tisura-light 0.0.1-100

package/README.md

@@ -0,0 +1,176 @@
+# Sentinel SDK
+
+This project contains the code for [tisura](https://www.npmjs.com/package/tisura) npm package.
+It provides modules for parsing network packets, proving statements, managing connections, and handling TLS operations.
+
+## Build
+
+### Build Wasm files
+
+Make sure to use `rustc` version of `1.82.0`.
+
+To install it, you can run:
+
+```bash
+# first install rustup
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
+# then install rust
+rustup install 1.82.0
+rustup default 1.82.0
+```
+
+### Build Noir files
+
+Make sure to install `noir`.
+
+To install it, you can run:
+
+```bash
+# first install noirup
+curl -L https://raw.githubusercontent.com/noir-lang/noirup/refs/heads/main/install | bash
+# then install noir
+noirup --version 1.0.0-beta.6
+```
+
+## Local SDK Development
+
+The `build-and-install.sh` script builds the SDK as a `.tgz` (exactly as it would be published to npm) and installs it into a sibling consumer project.
+
+```bash
+./build-and-install.sh <mode> <dest>
+```
+
+- **`<mode>`** (optional, default `full`): `full` builds with WASM + TS, `light` produces a slim ESM bundle (no TLS/circuit code, just stamping + provider requests).
+- **`<dest>`** (optional, default `twallet`): one of `extension`, `platform`, `airdrop`, `twallet`, `explorer`. `platform` and `airdrop` are installed via `yarn`, the others via `npm`.
+
+The script removes any existing `tisura*.tgz` and `node_modules/tisura` in the destination, clears the package manager's cache for tisura, and force-installs the new tarball — so re-running with the same version reliably picks up the new SDK code.
+
+Examples:
+
+```bash
+./build-and-install.sh                  # full build → twallet (npm)
+./build-and-install.sh light extension  # light build → sentinel_extension (npm)
+./build-and-install.sh full platform    # full build → sentinel/platform (yarn)
+```
+
+## Installation
+
+```bash
+npm install tisura
+```
+
+## Usage
+
+### Basic Setup
+
+```typescript
+import { Tisura } from "tisura";
+
+const client = new Tisura({
+  apiKey: "your-api-key", // Format: sk_dev_xxx key, sk_prod_xxx key, or simply sk_local for local development
+});
+```
+
+### Sending a request to the server
+
+```typescript
+const connectClient = client.connect;
+
+const conn = await connectClient.sendRequest({
+    serverHost, // e.g. "api.github.com"
+    serverPort, // e.g. 443
+    endpoint, // e.g. "/users"
+    params, // e.g. [{ key: "since", value: "1" }]
+    method, // e.g. "POST"
+    body , // eg. [{ key: "name", value: "sherlock" }] - Optional
+    headers, // e.g. { key: "Authorization", value: `Bearer ${token}` } - Optional
+}: SendRequestArgs);
+```
+
+### Generating a proof and verifying it
+
+```typescript
+const proveClient = client.prove;
+
+const proof = await proveClient.generateProof({
+    circuitName, // e.g. "ownership"
+    connectionId, // optional, defaults to the last connection
+    plaintext, // the data you want to prove in "substring" circuit - Optional
+    nodeId, // the github node ID to prove in "ownership" circuit - Optional
+    repoName, // the github repo name to prove in "contributions" circuit - Optional
+    repoOwner, // the github repo owner to prove in "contributions" circuit - Optional
+    count, // the number of contributions to prove in "contributions" circuit - Optional
+}: GenerateProofArgs);
+
+const isValid = await proveClient.verifyProof({
+    circuitName, // e.g. "ownership"
+    proof, // the proof above
+}: VerifyProofArgs);
+```
+
+### Certifying a statement
+
+```typescript
+const certifyClient = client.certify;
+
+const cert = await certifyClient.certify({
+    inputBytes, // the data you want to certify (in bytes)
+    connectionId, // optional, defaults to the last connection
+    inputSessionKey, // optional, defaults to the last session key
+}: CertifyArgs)
+```
+
+### Decrypting an encrypted statement
+
+```typescript
+const certifyClient = client.certify;
+const decrypted = await certifyClient.decrypt({
+    connectionId, // optional, defaults to the last connection
+}: DecryptArgs);
+```
+
+### Available Modules
+
+The SDK consists of several modules:
+
+- **Parse**: Network packet parsing and analysis
+- **Prove**: Statement proving and verification
+- **Certify**: Statement certifying from client side
+- **Connect**: Connection management
+
+### Module-specific Imports
+
+You can import specific modules directly:
+
+```typescript
+import { ParseClient } from "tisura/parse";
+import { ProveClient } from "tisura/prove";
+import { CertifyClient } from "tisura/certify";
+import { ConnectClient } from "tisura/connect";
+```
+
+## Configuration
+
+The SDK requires the following configuration parameters:
+
+```typescript
+interface TisuraConfig {
+  proxyUrl: string;
+  storeUrl: string;
+}
+```
+
+## Development
+
+### Install, build and run tests
+
+```bash
+# Install dependencies
+npm install
+
+# Build the package
+npm run build
+
+# Run tests
+npm test
+```

package/dist/certify/embedCertificateEml.d.ts

@@ -0,0 +1,21 @@
+import { SessionKey } from "../inputs.js";
+/**
+ * Embed certificate.json as a folded `X-Tisura-Certificate` header (RFC 5322).
+ *
+ * The cert JSON is base64-encoded and inserted right before the header/body
+ * separator. Body bytes are preserved byte-identical, and the original `.eml`
+ * is recoverable by stripping the inserted header.
+ */
+export declare function embedCertificateInEml(originalEmlBytes: Uint8Array, certificate: SessionKey): {
+    stampedEmlBytes: Uint8Array;
+};
+/**
+ * Extract the embedded certificate from a stamped `.eml` and return the
+ * recovered original bytes (with the `X-Tisura-Certificate` header stripped).
+ * Returns null if no embedded certificate is found.
+ */
+export declare function extractCertificateFromEml(emlBytes: Uint8Array): {
+    certObj: unknown;
+    originalEmlBytes: Uint8Array;
+} | null;
+export declare function isEmlWithCertificate(emlBytes: Uint8Array): boolean;

package/dist/certify/embedCertificatePdf.d.ts

@@ -0,0 +1,23 @@
+import { SessionKey } from "../inputs.js";
+/**
+ * Embed certificate.json as a PDF file attachment (ISO 32000-2:2020, 7.11.4).
+ *
+ * Uses incremental save to preserve original bytes as a prefix of the stamped
+ * PDF. The certificate includes `original_content_length` so the verifier can
+ * slice the stamped PDF to recover the exact original bytes and compare them
+ * against the TLS-decrypted body.
+ */
+export declare function embedCertificateInPdf(originalPdfBytes: Uint8Array, certificate: SessionKey): Promise<{
+    stampedPdfBytes: Uint8Array;
+}>;
+/**
+ * Extract certificate.json from a PDF's EmbeddedFiles name tree.
+ * Returns null if no embedded certificate is found.
+ */
+export declare function extractCertificateFromPdf(pdfBytes: Uint8Array): Promise<{
+    certObj: unknown;
+} | null>;
+/**
+ * Check if a PDF has an embedded certificate attachment.
+ */
+export declare function isPdfWithCertificate(pdfBytes: Uint8Array): Promise<boolean>;

package/dist/certify/embedQrCode.d.ts

@@ -0,0 +1,27 @@
+import { SessionKey } from "../inputs.js";
+export type QrPlacement = {
+    pageIndex: number;
+    x: number;
+    y: number;
+    size?: number;
+};
+/**
+ * Embed a QR code on the PDF.
+ *
+ * Defaults to bottom-right of the last page. Pass `placement` to override —
+ * callers that detect whitespace can pick a corner that won't collide with
+ * existing content.
+ *
+ * The QR encodes a verification URL with certificate query params:
+ *   <verifyBaseUrl>?cr=<client_random>&secret=<secret>&len=<original_content_length>
+ *
+ * Uses QRCode.toCanvas with OffscreenCanvas in service workers (no DOM needed),
+ * falls back to QRCode.toDataURL in Node.js.
+ *
+ * Uses incremental save to preserve all preceding bytes (including any
+ * certificate attachment from embedCertificateInPdf) as a prefix of the
+ * output, so `original_content_length` slice still works for verification.
+ */
+export declare function embedQrCodeInPdf(pdfBytes: Uint8Array, certificate: SessionKey & {
+    original_content_length: number;
+}, verifyBaseUrl?: string, placement?: QrPlacement): Promise<Uint8Array>;

package/dist/certify/findBestQrPlacement.d.ts

@@ -0,0 +1,13 @@
+import type { QrPlacement } from "./embedQrCode.js";
+/**
+ * Pick the brightest whitespace spot inside any of the four corner regions
+ * of the last page so a QR stamp avoids both page-edge content (decorative
+ * borders) and the page interior (body text).
+ *
+ * For each corner, slides a (qrSize + 2·margin)² probe and picks the
+ * position with the highest mean luminance across all four corners.
+ *
+ * Coordinates are returned in PDF user space (origin at bottom-left), ready
+ * to hand to embedQrCodeInPdf.
+ */
+export declare function findBestQrPlacement(pdfBytes: Uint8Array, qrSize?: number, margin?: number, cornerSize?: number): Promise<QrPlacement>;

package/dist/certify/utils.d.ts

@@ -0,0 +1,5 @@
+export declare function concatUint8Arrays(arrays: Uint8Array[]): Uint8Array;
+export declare function decodeToBytes(input: string | ArrayBuffer | Uint8Array): Uint8Array;
+export declare function includes(source: Uint8Array, needle: Uint8Array): boolean;
+export declare function bytesToBase64(bytes: Uint8Array): string;
+export declare function extractPdfFromEnvelope(body: Uint8Array): Uint8Array | null;

package/dist/client-light.d.ts

@@ -0,0 +1,110 @@
+import { TisuraConfig } from "./config.js";
+import { ConnectClient } from "./connect/index.js";
+import { SessionKey, LinkedSessionCertificate } from "./inputs.js";
+import { FtpsVerification, VerifyFtpsOptions } from "./verify/ftps.js";
+export type SendRequestArgs = {
+    serverHost: string;
+    endpoint: string;
+    method: "GET" | "POST";
+    params?: Array<{
+        key: string;
+        value: string;
+    }>;
+    body?: Array<{
+        key: string;
+        value: string;
+    }>;
+    headers?: Array<{
+        key: string;
+        value: string;
+    }>;
+    serverPort?: number;
+    onProgress?: (...args: [number, number?]) => void;
+};
+export type SendProviderRequestArgs = {
+    providerKey: string;
+    providerContext?: unknown;
+    headers?: Array<{
+        key: string;
+        value: string;
+    }>;
+    onProgress?: (...args: [number, number?]) => void;
+};
+export type ProviderInfo = {
+    id: string;
+    responseStatus: boolean;
+};
+export type DownloadFtpsArgs = {
+    serverHost: string;
+    user: string;
+    pass: string;
+    remotePath: string;
+};
+export declare class TisuraLight {
+    config: TisuraConfig;
+    protected connectClient: ConnectClient;
+    constructor({ apiKey }: {
+        apiKey: string;
+    });
+    sendRequest(args: SendRequestArgs): Promise<string | Blob>;
+    sendRequestRawResponse({ serverHost, endpoint, params, method, body, headers, serverPort, onProgress, }: SendRequestArgs): Promise<Uint8Array>;
+    /**
+     * Sends a request expected to return a PDF and returns the raw PDF bytes
+     * along with the TLS session key captured from the connection.
+     *
+     * Use this when you want to run logic between fetch and stamping (for
+     * example, scanning the PDF for whitespace before placing the QR). For the
+     * common case, prefer `sendRequestAndStampPdf`.
+     *
+     * Throws if the response is not application/pdf or if no
+     * SERVER_TRAFFIC_SECRET_0 key was captured.
+     */
+    sendRequestForPdf(args: SendRequestArgs): Promise<{
+        pdfBytes: Uint8Array;
+        sessionKey: SessionKey;
+    }>;
+    /**
+     * Sends a request expected to return a PDF and stamps a Tisura verification
+     * QR code in the bottom-right of the last page. The QR encodes the
+     * environment-aware verifyBaseUrl plus the TLS session key from this
+     * connection, so the recipient can verify the PDF's authenticity.
+     *
+     * Reads the session key directly from the connection's in-memory buffer, so
+     * this works in any runtime including Node — no localStorage required.
+     *
+     * Returns the QR-stamped PDF as a Uint8Array. Throws if the response is not
+     * application/pdf or if no SERVER_TRAFFIC_SECRET_0 key was captured.
+     */
+    sendRequestAndStampPdf(args: SendRequestArgs): Promise<Uint8Array>;
+    sendProviderRequest(args: SendProviderRequestArgs): Promise<string | Blob>;
+    sendProviderRequestRawResponse({ providerKey, providerContext, headers, onProgress, }: SendProviderRequestArgs): Promise<Uint8Array>;
+    /**
+     * POC: download a single file over implicit FTPS (port 990) and return just
+     * the file bytes. Establishes two tunnels (control + data), each with its own
+     * TLS session captured by the proxy.
+     */
+    downloadFtpsFile(args: DownloadFtpsArgs): Promise<Uint8Array>;
+    /**
+     * Like {@link downloadFtpsFile}, but also returns a {@link
+     * LinkedSessionCertificate} bundling the control- and data-channel TLS keys
+     * plus the PASV data endpoint. These are what a verifier needs to bind the
+     * two sessions into a single proof ("file F answered the command issued on
+     * the control channel"). Verification / the proxy-attested dial-address
+     * cross-check is separate (later phases); this surfaces the inputs.
+     *
+     * Throws if the expected traffic secrets were not captured on either channel.
+     */
+    downloadFtpsFileWithCertificate({ serverHost, user, pass, remotePath, }: DownloadFtpsArgs): Promise<{
+        bytes: Uint8Array;
+        certificate: LinkedSessionCertificate;
+    }>;
+    /**
+     * Verifies an FTPS download from its {@link LinkedSessionCertificate}: decrypts
+     * the proxy-captured control + data transcripts, checks the proxy-signed dial
+     * address of the data session matches the PASV endpoint named on the control
+     * channel, and returns the bound claim (command + file).
+     */
+    verifyFtpsDownload(cert: LinkedSessionCertificate, opts?: VerifyFtpsOptions): Promise<FtpsVerification>;
+    updateProviderMetrics({ id, responseStatus, }: ProviderInfo): Promise<void>;
+    protected incrementApiKeyCounter(): Promise<void>;
+}

package/dist/config.d.ts

@@ -0,0 +1,13 @@
+export interface TisuraConfig {
+    proxyUrl: string;
+    storeUrl: string;
+    verifyBaseUrl: string;
+    apiKey: string;
+    proxyPublicKeyHex?: string;
+}
+export declare function deriveConfigFromAPIKey(apiKey: string): TisuraConfig;
+export declare class TisuraBase {
+    config: TisuraConfig;
+    constructor(config: TisuraConfig);
+    protected getStoreFetcherEndpoint(): string;
+}

package/dist/connect/connect.d.ts

@@ -0,0 +1,81 @@
+import { TisuraConfig } from "../config.js";
+import { SessionKey } from "../inputs.js";
+import { BuiltRequest } from "./internal/connectionContext.js";
+import { SessionStore } from "./tls/index.js";
+export type ConnectOptions = {
+    /** Shared TLS session store to enable resumption (FTPS data channel). */
+    sessionStore?: SessionStore;
+    /**
+     * TLS server name (SNI) for the handshake, when it must differ from the
+     * tunnel target host — e.g. a PASV data channel that connects to a bare IP
+     * but must resume the control session keyed by its hostname.
+     */
+    tlsServerName?: string;
+};
+/**
+ * Class to create a raw TCP tunnel between the client and the server and upgrade to TLS.
+ */
+export declare class Connect {
+    private config;
+    private tlsClient;
+    private serverHost;
+    private serverPort;
+    private ctx;
+    constructor(config: TisuraConfig);
+    /**
+     * Establishes a secure TLS connection to a target server via a proxy tunnel.
+     */
+    connectToServer(serverHost: string, serverPort?: number, opts?: ConnectOptions): Promise<void>;
+    /**
+     * Establishes a secure TLS connection where the proxy builds the request
+     * from its stored config for `providerKey`. Returns the built request fields
+     * so the caller can use them for the HTTP request sent through the tunnel.
+     */
+    connectToProviderServer(providerKey: string, providerContext?: unknown): Promise<BuiltRequest>;
+    /**
+     * Sends a message to the server via the established TLS connection.
+     * @param {string} path - The path for the HTTP request
+     * @param {Array<{ key: string; value: string }>} params - Query parameters
+     * @param {string} method - HTTP method (GET, POST, etc.)
+     * @param {Array<{ key: string; value: string }>} body - Request body fields
+     * @param {Array<{ key: string; value: string }>} headers - HTTP headers
+     * @param {Function} onProgress - Optional progress callback
+     * @returns {Promise<Uint8Array>} - The server's response
+     */
+    sendRequest(path: string, params: Array<{
+        key: string;
+        value: string;
+    }>, method: string, body: Array<{
+        key: string;
+        value: string;
+    }>, headers: Array<{
+        key: string;
+        value: string;
+    }>, onProgress?: (bytesReceived: number, totalBytes?: number) => void): Promise<Uint8Array>;
+    /**
+     * Registers a callback to receive decrypted TLS application-data bytes,
+     * bypassing the HTTP response accumulator. Used by non-HTTP protocols.
+     */
+    setOnDecryptedData(cb: (data: Uint8Array) => void): void;
+    /**
+     * Registers a callback fired when the underlying WebSocket closes. Used by
+     * non-HTTP protocols whose end-of-stream signal is the socket close.
+     */
+    setOnClose(cb: () => void): void;
+    /**
+     * Encrypts and sends raw bytes over the established TLS session. Throws if
+     * the handshake has not completed or the connection is not initialized.
+     */
+    sendEncrypted(data: Uint8Array): void;
+    /**
+     * Drains and returns the TLS session keys captured during this connection's
+     * handshake. Returns [] if the TLS connection is no longer available (e.g.
+     * after disconnect). Calling this twice returns [] the second time.
+     */
+    takeSessionKeys(): SessionKey[];
+    /**
+     * Disconnects from the server and cleans up resources.
+     * Closes the WebSocket connection and resets internal state variables.
+     */
+    disconnectFromServer(): Promise<void>;
+}

package/dist/connect/ftp/ftpClient.d.ts

@@ -0,0 +1,18 @@
+import { TisuraConfig } from "../../config.js";
+import { SessionKey } from "../../inputs.js";
+export type FtpsDownloadResult = {
+    bytes: Uint8Array;
+    controlSessionKeys: SessionKey[];
+    dataSessionKeys: SessionKey[];
+    pasvAddr: string;
+};
+/**
+ * Minimal implicit-FTPS client (port 990) that downloads a single file via
+ * two tunnels (control + data). POC scope: USER/PASS auth, binary transfer,
+ * passive mode, no explicit AUTH TLS upgrade, no listings, no resume.
+ */
+export declare class FtpClient {
+    private config;
+    constructor(config: TisuraConfig);
+    download(host: string, user: string, pass: string, remotePath: string): Promise<FtpsDownloadResult>;
+}

package/dist/connect/index.d.ts

@@ -0,0 +1,67 @@
+import { TisuraBase, TisuraConfig } from "../config.js";
+import { SessionKey } from "../inputs.js";
+type KV = {
+    key: string;
+    value: string;
+};
+type OnProgress = (bytesReceived: number, totalBytes?: number) => void;
+export type SendRequestOptions = {
+    serverHost: string;
+    endpoint: string;
+    params: KV[];
+    method: string;
+    body: KV[];
+    headers?: KV[];
+    serverPort?: number;
+    onProgress?: OnProgress;
+    maxRedirects?: number;
+};
+export type SendProviderRequestOptions = {
+    providerKey: string;
+    providerContext?: unknown;
+    headers?: KV[];
+    onProgress?: OnProgress;
+    maxRedirects?: number;
+};
+export declare class ConnectClient extends TisuraBase {
+    constructor(config: TisuraConfig);
+    /**
+     * Establishes a secure TLS connection to the server via a proxy tunnel.
+     * Sends a request to the server and waits for a response.
+     * Closes the connection after receiving the response.
+     * @param onProgress - Optional callback for download progress (bytesReceived, totalBytes)
+     */
+    sendRequest(opts: SendRequestOptions): Promise<Uint8Array>;
+    /**
+     * Variant of {@link sendRequest} that also returns the TLS session keys
+     * captured during the request. Lets callers (e.g.
+     * `sendRequestAndStampPdf`) avoid round-tripping through localStorage.
+     * Useful in environments without browser storage, like Node.
+     *
+     * Redirect semantics: if the request follows redirects, the returned
+     * `sessionKeys` are from the **final hop only** — the connection that
+     * actually delivered the response. Keys from intermediate hops are
+     * discarded with their connections. If you need keys for an intermediate
+     * hop, disable redirects (`maxRedirects: 0`) and follow them manually.
+     */
+    sendRequestWithKeys({ serverHost, endpoint, params, method, body, headers, serverPort, onProgress, maxRedirects, }: SendRequestOptions): Promise<{
+        response: Uint8Array;
+        sessionKeys: SessionKey[];
+    }>;
+    /**
+     * Sends a request built by the proxy from the provider's stored template.
+     */
+    sendProviderRequest({ providerKey, providerContext, headers, onProgress, maxRedirects, }: SendProviderRequestOptions): Promise<Uint8Array>;
+    private sendHop;
+    private withConnection;
+    private followRedirects;
+}
+/**
+ * Process the complete response after all data has been received.
+ */
+export declare function extractHeadersAndBodyFromFullResponse(fullData: Uint8Array): {
+    body: Uint8Array;
+    headers: Record<string, string>;
+};
+export declare function processCompleteResponse(data: Uint8Array): string | Blob;
+export {};

package/dist/connect/internal/connectionContext.d.ts

@@ -0,0 +1,50 @@
+import { TlsConnection } from "../tls/wasm/tls.js";
+export type BuiltRequest = {
+    serverHost: string;
+    serverPort?: number;
+    method: string;
+    endpoint: string;
+    params: Array<{
+        key: string;
+        value: string;
+    }>;
+    headers: Array<{
+        key: string;
+        value: string;
+    }>;
+    body?: unknown;
+};
+/**
+ * Holds all state for a single connection instance.
+ * Eliminates global state by encapsulating WebSocket, TLS, and response tracking.
+ */
+export declare class ConnectionContext {
+    ws: WebSocket | null;
+    isTunnelEstablished: boolean;
+    tlsConnection: TlsConnection | undefined;
+    hasTlsSessionStarted: boolean;
+    hasCompletedHandshake: boolean;
+    hasCompletedSession: boolean;
+    wasmInitialized: boolean;
+    pendingResponse: ResponseAccumulator | null;
+    onDecryptedData?: (data: Uint8Array) => void;
+    onClose?: () => void;
+    /**
+     * Clean up all resources for this connection
+     */
+    cleanup(): void;
+}
+/**
+ * Type definition for response tracking
+ */
+export interface ResponseAccumulator {
+    buffer: Uint8Array;
+    isComplete: boolean;
+    resolve: (value: Uint8Array) => void;
+    reject: (reason: any) => void;
+    absoluteTimeout: ReturnType<typeof setTimeout>;
+    idleTimeout: ReturnType<typeof setTimeout>;
+    startTime: number;
+    onProgress?: (bytesReceived: number, totalBytes?: number) => void;
+    contentLength?: number;
+}

package/dist/connect/internal/fileTypes.d.ts

@@ -0,0 +1,3 @@
+export declare function normalizeMimeType(contentType: string): string;
+export declare const FILE_TYPE_MAP: Record<string, string>;
+export declare const BINARY_PREFIXES: string[];

package/dist/connect/internal/httpRequest.d.ts

@@ -0,0 +1,57 @@
+import { ConnectionContext } from "./connectionContext.js";
+/**
+ * Create the HTTP request, encrypt it and send it to the server.
+ */
+export declare function createAndEncryptHttpRequest(ctx: ConnectionContext, serverHost: string, path: string, params: Array<{
+    key: string;
+    value: string;
+}>, method: string, body: Array<{
+    key: string;
+    value: string;
+}>, headers: Array<{
+    key: string;
+    value: string;
+}>, serverPort?: number): Uint8Array;
+/**
+ * Create the HTTP request.
+ */
+export declare function createHttpRequest(serverHost: string, path: string, params: Array<{
+    key: string;
+    value: string;
+}>, method: string, body: Array<{
+    key: string;
+    value: string;
+}>, extraHeaders: Array<{
+    key: string;
+    value: string;
+}>, serverPort?: number): string;
+/**
+ * Handles the server response received over the TLS connection.
+ */
+export declare function handleServerResponse(ctx: ConnectionContext, onProgress?: (bytesReceived: number, totalBytes?: number) => void): Promise<Uint8Array>;
+/**
+ * Called by TLS layer to notify HTTP layer of new data.
+ */
+export declare function notifyTlsDataReceived(ctx: ConnectionContext, data: Uint8Array): void;
+export declare function parseHeaders(headerText: string): Record<string, string>;
+export declare function isChunkedBodyComplete(body: Uint8Array): boolean;
+export declare function parseChunkedBody(body: Uint8Array): Uint8Array;
+/**
+ * Gets appropriate MIME type and file type for binary content
+ */
+export declare function getBinaryContentInfo(contentType: string, headers: Record<string, string>): {
+    mimeType: string;
+    fileType: string;
+};
+export declare function handleContentType(bodyBytes: Uint8Array, headers: Record<string, string>): string | Blob;
+/**
+ * Split the headers and body of the HTTP response.
+ */
+export declare function splitHeadersAndBody(data: Uint8Array): {
+    headers: string;
+    body: Uint8Array;
+};
+/**
+ * Parse the server response.
+ */
+export declare function parseServerResponse(responseData: string): string;