borgmcp-server 0.1.1

package/dist/https-server.js

@@ -0,0 +1,814 @@
+import { createServer } from "node:https";
+import { createHash, X509Certificate } from "node:crypto";
+import { resolveBindOptions } from "./network-policy.js";
+export const DEFAULT_SERVICE_LIMITS = {
+    maxConnections: 100,
+    maxConnectionsPerAddress: 25,
+    maxRequestsPerWindow: 120,
+    maxRequestsPerAddressWindow: 600,
+    maxRequestsGlobalWindow: 5_000,
+    rateLimitWindowMs: 60_000,
+    maxRateLimitEntries: 1_024,
+    maxStreamsPerCredential: 8,
+    maxHeaderBytes: 16_384,
+    maxRequestBodyBytes: 65_536,
+    maxRequestsPerSocket: 100,
+    requestTimeoutMs: 15_000,
+    tlsHandshakeTimeoutMs: 10_000,
+    headersTimeoutMs: 10_000,
+    keepAliveTimeoutMs: 5_000,
+    handlerTimeoutMs: 5_000,
+};
+export async function startHttpsServer(options) {
+    if (options.handleCoordination !== undefined && options.authorizeCoordination === undefined) {
+        throw new Error("Coordination routes require server-derived principal authentication.");
+    }
+    const bind = resolveBindOptions(options.bind ?? {});
+    const limits = options.limits ?? DEFAULT_SERVICE_LIMITS;
+    validateLimits(limits);
+    validateTlsCertificate(options.tls.cert, bind.host, bind.mode, options.tls.ca);
+    const handlerContext = createRequestHandlerContext(options);
+    const server = createServer({
+        key: options.tls.key,
+        cert: options.tls.cert,
+        minVersion: "TLSv1.3",
+        maxHeaderSize: limits.maxHeaderBytes,
+        requestTimeout: limits.requestTimeoutMs,
+        handshakeTimeout: limits.tlsHandshakeTimeoutMs,
+        headersTimeout: limits.headersTimeoutMs,
+        keepAliveTimeout: limits.keepAliveTimeoutMs,
+    }, createRequestListener(handlerContext, limits, options.testHooks?.identifyRemoteAddress));
+    const acceptedSockets = applyServerLimits(server, limits);
+    server.on("secureConnection", (socket) => socket.disableRenegotiation());
+    server.on("tlsClientError", (_error, socket) => socket.destroy());
+    server.on("clientError", (_error, socket) => socket.end("HTTP/1.1 400 Bad Request\r\n\r\n"));
+    server.on("checkContinue", (_request, response) => sendEmpty(response, 417, true));
+    try {
+        await listen(server, bind.port, bind.host);
+    }
+    catch (error) {
+        server.closeAllConnections();
+        try {
+            server.close();
+        }
+        catch {
+            // Preserve the originating listen failure.
+        }
+        throw error;
+    }
+    const address = server.address();
+    const displayHost = address.family === "IPv6" ? `[${address.address}]` : address.address;
+    let closePromise;
+    return {
+        origin: `https://${displayHost}:${address.port}`,
+        limits,
+        close: () => {
+            closePromise ??= close(server, acceptedSockets);
+            return closePromise;
+        },
+    };
+}
+export function createRequestHandlerContext(options) {
+    return Object.freeze({
+        protocolInfo: options.protocolInfo,
+        authorizeProtocol: options.authorizeProtocol,
+        ...(options.exchangeEnrollment === undefined
+            ? {}
+            : { exchangeEnrollment: options.exchangeEnrollment }),
+        ...(options.authorizeCoordination === undefined
+            ? {}
+            : { authorizeCoordination: options.authorizeCoordination }),
+        ...(options.handleCoordination === undefined
+            ? {}
+            : { handleCoordination: options.handleCoordination }),
+    });
+}
+function createRequestListener(context, limits, identifyRemoteAddress = (socket) => socket.remoteAddress ?? "unknown") {
+    const admissionLimiter = new PreAuthAdmissionLimiter(limits);
+    const credentialRateLimiter = new RequestRateLimiter(limits, limits.maxRequestsPerWindow);
+    const streamQuota = new ConcurrentQuota(limits.maxStreamsPerCredential);
+    return (request, response) => {
+        const controller = new AbortController();
+        response.once("close", () => controller.abort());
+        let timer;
+        const deadline = new Promise((resolve) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                resolve("deadline");
+            }, limits.handlerTimeoutMs);
+            timer.unref();
+        });
+        const handled = handleRequest(request, response, context, limits, admissionLimiter, credentialRateLimiter, streamQuota, identifyRemoteAddress, controller.signal)
+            .then(() => "handled");
+        void Promise.race([handled, deadline])
+            .then((outcome) => {
+            if (outcome === "deadline")
+                sendEmpty(response, 503, true);
+        })
+            .catch(() => sendEmpty(response, 500, true))
+            .finally(() => {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        });
+    };
+}
+async function handleRequest(request, response, context, limits, admissionLimiter, credentialRateLimiter, streamQuota, identifyRemoteAddress, signal) {
+    const addressIdentity = `address:${identifyRemoteAddress(request.socket)}`;
+    const preAuthRetry = admissionLimiter.consume(addressIdentity);
+    if (preAuthRetry !== null) {
+        request.resume();
+        sendRateLimited(response, preAuthRetry);
+        return;
+    }
+    if (request.headers.origin !== undefined) {
+        request.resume();
+        sendEmpty(response, 403, true);
+        return;
+    }
+    const path = parseRequestPath(request.url);
+    const requestBody = await readRequestBody(request, limits.maxRequestBodyBytes);
+    if (requestBody === "oversized") {
+        if (isCoordinationPath(path)) {
+            sendJson(response, 413, protocolError("CONTENT_TOO_LARGE", "Request body is too large."), true);
+        }
+        else {
+            sendEmpty(response, 413, true);
+        }
+        return;
+    }
+    if (path === "/healthz") {
+        if (requestBody.length !== 0)
+            return sendEmpty(response, 400, true);
+        sendEmpty(response, request.method === "GET" ? 204 : 405);
+        return;
+    }
+    if (path === "/api/protocol") {
+        if (requestBody.length !== 0)
+            return sendEmpty(response, 400, true);
+        const authorized = await context.authorizeProtocol(request.headers.authorization, signal);
+        if (signal.aborted)
+            return;
+        if (authorized !== true) {
+            const code = authorized === "revoked"
+                ? "SESSION_REVOKED"
+                : authorized === "missing" || request.headers.authorization === undefined
+                    ? "AUTH_MISSING"
+                    : "AUTH_INVALID";
+            sendJson(response, 401, protocolError(code, "Authentication failed."));
+            return;
+        }
+        const credentialRetry = consumeAuthenticatedRateLimit(request.headers.authorization, credentialRateLimiter);
+        if (credentialRetry !== null)
+            return sendRateLimited(response, credentialRetry);
+        if (request.method !== "GET") {
+            sendEmpty(response, 405);
+            return;
+        }
+        sendJson(response, 200, {
+            protocol_version: "1",
+            request_id: "protocol-info",
+            payload: context.protocolInfo,
+        });
+        return;
+    }
+    if (path === "/api/enrollment/exchange") {
+        if (request.method !== "POST" || context.exchangeEnrollment === undefined) {
+            sendEmpty(response, 405);
+            return;
+        }
+        let decoded;
+        if (requestBody.length === 0) {
+            decoded = undefined;
+        }
+        else {
+            try {
+                decoded = JSON.parse(requestBody.toString("utf8"));
+            }
+            catch {
+                decoded = undefined;
+            }
+        }
+        const result = await context.exchangeEnrollment(decoded);
+        if (signal.aborted)
+            return;
+        if (result.body === undefined)
+            sendEmpty(response, result.status, result.status === 400);
+        else if (result.status === 400)
+            sendJson(response, 400, result.body, true);
+        else if (result.status === 401 || result.status === 507)
+            sendJson(response, result.status, result.body);
+        else
+            sendJson(response, 201, result.body);
+        return;
+    }
+    if (isCoordinationPath(path) && context.handleCoordination !== undefined) {
+        let decoded;
+        if (requestBody.length === 0) {
+            decoded = undefined;
+        }
+        else {
+            try {
+                decoded = JSON.parse(requestBody.toString("utf8"));
+            }
+            catch {
+                decoded = undefined;
+            }
+        }
+        const authorization = request.headers.authorization;
+        const authorizeCoordination = context.authorizeCoordination;
+        if (authorizeCoordination === undefined) {
+            sendJson(response, 500, protocolError("INTERNAL_ERROR", "Coordination authentication is unavailable."), true);
+            return;
+        }
+        const authentication = await authorizeCoordination(authorization, signal);
+        if (signal.aborted)
+            return;
+        if (typeof authentication === "string") {
+            const code = authentication === "revoked"
+                ? "SESSION_REVOKED"
+                : authentication === "missing" || authorization === undefined ? "AUTH_MISSING" : "AUTH_INVALID";
+            sendJson(response, 401, protocolError(code, "Authentication failed."));
+            return;
+        }
+        const clientIdentity = `client:${authentication.kind === "drone-session"
+            ? authentication.clientId
+            : authentication.id}`;
+        const credentialRetry = credentialRateLimiter.consume(clientIdentity);
+        if (credentialRetry !== null)
+            return sendRateLimited(response, credentialRetry);
+        const cursor = parseCursorParameter(request.url, path);
+        if (cursor === INVALID_COORDINATION_QUERY) {
+            sendJson(response, 400, protocolError("INVALID_INPUT", "Invalid query parameters."), true);
+            return;
+        }
+        const result = await context.handleCoordination({
+            method: request.method ?? "",
+            path,
+            principal: authentication,
+            ...(decoded === undefined ? {} : { body: decoded }),
+            ...(cursor === undefined ? {} : { cursor }),
+            signal,
+        });
+        if (signal.aborted) {
+            if (result.stream !== undefined)
+                await closeRejectedStream(result.stream);
+            return;
+        }
+        if (result.stream !== undefined) {
+            const release = streamQuota.acquire(credentialIdentity(authorization) ?? addressIdentity);
+            if (release === null) {
+                await closeRejectedStream(result.stream);
+                sendRateLimited(response, 1);
+            }
+            else
+                await startEventStream(response, result.stream, release);
+        }
+        else if (result.body === undefined) {
+            sendEmpty(response, result.status);
+        }
+        else {
+            sendJson(response, result.status, result.body, result.status === 400 || result.status === 413);
+        }
+        return;
+    }
+    sendEmpty(response, 404);
+}
+async function closeRejectedStream(stream) {
+    const iterator = stream[Symbol.asyncIterator]();
+    try {
+        await iterator.return?.();
+    }
+    catch {
+        // Quota rejection must not expose stream cleanup failures.
+    }
+}
+async function readRequestBody(request, maxBytes) {
+    const declaredLength = request.headers["content-length"];
+    if (declaredLength !== undefined) {
+        if (!/^\d+$/u.test(declaredLength)) {
+            request.resume();
+            return "oversized";
+        }
+        if (Number(declaredLength) > maxBytes) {
+            request.resume();
+            return "oversized";
+        }
+    }
+    let bytes = 0;
+    const chunks = [];
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.length;
+        if (bytes > maxBytes) {
+            request.resume();
+            return "oversized";
+        }
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks, bytes);
+}
+function parseRequestPath(value) {
+    if (value === undefined || !value.startsWith("/") || value.startsWith("//"))
+        return null;
+    try {
+        return new URL(value, "https://local.invalid").pathname;
+    }
+    catch {
+        return null;
+    }
+}
+function sendEmpty(response, status, closeConnection = false) {
+    if (response.headersSent || response.destroyed)
+        return;
+    response.writeHead(status, {
+        "cache-control": "no-store",
+        ...(closeConnection ? { connection: "close" } : {}),
+        "content-length": "0",
+    });
+    response.end();
+}
+function sendRateLimited(response, retryAfter) {
+    if (response.headersSent || response.destroyed)
+        return;
+    response.writeHead(429, {
+        "cache-control": "no-store",
+        connection: "close",
+        "content-length": "0",
+        "retry-after": retryAfter.toString(),
+    });
+    response.end();
+}
+function sendJson(response, status, value, closeConnection = false) {
+    const body = JSON.stringify(value);
+    response.writeHead(status, {
+        "cache-control": "no-store",
+        ...(closeConnection ? { connection: "close" } : {}),
+        "content-length": Buffer.byteLength(body).toString(),
+        "content-type": "application/json; charset=utf-8",
+        "x-content-type-options": "nosniff",
+    });
+    response.end(body);
+}
+async function startEventStream(response, stream, releaseQuota) {
+    if (response.destroyed || response.writableEnded || response.headersSent) {
+        releaseQuota();
+        await closeRejectedStream(stream);
+        return;
+    }
+    try {
+        response.writeHead(200, {
+            "cache-control": "no-store",
+            connection: "keep-alive",
+            "content-type": "text/event-stream; charset=utf-8",
+            "x-accel-buffering": "no",
+            "x-content-type-options": "nosniff",
+        });
+    }
+    catch (error) {
+        releaseQuota();
+        await closeRejectedStream(stream);
+        throw error;
+    }
+    void (async () => {
+        try {
+            for await (const chunk of stream) {
+                if (response.destroyed || response.writableEnded)
+                    break;
+                if (!response.write(chunk))
+                    await waitForDrain(response);
+            }
+        }
+        catch {
+            // Stream failures terminate the connection without exposing internals.
+        }
+        finally {
+            releaseQuota();
+            if (!response.destroyed && !response.writableEnded)
+                response.end();
+        }
+    })();
+}
+function waitForDrain(response) {
+    return new Promise((resolve) => {
+        const finish = () => {
+            response.off("drain", finish);
+            response.off("close", finish);
+            response.off("error", finish);
+            resolve();
+        };
+        response.once("drain", finish);
+        response.once("close", finish);
+        response.once("error", finish);
+    });
+}
+function protocolError(code, message) {
+    return { protocol_version: "1", error: { code, message } };
+}
+const INVALID_COORDINATION_QUERY = Symbol("invalid-coordination-query");
+function parseCursorParameter(value, path) {
+    if (value === undefined)
+        return undefined;
+    try {
+        const parsed = new URL(value, "https://local.invalid");
+        const keys = [...parsed.searchParams.keys()];
+        if (!path.endsWith("/stream")) {
+            return keys.length === 0 ? undefined : INVALID_COORDINATION_QUERY;
+        }
+        if (keys.some((key) => key !== "cursor"))
+            return INVALID_COORDINATION_QUERY;
+        const values = parsed.searchParams.getAll("cursor");
+        if (values.length === 0)
+            return undefined;
+        return values.length === 1 && values[0].length > 0
+            ? values[0]
+            : INVALID_COORDINATION_QUERY;
+    }
+    catch {
+        return INVALID_COORDINATION_QUERY;
+    }
+}
+function isCoordinationPath(path) {
+    return path === "/api/client/attach" || path === "/api/cubes" ||
+        path?.startsWith("/api/cubes/") === true;
+}
+function applyServerLimits(server, limits) {
+    server.maxConnections = limits.maxConnections;
+    server.maxRequestsPerSocket = limits.maxRequestsPerSocket;
+    server.requestTimeout = limits.requestTimeoutMs;
+    server.headersTimeout = limits.headersTimeoutMs;
+    server.keepAliveTimeout = limits.keepAliveTimeoutMs;
+    server.setTimeout(Math.min(limits.handlerTimeoutMs * 2, 2_147_483_647), (socket) => socket.destroy());
+    const addressConnections = new ConcurrentQuota(limits.maxConnectionsPerAddress);
+    const acceptedSockets = new Set();
+    server.on("connection", (socket) => {
+        const tracked = socket;
+        acceptedSockets.add(tracked);
+        tracked.once("close", () => acceptedSockets.delete(tracked));
+        const identity = tracked.remoteAddress ?? "unknown";
+        const release = addressConnections.acquire(identity);
+        if (release === null) {
+            socket.destroy();
+            return;
+        }
+        socket.once("close", release);
+    });
+    return acceptedSockets;
+}
+function validateLimits(limits) {
+    for (const [name, value] of Object.entries(limits)) {
+        if (!Number.isSafeInteger(value) || value <= 0) {
+            throw new Error(`${name} must be a positive safe integer.`);
+        }
+    }
+    if (limits.headersTimeoutMs > limits.requestTimeoutMs) {
+        throw new Error("headersTimeoutMs must not exceed requestTimeoutMs.");
+    }
+    if (limits.tlsHandshakeTimeoutMs > limits.requestTimeoutMs) {
+        throw new Error("tlsHandshakeTimeoutMs must not exceed requestTimeoutMs.");
+    }
+    if (limits.maxConnectionsPerAddress > limits.maxConnections) {
+        throw new Error("maxConnectionsPerAddress must not exceed maxConnections.");
+    }
+    if (limits.maxStreamsPerCredential > limits.maxConnectionsPerAddress) {
+        throw new Error("maxStreamsPerCredential must not exceed maxConnectionsPerAddress.");
+    }
+    if (limits.maxRequestsPerWindow > limits.maxRequestsPerAddressWindow) {
+        throw new Error("maxRequestsPerWindow must not exceed maxRequestsPerAddressWindow.");
+    }
+    if (limits.maxRequestsPerAddressWindow > limits.maxRequestsGlobalWindow) {
+        throw new Error("maxRequestsPerAddressWindow must not exceed maxRequestsGlobalWindow.");
+    }
+}
+export function validateTlsCertificate(certificate, host, mode, caCertificate) {
+    const [parsed, ...intermediates] = parseCertificateBundle(certificate);
+    if (parsed === undefined)
+        throw new Error("TLS certificate is missing.");
+    const now = Date.now();
+    if (now < parsed.validFromDate.getTime() || now > parsed.validToDate.getTime()) {
+        throw new Error("TLS certificate is outside its validity period.");
+    }
+    if (parsed.ca) {
+        throw new Error("TLS certificate must be a non-CA leaf certificate.");
+    }
+    if (parsed.checkIP(host) === undefined) {
+        throw new Error("TLS certificate does not cover the bind address.");
+    }
+    const serverAuthOid = "1.3.6.1.5.5.7.3.1";
+    if (parsed.keyUsage.length > 0 && !parsed.keyUsage.includes(serverAuthOid)) {
+        throw new Error("TLS certificate does not permit server authentication.");
+    }
+    if (caCertificate === undefined) {
+        if (mode === "lan")
+            throw new Error("A private LAN bind requires an explicit TLS trust anchor.");
+        return;
+    }
+    const [trustAnchor, ...additionalIntermediates] = parseCertificateBundle(caCertificate);
+    if (trustAnchor === undefined)
+        throw new Error("TLS trust anchor is missing.");
+    validateCertificateAuthority(trustAnchor, now, "TLS trust anchor");
+    if (!trustAnchor.verify(trustAnchor.publicKey)) {
+        throw new Error("TLS trust anchor must be self-signed.");
+    }
+    const chain = [...intermediates, ...additionalIntermediates];
+    for (const intermediate of chain)
+        validateCertificateAuthority(intermediate, now, "TLS intermediate");
+    const path = findCertificatePath(parsed, trustAnchor, chain, new Set(), 0);
+    if (path === null) {
+        throw new Error("TLS certificate is not signed by the configured trust anchor.");
+    }
+    validatePathLengthConstraints(path);
+}
+function parseCertificateBundle(value) {
+    const text = typeof value === "string" ? value : value.toString("utf8");
+    const pem = text.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/gu);
+    return pem === null ? [new X509Certificate(value)] : pem.map((certificate) => new X509Certificate(certificate));
+}
+function validateCertificateAuthority(certificate, now, label) {
+    if (!certificate.ca)
+        throw new Error(`${label} must be a CA certificate.`);
+    if (now < certificate.validFromDate.getTime() || now > certificate.validToDate.getTime()) {
+        throw new Error(`${label} is outside its validity period.`);
+    }
+    const constraints = readCaConstraints(certificate);
+    if (!constraints.basicConstraintsCritical || !constraints.ca || !constraints.keyCertSign) {
+        throw new Error(`${label} lacks required CA constraints or certificate-signing usage.`);
+    }
+}
+function findCertificatePath(certificate, trustAnchor, intermediates, visited, depth) {
+    if (depth > 8)
+        return null;
+    if (isIssuedBy(certificate, trustAnchor))
+        return [certificate, trustAnchor];
+    for (const intermediate of intermediates) {
+        if (visited.has(intermediate.fingerprint256) || !isIssuedBy(certificate, intermediate))
+            continue;
+        visited.add(intermediate.fingerprint256);
+        const path = findCertificatePath(intermediate, trustAnchor, intermediates, visited, depth + 1);
+        if (path !== null)
+            return [certificate, ...path];
+        visited.delete(intermediate.fingerprint256);
+    }
+    return null;
+}
+function isIssuedBy(certificate, issuer) {
+    return certificate.checkIssued(issuer) && certificate.verify(issuer.publicKey);
+}
+function validatePathLengthConstraints(path) {
+    for (let index = 1; index < path.length; index += 1) {
+        const authority = path[index];
+        const { pathLength } = readCaConstraints(authority);
+        if (pathLength === null)
+            continue;
+        const subordinateAuthorities = path.slice(1, index)
+            .filter((certificate) => certificate.subject !== certificate.issuer).length;
+        if (subordinateAuthorities > pathLength) {
+            throw new Error("TLS certificate chain exceeds a CA path-length constraint.");
+        }
+    }
+}
+function readCaConstraints(certificate) {
+    const extensions = readCertificateExtensions(certificate.raw);
+    const basic = extensions.get("551d13");
+    const keyUsage = extensions.get("551d0f");
+    if (basic === undefined || keyUsage === undefined) {
+        return { basicConstraintsCritical: false, ca: false, pathLength: null, keyCertSign: false };
+    }
+    const basicSequence = readDerElement(basic.value, 0, basic.value.length);
+    if (basicSequence.tag !== 0x30 || basicSequence.end !== basic.value.length)
+        throw new Error("Invalid CA constraints.");
+    const basicChildren = readDerChildren(basic.value, basicSequence);
+    const caElement = basicChildren.find((element) => element.tag === 0x01);
+    const pathElement = basicChildren.find((element) => element.tag === 0x02);
+    const usageBits = readDerElement(keyUsage.value, 0, keyUsage.value.length);
+    if (usageBits.tag !== 0x03 || usageBits.end !== keyUsage.value.length ||
+        usageBits.contentStart + 1 >= usageBits.end)
+        throw new Error("Invalid CA key usage.");
+    return {
+        basicConstraintsCritical: basic.critical,
+        ca: caElement !== undefined && basic.value[caElement.contentStart] !== 0,
+        pathLength: pathElement === undefined ? null : readDerInteger(basic.value, pathElement),
+        keyCertSign: (keyUsage.value[usageBits.contentStart + 1] & 0x04) !== 0,
+    };
+}
+function readCertificateExtensions(certificate) {
+    const outer = readDerElement(certificate, 0, certificate.length);
+    const outerChildren = readDerChildren(certificate, outer);
+    const tbs = outerChildren[0];
+    if (outer.tag !== 0x30 || tbs?.tag !== 0x30)
+        throw new Error("Invalid X.509 certificate encoding.");
+    const extensionWrapper = readDerChildren(certificate, tbs).find((element) => element.tag === 0xa3);
+    if (extensionWrapper === undefined)
+        return new Map();
+    const wrapperChildren = readDerChildren(certificate, extensionWrapper);
+    const extensionSequence = wrapperChildren[0];
+    if (extensionSequence?.tag !== 0x30)
+        throw new Error("Invalid X.509 extension encoding.");
+    const result = new Map();
+    for (const extension of readDerChildren(certificate, extensionSequence)) {
+        if (extension.tag !== 0x30)
+            throw new Error("Invalid X.509 extension encoding.");
+        const fields = readDerChildren(certificate, extension);
+        const oid = fields[0];
+        const hasCriticalField = fields[1]?.tag === 0x01;
+        const critical = hasCriticalField && certificate[fields[1].contentStart] !== 0;
+        const value = fields[hasCriticalField ? 2 : 1];
+        if (oid?.tag !== 0x06 || value?.tag !== 0x04)
+            throw new Error("Invalid X.509 extension encoding.");
+        result.set(certificate.subarray(oid.contentStart, oid.end).toString("hex"), { critical, value: certificate.subarray(value.contentStart, value.end) });
+    }
+    return result;
+}
+function readDerElement(data, offset, limit) {
+    if (offset + 2 > limit)
+        throw new Error("Invalid DER encoding.");
+    const tag = data[offset];
+    const firstLength = data[offset + 1];
+    let length = firstLength;
+    let contentStart = offset + 2;
+    if ((firstLength & 0x80) !== 0) {
+        const lengthBytes = firstLength & 0x7f;
+        if (lengthBytes === 0 || lengthBytes > 4 || contentStart + lengthBytes > limit) {
+            throw new Error("Invalid DER encoding.");
+        }
+        length = 0;
+        for (let index = 0; index < lengthBytes; index += 1) {
+            length = (length * 256) + data[contentStart + index];
+        }
+        contentStart += lengthBytes;
+    }
+    const end = contentStart + length;
+    if (end > limit || end < contentStart)
+        throw new Error("Invalid DER encoding.");
+    return { tag, contentStart, end };
+}
+function readDerChildren(data, parent) {
+    const children = [];
+    let offset = parent.contentStart;
+    while (offset < parent.end) {
+        const child = readDerElement(data, offset, parent.end);
+        children.push(child);
+        offset = child.end;
+    }
+    if (offset !== parent.end)
+        throw new Error("Invalid DER encoding.");
+    return children;
+}
+function readDerInteger(data, element) {
+    if (element.tag !== 0x02 || element.contentStart === element.end ||
+        (data[element.contentStart] & 0x80) !== 0)
+        throw new Error("Invalid DER integer.");
+    let value = 0;
+    for (let offset = element.contentStart; offset < element.end; offset += 1) {
+        value = (value * 256) + data[offset];
+        if (!Number.isSafeInteger(value))
+            throw new Error("DER integer exceeds policy.");
+    }
+    return value;
+}
+export class RequestRateLimiter {
+    #limits;
+    #clock;
+    #maxRequests;
+    #buckets = new Map();
+    constructor(limits, maxRequests = limits.maxRequestsPerWindow, clock = Date.now) {
+        this.#limits = limits;
+        this.#maxRequests = maxRequests;
+        this.#clock = clock;
+    }
+    consume(identity) {
+        const reservation = this.reserve(identity);
+        reservation.commit();
+        return reservation.retryAfter;
+    }
+    reserve(identity) {
+        const now = this.#clock();
+        const existing = this.#buckets.get(identity);
+        if (existing !== undefined && existing.resetAt > now) {
+            if (existing.count >= this.#maxRequests) {
+                return rejectedReservation(Math.max(1, Math.ceil((existing.resetAt - now) / 1_000)));
+            }
+            existing.count += 1;
+            return acceptedReservation(() => { existing.count -= 1; });
+        }
+        if (existing !== undefined)
+            this.#buckets.delete(identity);
+        for (const [key, bucket] of this.#buckets) {
+            if (bucket.resetAt <= now)
+                this.#buckets.delete(key);
+        }
+        if (this.#buckets.size >= this.#limits.maxRateLimitEntries) {
+            return rejectedReservation(Math.max(1, Math.ceil(this.#limits.rateLimitWindowMs / 1_000)));
+        }
+        const bucket = { count: 1, resetAt: now + this.#limits.rateLimitWindowMs };
+        this.#buckets.set(identity, bucket);
+        return acceptedReservation(() => {
+            if (this.#buckets.get(identity) === bucket)
+                this.#buckets.delete(identity);
+        });
+    }
+}
+export class PreAuthAdmissionLimiter {
+    #global;
+    #address;
+    constructor(limits, clock = Date.now) {
+        this.#global = new RequestRateLimiter(limits, limits.maxRequestsGlobalWindow, clock);
+        this.#address = new RequestRateLimiter(limits, limits.maxRequestsPerAddressWindow, clock);
+    }
+    consume(addressIdentity) {
+        const address = this.#address.reserve(addressIdentity);
+        if (address.retryAfter !== null)
+            return address.retryAfter;
+        const global = this.#global.reserve("global");
+        if (global.retryAfter !== null) {
+            address.rollback();
+            return global.retryAfter;
+        }
+        address.commit();
+        global.commit();
+        return null;
+    }
+}
+function acceptedReservation(undo) {
+    let active = true;
+    return {
+        retryAfter: null,
+        commit: () => { active = false; },
+        rollback: () => {
+            if (!active)
+                return;
+            active = false;
+            undo();
+        },
+    };
+}
+function rejectedReservation(retryAfter) {
+    return { retryAfter, commit: () => undefined, rollback: () => undefined };
+}
+export class ConcurrentQuota {
+    #limit;
+    #counts = new Map();
+    constructor(limit) {
+        this.#limit = limit;
+    }
+    acquire(identity) {
+        const count = this.#counts.get(identity) ?? 0;
+        if (count >= this.#limit)
+            return null;
+        this.#counts.set(identity, count + 1);
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            const remaining = (this.#counts.get(identity) ?? 1) - 1;
+            if (remaining <= 0)
+                this.#counts.delete(identity);
+            else
+                this.#counts.set(identity, remaining);
+        };
+    }
+}
+function credentialIdentity(authorization) {
+    if (authorization === undefined)
+        return null;
+    return `credential:${createHash("sha256").update(authorization).digest("base64url")}`;
+}
+function consumeAuthenticatedRateLimit(authorization, rateLimiter) {
+    const identity = credentialIdentity(authorization);
+    return identity === null ? null : rateLimiter.consume(identity);
+}
+function listen(server, port, host) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off("listening", onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, host);
+    });
+}
+async function close(server, acceptedSockets) {
+    const socketClosures = [...acceptedSockets].map((socket) => new Promise((resolve) => {
+        socket.once("close", () => resolve());
+    }));
+    const listenerClosure = new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error !== undefined)
+                reject(error);
+            else
+                resolve();
+        });
+    });
+    for (const socket of acceptedSockets)
+        socket.destroy();
+    server.closeAllConnections();
+    await Promise.all([listenerClosure, ...socketClosures]);
+    if (acceptedSockets.size !== 0)
+        throw new Error("HTTPS socket closure could not be confirmed.");
+}
+//# sourceMappingURL=https-server.js.map