agentic-qe 1.1.0 → 1.2.0

package/dist/core/security/CertificateValidator.js

@@ -0,0 +1,376 @@
+"use strict";
+/**
+ * Certificate Validation and Pinning for QUIC Transport
+ *
+ * Provides comprehensive certificate validation, pinning, and security checks
+ * to prevent man-in-the-middle attacks and ensure secure communication.
+ *
+ * @module CertificateValidator
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertificateValidator = void 0;
+exports.loadSecurityConfig = loadSecurityConfig;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const tls = __importStar(require("tls"));
+const Logger_1 = require("../../utils/Logger");
+/**
+ * Certificate Validator
+ *
+ * Handles certificate validation, pinning, and security checks for QUIC transport.
+ * Prevents common TLS/QUIC security vulnerabilities.
+ */
+class CertificateValidator {
+    constructor(validationOptions, pinningOptions, environment = 'production') {
+        this.logger = Logger_1.Logger.getInstance();
+        this.validationOptions = validationOptions;
+        this.pinningOptions = pinningOptions;
+        this.environment = environment;
+        // CRITICAL: Never allow self-signed certificates in production
+        if (environment === 'production' && validationOptions.allowSelfSigned) {
+            throw new Error('SECURITY ERROR: Self-signed certificates are not allowed in production. ' +
+                'Use CA-signed certificates from Let\'s Encrypt or your organization\'s CA.');
+        }
+    }
+    /**
+     * Validate certificate file paths
+     */
+    validateCertificatePaths(certPath, keyPath, caPath) {
+        const errors = [];
+        const warnings = [];
+        // Check certificate file exists
+        if (!fs.existsSync(certPath)) {
+            errors.push(`Certificate file not found: ${certPath}`);
+        }
+        // Check private key file exists
+        if (!fs.existsSync(keyPath)) {
+            errors.push(`Private key file not found: ${keyPath}`);
+        }
+        // Check CA file if provided
+        if (caPath && !fs.existsSync(caPath)) {
+            errors.push(`CA certificate file not found: ${caPath}`);
+        }
+        // Verify file permissions (should be readable only by owner)
+        try {
+            if (fs.existsSync(keyPath)) {
+                const stats = fs.statSync(keyPath);
+                const mode = stats.mode & parseInt('777', 8);
+                // Private key should be 0600 (readable/writable by owner only)
+                if (mode !== parseInt('600', 8)) {
+                    warnings.push(`Private key file has insecure permissions: ${mode.toString(8)}. ` +
+                        'Recommended: 0600 (chmod 600 keyfile.pem)');
+                }
+            }
+        }
+        catch (error) {
+            warnings.push(`Could not check file permissions: ${error}`);
+        }
+        if (errors.length > 0) {
+            this.logger.error('Certificate path validation failed', { errors, warnings });
+            return { valid: false, errors, warnings };
+        }
+        if (warnings.length > 0) {
+            this.logger.warn('Certificate path validation warnings', { warnings });
+        }
+        return { valid: true, errors: [], warnings };
+    }
+    /**
+     * Load and validate certificate
+     */
+    loadCertificate(certPath) {
+        const certPem = fs.readFileSync(certPath, 'utf8');
+        const cert = this.parseCertificate(certPem);
+        return {
+            subject: cert.subject.CN || 'Unknown',
+            issuer: cert.issuer.CN || 'Unknown',
+            validFrom: new Date(cert.valid_from),
+            validTo: new Date(cert.valid_to),
+            fingerprint: this.calculateFingerprint(certPem),
+            isSelfSigned: this.isSelfSigned(cert),
+            isExpired: this.isExpired(cert),
+            isCAVerified: !this.isSelfSigned(cert),
+            commonName: cert.subject.CN || '',
+            subjectAltNames: cert.subjectaltname ? cert.subjectaltname.split(', ') : []
+        };
+    }
+    /**
+     * Validate certificate against security requirements
+     */
+    validateCertificate(certInfo) {
+        const errors = [];
+        const warnings = [];
+        // Check if certificate is expired
+        if (this.validationOptions.checkExpiry && certInfo.isExpired) {
+            errors.push('Certificate has expired');
+        }
+        // Check if certificate is self-signed
+        if (certInfo.isSelfSigned) {
+            if (this.environment === 'production' || !this.validationOptions.allowSelfSigned) {
+                errors.push('Self-signed certificates are not allowed. Use CA-signed certificates from ' +
+                    'Let\'s Encrypt (free) or your organization\'s Certificate Authority.');
+            }
+            else {
+                warnings.push('Using self-signed certificate (DEVELOPMENT ONLY)');
+            }
+        }
+        // Check certificate validity period
+        const now = new Date();
+        if (now < certInfo.validFrom) {
+            errors.push('Certificate is not yet valid');
+        }
+        // Warn if certificate expires soon (within 30 days)
+        const daysUntilExpiry = Math.floor((certInfo.validTo.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
+        if (daysUntilExpiry <= 30 && daysUntilExpiry > 0) {
+            warnings.push(`Certificate expires in ${daysUntilExpiry} days. Consider renewal.`);
+        }
+        // Check certificate pinning if enabled
+        if (this.pinningOptions.enabled) {
+            const pinningResult = this.validateCertificatePinning(certInfo.fingerprint);
+            if (!pinningResult.valid) {
+                errors.push(...pinningResult.errors);
+            }
+            warnings.push(...pinningResult.warnings);
+        }
+        if (errors.length > 0) {
+            this.logger.error('Certificate validation failed', {
+                errors,
+                warnings,
+                subject: certInfo.subject,
+                issuer: certInfo.issuer,
+                validTo: certInfo.validTo
+            });
+        }
+        return {
+            valid: errors.length === 0,
+            errors,
+            warnings,
+            certificateInfo: certInfo
+        };
+    }
+    /**
+     * Validate certificate pinning
+     */
+    validateCertificatePinning(fingerprint) {
+        const errors = [];
+        const warnings = [];
+        if (!this.pinningOptions.enabled) {
+            return { valid: true, errors: [], warnings: [] };
+        }
+        if (this.pinningOptions.fingerprints.length === 0) {
+            warnings.push('Certificate pinning enabled but no fingerprints configured');
+            return { valid: true, errors: [], warnings };
+        }
+        // Normalize fingerprints for comparison (remove colons, convert to lowercase)
+        const normalizedFingerprint = fingerprint.toLowerCase().replace(/:/g, '');
+        const normalizedExpected = this.pinningOptions.fingerprints.map(fp => fp.toLowerCase().replace(/:/g, ''));
+        if (!normalizedExpected.includes(normalizedFingerprint)) {
+            errors.push('Certificate fingerprint does not match pinned fingerprints. ' +
+                'This could indicate a man-in-the-middle attack or certificate change.');
+            this.logger.error('Certificate pinning validation failed', {
+                received: fingerprint,
+                expected: this.pinningOptions.fingerprints
+            });
+        }
+        return {
+            valid: errors.length === 0,
+            errors,
+            warnings
+        };
+    }
+    /**
+     * Create TLS options for secure connections
+     */
+    createTLSOptions(certPath, keyPath, caPath) {
+        // Validate paths first
+        const pathValidation = this.validateCertificatePaths(certPath, keyPath, caPath);
+        if (!pathValidation.valid) {
+            throw new Error(`Certificate path validation failed: ${pathValidation.errors.join(', ')}`);
+        }
+        // Load and validate certificate
+        const certInfo = this.loadCertificate(certPath);
+        const certValidation = this.validateCertificate(certInfo);
+        if (!certValidation.valid) {
+            throw new Error(`Certificate validation failed: ${certValidation.errors.join(', ')}`);
+        }
+        // Log warnings
+        if (certValidation.warnings.length > 0) {
+            this.logger.warn('Certificate validation warnings', {
+                warnings: certValidation.warnings
+            });
+        }
+        // Create TLS options
+        const tlsOptions = {
+            // CRITICAL: Always verify certificates in production
+            rejectUnauthorized: this.validationOptions.rejectUnauthorized,
+            // Certificate and key
+            cert: fs.readFileSync(certPath),
+            key: fs.readFileSync(keyPath),
+            // Minimum TLS version (TLS 1.3 recommended)
+            minVersion: this.validationOptions.minTLSVersion,
+            maxVersion: 'TLSv1.3',
+            // Allowed cipher suites (strong ciphers only)
+            ciphers: this.validationOptions.allowedCipherSuites?.join(':'),
+            // Prefer server cipher order
+            honorCipherOrder: true,
+            // Request certificate from peer (for mutual TLS)
+            requestCert: this.validationOptions.requireValidCertificates,
+        };
+        // Add CA if provided
+        if (caPath) {
+            tlsOptions.ca = fs.readFileSync(caPath);
+        }
+        // Add custom certificate validation if pinning is enabled
+        if (this.pinningOptions.enabled) {
+            tlsOptions.checkServerIdentity = (hostname, cert) => {
+                const fingerprint = this.calculateCertificateFingerprint(cert);
+                const pinningResult = this.validateCertificatePinning(fingerprint);
+                if (!pinningResult.valid) {
+                    return new Error(pinningResult.errors.join(', '));
+                }
+                // Also perform standard hostname verification
+                return tls.checkServerIdentity(hostname, cert);
+            };
+        }
+        return tlsOptions;
+    }
+    /**
+     * Calculate certificate fingerprint
+     */
+    calculateFingerprint(certPem) {
+        const cert = certPem.replace(/-----BEGIN CERTIFICATE-----/, '')
+            .replace(/-----END CERTIFICATE-----/, '')
+            .replace(/\s/g, '');
+        const certBuffer = Buffer.from(cert, 'base64');
+        const hash = crypto.createHash(this.pinningOptions.algorithm);
+        hash.update(certBuffer);
+        return hash.digest('hex').toUpperCase().match(/.{2}/g).join(':');
+    }
+    /**
+     * Calculate certificate fingerprint from certificate object
+     */
+    calculateCertificateFingerprint(cert) {
+        const certDer = cert.raw;
+        const hash = crypto.createHash(this.pinningOptions.algorithm);
+        hash.update(certDer);
+        return hash.digest('hex').toUpperCase().match(/.{2}/g).join(':');
+    }
+    /**
+     * Parse PEM certificate
+     */
+    parseCertificate(certPem) {
+        // This is a simplified parser. In production, use a proper X.509 parser
+        // or Node.js built-in certificate parsing
+        const cert = tls.createSecureContext({ cert: certPem }).context.getCertificate();
+        return cert || {};
+    }
+    /**
+     * Check if certificate is self-signed
+     */
+    isSelfSigned(cert) {
+        return cert.issuer?.CN === cert.subject?.CN;
+    }
+    /**
+     * Check if certificate is expired
+     */
+    isExpired(cert) {
+        const validTo = new Date(cert.valid_to);
+        return new Date() > validTo;
+    }
+    /**
+     * Generate security audit log entry
+     */
+    auditLog(event, details) {
+        this.logger.info(`[SECURITY AUDIT] ${event}`, {
+            timestamp: new Date().toISOString(),
+            environment: this.environment,
+            ...details
+        });
+    }
+}
+exports.CertificateValidator = CertificateValidator;
+/**
+ * Load security configuration from file
+ */
+function loadSecurityConfig(configPath = '.agentic-qe/config/security.json') {
+    const logger = Logger_1.Logger.getInstance();
+    try {
+        const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+        const env = process.env.NODE_ENV === 'production' ? 'production' : 'development';
+        // Use environment-specific settings
+        const envConfig = env === 'production' ? config.production : config.development;
+        return {
+            validation: {
+                requireValidCertificates: config.tls.requireValidCertificates,
+                rejectUnauthorized: config.tls.rejectUnauthorized,
+                checkExpiry: config.tls.certificateValidation.checkExpiry,
+                checkRevocation: config.tls.certificateValidation.checkRevocation,
+                allowSelfSigned: env === 'development' && envConfig.allowSelfSignedCerts,
+                minTLSVersion: config.tls.minVersion,
+                allowedCipherSuites: config.quic.security.allowedCipherSuites
+            },
+            pinning: {
+                enabled: config.tls.certificatePinning.enabled,
+                fingerprints: config.tls.certificatePinning.fingerprints,
+                algorithm: config.tls.certificatePinning.algorithm
+            }
+        };
+    }
+    catch (error) {
+        logger.warn('Could not load security config, using secure defaults', { error });
+        // Return secure defaults
+        return {
+            validation: {
+                requireValidCertificates: true,
+                rejectUnauthorized: true,
+                checkExpiry: true,
+                checkRevocation: true,
+                allowSelfSigned: false,
+                minTLSVersion: 'TLSv1.3',
+                allowedCipherSuites: [
+                    'TLS_AES_256_GCM_SHA384',
+                    'TLS_CHACHA20_POLY1305_SHA256',
+                    'TLS_AES_128_GCM_SHA256'
+                ]
+            },
+            pinning: {
+                enabled: false,
+                fingerprints: [],
+                algorithm: 'sha256'
+            }
+        };
+    }
+}
+//# sourceMappingURL=CertificateValidator.js.map

package/dist/core/security/CertificateValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CertificateValidator.js","sourceRoot":"","sources":["../../../src/core/security/CertificateValidator.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsbH,gDAqDC;AAzeD,+CAAiC;AACjC,uCAAyB;AACzB,yCAA2B;AAC3B,+CAA4C;AAkF5C;;;;;GAKG;AACH,MAAa,oBAAoB;IAM/B,YACE,iBAA+C,EAC/C,cAAyC,EACzC,cAA4C,YAAY;QAExD,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAE/B,+DAA+D;QAC/D,IAAI,WAAW,KAAK,YAAY,IAAI,iBAAiB,CAAC,eAAe,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,0EAA0E;gBAC1E,4EAA4E,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,wBAAwB,CAAC,QAAgB,EAAE,OAAe,EAAE,MAAe;QACzE,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,gCAAgC;QAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,4BAA4B;QAC5B,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE7C,+DAA+D;gBAC/D,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;oBAChC,QAAQ,CAAC,IAAI,CACX,8CAA8C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;wBAClE,2CAA2C,CAC5C,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,QAAgB;QAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE5C,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,SAAS;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,SAAS;YACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAChC,WAAW,EAAE,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YAC/C,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC/B,YAAY,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YACtC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;YACjC,eAAe,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;SAC5E,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,QAAyB;QAC3C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,kCAAkC;QAClC,IAAI,IAAI,CAAC,iBAAiB,CAAC,WAAW,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACzC,CAAC;QAED,sCAAsC;QACtC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;gBACjF,MAAM,CAAC,IAAI,CACT,4EAA4E;oBAC5E,sEAAsE,CACvE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC9C,CAAC;QAED,oDAAoD;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAChC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACrE,CAAC;QAEF,IAAI,eAAe,IAAI,EAAE,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC,0BAA0B,eAAe,0BAA0B,CAAC,CAAC;QACrF,CAAC;QAED,uCAAuC;QACvC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5E,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;gBACjD,MAAM;gBACN,QAAQ;gBACR,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,QAAQ;YACR,eAAe,EAAE,QAAQ;SAC1B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,0BAA0B,CAAC,WAAmB;QAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;QAC/C,CAAC;QAED,8EAA8E;QAC9E,MAAM,qBAAqB,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1E,MAAM,kBAAkB,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CACnE,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CACnC,CAAC;QAEF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CACT,8DAA8D;gBAC9D,uEAAuE,CACxE,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACzD,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,YAAY;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAgB,EAAE,OAAe,EAAE,MAAe;QACjE,uBAAuB;QACvB,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,uCAAuC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1E,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAE1D,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,kCAAkC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,eAAe;QACf,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAClD,QAAQ,EAAE,cAAc,CAAC,QAAQ;aAClC,CAAC,CAAC;QACL,CAAC;QAED,qBAAqB;QACrB,MAAM,UAAU,GAAmB;YACjC,qDAAqD;YACrD,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,kBAAkB;YAE7D,sBAAsB;YACtB,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;YAC/B,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC;YAE7B,4CAA4C;YAC5C,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,aAAoB;YACvD,UAAU,EAAE,SAAgB;YAE5B,8CAA8C;YAC9C,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC;YAE9D,6BAA6B;YAC7B,gBAAgB,EAAE,IAAI;YAEtB,iDAAiD;YACjD,WAAW,EAAE,IAAI,CAAC,iBAAiB,CAAC,wBAAwB;SAC7D,CAAC;QAEF,qBAAqB;QACrB,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,0DAA0D;QAC1D,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAChC,UAAU,CAAC,mBAAmB,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAClD,MAAM,WAAW,GAAG,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;gBAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;gBAEnE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;oBACzB,OAAO,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACpD,CAAC;gBAED,8CAA8C;gBAC9C,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,OAAe;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;aAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;aACxC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAExC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAExB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACK,+BAA+B,CAAC,IAAyB;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,OAAe;QACtC,wEAAwE;QACxE,0CAA0C;QAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAS,CAAC;QACxF,OAAO,IAAI,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,IAAS;QAC5B,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,IAAS;QACzB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,IAAI,IAAI,EAAE,GAAG,OAAO,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAa,EAAE,OAAY;QAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,KAAK,EAAE,EAAE;YAC5C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;CACF;AApVD,oDAoVC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAChC,aAAqB,kCAAkC;IAEvD,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;QAEjF,oCAAoC;QACpC,MAAM,SAAS,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QAEhF,OAAO;YACL,UAAU,EAAE;gBACV,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,wBAAwB;gBAC7D,kBAAkB,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB;gBACjD,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,WAAW;gBACzD,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,eAAe;gBACjE,eAAe,EAAE,GAAG,KAAK,aAAa,IAAI,SAAS,CAAC,oBAAoB;gBACxE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU;gBACpC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB;aAC9D;YACD,OAAO,EAAE;gBACP,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO;gBAC9C,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY;gBACxD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,SAAS;aACnD;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhF,yBAAyB;QACzB,OAAO;YACL,UAAU,EAAE;gBACV,wBAAwB,EAAE,IAAI;gBAC9B,kBAAkB,EAAE,IAAI;gBACxB,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,IAAI;gBACrB,eAAe,EAAE,KAAK;gBACtB,aAAa,EAAE,SAAS;gBACxB,mBAAmB,EAAE;oBACnB,wBAAwB;oBACxB,8BAA8B;oBAC9B,wBAAwB;iBACzB;aACF;YACD,OAAO,EAAE;gBACP,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,EAAE;gBAChB,SAAS,EAAE,QAAQ;aACpB;SACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/transport/QUICTransport.d.ts

@@ -0,0 +1,62 @@
+/**
+ * QUIC Transport Implementation
+ *
+ * Fallback implementation using EventBus when QUIC library is not available.
+ * In production, this would be replaced with a real QUIC implementation
+ * using libraries like @fails-components/webtransport or node-quic.
+ */
+import { EventEmitter } from 'events';
+import { IQUICTransport, QUICConfig, QUICPeerInfo, QUICMessage, QUICBroadcastOptions, QUICRequestOptions, QUICStreamOptions, QUICStreamData, QUICConnectionStats, QUICHealthCheck, QUICDiscoveryOptions } from '../../types/quic';
+/**
+ * EventBus-based QUIC Transport Fallback
+ *
+ * This implementation provides QUIC-like semantics using EventBus.
+ * It's designed to be replaced with a real QUIC transport in production.
+ */
+export declare class QUICTransport extends EventEmitter implements IQUICTransport {
+    private config?;
+    private peers;
+    private streams;
+    private pendingRequests;
+    private stats;
+    private isInitialized;
+    private readonly logger;
+    private eventBus?;
+    private discoveryInterval?;
+    constructor();
+    initialize(config: QUICConfig): Promise<void>;
+    connect(peer: string, port: number): Promise<QUICPeerInfo>;
+    disconnect(peerId: string): Promise<void>;
+    send(to: string, message: QUICMessage): Promise<void>;
+    broadcast(message: QUICMessage, options?: QUICBroadcastOptions): Promise<void>;
+    request(to: string, message: QUICMessage, options?: QUICRequestOptions): Promise<QUICMessage>;
+    private sendRequestWithRetry;
+    private sendRequest;
+    openStream(streamId: string, options?: QUICStreamOptions): Promise<void>;
+    writeStream(streamId: string, data: QUICStreamData): Promise<void>;
+    closeStream(streamId: string): Promise<void>;
+    discoverPeers(options?: QUICDiscoveryOptions): Promise<QUICPeerInfo[]>;
+    getPeers(): QUICPeerInfo[];
+    getPeer(peerId: string): QUICPeerInfo | undefined;
+    getStats(): QUICConnectionStats;
+    getHealth(): QUICHealthCheck;
+    close(): Promise<void>;
+    private ensureInitialized;
+    private getBroadcastTargets;
+    private generateRequestId;
+    private estimateMessageSize;
+    private simulateNetworkDelay;
+    private delay;
+    private createError;
+    private startDiscovery;
+    /**
+     * Handle incoming response message
+     * Called by external message handler
+     */
+    handleResponse(message: QUICMessage): void;
+    /**
+     * Set EventBus for fallback communication
+     */
+    setEventBus(eventBus: EventEmitter): void;
+}
+//# sourceMappingURL=QUICTransport.d.ts.map

package/dist/core/transport/QUICTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"QUICTransport.d.ts","sourceRoot":"","sources":["../../../src/core/transport/QUICTransport.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,eAAe,EAEf,oBAAoB,EAIrB,MAAM,kBAAkB,CAAC;AAG1B;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,YAAa,YAAW,cAAc;IACvE,OAAO,CAAC,MAAM,CAAC,CAAa;IAC5B,OAAO,CAAC,KAAK,CAAwC;IACrD,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,eAAe,CAIR;IACf,OAAO,CAAC,KAAK,CAAsB;IACnC,OAAO,CAAC,aAAa,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAe;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAAiB;;IAwBrC,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB7C,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAwB1D,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAazC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCrD,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqB9E,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC;YAarF,oBAAoB;IAkBlC,OAAO,CAAC,WAAW;IAsBb,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBxE,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBlE,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa5C,aAAa,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAY5E,QAAQ,IAAI,YAAY,EAAE;IAK1B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAIjD,QAAQ,IAAI,mBAAmB;IAW/B,SAAS,IAAI,eAAe;IAmCtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAuD5B,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,mBAAmB;IAc3B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,mBAAmB;YAIb,oBAAoB;IAMlC,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,cAAc;IAYtB;;;OAGG;IACI,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAgBjD;;OAEG;IACI,WAAW,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI;CAGjD"}