borgmcp-server 0.1.1

package/dist/credentials.js

@@ -0,0 +1,244 @@
+import { createHmac, randomBytes, randomUUID, timingSafeEqual, } from "node:crypto";
+import { clientPrincipal, droneSessionPrincipal, } from "./principal.js";
+import { operatorErrors } from "./operator-error.js";
+const tokenPattern = /^[A-Za-z0-9_-]{43,1024}$/u;
+const dummyVerifier = Buffer.alloc(32);
+export class CredentialDigester {
+    #key;
+    constructor(key) {
+        if (key.length !== 32)
+            throw new Error("Credential digest key must contain 32 bytes.");
+        this.#key = Buffer.from(key);
+    }
+    digest(secret, purpose) {
+        if (!tokenPattern.test(secret))
+            throw new Error("Credential must be unpadded base64url.");
+        const lookup = createHmac("sha256", this.#key)
+            .update(`lookup:${purpose}:`)
+            .update(secret)
+            .digest()
+            .subarray(0, 16);
+        const verifier = createHmac("sha256", this.#key)
+            .update(`verify:${purpose}:`)
+            .update(secret)
+            .digest();
+        return { lookup, verifier };
+    }
+    verify(secret, purpose, stored) {
+        let candidate;
+        let valid = true;
+        try {
+            candidate = this.digest(secret, purpose).verifier;
+        }
+        catch {
+            candidate = dummyVerifier;
+            valid = false;
+        }
+        const expected = stored?.length === 32 ? stored : dummyVerifier;
+        return timingSafeEqual(candidate, expected) && stored !== undefined && valid;
+    }
+    destroy() {
+        this.#key.fill(0);
+    }
+}
+export class LiveCredentialRegistry {
+    #sessions = new Map();
+    #keys = new Map();
+    register(identities) {
+        const controller = new AbortController();
+        const keys = [...new Set(typeof identities === "string" ? [identities] : identities)];
+        this.#keys.set(controller, keys);
+        for (const key of keys) {
+            const sessions = this.#sessions.get(key) ?? new Set();
+            sessions.add(controller);
+            this.#sessions.set(key, sessions);
+        }
+        return {
+            signal: controller.signal,
+            release: () => this.#release(controller),
+        };
+    }
+    invalidate(identity) {
+        const sessions = this.#sessions.get(identity);
+        if (sessions === undefined)
+            return;
+        for (const controller of [...sessions]) {
+            this.#release(controller);
+            controller.abort();
+        }
+    }
+    activeSessionCount(clientId) {
+        return this.#sessions.get(clientId)?.size ?? 0;
+    }
+    #release(controller) {
+        const keys = this.#keys.get(controller);
+        if (keys === undefined)
+            return;
+        this.#keys.delete(controller);
+        for (const key of keys) {
+            const sessions = this.#sessions.get(key);
+            sessions?.delete(controller);
+            if (sessions?.size === 0)
+                this.#sessions.delete(key);
+        }
+    }
+}
+export class CredentialAuthority {
+    #store;
+    #digester;
+    #clock;
+    #registry;
+    constructor(store, digester, clock = () => new Date(), registry = new LiveCredentialRegistry()) {
+        this.#store = store;
+        this.#digester = digester;
+        this.#clock = clock;
+        this.#registry = registry;
+    }
+    createRecoveryCredential() {
+        const secret = generateSecret();
+        this.#store.createRecoveryCredential(randomUUID(), this.#digester.digest(secret, "recovery"));
+        return secret;
+    }
+    createBootstrapInvitation(ttlMs) {
+        return this.#createInvitation("owner", ttlMs);
+    }
+    createInvitation(recoveryCredential, ttlMs) {
+        const digest = safeDigest(this.#digester, recoveryCredential, "recovery");
+        const stored = this.#store.findRecoveryCredential(digest.lookup);
+        if (!this.#digester.verify(recoveryCredential, "recovery", stored?.verifier))
+            return null;
+        return this.#createInvitation("client", ttlMs);
+    }
+    replaceOwnerInvitation(recoveryCredential, ttlMs) {
+        const digest = safeDigest(this.#digester, recoveryCredential, "recovery");
+        const stored = this.#store.findRecoveryCredential(digest.lookup);
+        if (!this.#digester.verify(recoveryCredential, "recovery", stored?.verifier))
+            return null;
+        return this.#createInvitation("owner", ttlMs);
+    }
+    #createInvitation(purpose, ttlMs) {
+        if (!Number.isSafeInteger(ttlMs) || ttlMs < 1_000 || ttlMs > 86_400_000) {
+            throw new Error("Invitation TTL must be an integer from 1000 to 86400000 milliseconds.");
+        }
+        const secret = generateSecret();
+        this.#store.createInvitation({
+            id: randomUUID(),
+            digest: this.#digester.digest(secret, "invitation"),
+            expiresAt: new Date(this.#clock().getTime() + ttlMs).toISOString(),
+            purpose,
+        });
+        return secret;
+    }
+    exchangeInvitation(request) {
+        const invitationDigest = safeDigest(this.#digester, request.invitation, "invitation");
+        const stored = this.#store.findInvitation(invitationDigest.lookup);
+        const verified = this.#digester.verify(request.invitation, "invitation", stored?.verifier);
+        const clientId = randomUUID();
+        const claimed = this.#store.claimInvitation({
+            invitationId: stored?.id ?? "00000000-0000-4000-8000-000000000000",
+            clientId,
+            requestedClientName: request.clientName ?? null,
+            retryKey: request.retryKey,
+            credentialId: randomUUID(),
+            credentialDigest: safeDigest(this.#digester, request.clientCredential, "client"),
+        });
+        return !verified || stored?.expiresAt === undefined || claimed === null ? null : {
+            purpose: claimed.purpose,
+            clientId: claimed.clientId,
+            serverCapabilities: claimed.serverCapabilities,
+        };
+    }
+    authenticate(authorization) {
+        const result = this.authenticateStatus(authorization);
+        return typeof result === "object" ? result : null;
+    }
+    authenticateStatus(authorization) {
+        if (authorization === undefined)
+            return "missing";
+        const secret = bearerSecret(authorization);
+        const clientDigest = safeDigest(this.#digester, secret, "client");
+        const droneDigest = safeDigest(this.#digester, secret, "drone-session");
+        const client = this.#store.findClientCredential(clientDigest.lookup);
+        const drone = this.#store.findDroneSessionCredential(droneDigest.lookup);
+        const clientValid = this.#digester.verify(secret, "client", client?.verifier) &&
+            client?.clientId !== undefined;
+        const droneValid = this.#digester.verify(secret, "drone-session", drone?.verifier) &&
+            drone !== null;
+        if (clientValid) {
+            if (client.revokedAt != null)
+                return "revoked";
+            return clientPrincipal(client.clientId);
+        }
+        if (droneValid) {
+            if (drone.revokedAt != null || drone.expiresAt <= this.#clock().toISOString()) {
+                return "revoked";
+            }
+            return droneSessionPrincipal({
+                id: drone.sessionId,
+                clientId: drone.clientId,
+                cubeId: drone.cubeId,
+                droneId: drone.droneId,
+            });
+        }
+        return "invalid";
+    }
+    attachSeat(store, request) {
+        const credential = generateSecret();
+        const record = store.attachSeat({
+            ...request,
+            droneId: randomUUID(),
+            sessionId: randomUUID(),
+            credentialId: randomUUID(),
+            credentialDigest: this.#digester.digest(credential, "drone-session"),
+            expiresAt: new Date(this.#clock().getTime() + 86_400_000).toISOString(),
+        });
+        for (const sessionId of record.revokedSessionIds)
+            this.#registry.invalidate(sessionId);
+        return { ...record, credential };
+    }
+    rotateClient(clientId) {
+        if (!this.#store.clientIsActive(clientId))
+            throw operatorErrors.CLIENT_NOT_FOUND;
+        const secret = generateSecret();
+        const rotated = this.#store.rotateClientCredential({
+            clientId,
+            credentialId: randomUUID(),
+            credentialDigest: this.#digester.digest(secret, "client"),
+        });
+        if (!rotated)
+            throw operatorErrors.CLIENT_NOT_FOUND;
+        this.#registry.invalidate(clientId);
+        return secret;
+    }
+    revokeClient(clientId) {
+        if (!this.#store.clientExists(clientId))
+            throw operatorErrors.CLIENT_NOT_FOUND;
+        this.#store.revokeClientCredentials(clientId);
+        this.#registry.invalidate(clientId);
+    }
+    registerLiveSession(principal) {
+        if (typeof principal === "string")
+            return this.#registry.register(principal);
+        return this.#registry.register(principal.kind === "drone-session"
+            ? [principal.id, principal.clientId]
+            : principal.id);
+    }
+}
+export function generateSecret() {
+    return randomBytes(32).toString("base64url");
+}
+function bearerSecret(authorization) {
+    if (authorization === undefined)
+        return "";
+    const match = /^Bearer ([A-Za-z0-9_-]{43,1024})$/u.exec(authorization);
+    return match?.[1] ?? "";
+}
+function safeDigest(digester, secret, purpose) {
+    try {
+        return digester.digest(secret, purpose);
+    }
+    catch {
+        return { lookup: Buffer.alloc(16), verifier: dummyVerifier };
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAoBvC,MAAM,OAAO,kBAAkB;IACpB,IAAI,CAAS;IAEtB,YAAY,GAAW;QACrB,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,OAA0B;QAC/C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC;aAC3C,MAAM,CAAC,UAAU,OAAO,GAAG,CAAC;aAC5B,MAAM,CAAC,MAAM,CAAC;aACd,MAAM,EAAE;aACR,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC;aAC7C,MAAM,CAAC,UAAU,OAAO,GAAG,CAAC;aAC5B,MAAM,CAAC,MAAM,CAAC;aACd,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,OAA0B,EAAE,MAAe;QAChE,IAAI,SAAiB,CAAC;QACtB,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,aAAa,CAAC;YAC1B,KAAK,GAAG,KAAK,CAAC;QAChB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QAChE,OAAO,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACF;AAED,MAAM,OAAO,sBAAsB;IACxB,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpD,KAAK,GAAG,IAAI,GAAG,EAAsC,CAAC;IAE/D,QAAQ,CAAC,UAAsC;QAI7C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAmB,CAAC;YACvE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QACD,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;SACzC,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,QAAgB;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC1B,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,QAAQ,CAAC,UAA2B;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO;QAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAC7B,IAAI,QAAQ,EAAE,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IACrB,MAAM,CAAkB;IACxB,SAAS,CAAqB;IAC9B,MAAM,CAAa;IACnB,SAAS,CAAyB;IAE3C,YACE,KAAsB,EACtB,QAA4B,EAC5B,KAAK,GAAe,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EACpC,QAAQ,GAAG,IAAI,sBAAsB,EAAE;QAEvC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,wBAAwB;QACtB,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAClC,UAAU,EAAE,EACZ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAC1C,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yBAAyB,CAAC,KAAa;QACrC,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,gBAAgB,CAAC,kBAA0B,EAAE,KAAa;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1F,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,sBAAsB,CAAC,kBAA0B,EAAE,KAAa;QAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1F,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,iBAAiB,CAAC,OAA2B,EAAE,KAAa;QAC1D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC3B,EAAE,EAAE,UAAU,EAAE;YAChB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC;YACnD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;YAClE,OAAO;SACR,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,OAA0B;QAC3C,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CACpC,OAAO,CAAC,UAAU,EAClB,YAAY,EACZ,MAAM,EAAE,QAAQ,CACjB,CAAC;QACF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YAC1C,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,sCAAsC;YAClE,QAAQ;YACR,mBAAmB,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;YAC/C,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,UAAU,EAAE;YAC1B,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SACjF,CAAC,CAAC;QACH,OAAO,CAAC,QAAQ,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/E,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;SAC/C,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,aAAiC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACtD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED,kBAAkB,CAChB,aAAiC;QAEjC,IAAI,aAAa,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAClD,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YAC3E,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,CAAC;YAChF,KAAK,KAAK,IAAI,CAAC;QACjB,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,MAAO,CAAC,SAAS,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAC;YAChD,OAAO,eAAe,CAAC,MAAO,CAAC,QAAS,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,KAAM,CAAC,SAAS,IAAI,IAAI,IAAI,KAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAChF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,qBAAqB,CAAC;gBAC3B,EAAE,EAAE,KAAM,CAAC,SAAS;gBACpB,QAAQ,EAAE,KAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,KAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,KAAM,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,UAAU,CACR,KAAkB,EAClB,OAKC;QAED,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;YAC9B,GAAG,OAAO;YACV,OAAO,EAAE,UAAU,EAAE;YACrB,SAAS,EAAE,UAAU,EAAE;YACvB,YAAY,EAAE,UAAU,EAAE;YAC1B,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC;YACpE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;SACxE,CAAC,CAAC;QACH,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,iBAAiB;YAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACvF,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YAAE,MAAM,cAAc,CAAC,gBAAgB,CAAC;QACjF,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC;YACjD,QAAQ;YACR,YAAY,EAAE,UAAU,EAAE;YAC1B,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,cAAc,CAAC,gBAAgB,CAAC;QACpD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC;YAAE,MAAM,cAAc,CAAC,gBAAgB,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,mBAAmB,CAAC,SAA6B;QAC/C,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAC5B,SAAS,CAAC,IAAI,KAAK,eAAe;YAChC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC,EAAE,CACjB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,YAAY,CAAC,aAAiC;IACrD,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CACjB,QAA4B,EAC5B,MAAc,EACd,OAA0B;IAE1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC/D,CAAC;AACH,CAAC"}

package/dist/enrollment.d.ts

@@ -0,0 +1,17 @@
+import type { CredentialAuthority } from "./credentials.js";
+interface EnrollmentEnvelope {
+    readonly protocol_version: "1";
+    readonly request_id: string;
+    readonly payload: {
+        readonly invitation: string;
+        readonly retry_key: string;
+        readonly client_credential: string;
+        readonly client_name?: string;
+    };
+}
+export declare function createEnrollmentExchange(authority: CredentialAuthority): (body: unknown) => Promise<{
+    readonly status: 201 | 400 | 401 | 507;
+    readonly body?: unknown;
+}>;
+export declare function decodeEnrollmentEnvelope(value: unknown): EnrollmentEnvelope;
+export {};

package/dist/enrollment.js

@@ -0,0 +1,122 @@
+import { StorageCapacityError } from "./store.js";
+export function createEnrollmentExchange(authority) {
+    return async (body) => {
+        let envelope;
+        try {
+            envelope = decodeEnrollmentEnvelope(body);
+        }
+        catch {
+            return {
+                status: 400,
+                body: errorEnvelope("INVALID_INPUT", "Invalid enrollment request.", safeRequestId(body)),
+            };
+        }
+        let response;
+        try {
+            response = authority.exchangeInvitation({
+                invitation: envelope.payload.invitation,
+                retryKey: envelope.payload.retry_key,
+                clientCredential: envelope.payload.client_credential,
+                ...(envelope.payload.client_name === undefined
+                    ? {}
+                    : { clientName: envelope.payload.client_name }),
+            });
+        }
+        catch (error) {
+            if (!(error instanceof StorageCapacityError))
+                throw error;
+            return {
+                status: 507,
+                body: errorEnvelope("CAPACITY_EXCEEDED", error.message, envelope.request_id),
+            };
+        }
+        if (response === null) {
+            return {
+                status: 401,
+                body: errorEnvelope("AUTH_INVALID", "Enrollment authentication failed.", envelope.request_id),
+            };
+        }
+        return {
+            status: 201,
+            body: {
+                protocol_version: "1",
+                request_id: envelope.request_id,
+                payload: {
+                    purpose: response.purpose,
+                    client_id: response.clientId,
+                    server_capabilities: response.serverCapabilities,
+                },
+            },
+        };
+    };
+}
+function errorEnvelope(code, message, requestId) {
+    return {
+        protocol_version: "1",
+        ...(requestId === undefined ? {} : { request_id: requestId }),
+        error: { code, message },
+    };
+}
+function safeRequestId(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const requestId = value["request_id"];
+    return typeof requestId === "string" && /^[A-Za-z0-9._-]{8,128}$/u.test(requestId)
+        ? requestId
+        : undefined;
+}
+export function decodeEnrollmentEnvelope(value) {
+    const envelope = exactRecord(value, ["protocol_version", "request_id", "payload"]);
+    if (envelope["protocol_version"] !== "1")
+        throw new Error("Invalid enrollment request.");
+    const requestId = envelope["request_id"];
+    if (typeof requestId !== "string" || !/^[A-Za-z0-9._-]{8,128}$/u.test(requestId)) {
+        throw new Error("Invalid enrollment request.");
+    }
+    const payload = exactRecord(envelope["payload"], ["invitation", "retry_key", "client_credential"], ["client_name"]);
+    const invitation = payload["invitation"];
+    if (typeof invitation !== "string" || !/^[A-Za-z0-9_-]{43,1024}$/u.test(invitation)) {
+        throw new Error("Invalid enrollment request.");
+    }
+    const retryKey = payload["retry_key"];
+    if (typeof retryKey !== "string" ||
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(retryKey)) {
+        throw new Error("Invalid enrollment request.");
+    }
+    const clientCredential = payload["client_credential"];
+    if (typeof clientCredential !== "string" ||
+        !/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/u.test(clientCredential)) {
+        throw new Error("Invalid enrollment request.");
+    }
+    const clientName = payload["client_name"];
+    if (clientName !== undefined &&
+        (typeof clientName !== "string" || Buffer.byteLength(clientName) > 120 ||
+            !/^[A-Za-z0-9][A-Za-z0-9 ._-]*$/u.test(clientName))) {
+        throw new Error("Invalid enrollment request.");
+    }
+    return {
+        protocol_version: "1",
+        request_id: requestId,
+        payload: clientName === undefined
+            ? { invitation, retry_key: retryKey.toLowerCase(), client_credential: clientCredential }
+            : {
+                invitation,
+                retry_key: retryKey.toLowerCase(),
+                client_credential: clientCredential,
+                client_name: clientName,
+            },
+    };
+}
+function exactRecord(value, required, optional = []) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error("Invalid enrollment request.");
+    }
+    const record = value;
+    const allowed = new Set([...required, ...optional]);
+    if (Object.keys(record).some((key) => !allowed.has(key)) ||
+        required.some((key) => !Object.hasOwn(record, key))) {
+        throw new Error("Invalid enrollment request.");
+    }
+    return record;
+}
+//# sourceMappingURL=enrollment.js.map

package/dist/enrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../src/enrollment.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAalD,MAAM,UAAU,wBAAwB,CAAC,SAA8B;IACrE,OAAO,KAAK,EAAE,IAAa,EAGxB,EAAE;QACH,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,aAAa,CACjB,eAAe,EACf,6BAA6B,EAC7B,aAAa,CAAC,IAAI,CAAC,CACpB;aACF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,SAAS,CAAC,kBAAkB,CAAC;gBACtC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;gBACvC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;gBACpC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,iBAAiB;gBACpD,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;oBAC5C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC1D,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,aAAa,CAAC,mBAAmB,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC;aAC7E,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,aAAa,CACjB,cAAc,EACd,mCAAmC,EACnC,QAAQ,CAAC,UAAU,CACpB;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,gBAAgB,EAAE,GAAG;gBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE;oBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,SAAS,EAAE,QAAQ,CAAC,QAAQ;oBAC5B,mBAAmB,EAAE,QAAQ,CAAC,kBAAkB;iBACjD;aACF;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAA4D,EAC5D,OAAe,EACf,SAAkB;IAElB,OAAO;QACL,gBAAgB,EAAE,GAAY;QAC9B,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAC7D,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,SAAS,GAAI,KAAiC,CAAC,YAAY,CAAC,CAAC;IACnE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;QAChF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,kBAAkB,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,kBAAkB,CAAC,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CACzB,QAAQ,CAAC,SAAS,CAAC,EACnB,CAAC,YAAY,EAAE,WAAW,EAAE,mBAAmB,CAAC,EAChD,CAAC,aAAa,CAAC,CAChB,CAAC;IACF,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,6EAA6E,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,OAAO,gBAAgB,KAAK,QAAQ;QACpC,CAAC,wCAAwC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,GAAG;YACrE,CAAC,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO;QACL,gBAAgB,EAAE,GAAG;QACrB,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,UAAU,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE;YACxF,CAAC,CAAC;gBACE,UAAU;gBACV,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE;gBACjC,iBAAiB,EAAE,gBAAgB;gBACnC,WAAW,EAAE,UAAU;aACxB;KACN,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,QAA2B,EAC3B,QAAQ,GAAsB,EAAE;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/https-server.d.ts

@@ -0,0 +1,94 @@
+import type { Socket } from "node:net";
+import { type BindOptionsInput } from "./network-policy.js";
+import type { CoordinationRequest, CoordinationResponse } from "./coordination-api.js";
+import type { Principal } from "./principal.js";
+export interface ProtocolInfoDocument {
+    readonly protocol_version: string;
+    readonly package: {
+        readonly name: "borgmcp-shared";
+        readonly version: string;
+    };
+    readonly capabilities: readonly string[];
+    readonly limits: {
+        readonly max_request_bytes: number;
+        readonly max_log_message_bytes: number;
+        readonly max_read_page_size: number;
+        readonly max_replay_page_size: number;
+    };
+}
+export interface ServiceLimits {
+    readonly maxConnections: number;
+    readonly maxConnectionsPerAddress: number;
+    readonly maxRequestsPerWindow: number;
+    readonly maxRequestsPerAddressWindow: number;
+    readonly maxRequestsGlobalWindow: number;
+    readonly rateLimitWindowMs: number;
+    readonly maxRateLimitEntries: number;
+    readonly maxStreamsPerCredential: number;
+    readonly maxHeaderBytes: number;
+    readonly maxRequestBodyBytes: number;
+    readonly maxRequestsPerSocket: number;
+    readonly requestTimeoutMs: number;
+    readonly tlsHandshakeTimeoutMs: number;
+    readonly headersTimeoutMs: number;
+    readonly keepAliveTimeoutMs: number;
+    readonly handlerTimeoutMs: number;
+}
+export declare const DEFAULT_SERVICE_LIMITS: ServiceLimits;
+export interface RequestHandlerContext {
+    readonly protocolInfo: ProtocolInfoDocument;
+    readonly authorizeProtocol: (authorization: string | undefined, signal: AbortSignal) => Promise<boolean | "missing" | "invalid" | "revoked">;
+    readonly exchangeEnrollment?: (body: unknown) => Promise<{
+        readonly status: 201 | 400 | 401 | 507;
+        readonly body?: unknown;
+    }>;
+    readonly authorizeCoordination?: (authorization: string | undefined, signal: AbortSignal) => Promise<Principal | "missing" | "invalid" | "revoked">;
+    readonly handleCoordination?: (request: CoordinationRequest) => Promise<CoordinationResponse>;
+}
+export interface HttpsServerOptions {
+    readonly bind?: BindOptionsInput;
+    readonly tls: {
+        readonly key: string | Buffer;
+        readonly cert: string | Buffer;
+        readonly ca?: string | Buffer;
+    };
+    readonly protocolInfo: ProtocolInfoDocument;
+    readonly authorizeProtocol: RequestHandlerContext["authorizeProtocol"];
+    readonly exchangeEnrollment?: RequestHandlerContext["exchangeEnrollment"];
+    readonly authorizeCoordination?: RequestHandlerContext["authorizeCoordination"];
+    readonly handleCoordination?: RequestHandlerContext["handleCoordination"];
+    readonly limits?: ServiceLimits;
+    readonly testHooks?: {
+        readonly identifyRemoteAddress?: (socket: Socket) => string;
+    };
+}
+export interface RunningServer {
+    readonly origin: string;
+    readonly limits: ServiceLimits;
+    readonly close: () => Promise<void>;
+}
+export declare function startHttpsServer(options: HttpsServerOptions): Promise<RunningServer>;
+export declare function createRequestHandlerContext(options: HttpsServerOptions): RequestHandlerContext;
+export declare function validateTlsCertificate(certificate: string | Buffer, host: string, mode: "loopback" | "lan", caCertificate?: string | Buffer): void;
+export declare class RequestRateLimiter {
+    #private;
+    constructor(limits: ServiceLimits, maxRequests?: number, clock?: () => number);
+    consume(identity: string): number | null;
+    reserve(identity: string): RateLimitReservation;
+}
+export declare class PreAuthAdmissionLimiter {
+    #private;
+    constructor(limits: ServiceLimits, clock?: () => number);
+    consume(addressIdentity: string): number | null;
+}
+interface RateLimitReservation {
+    readonly retryAfter: number | null;
+    readonly commit: () => void;
+    readonly rollback: () => void;
+}
+export declare class ConcurrentQuota {
+    #private;
+    constructor(limit: number);
+    acquire(identity: string): (() => void) | null;
+}
+export {};