@xiotbox/e2e-channel 0.1.0

package/lib/secure-channel.js

@@ -0,0 +1,319 @@
+/**
+ * XiotBox E2E Secure Channel — generic end-to-end encrypted channel.
+ *
+ * Sits between an application protocol and the XiotBox Gateway relay: any
+ * channel that relays opaque JSON frames (DSH web tunnel, agent RPC, PTY
+ * streams, …) can wrap them with this layer and get:
+ *
+ *  - confidentiality   — the Gateway only ever sees ciphertext frames
+ *  - integrity         — AES-256-GCM AEAD rejects any modified frame
+ *  - anti-replay       — per-direction sequence counters bound in the AAD
+ *  - forward secrecy   — fresh ephemeral X25519 key pair per channel
+ *  - peer authentication — Ed25519 identity signatures over the handshake
+ *    transcript, pinned TOFU by the application via `peerIdentityPolicy`
+ *
+ * Wire format (all frames are JSON, base64-encoded by the relay):
+ *   handshake:  {t:'hello', v:1, pub, kid, nonce}
+ *               {t:'hello_ack', v:1, pub, kid, nonce}
+ *               {t:'ident', v:1, id, fp, sig}      (identity claim, signed)
+ *               {t:'ident_ack', v:1, id, fp, sig}
+ *   data:       {t:'enc', v:1, iv, tag, ct}        (ct = encrypted app frame)
+ *
+ * Application keepalives (e.g. the tunnel's ping/pong) stay outside this
+ * layer and are relayed plaintext; they carry no sensitive content.
+ *
+ * See `docs/e2e-secure-channel.md` for the full protocol specification.
+ */
+import { randomBytes } from 'node:crypto';
+import { b64d, b64e, buildFrameAad, buildHandshakeTranscript, computeIdentityFingerprint, deriveSessionKey, normalizeEd25519Pub, openFrame, sealFrame, signMessage, verifyMessage, x25519Keypair, x25519Shared, } from './crypto.js';
+const DEFAULT_HANDSHAKE_TIMEOUT_MS = 10_000;
+/**
+ * One E2E session bound to one relay channel. Created per channel; the
+ * session key lives only in memory and is dropped on close.
+ */
+export class SecureChannel {
+    opts;
+    state = 'init';
+    eph;
+    myNonce;
+    myKid;
+    peerEphPubB64 = '';
+    peerKid = '';
+    peerNonce = '';
+    peerIdentityFp = '';
+    sessionKey;
+    sendSeq = 0;
+    recvSeq = 0;
+    timeout;
+    closedReason = '';
+    constructor(options) {
+        this.opts = options;
+        this.eph = x25519Keypair();
+        this.myNonce = randomBytes(16).toString('hex');
+        this.myKid = options.keypair.keyId;
+        if (options.role === 'initiator')
+            this.state = 'hello_sent';
+    }
+    get ready() {
+        return this.state === 'ready';
+    }
+    get channelId() {
+        return this.opts.channelId;
+    }
+    get direction() {
+        return this.opts.role === 'initiator' ? 'c2p' : 'p2c';
+    }
+    /** Initiate (initiator) or arm the handshake timeout (responder). */
+    start() {
+        if (this.opts.role === 'initiator' && this.state === 'hello_sent') {
+            const ok = this.opts.send({
+                t: 'hello',
+                v: 1,
+                pub: b64e(this.eph.pub),
+                kid: this.myKid,
+                nonce: this.myNonce,
+            });
+            if (!ok) {
+                this.close('send_failed');
+                return;
+            }
+        }
+        this.armTimeout();
+    }
+    /**
+     * Feed an inbound relay frame. Returns:
+     *   { status: 'ok', app?: Record }  — app frame decrypted (when ready)
+     *   { status: 'ok' }                — handshake/control frame consumed
+     *   { status: 'closed', reason }    — protocol/security failure
+     */
+    receive(frame) {
+        if (this.state === 'closed')
+            return { status: 'closed', reason: this.closedReason || 'closed' };
+        const t = String(frame.t ?? '');
+        if (t === 'enc') {
+            if (!this.ready)
+                return { status: 'closed', reason: 'enc_before_handshake' };
+            return this.handleEnc(frame);
+        }
+        switch (t) {
+            case 'hello':
+                return this.handleHello(frame);
+            case 'hello_ack':
+                return this.handleHelloAck(frame);
+            case 'ident':
+                return this.handleIdent(frame);
+            case 'ident_ack':
+                return this.handleIdentAck(frame);
+            default:
+                return { status: 'closed', reason: 'unexpected_frame' };
+        }
+    }
+    /** Wrap an application frame into an encrypted relay frame. */
+    wrap(app) {
+        if (!this.ready || this.sessionKey === undefined) {
+            throw new Error('secure_channel_not_ready');
+        }
+        this.sendSeq += 1;
+        const aad = buildFrameAad(this.channelId, this.direction, this.sendSeq);
+        const sealed = sealFrame(this.sessionKey, Buffer.from(JSON.stringify(app), 'utf8'), aad);
+        return { t: 'enc', v: 1, ...sealed };
+    }
+    /** Close the channel; clears the session key and timers. */
+    close(reason = 'closed') {
+        if (this.state === 'closed')
+            return;
+        this.state = 'closed';
+        this.closedReason = reason;
+        this.clearTimeout();
+        this.sessionKey = undefined;
+        this.opts.onClose?.(reason);
+    }
+    // -------------------------------------------------------------------------
+    // Handshake
+    // -------------------------------------------------------------------------
+    handleHello(frame) {
+        if (this.opts.role !== 'responder' || this.state !== 'init') {
+            return { status: 'closed', reason: 'protocol_error' };
+        }
+        const pub = b64d(frame.pub);
+        const kid = String(frame.kid ?? '');
+        const nonce = String(frame.nonce ?? '');
+        if (pub === undefined || pub.length !== 32 || kid.length === 0 || nonce.length === 0) {
+            return { status: 'closed', reason: 'invalid_hello' };
+        }
+        if (this.opts.peerKid && kid !== this.opts.peerKid) {
+            this.opts.log?.('warn', `[E2E] peer kid mismatch channel=${this.channelId} got=${kid.slice(0, 8)}… expected=${this.opts.peerKid.slice(0, 8)}…`);
+            return { status: 'closed', reason: 'e2e_peer_kid_mismatch' };
+        }
+        this.peerEphPubB64 = frame.pub;
+        this.peerKid = kid;
+        this.peerNonce = nonce;
+        this.sessionKey = deriveSessionKey(x25519Shared(this.eph.priv, pub), this.channelId);
+        // Advance the state BEFORE sending: the synchronous send() re-enters the
+        // peer, which may immediately reply with its ident frame.
+        this.state = 'hello_received';
+        const ok = this.opts.send({
+            t: 'hello_ack',
+            v: 1,
+            pub: b64e(this.eph.pub),
+            kid: this.myKid,
+            nonce: this.myNonce,
+        });
+        if (!ok)
+            return { status: 'closed', reason: 'send_failed' };
+        return { status: 'ok' };
+    }
+    handleHelloAck(frame) {
+        if (this.opts.role !== 'initiator' || this.state !== 'hello_sent') {
+            return { status: 'closed', reason: 'protocol_error' };
+        }
+        const pub = b64d(frame.pub);
+        const kid = String(frame.kid ?? '');
+        const nonce = String(frame.nonce ?? '');
+        if (pub === undefined || pub.length !== 32 || kid.length === 0 || nonce.length === 0) {
+            return { status: 'closed', reason: 'invalid_hello_ack' };
+        }
+        if (this.opts.peerKid && kid !== this.opts.peerKid) {
+            this.opts.log?.('warn', `[E2E] peer kid mismatch channel=${this.channelId} got=${kid.slice(0, 8)}… expected=${this.opts.peerKid.slice(0, 8)}…`);
+            return { status: 'closed', reason: 'e2e_peer_kid_mismatch' };
+        }
+        this.peerEphPubB64 = frame.pub;
+        this.peerKid = kid;
+        this.peerNonce = nonce;
+        this.sessionKey = deriveSessionKey(x25519Shared(this.eph.priv, pub), this.channelId);
+        this.state = 'ident_sent';
+        // Identity claim over the full handshake transcript.
+        const transcript = this.buildTranscript('c2p');
+        const sig = signMessage(this.opts.identity.privKey, transcript);
+        const ok = this.opts.send({
+            t: 'ident',
+            v: 1,
+            id: b64e(this.opts.identity.pubRaw),
+            fp: this.opts.identity.fingerprint,
+            sig: b64e(sig),
+        });
+        if (!ok)
+            return { status: 'closed', reason: 'send_failed' };
+        return { status: 'ok' };
+    }
+    handleIdent(frame) {
+        if (this.opts.role !== 'responder' || this.state !== 'hello_received') {
+            return { status: 'closed', reason: 'protocol_error' };
+        }
+        const result = this.verifyIdentityClaim(frame, 'c2p');
+        if (!result.ok) {
+            this.opts.log?.('warn', `[E2E] peer identity rejected channel=${this.channelId} reason=${result.reason ?? 'invalid'}`);
+            return { status: 'closed', reason: result.reason ?? 'e2e_peer_identity_rejected' };
+        }
+        this.peerIdentityFp = String(frame.fp ?? '');
+        // Reply with our identity claim.
+        const transcript = this.buildTranscript('p2c');
+        const sig = signMessage(this.opts.identity.privKey, transcript);
+        const ok = this.opts.send({
+            t: 'ident_ack',
+            v: 1,
+            id: b64e(this.opts.identity.pubRaw),
+            fp: this.opts.identity.fingerprint,
+            sig: b64e(sig),
+        });
+        if (!ok)
+            return { status: 'closed', reason: 'send_failed' };
+        this.clearTimeout();
+        this.state = 'ready';
+        this.opts.log?.('info', `[E2E] channel ready channel=${this.channelId} peerFp=${this.peerIdentityFp.slice(0, 12)}…`);
+        return { status: 'ok' };
+    }
+    handleIdentAck(frame) {
+        if (this.opts.role !== 'initiator' || this.state !== 'ident_sent') {
+            return { status: 'closed', reason: 'protocol_error' };
+        }
+        const result = this.verifyIdentityClaim(frame, 'p2c');
+        if (!result.ok) {
+            this.opts.log?.('warn', `[E2E] peer identity rejected channel=${this.channelId} reason=${result.reason ?? 'invalid'}`);
+            return { status: 'closed', reason: result.reason ?? 'e2e_peer_identity_rejected' };
+        }
+        this.peerIdentityFp = String(frame.fp ?? '');
+        this.clearTimeout();
+        this.state = 'ready';
+        this.opts.log?.('info', `[E2E] channel ready channel=${this.channelId} peerFp=${this.peerIdentityFp.slice(0, 12)}…`);
+        return { status: 'ok' };
+    }
+    verifyIdentityClaim(frame, dir) {
+        const idDecoded = b64d(frame.id);
+        const sig = b64d(frame.sig);
+        if (idDecoded === undefined || sig === undefined) {
+            return { ok: false, reason: 'invalid_identity_claim' };
+        }
+        const idRaw = normalizeEd25519Pub(idDecoded);
+        if (idRaw === undefined) {
+            return { ok: false, reason: 'invalid_identity_claim' };
+        }
+        const transcript = this.buildTranscript(dir);
+        if (!verifyMessage(idRaw, transcript, sig)) {
+            return { ok: false, reason: 'e2e_identity_sig_invalid' };
+        }
+        // Advisory fingerprint check: SHA256 of the SPKI DER encoding (idRaw is
+        // always the raw 32 bytes here; canonical Ed25519 SPKI DER = prefix + raw).
+        const der = Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), idRaw]);
+        const computedFp = computeIdentityFingerprint(der);
+        const claimedFp = String(frame.fp ?? '').trim().toLowerCase();
+        if (claimedFp && claimedFp !== computedFp) {
+            return { ok: false, reason: 'e2e_identity_fp_mismatch' };
+        }
+        if (this.opts.peerIdentityPolicy) {
+            return this.opts.peerIdentityPolicy(idRaw, claimedFp || computedFp, transcript, sig);
+        }
+        return { ok: true };
+    }
+    buildTranscript(dir) {
+        // Canonical c_/p_ fields: c_ = client/initiator side, p_ = plugin/responder
+        // side. Both peers must produce the identical string for the same dir.
+        const isInitiator = this.opts.role === 'initiator';
+        return buildHandshakeTranscript({
+            channelId: this.channelId,
+            dir,
+            cEphPubB64: isInitiator ? b64e(this.eph.pub) : this.peerEphPubB64,
+            pEphPubB64: isInitiator ? this.peerEphPubB64 : b64e(this.eph.pub),
+            cKid: isInitiator ? this.myKid : this.peerKid,
+            pKid: isInitiator ? this.peerKid : this.myKid,
+            cNonce: isInitiator ? this.myNonce : this.peerNonce,
+            pNonce: isInitiator ? this.peerNonce : this.myNonce,
+        });
+    }
+    handleEnc(frame) {
+        if (this.sessionKey === undefined)
+            return { status: 'closed', reason: 'no_session_key' };
+        this.recvSeq += 1;
+        const inboundDir = this.direction === 'c2p' ? 'p2c' : 'c2p';
+        const aad = buildFrameAad(this.channelId, inboundDir, this.recvSeq);
+        const plaintext = openFrame(this.sessionKey, frame, aad);
+        if (plaintext === undefined) {
+            this.opts.log?.('warn', `[E2E] frame auth failed channel=${this.channelId} seq=${this.recvSeq}`);
+            return { status: 'closed', reason: 'e2e_frame_auth_failed' };
+        }
+        try {
+            const app = JSON.parse(plaintext.toString('utf8'));
+            return { status: 'ok', app };
+        }
+        catch {
+            return { status: 'closed', reason: 'invalid_app_frame' };
+        }
+    }
+    armTimeout() {
+        this.clearTimeout();
+        const timeoutMs = this.opts.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS;
+        this.timeout = setTimeout(() => {
+            if (this.state !== 'ready' && this.state !== 'closed') {
+                this.opts.log?.('warn', `[E2E] handshake timeout channel=${this.channelId}`);
+                this.close('e2e_handshake_timeout');
+            }
+        }, timeoutMs);
+    }
+    clearTimeout() {
+        if (this.timeout !== undefined) {
+            clearTimeout(this.timeout);
+            this.timeout = undefined;
+        }
+    }
+}
+//# sourceMappingURL=secure-channel.js.map

package/lib/secure-channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-channel.js","sourceRoot":"","sources":["../src/secure-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,aAAa,EACb,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,WAAW,EACX,aAAa,EACb,aAAa,EACb,YAAY,GAGb,MAAM,aAAa,CAAA;AAmDpB,MAAM,4BAA4B,GAAG,MAAM,CAAA;AAE3C;;;GAGG;AACH,MAAM,OAAO,aAAa;IACP,IAAI,CAAsB;IACnC,KAAK,GAAiB,MAAM,CAAA;IACnB,GAAG,CAA+B;IAClC,OAAO,CAAQ;IACf,KAAK,CAAQ;IACtB,aAAa,GAAG,EAAE,CAAA;IAClB,OAAO,GAAG,EAAE,CAAA;IACZ,SAAS,GAAG,EAAE,CAAA;IACd,cAAc,GAAG,EAAE,CAAA;IACnB,UAAU,CAAoB;IAC9B,OAAO,GAAG,CAAC,CAAA;IACX,OAAO,GAAG,CAAC,CAAA;IACX,OAAO,CAA2C;IAClD,YAAY,GAAG,EAAE,CAAA;IAEzB,YAAY,OAA6B;QACvC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAA;QACnB,IAAI,CAAC,GAAG,GAAG,aAAa,EAAE,CAAA;QAC1B,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;QAClC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;YAAE,IAAI,CAAC,KAAK,GAAG,YAAY,CAAA;IAC7D,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,KAAK,KAAK,OAAO,CAAA;IAC/B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAA;IAC5B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;IACvD,CAAC;IAED,qEAAqE;IACrE,KAAK;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBACxB,CAAC,EAAE,OAAO;gBACV,CAAC,EAAE,CAAC;gBACJ,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBACvB,GAAG,EAAE,IAAI,CAAC,KAAK;gBACf,KAAK,EAAE,IAAI,CAAC,OAAO;aACpB,CAAC,CAAA;YACF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;gBACzB,OAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IAED;;;;;OAKG;IACH,OAAO,CACL,KAA8B;QAE9B,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,IAAI,QAAQ,EAAE,CAAA;QAC/F,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAA;YAC5E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC9B,CAAC;QACD,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAChC,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;YACnC,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAChC,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;YACnC;gBACE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC,GAA4B;QAC/B,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QAC7C,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;QACjB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QACvE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;QACxF,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,EAAE,CAAA;IACtC,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,MAAM,GAAG,QAAQ;QACrB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAM;QACnC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAA;QACrB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAA;QAC1B,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAEpE,WAAW,CAAC,KAA8B;QAChD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QACvD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QACvC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QACtD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,mCAAmC,IAAI,CAAC,SAAS,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;YAC/I,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;QAC9D,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,GAAa,CAAA;QACxC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAA;QAClB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAA;QACtB,IAAI,CAAC,UAAU,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QACpF,yEAAyE;QACzE,0DAA0D;QAC1D,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAA;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,CAAC,EAAE,WAAW;YACd,CAAC,EAAE,CAAC;YACJ,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,GAAG,EAAE,IAAI,CAAC,KAAK;YACf,KAAK,EAAE,IAAI,CAAC,OAAO;SACpB,CAAC,CAAA;QACF,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;QAC3D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAEO,cAAc,CAAC,KAA8B;QACnD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QACvD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QACvC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,mCAAmC,IAAI,CAAC,SAAS,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;YAC/I,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;QAC9D,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,GAAa,CAAA;QACxC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAA;QAClB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAA;QACtB,IAAI,CAAC,UAAU,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QACpF,IAAI,CAAC,KAAK,GAAG,YAAY,CAAA;QACzB,qDAAqD;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,CAAC,EAAE,OAAO;YACV,CAAC,EAAE,CAAC;YACJ,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW;YAClC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;SACf,CAAC,CAAA;QACF,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;QAC3D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAEO,WAAW,CAAC,KAA8B;QAChD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;YACtE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QACvD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,wCAAwC,IAAI,CAAC,SAAS,WAAW,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAA;YACtH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,4BAA4B,EAAE,CAAA;QACpF,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5C,iCAAiC;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,CAAC,EAAE,WAAW;YACd,CAAC,EAAE,CAAC;YACJ,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW;YAClC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;SACf,CAAC,CAAA;QACF,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;QAC3D,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAA;QACpB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,+BAA+B,IAAI,CAAC,SAAS,WAAW,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;QACpH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAEO,cAAc,CAAC,KAA8B;QACnD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QACvD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,wCAAwC,IAAI,CAAC,SAAS,WAAW,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAA;YACtH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,4BAA4B,EAAE,CAAA;QACpF,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5C,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAA;QACpB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,+BAA+B,IAAI,CAAC,SAAS,WAAW,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;QACpH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAEO,mBAAmB,CACzB,KAA8B,EAC9B,GAAqB;QAErB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAA;QAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;QACxD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAA;QAC1D,CAAC;QACD,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;QAClF,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAA;QAClD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC7D,IAAI,SAAS,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAA;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,SAAS,IAAI,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;QACtF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACrB,CAAC;IAEO,eAAe,CAAC,GAAqB;QAC3C,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAA;QAClD,OAAO,wBAAwB,CAAC;YAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG;YACH,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa;YACjE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACjE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;YAC7C,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK;YAC7C,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS;YACnD,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;SACpD,CAAC,CAAA;IACJ,CAAC;IAEO,SAAS,CAAC,KAA8B;QAC9C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QACxF,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;QACjB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;QAC3D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QACnE,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,KAAgD,EAAE,GAAG,CAAC,CAAA;QACnG,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,mCAAmC,IAAI,CAAC,SAAS,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YAChG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;QAC9D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;YAC7E,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAC1D,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,4BAA4B,CAAA;QAC9E,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,mCAAmC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;gBAC5E,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;YACrC,CAAC;QACH,CAAC,EAAE,SAAS,CAAC,CAAA;IACf,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC1B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAA;QAC1B,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@xiotbox/e2e-channel",
+  "version": "0.1.0",
+  "description": "XiotBox E2E Secure Channel — generic end-to-end encrypted relay protocol (TypeScript/Node implementation). Zero runtime dependencies (node:crypto only).",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "docs"
+  ],
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test test/*.test.js",
+    "prepare": "npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}