * Client side: builds the signed handshake (offering frame encryption with a
+     * fresh ephemeral key) and boxes it to the remote device.
      */
     initiateHandshake(serverAddress, remoteDeviceInfo) {
         if (remoteDeviceInfo) {
             this._remoteDeviceInfo = remoteDeviceInfo;
         }
-        let frameCrypto;
         this.pendingClientHandshake?.ephemeralSecretKey.fill(0);
         this.pendingClientHandshake = undefined;
-        let ephemeralSecretKey;
-        if (this.supportsFrameCrypto) {
-            const ephemeral = (0, keys_1.newEphemeralBoxKeyPair)();
-            ephemeralSecretKey = ephemeral.secretKey;
-            frameCrypto = { version: 1, ephemeralBoxKey: (0, keys_1.encodeBase64)(ephemeral.publicKey) };
-        }
-        const handshake = this.localDevice.getHandshake(this.connectionId, serverAddress, frameCrypto, (0, key_change_1.peekLocalKeyContest)());
-        if (ephemeralSecretKey) {
+        this.requireFrameCipher();
+        const ephemeral = (0, keys_1.newEphemeralBoxKeyPair)();
+        const ephemeralSecretKey = ephemeral.secretKey;
+        const frameCrypto = {
+            version: 1,
+            ephemeralBoxKey: (0, keys_1.encodeBase64)(ephemeral.publicKey),
+        };
+        try {
+            const handshake = this.localDevice.getHandshake(this.connectionId, serverAddress, frameCrypto, (0, key_change_1.peekLocalKeyContest)());
             this.pendingClientHandshake = {
                 ephemeralSecretKey,
                 timestamp: handshake.contents.timestamp,
             };
+            return this.localDevice.boxDataForDevice(handshake, this._remoteDeviceInfo);
+        }
+        catch (e) {
+            ephemeralSecretKey.fill(0);
+            this.pendingClientHandshake = undefined;
+            throw e;
         }
-        return this.localDevice.boxDataForDevice(handshake, this._remoteDeviceInfo);
     }
     /**
      * Server side: verifies the client's handshake, resolves trust, and returns
-     * the (unsigned) response for the caller to sign and box. When the client
-     * offered `frameCrypto` and this socket can arm a cipher, derives the frame
+     * the (unsigned) response for the caller to sign and box. Derives the frame
      * keys, arms the receive direction immediately, and schedules the send
      * direction to arm right after the response frame (see
-     * {@link Connection.handleCompleteHandshakeRPC}).
+     * {@link Connection.handleCompleteHandshakeRPC}). A client that does not
+     * offer frame encryption is refused.
      */
     async completeHandshake(boxedHandshake) {
+        const generation = this.handshakeGeneration;
+        this.assertHandshakeCurrent(generation);
         const signedHandshake = this.localDevice.openBoxWithSecretKey(boxedHandshake);
         const _handshake = data_1.deviceHandshakeSchema.parse((0, keys_1.openSignedObject)(signedHandshake));
         const timeDiff = Math.abs(Date.now() - _handshake.timestamp);
@@ -400,15 +360,17 @@ class Connection {
         const thisServerAddress = this.localDeviceServerAddresses?.find((a) => a === clientServerAddress) ||
             this.localDeviceServerAddresses?.[0] ||
             "unknown";
-        // Legacy classification: only meaningful when the frame cipher will not be armed.
-        this.secureLocal =
-            clientServerAddress === thisServerAddress && thisServerAddress.startsWith("https");
-        this._connectionAddress = thisServerAddress;
-        let frameCrypto;
+        if (!_handshake.frameCrypto) {
+            throw legacyPeerError(_handshake.deviceId);
+        }
+        const armFrameCipher = this.requireFrameCipher();
+        const ephemeral = (0, keys_1.newEphemeralBoxKeyPair)();
+        const frameCrypto = {
+            version: 1,
+            ephemeralBoxKey: (0, keys_1.encodeBase64)(ephemeral.publicKey),
+        };
         let frameKeys;
-        if (_handshake.frameCrypto && this.supportsFrameCrypto) {
-            const ephemeral = (0, keys_1.newEphemeralBoxKeyPair)();
-            frameCrypto = { version: 1, ephemeralBoxKey: (0, keys_1.encodeBase64)(ephemeral.publicKey) };
+        try {
             const derived = this.localDevice.deriveFrameKeys({
                 remotePublicBoxKey: _handshake.publicBoxKey,
                 ephemeralSecretKey: ephemeral.secretKey,
@@ -420,8 +382,26 @@ class Connection {
             });
             frameKeys = (0, frame_cipher_1.frameKeysForRole)(derived, "server");
         }
+        finally {
+            // Invalid peer keys can throw before Device.deriveFrameKeys reaches its cleanup.
+            ephemeral.secretKey.fill(0);
+        }
         const handshakeResponse = this.localDevice.handshakeResponse(signedHandshake, this.connectionId, thisServerAddress, frameCrypto, (0, key_change_1.peekLocalKeyContest)());
         await noteHandshakeContest(_handshake.keyContest);
+        this.assertHandshakeCurrent(generation);
+        const trustLevel = await this.getTrustLevel(_handshake, true);
+        this.assertHandshakeCurrent(generation);
+        if (trustLevel < socket_type_1.TrustLevel.Unknown) {
+            this.resetRemote();
+            throw new Error("Untrusted connection");
+        }
+        // The client seals everything after it reads our response, so receive
+        // can arm now; send arms after the response frame goes out.
+        armFrameCipher(frameKeys, "receive");
+        this.pendingSendArm = frameKeys;
+        // Publish the identity only after arming succeeds; a failed cipher must not
+        // leave application RPC handlers accepting an unsealed connection.
+        this._connectionAddress = thisServerAddress;
         this._remoteDeviceInfo = {
             userId: _handshake.userId,
             deviceId: _handshake.deviceId,
@@ -430,57 +410,76 @@ class Connection {
             userName: _handshake.userName,
             deviceName: _handshake.deviceName,
         };
-        this.trustLevel = await this.getTrustLevel(_handshake, true);
-        if (this.trustLevel < socket_type_1.TrustLevel.Unknown) {
-            this.resetRemote();
-            throw new Error("Untrusted connection");
-        }
+        this.trustLevel = trustLevel;
         this._verified = true;
-        if (frameKeys && this.socket.armFrameCipher) {
-            // The client seals everything after it reads our response, so receive
-            // can arm now; send arms after the response frame goes out.
-            this.socket.armFrameCipher(frameKeys, "receive");
-            this.pendingSendArm = frameKeys;
-        }
-        else {
-            this.warnLegacyPeer(_handshake.deviceId);
-            this.socket.setPlaintextStreamsAllowed?.(true);
-        }
-        if (this.onHandshakeComplete) {
-            setTimeout(() => {
-                this.onHandshakeComplete?.(this._remoteDeviceInfo);
-            }, 10);
-        }
         return handshakeResponse;
     }
     /**
      * Client side: runs the full handshake against `remoteAddress`. On success
-     * the remote identity is verified and, if both sockets support it, the
-     * frame cipher is armed in both directions before this resolves.
+     * the remote identity is verified and the frame cipher is armed in both
+     * directions before this resolves.
      */
     async doHandshake(remoteAddress) {
         remoteAddress = normalizeAddress(remoteAddress);
         this.reset();
-        await this.emit("reset");
-        const remoteDeviceInfoSigned = await this.emit("requestDeviceInfo");
-        const remoteDeviceInfo = data_1.deviceInfoSchema.parse((0, keys_1.openSignedObject)(remoteDeviceInfoSigned));
-        if (remoteDeviceInfoSigned.publicKey !== remoteDeviceInfo.publicKey) {
-            throw new Error("Device info signing key does not match claimed identity key");
+        const generation = this.handshakeGeneration;
+        try {
+            this.assertHandshakeCurrent(generation);
+            await this.emit("reset");
+            this.assertHandshakeCurrent(generation);
+            const remoteDeviceInfoSigned = await this.emit("requestDeviceInfo");
+            this.assertHandshakeCurrent(generation);
+            const remoteDeviceInfo = data_1.deviceInfoSchema.parse((0, keys_1.openSignedObject)(remoteDeviceInfoSigned));
+            if (remoteDeviceInfoSigned.publicKey !== remoteDeviceInfo.publicKey) {
+                throw new Error("Device info signing key does not match claimed identity key");
+            }
+            if (remoteDeviceInfo.userId === this.localDevice.userId &&
+                remoteDeviceInfo.publicKey !== this.localDevice.publicKey) {
+                // The server will refuse this handshake. Decide here, while we still have the signed
+                // identity, whether the anchors say this device's key was rotated away.
+                await (0, key_change_1.detectIdentityRotatedAway)(this.localDevice, remoteDeviceInfo);
+                this.assertHandshakeCurrent(generation);
+            }
+            const handshake = this.initiateHandshake(remoteAddress, remoteDeviceInfo);
+            // The server seals every frame after its reply, and a busy client can read the next one
+            // in the same batch as the reply. So the reply is checked and the cipher armed while the
+            // reply frame is processed, not after an await.
+            const handshakeResponse = await this.request("completeHandshake", [handshake], (box) => this.acceptHandshakeReply(box, remoteAddress, remoteDeviceInfo, generation));
+            this.assertHandshakeCurrent(generation);
+            const currentRemoteDeviceInfo = this.remoteDeviceInfo;
+            await noteHandshakeContest(handshakeResponse.keyContest);
+            this.assertHandshakeCurrent(generation);
+            const trustLevel = await this.getTrustLevel(currentRemoteDeviceInfo, true);
+            this.assertHandshakeCurrent(generation);
+            this.trustLevel = trustLevel;
+            if (this.trustLevel < socket_type_1.TrustLevel.Unknown) {
+                this.resetRemote();
+                throw new Error("Untrusted connection");
+            }
+            return handshakeResponse;
         }
-        if (remoteDeviceInfo.userId === this.localDevice.userId &&
-            remoteDeviceInfo.publicKey !== this.localDevice.publicKey) {
-            // The server will refuse this handshake. Decide here, while we still have the signed
-            // identity, whether the anchors say this device's key was rotated away.
-            await (0, key_change_1.detectIdentityRotatedAway)(this.localDevice, remoteDeviceInfo);
+        catch (e) {
+            // A failed or timed-out attempt must neither retain its ephemeral secret nor let a
+            // late reply authenticate it. Do not clear state belonging to a newer handshake.
+            if (generation === this.handshakeGeneration)
+                this.reset();
+            throw e;
         }
-        const handshake = await this.initiateHandshake(remoteAddress, remoteDeviceInfo);
-        const handshakeResponseBox = await this.emit("completeHandshake", handshake);
-        const handshakeResponse = data_1.deviceHandshakeSchema.parse(await this.localDevice.openBoxedAndSignedData(handshakeResponseBox));
-        await noteHandshakeContest(handshakeResponse.keyContest);
+    }
+    /**
+     * Client side: checks the server's handshake reply, arms the frame cipher, and records the
+     * verified identity. Runs synchronously while the reply frame is processed, so a sealed
+     * frame read right after it finds the cipher armed and the connection verified.
+     */
+    acceptHandshakeReply(handshakeResponseBox, remoteAddress, remoteDeviceInfo, generation) {
+        this.assertHandshakeCurrent(generation);
+        const signedResponse = this.localDevice.openBoxWithSecretKey(handshakeResponseBox);
+        const handshakeResponse = data_1.deviceHandshakeSchema.parse((0, keys_1.openSignedObject)(signedResponse));
         if (handshakeResponse.connectionId !== this.connectionId) {
             throw new Error(`Invalid connectionId ${handshakeResponse.connectionId}, expected ${this.connectionId}`);
         }
-        if (remoteDeviceInfo.publicKey !== handshakeResponse.publicKey ||
+        if (signedResponse.publicKey !== remoteDeviceInfo.publicKey ||
+            remoteDeviceInfo.publicKey !== handshakeResponse.publicKey ||
             remoteDeviceInfo.publicBoxKey !== handshakeResponse.publicBoxKey) {
             throw new Error("Inconsistent public keys");
         }
@@ -488,21 +487,15 @@ class Connection {
             remoteDeviceInfo.deviceId !== handshakeResponse.deviceId) {
             throw new Error("Inconsistent device info");
         }
-        const currentRemoteDeviceInfo = {
-            ...remoteDeviceInfo,
-            userName: handshakeResponse.userName !== undefined
-                ? handshakeResponse.userName
-                : remoteDeviceInfo.userName,
-            deviceName: handshakeResponse.deviceName !== undefined
-                ? handshakeResponse.deviceName
-                : remoteDeviceInfo.deviceName,
-        };
-        this._remoteDeviceInfo = currentRemoteDeviceInfo;
-        this._verified = true;
-        this._connectionAddress = remoteAddress;
         const pending = this.pendingClientHandshake;
         this.pendingClientHandshake = undefined;
-        if (pending && handshakeResponse.frameCrypto && this.socket.armFrameCipher) {
+        try {
+            if (!handshakeResponse.frameCrypto) {
+                throw legacyPeerError(handshakeResponse.deviceId);
+            }
+            if (!pending) {
+                throw new Error("No handshake is pending on this connection");
+            }
             const derived = this.localDevice.deriveFrameKeys({
                 remotePublicBoxKey: handshakeResponse.publicBoxKey,
                 ephemeralSecretKey: pending.ephemeralSecretKey,
@@ -513,29 +506,34 @@ class Connection {
                 timestamp: pending.timestamp,
             });
             // The server armed receive before replying and send right after; from
-            // here on both directions are sealed.
-            this.socket.armFrameCipher((0, frame_cipher_1.frameKeysForRole)(derived, "client"));
+            // here on both directions are sealed. Do not mark verified if deriving or arming fails.
+            this.requireFrameCipher()((0, frame_cipher_1.frameKeysForRole)(derived, "client"));
         }
-        else {
+        finally {
             pending?.ephemeralSecretKey.fill(0);
-            this.warnLegacyPeer(handshakeResponse.deviceId);
-            this.socket.setPlaintextStreamsAllowed?.(true);
-        }
-        // Legacy classification, only consulted when the frame cipher is not armed.
-        const secureProtocols = ["https", "wss", "wrtc"];
-        this.secureLocal =
-            secureProtocols.some((s) => remoteAddress.startsWith(s)) &&
-                handshakeResponse.serverAddress === remoteAddress;
-        if (this.secureLocal && !this.socket.frameCipherArmed) {
-            await this.emit("requestSecure");
-        }
-        this.trustLevel = await this.getTrustLevel(currentRemoteDeviceInfo, true);
-        if (this.trustLevel < socket_type_1.TrustLevel.Unknown) {
-            this.resetRemote();
-            throw new Error("Untrusted connection");
         }
+        this._remoteDeviceInfo = {
+            ...remoteDeviceInfo,
+            userName: handshakeResponse.userName !== undefined
+                ? handshakeResponse.userName
+                : remoteDeviceInfo.userName,
+            deviceName: handshakeResponse.deviceName !== undefined
+                ? handshakeResponse.deviceName
+                : remoteDeviceInfo.deviceName,
+        };
+        this._verified = true;
+        this._connectionAddress = remoteAddress;
         return handshakeResponse;
     }
+    /**
+     * Throws when the connection was reset or closed after the handshake started: a handshake
+     * cut short must fail, not finish on a dead or reused connection.
+     */
+    assertHandshakeCurrent(generation) {
+        if (generation !== this.handshakeGeneration || this.socket.connected === false) {
+            throw new Error("Connection was closed or reset during the handshake");
+        }
+    }
     /**
      * Resets this side and asks the remote to do the same. The remote call is a courtesy: a
      * peer that is not a server has no `reset` handler, and a peer we just refused may already
@@ -578,6 +576,10 @@ class Connection {
     }
 }
 exports.Connection = Connection;
+/** Refusal for a peer whose build predates frame encryption (0.25.7). */
+function legacyPeerError(deviceId) {
+    return new Error(`Device ${deviceId} does not support frame encryption; update Peers on that device to connect`);
+}
 async function noteHandshakeContest(contest) {
     if (!contest)
         return;

package/dist/device/device.d.ts

@@ -49,7 +49,7 @@ export declare class Device implements IDeviceInfo {
     boxDataForDevice(data: any, device: IDeviceInfo): IDataBox;
     /** Opens a box addressed to this device. @throws on authentication failure */
     openBoxWithSecretKey(data: IDataBox): any;
-    /** Signs then boxes `data` for a device: the legacy per-message RPC envelope. */
+    /** Signs then boxes `data` for a device, including handshake replies and pairing credentials. */
     signAndBoxDataForDevice<T>(data: T, device: IDeviceInfo): IDataBox;
     /** Signs then boxes `data` to a raw X25519 public key (base64url). */
     signAndBoxDataForKey<T>(data: T, toPublicBoxKey: string): IDataBox;
@@ -60,13 +60,6 @@ export declare class Device implements IDeviceInfo {
      * zeroizes both secrets and the supplied ephemeral secret key.
      */
     deriveFrameKeys(params: DeviceFrameKeyParams): DerivedFrameKeys;
-    /**
-     * Unwraps a possibly boxed and/or signed RPC value down to its contents.
-     * Plain values pass through unchanged.
-     */
-    unwrapResponse<T>(response: T | ISignedObject<T> | IDataBox): T;
-    /** Opens a box addressed to this device and verifies the signed object inside. */
-    openBoxedAndSignedData<T>(data: IDataBox): T;
     /** Updates bounded presentation metadata included in future signed identity messages. */
     setDisplayInfo({ userName, deviceName }: IDeviceDisplayInfo): void;
     /**

package/dist/device/device.js

@@ -54,7 +54,7 @@ class Device {
     openBoxWithSecretKey(data) {
         return (0, keys_1.openBoxWithSecretKey)(data, this.keys.secretKey);
     }
-    /** Signs then boxes `data` for a device: the legacy per-message RPC envelope. */
+    /** Signs then boxes `data` for a device, including handshake replies and pairing credentials. */
     signAndBoxDataForDevice(data, device) {
         const signedData = this.signObjectWithSecretKey(data);
         return this.boxDataForDevice(signedData, device);
@@ -89,35 +89,6 @@ class Device {
             params.ephemeralSecretKey.fill(0);
         }
     }
-    /**
-     * Unwraps a possibly boxed and/or signed RPC value down to its contents.
-     * Plain values pass through unchanged.
-     */
-    unwrapResponse(response) {
-        if (!response) {
-            return response;
-        }
-        if (typeof response === "object" &&
-            "contents" in response &&
-            "nonce" in response &&
-            "fromPublicKey" in response) {
-            const signedResponse = this.openBoxWithSecretKey(response);
-            return this.unwrapResponse(signedResponse);
-        }
-        if (typeof response === "object" &&
-            "contents" in response &&
-            "signature" in response &&
-            "publicKey" in response) {
-            const signedResponse = response;
-            return (0, keys_1.openSignedObject)(signedResponse);
-        }
-        return response;
-    }
-    /** Opens a box addressed to this device and verifies the signed object inside. */
-    openBoxedAndSignedData(data) {
-        const signedData = this.openBoxWithSecretKey(data);
-        return (0, keys_1.openSignedObject)(signedData);
-    }
     /** Updates bounded presentation metadata included in future signed identity messages. */
     setDisplayInfo({ userName, deviceName }) {
         userName = userName ? userName.slice(0, data_1.DISPLAY_NAME_MAX_LENGTH) : undefined;