ai-remote 0.4.2 → 0.4.3

package/dist/protocols/ssh/kex.js

@@ -1,176 +0,0 @@
-import { SshReader, SshWriter, concatBytes, padStart, toBase64, toBase64Url } from "./wire.js";
-const subtle = globalThis.crypto?.subtle;
-const KEX_ALGORITHMS = {
-  "curve25519-sha256": { type: "x25519", hash: "SHA-256" },
-  "curve25519-sha256@libssh.org": { type: "x25519", hash: "SHA-256" },
-  "ecdh-sha2-nistp256": { type: "ecdh", curve: "P-256", hash: "SHA-256" }
-};
-const HOST_KEY_ALGORITHMS = {
-  "ssh-ed25519": { keyType: "ssh-ed25519", kind: "ed25519" },
-  "rsa-sha2-512": { keyType: "ssh-rsa", kind: "rsa", hash: "SHA-512" },
-  "rsa-sha2-256": { keyType: "ssh-rsa", kind: "rsa", hash: "SHA-256" },
-  "ecdsa-sha2-nistp256": { keyType: "ecdsa-sha2-nistp256", kind: "ecdsa", curve: "P-256", hash: "SHA-256" }
-};
-async function supports(algorithm, usages) {
-  if (!subtle) return false;
-  try {
-    await subtle.generateKey(algorithm, false, usages);
-    return true;
-  } catch {
-    return false;
-  }
-}
-let cachedOffer = null;
-async function negotiableAlgorithms() {
-  if (cachedOffer) return cachedOffer;
-  const [x25519, ed25519] = await Promise.all([
-    supports({ name: "X25519" }, ["deriveBits"]),
-    supports({ name: "Ed25519" }, ["sign", "verify"])
-  ]);
-  const kex = [];
-  if (x25519) kex.push("curve25519-sha256", "curve25519-sha256@libssh.org");
-  kex.push("ecdh-sha2-nistp256");
-  const hostKey = [];
-  if (ed25519) hostKey.push("ssh-ed25519");
-  hostKey.push("rsa-sha2-512", "rsa-sha2-256", "ecdsa-sha2-nistp256");
-  cachedOffer = { kex, hostKey, x25519, ed25519 };
-  return cachedOffer;
-}
-async function createKexClient(algorithmName) {
-  const algorithm = KEX_ALGORITHMS[algorithmName];
-  if (!algorithm) throw new Error(`SSH: unsupported key exchange ${algorithmName}`);
-  if (algorithm.type === "x25519") {
-    const pair2 = await subtle.generateKey({ name: "X25519" }, false, ["deriveBits"]);
-    const publicKey2 = new Uint8Array(await subtle.exportKey("raw", pair2.publicKey));
-    return {
-      hash: algorithm.hash,
-      publicKey: publicKey2,
-      async sharedSecret(serverPublicKey) {
-        if (serverPublicKey.length !== 32) throw new Error("SSH: the host sent a malformed X25519 key.");
-        const peer = await subtle.importKey("raw", serverPublicKey, { name: "X25519" }, false, []);
-        const secret = new Uint8Array(await subtle.deriveBits({ name: "X25519", public: peer }, pair2.privateKey, 256));
-        if (secret.every((byte) => byte === 0)) {
-          throw new Error("SSH: the host sent a degenerate X25519 key.");
-        }
-        return secret;
-      }
-    };
-  }
-  const pair = await subtle.generateKey({ name: "ECDH", namedCurve: algorithm.curve }, false, ["deriveBits"]);
-  const publicKey = new Uint8Array(await subtle.exportKey("raw", pair.publicKey));
-  return {
-    hash: algorithm.hash,
-    publicKey,
-    async sharedSecret(serverPublicKey) {
-      const peer = await subtle.importKey(
-        "raw",
-        serverPublicKey,
-        { name: "ECDH", namedCurve: algorithm.curve },
-        false,
-        []
-      );
-      return new Uint8Array(await subtle.deriveBits({ name: "ECDH", public: peer }, pair.privateKey, 256));
-    }
-  };
-}
-function hostKeyType(keyBlob) {
-  return new SshReader(keyBlob).string();
-}
-async function hostKeyFingerprint(keyBlob) {
-  const digest = new Uint8Array(await subtle.digest("SHA-256", keyBlob));
-  return `SHA256:${toBase64(digest).replace(/=+$/, "")}`;
-}
-async function importHostKey(algorithmName, keyBlob) {
-  const algorithm = HOST_KEY_ALGORITHMS[algorithmName];
-  if (!algorithm) throw new Error(`SSH: unsupported host key algorithm ${algorithmName}`);
-  const reader = new SshReader(keyBlob);
-  const keyType = reader.string();
-  if (keyType !== algorithm.keyType) {
-    throw new Error(`SSH: the host key is a ${keyType} but was announced as ${algorithmName}.`);
-  }
-  if (algorithm.kind === "ed25519") {
-    return subtle.importKey("raw", reader.stringBytes(), { name: "Ed25519" }, false, ["verify"]);
-  }
-  if (algorithm.kind === "rsa") {
-    const exponent = reader.mpint();
-    const modulus = reader.mpint();
-    return subtle.importKey(
-      "jwk",
-      { kty: "RSA", n: toBase64Url(modulus), e: toBase64Url(exponent), ext: true },
-      { name: "RSASSA-PKCS1-v1_5", hash: algorithm.hash },
-      false,
-      ["verify"]
-    );
-  }
-  reader.string();
-  return subtle.importKey(
-    "raw",
-    reader.stringBytes(),
-    { name: "ECDSA", namedCurve: algorithm.curve },
-    false,
-    ["verify"]
-  );
-}
-function signatureBytes(algorithmName, signatureBlob) {
-  const reader = new SshReader(signatureBlob);
-  const named = reader.string();
-  if (named !== algorithmName) {
-    throw new Error(`SSH: the host signed with ${named} after agreeing on ${algorithmName}.`);
-  }
-  const raw = reader.stringBytes();
-  if (HOST_KEY_ALGORITHMS[algorithmName]?.kind !== "ecdsa") return raw;
-  const parts = new SshReader(raw);
-  const r = parts.mpint();
-  const s = parts.mpint();
-  return concatBytes(padStart(r, 32), padStart(s, 32));
-}
-async function verifyHostKeySignature({ algorithm, keyBlob, signatureBlob, exchangeHash: exchangeHash2 }) {
-  const { kind, hash } = HOST_KEY_ALGORITHMS[algorithm];
-  const key = await importHostKey(algorithm, keyBlob);
-  const signature = signatureBytes(algorithm, signatureBlob);
-  const parameters = kind === "ecdsa" ? { name: "ECDSA", hash } : kind === "rsa" ? { name: "RSASSA-PKCS1-v1_5" } : { name: "Ed25519" };
-  return subtle.verify(parameters, key, signature, exchangeHash2);
-}
-async function exchangeHash({
-  hash,
-  clientVersion,
-  serverVersion,
-  clientKexInit,
-  serverKexInit,
-  hostKeyBlob,
-  clientPublicKey,
-  serverPublicKey,
-  sharedSecret
-}) {
-  const writer = new SshWriter(1024);
-  writer.string(clientVersion);
-  writer.string(serverVersion);
-  writer.string(clientKexInit);
-  writer.string(serverKexInit);
-  writer.string(hostKeyBlob);
-  writer.string(clientPublicKey);
-  writer.string(serverPublicKey);
-  writer.mpint(sharedSecret);
-  return new Uint8Array(await subtle.digest(hash, writer.take()));
-}
-async function deriveKey({ hash, sharedSecret, exchangeHash: h, letter, sessionId, length }) {
-  const prefix = new SshWriter(64 + h.length).mpint(sharedSecret).take();
-  const seed = concatBytes(prefix, h, new Uint8Array([letter.charCodeAt(0)]), sessionId);
-  let material = new Uint8Array(await subtle.digest(hash, seed));
-  while (material.length < length) {
-    const extension = new Uint8Array(await subtle.digest(hash, concatBytes(prefix, h, material)));
-    material = concatBytes(material, extension);
-  }
-  return material.subarray(0, length);
-}
-export {
-  HOST_KEY_ALGORITHMS,
-  KEX_ALGORITHMS,
-  createKexClient,
-  deriveKey,
-  exchangeHash,
-  hostKeyFingerprint,
-  hostKeyType,
-  negotiableAlgorithms,
-  verifyHostKeySignature
-};

package/dist/protocols/ssh/messages.d.ts

@@ -1,50 +0,0 @@
-export declare const MSG: {
-    DISCONNECT: number;
-    IGNORE: number;
-    UNIMPLEMENTED: number;
-    DEBUG: number;
-    SERVICE_REQUEST: number;
-    SERVICE_ACCEPT: number;
-    EXT_INFO: number;
-    KEXINIT: number;
-    NEWKEYS: number;
-    KEX_ECDH_INIT: number;
-    KEX_ECDH_REPLY: number;
-    USERAUTH_REQUEST: number;
-    USERAUTH_FAILURE: number;
-    USERAUTH_SUCCESS: number;
-    USERAUTH_BANNER: number;
-    USERAUTH_INFO_REQUEST: number;
-    USERAUTH_INFO_RESPONSE: number;
-    GLOBAL_REQUEST: number;
-    REQUEST_SUCCESS: number;
-    REQUEST_FAILURE: number;
-    CHANNEL_OPEN: number;
-    CHANNEL_OPEN_CONFIRMATION: number;
-    CHANNEL_OPEN_FAILURE: number;
-    CHANNEL_WINDOW_ADJUST: number;
-    CHANNEL_DATA: number;
-    CHANNEL_EXTENDED_DATA: number;
-    CHANNEL_EOF: number;
-    CHANNEL_CLOSE: number;
-    CHANNEL_REQUEST: number;
-    CHANNEL_SUCCESS: number;
-    CHANNEL_FAILURE: number;
-};
-/** SSH_EXTENDED_DATA_STDERR. */
-export declare const EXTENDED_DATA_STDERR = 1;
-export declare const DISCONNECT_REASON: {
-    1: string;
-    2: string;
-    3: string;
-    5: string;
-    6: string;
-    7: string;
-    8: string;
-    9: string;
-    10: string;
-    11: string;
-    12: string;
-    14: string;
-    15: string;
-};

package/dist/protocols/ssh/messages.js

@@ -1,54 +0,0 @@
-const MSG = {
-  DISCONNECT: 1,
-  IGNORE: 2,
-  UNIMPLEMENTED: 3,
-  DEBUG: 4,
-  SERVICE_REQUEST: 5,
-  SERVICE_ACCEPT: 6,
-  EXT_INFO: 7,
-  KEXINIT: 20,
-  NEWKEYS: 21,
-  KEX_ECDH_INIT: 30,
-  KEX_ECDH_REPLY: 31,
-  USERAUTH_REQUEST: 50,
-  USERAUTH_FAILURE: 51,
-  USERAUTH_SUCCESS: 52,
-  USERAUTH_BANNER: 53,
-  USERAUTH_INFO_REQUEST: 60,
-  USERAUTH_INFO_RESPONSE: 61,
-  GLOBAL_REQUEST: 80,
-  REQUEST_SUCCESS: 81,
-  REQUEST_FAILURE: 82,
-  CHANNEL_OPEN: 90,
-  CHANNEL_OPEN_CONFIRMATION: 91,
-  CHANNEL_OPEN_FAILURE: 92,
-  CHANNEL_WINDOW_ADJUST: 93,
-  CHANNEL_DATA: 94,
-  CHANNEL_EXTENDED_DATA: 95,
-  CHANNEL_EOF: 96,
-  CHANNEL_CLOSE: 97,
-  CHANNEL_REQUEST: 98,
-  CHANNEL_SUCCESS: 99,
-  CHANNEL_FAILURE: 100
-};
-const EXTENDED_DATA_STDERR = 1;
-const DISCONNECT_REASON = {
-  1: "the host reported a protocol error",
-  2: "the host could not agree on a key exchange method",
-  3: "the key exchange failed",
-  5: "the host ran out of resources",
-  6: "the connection was lost below SSH",
-  7: "the host application ended the connection",
-  8: "too many connections",
-  9: "authentication was cancelled by the user",
-  10: "no more authentication methods are available",
-  11: "the host closed the connection",
-  12: "authentication was cancelled by the host",
-  14: "the host refused the authentication attempt",
-  15: "the host closed the connection while authenticating"
-};
-export {
-  DISCONNECT_REASON,
-  EXTENDED_DATA_STDERR,
-  MSG
-};

package/dist/protocols/ssh/transport.d.ts

@@ -1,62 +0,0 @@
-export declare const CLIENT_VERSION = "SSH-2.0-CloudflareGateway_1.0";
-/** Pick the first client preference the host also offered (RFC 4253 7.1). */
-export declare function negotiate(clientNames: any, serverNames: any): any;
-export declare class SshTransport extends EventTarget {
-    #private;
-    url: string;
-    verifyHost: (info: any) => Promise<boolean> | boolean;
-    log: (...args: any[]) => void;
-    socket: WebSocket | null;
-    openTransport: ((url: string) => any) | null;
-    closed: boolean;
-    buffer: Uint8Array;
-    serverVersion: string;
-    greeting: string[];
-    sendSequence: number;
-    receiveSequence: number;
-    outgoing: any;
-    incoming: any;
-    sessionId: Uint8Array | null;
-    kex: any;
-    kexQueue: Uint8Array[];
-    keepaliveTimer: any;
-    bytesSent: number;
-    bytesReceived: number;
-    encryptChain?: Promise<void>;
-    newKeysBarrier?: Promise<void> | null;
-    releaseNewKeys?: (() => void) | null;
-    pendingServerKexInit?: Uint8Array | null;
-    established?: boolean;
-    /**
-     * @param {string} url gateway WebSocket URL
-     * @param {object} options
-     * @param {(info: object) => Promise<boolean>} options.verifyHost decides
-     *   whether an unknown or changed host key may be used.
-     */
-    constructor(url: string, { verifyHost, log, openTransport }?: {
-        verifyHost?: (info: any) => Promise<boolean> | boolean;
-        log?: (...args: any[]) => void;
-        /** Returns a WebSocket-shaped transport for `url`; default is a real one. */
-        openTransport?: ((url: string) => any) | null;
-    });
-    connect(): void;
-    disconnect(message?: string): void;
-    fail(error: unknown): void;
-    /** Application packets wait while a key exchange is in flight (RFC 4253 7.1). */
-    send(payload: Uint8Array): boolean;
-}
-/** Padding for a GCM packet: only the encrypted part is block aligned. */
-export declare function gcmPaddingLength(payloadLength: any): number;
-/** A packet before any keys exist: the whole thing is block aligned. */
-export declare function framePlain(payload: Uint8Array): Uint8Array<ArrayBufferLike>;
-export declare function buildKexInit(offer: any): Uint8Array<ArrayBufferLike>;
-export declare function parseKexInit(payload: Uint8Array): {
-    kex: string[];
-    hostKey: string[];
-    cipherClientToServer: string[];
-    cipherServerToClient: string[];
-    macClientToServer: string[];
-    macServerToClient: string[];
-    compressionClientToServer: string[];
-    compressionServerToClient: string[];
-};