ai-remote 0.4.2 → 0.4.3

package/dist/protocols/rdp/tls.js

@@ -1,353 +0,0 @@
-import { Reader, Writer, concatBytes } from "./buffer.js";
-import { parseX509PublicKey } from "./cert.js";
-import { rsaEncryptPkcs1 } from "./crypto.js";
-const TLS_1_2 = 771;
-const RECORD = {
-  CHANGE_CIPHER_SPEC: 20,
-  ALERT: 21,
-  HANDSHAKE: 22,
-  APPLICATION_DATA: 23
-};
-const HANDSHAKE = {
-  CLIENT_HELLO: 1,
-  SERVER_HELLO: 2,
-  NEW_SESSION_TICKET: 4,
-  CERTIFICATE: 11,
-  SERVER_KEY_EXCHANGE: 12,
-  CERTIFICATE_REQUEST: 13,
-  SERVER_HELLO_DONE: 14,
-  CLIENT_KEY_EXCHANGE: 16,
-  FINISHED: 20
-};
-const CIPHER_SUITES = {
-  156: { name: "TLS_RSA_WITH_AES_128_GCM_SHA256", keyLength: 16, hash: "SHA-256" },
-  157: { name: "TLS_RSA_WITH_AES_256_GCM_SHA384", keyLength: 32, hash: "SHA-384" }
-};
-const ALERT_DESCRIPTIONS = {
-  0: "close_notify",
-  10: "unexpected_message",
-  20: "bad_record_mac",
-  40: "handshake_failure",
-  42: "bad_certificate",
-  46: "certificate_unknown",
-  47: "illegal_parameter",
-  48: "unknown_ca",
-  50: "decode_error",
-  51: "decrypt_error",
-  70: "protocol_version",
-  71: "insufficient_security",
-  80: "internal_error",
-  90: "user_canceled",
-  109: "missing_extension",
-  112: "unrecognized_name"
-};
-const ascii = (text) => new TextEncoder().encode(text);
-function u16(value) {
-  return new Uint8Array([value >> 8 & 255, value & 255]);
-}
-function u24(value) {
-  return new Uint8Array([value >> 16 & 255, value >> 8 & 255, value & 255]);
-}
-function u64(value) {
-  const out = new Uint8Array(8);
-  new DataView(out.buffer).setBigUint64(0, BigInt(value));
-  return out;
-}
-async function pHash(hash, secret, seed, length) {
-  const key = await crypto.subtle.importKey("raw", secret, { name: "HMAC", hash }, false, ["sign"]);
-  const hmac = async (data) => new Uint8Array(await crypto.subtle.sign("HMAC", key, data));
-  const blocks = [];
-  let produced = 0;
-  let a = await hmac(seed);
-  while (produced < length) {
-    const block = await hmac(concatBytes(a, seed));
-    blocks.push(block);
-    produced += block.length;
-    a = await hmac(a);
-  }
-  return concatBytes(...blocks).subarray(0, length);
-}
-const prf = (hash, secret, label, seed, length) => pHash(hash, secret, concatBytes(ascii(label), seed), length);
-class Tls12Client {
-  /**
-   * @param {(bytes: Uint8Array) => void} send        write raw bytes to the transport
-   * @param {(bytes: Uint8Array) => void} onData      decrypted application data
-   * @param {(error: Error) => void} onError          fatal protocol failure
-   */
-  constructor({ send, onData, onError }) {
-    this.sendRaw = send;
-    this.onData = onData;
-    this.onError = onError;
-    this.inbound = new Uint8Array(0);
-    this.transcript = [];
-    this.established = false;
-    this.serverPublicKey = null;
-    this.suite = null;
-    this.certificates = [];
-    this.readSequence = 0n;
-    this.writeSequence = 0n;
-    this.readEncrypted = false;
-    this.writeEncrypted = false;
-    this.queue = Promise.resolve();
-    this.handshakeDone = new Promise((resolve, reject) => {
-      this.resolveHandshake = resolve;
-      this.rejectHandshake = reject;
-    });
-  }
-  // --- handshake ------------------------------------------------------------
-  async start() {
-    this.clientRandom = new Uint8Array(32);
-    crypto.getRandomValues(this.clientRandom);
-    const extensions = concatBytes(
-      // signature_algorithms: rsa with sha256, sha384, sha1
-      u16(13),
-      u16(10),
-      u16(8),
-      new Uint8Array([4, 1, 5, 1, 2, 1, 6, 1]),
-      // renegotiation_info: empty, which Schannel expects to see
-      u16(65281),
-      u16(1),
-      new Uint8Array([0])
-    );
-    const body = concatBytes(
-      u16(TLS_1_2),
-      this.clientRandom,
-      new Uint8Array([0]),
-      // no session id
-      u16(4),
-      u16(156),
-      u16(157),
-      // cipher suites
-      new Uint8Array([1, 0]),
-      // compression: null
-      u16(extensions.length),
-      extensions
-    );
-    await this.#sendHandshake(HANDSHAKE.CLIENT_HELLO, body);
-    return this.handshakeDone;
-  }
-  #record(type, payload) {
-    return concatBytes(new Uint8Array([type]), u16(TLS_1_2), u16(payload.length), payload);
-  }
-  async #sendHandshake(type, body) {
-    const message = concatBytes(new Uint8Array([type]), u24(body.length), body);
-    this.transcript.push(message);
-    await this.#sendRecord(RECORD.HANDSHAKE, message);
-  }
-  async #sendRecord(type, payload) {
-    if (!this.writeEncrypted) {
-      this.sendRaw(this.#record(type, payload));
-      return;
-    }
-    this.sendRaw(this.#record(type, await this.#seal(type, payload)));
-  }
-  /** AES-GCM record protection (RFC 5288): explicit nonce, then ciphertext. */
-  async #seal(type, plaintext) {
-    const sequence = this.writeSequence++;
-    const explicitNonce = u64(sequence);
-    const iv = concatBytes(this.keys.clientIv, explicitNonce);
-    const aad = concatBytes(u64(sequence), new Uint8Array([type]), u16(TLS_1_2), u16(plaintext.length));
-    const sealed = await crypto.subtle.encrypt(
-      { name: "AES-GCM", iv, additionalData: aad, tagLength: 128 },
-      this.keys.clientKey,
-      plaintext
-    );
-    return concatBytes(explicitNonce, new Uint8Array(sealed));
-  }
-  async #open(type, fragment) {
-    const sequence = this.readSequence++;
-    const explicitNonce = fragment.subarray(0, 8);
-    const ciphertext = fragment.subarray(8);
-    const iv = concatBytes(this.keys.serverIv, explicitNonce);
-    const aad = concatBytes(
-      u64(sequence),
-      new Uint8Array([type]),
-      u16(TLS_1_2),
-      u16(ciphertext.length - 16)
-    );
-    const opened = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv, additionalData: aad, tagLength: 128 },
-      this.keys.serverKey,
-      ciphertext
-    );
-    return new Uint8Array(opened);
-  }
-  async #deriveKeys(preMasterSecret) {
-    const { hash, keyLength } = this.suite;
-    this.masterSecret = await prf(
-      hash,
-      preMasterSecret,
-      "master secret",
-      concatBytes(this.clientRandom, this.serverRandom),
-      48
-    );
-    const keyBlock = await prf(
-      hash,
-      this.masterSecret,
-      "key expansion",
-      concatBytes(this.serverRandom, this.clientRandom),
-      keyLength * 2 + 8
-    );
-    const reader = new Reader(keyBlock);
-    const clientKeyBytes = reader.raw(keyLength);
-    const serverKeyBytes = reader.raw(keyLength);
-    this.keys = {
-      clientKey: await crypto.subtle.importKey("raw", clientKeyBytes, "AES-GCM", false, ["encrypt"]),
-      serverKey: await crypto.subtle.importKey("raw", serverKeyBytes, "AES-GCM", false, ["decrypt"]),
-      clientIv: reader.raw(4).slice(),
-      serverIv: reader.raw(4).slice()
-    };
-  }
-  async #transcriptHash() {
-    const digest = await crypto.subtle.digest(this.suite.hash, concatBytes(...this.transcript));
-    return new Uint8Array(digest);
-  }
-  async #verifyData(label) {
-    return prf(this.suite.hash, this.masterSecret, label, await this.#transcriptHash(), 12);
-  }
-  // --- inbound --------------------------------------------------------------
-  /** Feed transport bytes. Calls are serialized, so order is preserved. */
-  receive(bytes) {
-    this.queue = this.queue.then(() => this.#consume(bytes)).catch((error) => this.#fail(error));
-    return this.queue;
-  }
-  #fail(error) {
-    const failure = error instanceof Error ? error : new Error(String(error));
-    this.rejectHandshake(failure);
-    if (this.onError) this.onError(failure);
-  }
-  async #consume(bytes) {
-    this.inbound = this.inbound.length === 0 ? bytes : concatBytes(this.inbound, bytes);
-    while (this.inbound.length >= 5) {
-      const type = this.inbound[0];
-      const length = this.inbound[3] << 8 | this.inbound[4];
-      if (this.inbound.length < 5 + length) return;
-      const fragment = this.inbound.subarray(5, 5 + length);
-      this.inbound = this.inbound.subarray(5 + length).slice();
-      const payload = this.readEncrypted && type !== RECORD.CHANGE_CIPHER_SPEC ? await this.#open(type, fragment) : fragment;
-      await this.#handleRecord(type, payload);
-    }
-  }
-  async #handleRecord(type, payload) {
-    if (type === RECORD.ALERT) {
-      const level = payload[0];
-      const description = payload[1];
-      const name = ALERT_DESCRIPTIONS[description] || `alert ${description}`;
-      if (name === "close_notify") {
-        this.established = false;
-        return;
-      }
-      throw new Error(`TLS: the host sent a fatal alert: ${name}${level === 1 ? " (warning)" : ""}`);
-    }
-    if (type === RECORD.CHANGE_CIPHER_SPEC) {
-      this.readEncrypted = true;
-      this.readSequence = 0n;
-      return;
-    }
-    if (type === RECORD.APPLICATION_DATA) {
-      if (this.onData && payload.length > 0) this.onData(payload);
-      return;
-    }
-    if (type !== RECORD.HANDSHAKE) return;
-    let offset = 0;
-    while (offset + 4 <= payload.length) {
-      const messageType = payload[offset];
-      const length = payload[offset + 1] << 16 | payload[offset + 2] << 8 | payload[offset + 3];
-      const message = payload.subarray(offset, offset + 4 + length);
-      const body = payload.subarray(offset + 4, offset + 4 + length);
-      offset += 4 + length;
-      if (messageType !== HANDSHAKE.FINISHED) this.transcript.push(message);
-      await this.#handleHandshake(messageType, body, message);
-    }
-  }
-  async #handleHandshake(type, body, message) {
-    switch (type) {
-      case HANDSHAKE.SERVER_HELLO: {
-        const reader = new Reader(body);
-        const version = reader.u16be();
-        if (version !== TLS_1_2) {
-          throw new Error(`TLS: the host chose an unsupported version 0x${version.toString(16)}`);
-        }
-        this.serverRandom = reader.raw(32).slice();
-        reader.raw(reader.u8());
-        const suiteId = reader.u16be();
-        this.suite = CIPHER_SUITES[suiteId];
-        if (!this.suite) {
-          throw new Error(`TLS: the host chose cipher suite 0x${suiteId.toString(16)}, which this client does not implement`);
-        }
-        reader.u8();
-        return;
-      }
-      case HANDSHAKE.CERTIFICATE: {
-        const reader = new Reader(body);
-        const totalLength = reader.u8() << 16 | reader.u16be();
-        const end = reader.offset + totalLength;
-        while (reader.offset < end) {
-          const certificateLength = reader.u8() << 16 | reader.u16be();
-          this.certificates.push(reader.raw(certificateLength).slice());
-        }
-        if (this.certificates.length === 0) throw new Error("TLS: the host sent no certificate");
-        this.serverPublicKey = parseX509PublicKey(this.certificates[0]);
-        return;
-      }
-      case HANDSHAKE.CERTIFICATE_REQUEST:
-        this.certificateRequested = true;
-        return;
-      case HANDSHAKE.SERVER_KEY_EXCHANGE:
-        throw new Error("TLS: the host chose an ephemeral key exchange, which this client does not implement");
-      case HANDSHAKE.SERVER_HELLO_DONE:
-        await this.#finishClientHandshake();
-        return;
-      case HANDSHAKE.NEW_SESSION_TICKET:
-        return;
-      case HANDSHAKE.FINISHED: {
-        const expected = await this.#verifyData("server finished");
-        const actual = body.subarray(0, 12);
-        const matches = expected.length === actual.length && expected.every((byte, i) => byte === actual[i]);
-        if (!matches) throw new Error("TLS: the host Finished message did not verify");
-        this.transcript.push(message);
-        this.established = true;
-        this.resolveHandshake({
-          cipherSuite: this.suite.name,
-          certificates: this.certificates,
-          publicKey: this.serverPublicKey
-        });
-        return;
-      }
-      default:
-        return;
-    }
-  }
-  async #finishClientHandshake() {
-    if (this.certificateRequested) {
-      await this.#sendHandshake(HANDSHAKE.CERTIFICATE, u24(0));
-    }
-    const preMasterSecret = new Uint8Array(48);
-    crypto.getRandomValues(preMasterSecret);
-    preMasterSecret[0] = 3;
-    preMasterSecret[1] = 3;
-    const encrypted = rsaEncryptPkcs1(
-      preMasterSecret,
-      this.serverPublicKey.modulus,
-      this.serverPublicKey.exponent
-    );
-    await this.#sendHandshake(HANDSHAKE.CLIENT_KEY_EXCHANGE, concatBytes(u16(encrypted.length), encrypted));
-    await this.#deriveKeys(preMasterSecret);
-    await this.#sendRecord(RECORD.CHANGE_CIPHER_SPEC, new Uint8Array([1]));
-    this.writeEncrypted = true;
-    this.writeSequence = 0n;
-    await this.#sendHandshake(HANDSHAKE.FINISHED, await this.#verifyData("client finished"));
-  }
-  // --- outbound -------------------------------------------------------------
-  /** Send application data once the handshake has completed. */
-  write(plaintext) {
-    this.queue = this.queue.then(async () => {
-      if (!this.established) throw new Error("TLS: write before the handshake finished");
-      await this.#sendRecord(RECORD.APPLICATION_DATA, plaintext);
-    }).catch((error) => this.#fail(error));
-    return this.queue;
-  }
-}
-export {
-  Tls12Client
-};

package/dist/protocols/rdp/vchannel.d.ts

@@ -1,28 +0,0 @@
-/** Channel option bits used when the channel is declared in Client Network Data. */
-export declare const CHANNEL_OPTION: {
-    INITIALIZED: number;
-    ENCRYPT_RDP: number;
-    COMPRESS_RDP: number;
-    SHOW_PROTOCOL: number;
-};
-export declare const CHANNEL_FLAG_SHOW_PROTOCOL = 16;
-/** What RDP itself uses; a host may accept more, but never needs to. */
-export declare const CHANNEL_CHUNK_LENGTH = 1600;
-/**
- * Split one logical channel message into wire chunks, each already carrying its
- * CHANNEL_PDU_HEADER. An empty message still produces one chunk, because the
- * header is what tells the host anything happened at all.
- */
-export declare function chunkChannelData(data: Uint8Array, chunkSize?: number, extraFlags?: number): any[];
-/**
- * Reassemble inbound chunks into whole messages. A chunk that arrives without a
- * preceding FIRST is treated as its own message rather than dropped: some hosts
- * send small PDUs with both flags set and others with neither.
- */
-export declare class ChannelReassembler {
-    private parts;
-    private expectedLength;
-    constructor();
-    /** Returns the completed message, or null while more chunks are pending. */
-    push(bytes: Uint8Array): Uint8Array<ArrayBufferLike>;
-}

package/dist/protocols/rdp/vchannel.js

@@ -1,58 +0,0 @@
-import { Reader, Writer, concatBytes } from "./buffer.js";
-const CHANNEL_OPTION = {
-  INITIALIZED: 2147483648,
-  ENCRYPT_RDP: 1073741824,
-  COMPRESS_RDP: 8388608,
-  SHOW_PROTOCOL: 2097152
-};
-const CHANNEL_FLAG_FIRST = 1;
-const CHANNEL_FLAG_LAST = 2;
-const CHANNEL_FLAG_SHOW_PROTOCOL = 16;
-const CHANNEL_CHUNK_LENGTH = 1600;
-function chunkChannelData(data, chunkSize = CHANNEL_CHUNK_LENGTH, extraFlags = 0) {
-  const chunks = [];
-  for (let offset = 0; offset < data.length || offset === 0; offset += chunkSize) {
-    const slice = data.subarray(offset, offset + chunkSize);
-    let flags = extraFlags;
-    if (offset === 0) flags |= CHANNEL_FLAG_FIRST;
-    if (offset + chunkSize >= data.length) flags |= CHANNEL_FLAG_LAST;
-    const writer = new Writer(slice.length + 8);
-    writer.u32le(data.length).u32le(flags).raw(slice);
-    chunks.push(writer.take());
-    if (data.length === 0) break;
-  }
-  return chunks;
-}
-class ChannelReassembler {
-  parts;
-  expectedLength;
-  constructor() {
-    this.parts = [];
-    this.expectedLength = 0;
-  }
-  /** Returns the completed message, or null while more chunks are pending. */
-  push(bytes) {
-    if (bytes.length < 8) return null;
-    const reader = new Reader(bytes);
-    const totalLength = reader.u32le();
-    const flags = reader.u32le();
-    const data = reader.rest();
-    if (flags & CHANNEL_FLAG_FIRST) {
-      this.parts = [];
-      this.expectedLength = totalLength;
-    }
-    this.parts.push(data.slice());
-    const complete = (flags & CHANNEL_FLAG_LAST) !== 0;
-    if (!complete) return null;
-    const message = concatBytes(...this.parts);
-    this.parts = [];
-    return this.expectedLength && this.expectedLength < message.length ? message.subarray(0, this.expectedLength) : message;
-  }
-}
-export {
-  CHANNEL_CHUNK_LENGTH,
-  CHANNEL_FLAG_SHOW_PROTOCOL,
-  CHANNEL_OPTION,
-  ChannelReassembler,
-  chunkChannelData
-};

package/dist/protocols/rdp/x224.d.ts

@@ -1,40 +0,0 @@
-export declare const TPKT_VERSION = 3;
-export declare const TPKT_HEADER_LENGTH = 4;
-export declare const NEG_FAILURE: {
-    SSL_REQUIRED: number;
-    SSL_NOT_ALLOWED: number;
-    SSL_CERT_NOT_ON_SERVER: number;
-    INCONSISTENT_FLAGS: number;
-    HYBRID_REQUIRED: number;
-    SSL_WITH_USER_AUTH_REQUIRED: number;
-};
-export declare const NEG_PROTOCOL: {
-    RDP: number;
-    SSL: number;
-    HYBRID: number;
-    RDSTLS: number;
-    HYBRID_EX: number;
-};
-/** X.224 Connection Request, carrying the protocols this client will accept. */
-export declare function connectionRequest(requestedProtocols: number): Uint8Array<ArrayBufferLike>;
-/**
- * Read the X.224 Connection Confirm. Throws with the host's own explanation
- * when it refuses the requested protocol.
- */
-export declare function parseConnectionConfirm(frame: Uint8Array): {
-    selectedProtocol: number;
-    negotiated: boolean;
-};
-/** Wrap a payload in TPKT + X.224 Data. */
-export declare function dataFrame(payload: Uint8Array): Uint8Array<ArrayBufferLike>;
-/** Strip TPKT + X.224 Data headers from a complete frame. */
-export declare function dataPayload(frame: Uint8Array): Uint8Array<ArrayBufferLike>;
-/**
- * Split a byte stream into whole frames. RDP interleaves two framings on one
- * connection: TPKT (first byte 0x03) and fast-path output (any other value),
- * each with its own length encoding.
- */
-export declare function splitFrames(buffer: Uint8Array): {
-    frames: any[];
-    rest: Uint8Array<ArrayBufferLike>;
-};

package/dist/protocols/rdp/x224.js

@@ -1,109 +0,0 @@
-import { Reader, Writer } from "./buffer.js";
-const TPKT_VERSION = 3;
-const TPKT_HEADER_LENGTH = 4;
-const X224_CONNECTION_REQUEST = 224;
-const X224_CONNECTION_CONFIRM = 208;
-const X224_DATA = 240;
-const RDP_NEG_REQ = 1;
-const RDP_NEG_RSP = 2;
-const RDP_NEG_FAILURE = 3;
-const NEG_FAILURE = {
-  SSL_REQUIRED: 1,
-  SSL_NOT_ALLOWED: 2,
-  SSL_CERT_NOT_ON_SERVER: 3,
-  INCONSISTENT_FLAGS: 4,
-  HYBRID_REQUIRED: 5,
-  SSL_WITH_USER_AUTH_REQUIRED: 6
-};
-const NEG_PROTOCOL = {
-  RDP: 0,
-  SSL: 1,
-  HYBRID: 2,
-  RDSTLS: 4,
-  HYBRID_EX: 8
-};
-const NEG_FAILURE_MESSAGES = {
-  1: "The host requires TLS. Choose the TLS security option for this target.",
-  2: 'The host does not allow TLS. Choose the "RDP (standard)" security option.',
-  3: "The host has no certificate installed, so it cannot negotiate TLS.",
-  4: "The host rejected the requested protocol flags as inconsistent.",
-  5: 'The host requires Network Level Authentication (NLA/CredSSP). Turn NLA off on the host, or set its security layer to "RDP".',
-  6: "The host requires TLS with early user authentication, which this gateway does not support."
-};
-function connectionRequest(requestedProtocols) {
-  const writer = new Writer(32);
-  writer.u8(TPKT_VERSION).u8(0).u16be(19);
-  writer.u8(14).u8(X224_CONNECTION_REQUEST).u16be(0).u16be(0).u8(0);
-  writer.u8(RDP_NEG_REQ).u8(0).u16le(8).u32le(requestedProtocols);
-  return writer.take();
-}
-function parseConnectionConfirm(frame) {
-  const reader = new Reader(frame);
-  reader.skip(TPKT_HEADER_LENGTH);
-  reader.u8();
-  const code = reader.u8();
-  if (code !== X224_CONNECTION_CONFIRM) {
-    throw new Error(`RDP: expected an X.224 connection confirm, got TPDU code 0x${code.toString(16)}`);
-  }
-  reader.skip(5);
-  if (reader.remaining < 8) return { selectedProtocol: NEG_PROTOCOL.RDP, negotiated: false };
-  const type = reader.u8();
-  reader.u8();
-  reader.u16le();
-  if (type === RDP_NEG_FAILURE) {
-    const failureCode = reader.u32le();
-    const error = new Error(
-      NEG_FAILURE_MESSAGES[failureCode] || `The host refused the RDP connection (negotiation failure 0x${failureCode.toString(16)}).`
-    );
-    error.negotiationFailure = failureCode;
-    throw error;
-  }
-  if (type !== RDP_NEG_RSP) {
-    return { selectedProtocol: NEG_PROTOCOL.RDP, negotiated: false };
-  }
-  return { selectedProtocol: reader.u32le(), negotiated: true };
-}
-function dataFrame(payload) {
-  const writer = new Writer(payload.length + 7);
-  writer.u8(TPKT_VERSION).u8(0).u16be(payload.length + 7);
-  writer.u8(2).u8(X224_DATA).u8(128);
-  writer.raw(payload);
-  return writer.take();
-}
-function dataPayload(frame) {
-  if (frame.length < 7) throw new Error("RDP: X.224 data frame is too short");
-  return frame.subarray(7);
-}
-function splitFrames(buffer) {
-  const frames = [];
-  let offset = 0;
-  while (buffer.length - offset >= 4) {
-    let frameLength;
-    let fastPath = false;
-    if (buffer[offset] === TPKT_VERSION) {
-      frameLength = buffer[offset + 2] << 8 | buffer[offset + 3];
-      if (frameLength < TPKT_HEADER_LENGTH) {
-        throw new Error("RDP: malformed TPKT length");
-      }
-    } else {
-      fastPath = true;
-      frameLength = buffer[offset + 1] & 128 ? (buffer[offset + 1] & 127) << 8 | buffer[offset + 2] : buffer[offset + 1];
-      if (frameLength < 2) throw new Error("RDP: malformed fast-path length");
-    }
-    if (buffer.length - offset < frameLength) break;
-    frames.push({ fastPath, frame: buffer.subarray(offset, offset + frameLength) });
-    offset += frameLength;
-  }
-  return { frames, rest: buffer.subarray(offset) };
-}
-export {
-  NEG_FAILURE,
-  NEG_PROTOCOL,
-  TPKT_HEADER_LENGTH,
-  TPKT_VERSION,
-  connectionRequest,
-  dataFrame,
-  dataPayload,
-  parseConnectionConfirm,
-  splitFrames
-};

package/dist/protocols/ssh/kex.d.ts

@@ -1,97 +0,0 @@
-/** Key exchange methods, best first. All of them hash with SHA-256. */
-export declare const KEX_ALGORITHMS: {
-    'curve25519-sha256': {
-        type: string;
-        hash: string;
-    };
-    'curve25519-sha256@libssh.org': {
-        type: string;
-        hash: string;
-    };
-    'ecdh-sha2-nistp256': {
-        type: string;
-        curve: string;
-        hash: string;
-    };
-};
-/**
- * Host key signature algorithms. `keyType` is what appears inside the key blob;
- * a modern RSA key is signed with SHA-256 or SHA-512 but still calls itself
- * ssh-rsa, so the two names differ there.
- */
-export declare const HOST_KEY_ALGORITHMS: {
-    'ssh-ed25519': {
-        keyType: string;
-        kind: string;
-    };
-    'rsa-sha2-512': {
-        keyType: string;
-        kind: string;
-        hash: string;
-    };
-    'rsa-sha2-256': {
-        keyType: string;
-        kind: string;
-        hash: string;
-    };
-    'ecdsa-sha2-nistp256': {
-        keyType: string;
-        kind: string;
-        curve: string;
-        hash: string;
-    };
-};
-/**
- * What this browser can actually do. X25519 and Ed25519 are recent additions to
- * Web Crypto, so they are probed rather than assumed; the NIST curve and RSA
- * have been there all along and always keep the session possible.
- */
-export declare function negotiableAlgorithms(): Promise<any>;
-/** The client half of one key exchange. */
-export declare function createKexClient(algorithmName: string): Promise<{
-    hash: any;
-    publicKey: Uint8Array<ArrayBuffer>;
-    sharedSecret(serverPublicKey: any): Promise<Uint8Array<ArrayBuffer>>;
-}>;
-/** The key type named inside a host key blob, which the algorithm must match. */
-export declare function hostKeyType(keyBlob: Uint8Array): string;
-/** The SHA256:… fingerprint OpenSSH prints, so a user can compare it. */
-export declare function hostKeyFingerprint(keyBlob: Uint8Array): Promise<string>;
-/**
- * Check that the host owns the key it presented, by verifying its signature
- * over the exchange hash. A failure here is fatal: it is what stands between
- * the session and a machine in the middle of it.
- */
-export declare function verifyHostKeySignature({ algorithm, keyBlob, signatureBlob, exchangeHash }: {
-    algorithm: any;
-    exchangeHash: any;
-    keyBlob: any;
-    signatureBlob: any;
-}): Promise<boolean>;
-/**
- * The exchange hash H (RFC 4253 section 8), which both sides compute from the
- * same inputs and the host signs.
- */
-export declare function exchangeHash({ hash, clientVersion, serverVersion, clientKexInit, serverKexInit, hostKeyBlob, clientPublicKey, serverPublicKey, sharedSecret, }: {
-    clientKexInit: any;
-    clientPublicKey: any;
-    clientVersion: any;
-    hash: any;
-    hostKeyBlob: any;
-    serverKexInit: any;
-    serverPublicKey: any;
-    serverVersion: any;
-    sharedSecret: any;
-}): Promise<Uint8Array<ArrayBuffer>>;
-/**
- * Derive one key from the exchange (RFC 4253 section 7.2), extending it with
- * further hash rounds when the cipher wants more bytes than one digest.
- */
-export declare function deriveKey({ hash, sharedSecret, exchangeHash: h, letter, sessionId, length }: {
-    exchangeHash: any;
-    hash: any;
-    length: any;
-    letter: any;
-    sessionId: any;
-    sharedSecret: any;
-}): Promise<Uint8Array<ArrayBuffer>>;