import { AEAD, AEADFactory, CipherSuite, KDFFactory, KeyPair, RecipientContext, SenderContext } from "hpke"; import "bhttp-ts"; //#region src/errors.d.ts /** * OHTTP error codes - opaque to prevent information leakage */ declare const OHTTPErrorCode: { /** Failed to parse key configuration */ readonly InvalidKeyConfig: "INVALID_KEY_CONFIG"; /** Unknown key identifier */ readonly UnknownKeyId: "UNKNOWN_KEY_ID"; /** Unsupported cipher suite */ readonly UnsupportedCipherSuite: "UNSUPPORTED_CIPHER_SUITE"; /** Decryption failed - deliberately opaque */ readonly DecryptionFailed: "DECRYPTION_FAILED"; /** Encryption failed */ readonly EncryptionFailed: "ENCRYPTION_FAILED"; /** Invalid message format */ readonly InvalidMessage: "INVALID_MESSAGE"; /** Chunk sequence error */ readonly ChunkSequenceError: "CHUNK_SEQUENCE_ERROR"; /** Chunk limit exceeded */ readonly ChunkLimitExceeded: "CHUNK_LIMIT_EXCEEDED"; /** Aggregate message size exceeded */ readonly MessageTooLarge: "MESSAGE_TOO_LARGE"; }; type OHTTPErrorCode = (typeof OHTTPErrorCode)[keyof typeof OHTTPErrorCode]; /** * Opaque error type for OHTTP operations. * Messages are deliberately vague to prevent oracle attacks. */ declare class OHTTPError extends Error { readonly code: OHTTPErrorCode; constructor(code: OHTTPErrorCode); } /** * Type guard for OHTTPError */ declare function isOHTTPError(error: unknown): error is OHTTPError; //#endregion //#region src/constants.d.ts /** * OHTTP media types for Content-Type headers */ declare const MediaType: { /** Key configuration: application/ohttp-keys (RFC 9458 Section 9.1) */ readonly KEYS: "application/ohttp-keys"; /** Encapsulated request: message/ohttp-req (RFC 9458 Section 9.2) */ readonly REQUEST: "message/ohttp-req"; /** Encapsulated response: message/ohttp-res (RFC 9458 Section 9.3) */ readonly RESPONSE: "message/ohttp-res"; /** Chunked encapsulated request: message/ohttp-chunked-req (draft-08 Section 8.1) */ readonly CHUNKED_REQUEST: "message/ohttp-chunked-req"; /** Chunked encapsulated response: message/ohttp-chunked-res (draft-08 Section 8.2) */ readonly CHUNKED_RESPONSE: "message/ohttp-chunked-res"; }; type MediaType = (typeof MediaType)[keyof typeof MediaType]; /** * AEAD tag length in bytes, 16 for every AEAD OHTTP registers (draft-08 Section 6). */ declare const AEAD_TAG_SIZE = 16; /** * Keys for the HPKE/AEAD state the chunked contexts carry from the object * literal that builds them to the streaming transforms that consume it. * Not re-exported from the package entry point. */ declare const kSenderContext: unique symbol; declare const kRecipientContext: unique symbol; declare const kEnc: unique symbol; declare const kSuite: unique symbol; declare const kAead: unique symbol; declare const kAeadKey: unique symbol; declare const kAeadNonce: unique symbol; //#endregion //#region src/keyConfig.d.ts /** * HPKE KEM identifiers (RFC 9458 Section 3.1) * * Includes post-quantum ML-KEM variants from @panva/hpke-noble */ declare const KemId: { readonly P256_HKDF_SHA256: 16; readonly P384_HKDF_SHA384: 17; readonly P521_HKDF_SHA512: 18; readonly X25519_HKDF_SHA256: 32; readonly X448_HKDF_SHA512: 33; readonly ML_KEM_512: 64; readonly ML_KEM_768: 65; readonly ML_KEM_1024: 66; readonly MLKEM768_P256: 80; readonly MLKEM1024_P384: 81; readonly MLKEM768_X25519: 25722; }; type KemId = (typeof KemId)[keyof typeof KemId]; /** * HPKE KDF identifiers (RFC 9458 Section 3.1) */ declare const KdfId: { readonly HKDF_SHA256: 1; readonly HKDF_SHA384: 2; readonly HKDF_SHA512: 3; }; type KdfId = (typeof KdfId)[keyof typeof KdfId]; /** * HPKE AEAD identifiers (RFC 9458 Section 3.1) * * Note: ChaCha20Poly1305 response encryption requires a runtime with * ChaCha20-Poly1305 support (e.g. Node.js 24+). In browsers and Cloudflare * Workers, where WebCrypto lacks it, pass a non-WebCrypto AEAD factory via the * `responseCrypto` option (e.g. `@panva/hpke-noble`'s `AEAD_ChaCha20Poly1305`). */ declare const AeadId: { readonly AES_128_GCM: 1; readonly AES_256_GCM: 2; readonly ChaCha20Poly1305: 3; }; type AeadId = (typeof AeadId)[keyof typeof AeadId]; /** * Type guard for valid KEM IDs */ declare function isValidKemId(id: number): id is KemId; /** * Type guard for valid KDF IDs */ declare function isValidKdfId(id: number): id is KdfId; /** * Type guard for valid AEAD IDs */ declare function isValidAeadId(id: number): id is AeadId; /** * A symmetric algorithm pair (KDF + AEAD) */ interface SymmetricAlgorithm$1 { readonly kdfId: KdfId; readonly aeadId: AeadId; } /** * Key configuration for OHTTP (RFC 9458 Section 3.1) */ interface KeyConfig$1 { /** Key identifier (0-255) */ readonly keyId: number; /** KEM identifier */ readonly kemId: KemId; /** Public key bytes */ readonly publicKey: Uint8Array; /** Supported symmetric algorithms */ readonly symmetricAlgorithms: readonly SymmetricAlgorithm$1[]; } /** * Key configuration with private key for server use */ interface KeyConfigWithPrivate$1 extends KeyConfig$1 { /** HPKE key pair, valid for every suite in {@link suites} */ readonly keyPair: KeyPair; /** One suite per advertised (KDF, AEAD) pair; {@link selectSuite} picks one */ readonly suites: readonly CipherSuite[]; } /** * Get the serialized public key length (Npk) for a KEM * * @throws OHTTPError if kemId is not a supported KEM */ declare function getPublicKeyLength(kemId: KemId): number; /** * Pick the suite a request header names (RFC 9458 Section 4.3) * * The gateway side of {@link selectKeyConfig}. One config may advertise several * pairs, as RFC 9458 Appendix A does, and the header says which was used. * * @throws OHTTPError UnsupportedCipherSuite if the config offers no such pair */ declare function selectSuite(config: KeyConfigWithPrivate$1, kdfId: number, aeadId: number): CipherSuite; /** * Serialize a KeyConfig to bytes (RFC 9458 Section 3.1) * * Refuses to write anything `parseKeyConfig` would not read back, so it throws * `UnsupportedCipherSuite` for a KEM this library lacks and `InvalidKeyConfig` * for a keyId, public key, or algorithm list that does not fit. * * Format: * - Key Identifier (1 byte) * - HPKE KEM ID (2 bytes) * - HPKE Public Key (Npk bytes) * - Symmetric Algorithms Length (2 bytes) * - Symmetric Algorithms (4 bytes each: KDF ID + AEAD ID) */ declare function serializeKeyConfig(config: KeyConfig$1): Uint8Array; /** * Parse a KeyConfig from bytes (RFC 9458 Section 3.1) * * Rejects with {@link OHTTPErrorCode.InvalidKeyConfig} for structural damage * and {@link OHTTPErrorCode.UnsupportedCipherSuite} for a KEM this library does * not implement, or a config whose every symmetric algorithm is unimplemented. * Unimplemented (KDF, AEAD) pairs alongside implemented ones are dropped, per * RFC 9458 Section 3.1. Only the latter code is safe for a list to skip. */ declare function parseKeyConfig(data: Uint8Array): KeyConfig$1; /** * Serialize key configurations to application/ohttp-keys format (RFC 9458 Section 3.2) * * Format: For each config: 2-byte length prefix + serialized KeyConfig */ declare function serializeKeyConfigs(configs: readonly KeyConfig$1[]): Uint8Array; /** * Parse application/ohttp-keys format to KeyConfig array (RFC 9458 Section 3.2) * * Configs naming algorithms this library does not implement are skipped, so the * result may be empty. Use {@link selectKeyConfig} to pick a usable one rather * than reaching for `configs[0]`. */ declare function parseKeyConfigs(data: Uint8Array): KeyConfig$1[]; /** * Pick the first config a `suite` can actually use (RFC 9458 Section 4.1) * * Throws {@link OHTTPErrorCode.UnsupportedCipherSuite} when none match, so a * gateway rotating to a KEM this client lacks fails here rather than at * encapsulation. That code from this function means exactly "no offered config * matches this suite", which is the case worth catching: re-fetch the key * configuration, try another suite, or fall back to a direct request. * * First match means the gateway's order decides. Where it lists two keys this * suite can use, the earlier one wins. */ declare function selectKeyConfig(suite: CipherSuite, configs: readonly KeyConfig$1[]): KeyConfig$1; /** * Generate a KeyConfig with a new random key pair * * @param suites - HPKE cipher suite, or one per (KDF, AEAD) pair to advertise * @param keyId - Key identifier (0-255) * @param extractable - Allow exporting the private key (default: false) */ declare function generateKeyConfig(suites: CipherSuite | readonly CipherSuite[], keyId: number, extractable?: boolean): Promise; /** * Derive a deterministic KeyConfig from a seed (for testing) * * Uses HPKE's DeriveKeyPair(ikm) for deterministic key generation. */ declare function deriveKeyConfig(suites: CipherSuite | readonly CipherSuite[], seed: Uint8Array, keyId: number): Promise; /** * Import a key pair to create a KeyConfigWithPrivate * * Both public and private key bytes are required since deriving the public key * from the private key is KEM-specific and not exposed by the hpke library. * * @param suites - HPKE cipher suite, or one per (KDF, AEAD) pair to advertise * @param keyId - Key identifier (0-255) * @param publicKeyBytes - Serialized public key * @param privateKeyBytes - Serialized private key */ declare function importKeyConfig(suites: CipherSuite | readonly CipherSuite[], keyId: number, publicKeyBytes: Uint8Array, privateKeyBytes: Uint8Array): Promise; //#endregion //#region src/framing.d.ts /** * Frame a chunk with varint length prefix * * Non-final chunks: length (varint) + ciphertext * Final chunk: 0 (varint) + ciphertext */ declare function frameChunk(ciphertext: Uint8Array, isFinal: boolean): Uint8Array; /** * Result of parsing a framed chunk */ interface ParsedChunk { readonly ciphertext: Uint8Array; readonly isFinal: boolean; readonly bytesConsumed: number; } /** * Parse a framed chunk, returning the ciphertext and whether it's final * * Returns undefined if not enough data available. * Throws OHTTPError if the varint encoding is malformed, or if the declared * frame length exceeds `maxFrameSize`. * * `ciphertext` views `data`; do not mutate `data` while holding it. */ declare function parseFramedChunk(data: Uint8Array, maxFrameSize?: number): ParsedChunk | undefined; //#endregion //#region src/encapsulation.d.ts /** * Optional crypto factories for OHTTP response encryption (RFC 9458 Section 4.4). * * OHTTP responses are not HPKE: the response key is derived with HKDF over an * HPKE-exported secret and then used with a raw AEAD. The constructed * {@link CipherSuite} only exposes metadata for its KDF/AEAD, so the response * primitives are obtained by instantiating hpke factories instead. * * By default the factories are resolved from the suite's KDF/AEAD ids using * hpke's built-in (WebCrypto-backed) implementations. Override either field to * supply a non-WebCrypto implementation — for example * `@panva/hpke-noble`'s `AEAD_ChaCha20Poly1305` for ChaCha20 responses in * browsers and Cloudflare Workers, where WebCrypto lacks ChaCha20-Poly1305. * * An override may swap the implementation but not the algorithm: the factory * must produce the same KDF/AEAD the suite negotiated, otherwise resolution * throws {@link OHTTPErrorCode.UnsupportedCipherSuite}. A config serving * several suites takes a factory per algorithm: the request picks which. */ interface ResponseCrypto { /** KDF factory override, or one per KDF served (default: resolved from the suite) */ readonly kdf?: KDFFactory | readonly KDFFactory[]; /** AEAD factory override, or one per AEAD served (default: resolved from the suite) */ readonly aead?: AEADFactory | readonly AEADFactory[]; } /** * Encapsulated request header structure (raw wire values) * * Note: kemId, kdfId, aeadId are raw numbers from the wire. * They must be validated against supported values before use. */ interface EncapsulatedRequestHeader { readonly keyId: number; readonly kemId: number; readonly kdfId: number; readonly aeadId: number; readonly enc: Uint8Array; } /** * Client context for encrypting requests and decrypting responses */ interface ClientEncapsulationContext { /** The encapsulated request bytes (header + enc + ciphertext) */ readonly encapsulatedRequest: Uint8Array; /** The HPKE sender context for exporting secrets */ readonly senderContext: SenderContext; /** The encapsulated secret (enc) */ readonly enc: Uint8Array; /** The cipher suite used */ readonly suite: CipherSuite; } /** * Server context for decrypting requests and encrypting responses */ interface ServerEncapsulationContext { /** The decrypted request */ readonly request: Uint8Array; /** The HPKE recipient context for exporting secrets */ readonly recipientContext: RecipientContext; /** The encapsulated secret (enc) */ readonly enc: Uint8Array; /** The cipher suite used */ readonly suite: CipherSuite; /** The key config that was used */ readonly keyConfig: KeyConfigWithPrivate$1; } //#endregion //#region src/streaming.d.ts /** Cancellation shared by one high-level streaming operation. */ interface StreamOperationOptions { /** Abort the operation and cancel its input stream with the signal's reason. */ readonly signal?: AbortSignal; } //#endregion //#region src/client.d.ts /** * Options for OHTTP client */ interface OHTTPClientOptions { /** Custom request label (default: "message/bhttp request") */ readonly requestLabel?: string; /** Custom response label (default: "message/bhttp response") */ readonly responseLabel?: string; /** Crypto factory overrides for response decryption (default: resolved from the suite) */ readonly responseCrypto?: ResponseCrypto; /** Maximum Binary HTTP bytes in one request or response. @default 1048576 */ readonly maxMessageSize?: number; } /** * Options for chunked OHTTP client */ interface ChunkedOHTTPClientOptions { /** Custom request label (default: "message/bhttp chunked request") */ readonly requestLabel?: string; /** Custom response label (default: "message/bhttp chunked response") */ readonly responseLabel?: string; /** Crypto factory overrides for response decryption (default: resolved from the suite) */ readonly responseCrypto?: ResponseCrypto; /** * Maximum total plaintext bytes protected in one request or response. * @default 1073741824 */ readonly maxMessageSize?: number; } /** * Result of encapsulating a request (bytes API) */ interface EncapsulatedRequest { /** The encapsulated request bytes */ readonly encapsulatedRequest: Uint8Array; /** Context needed to decrypt the response */ readonly context: ClientContext; } /** * Result of encapsulating a request (Request/Response API) * * The `init` object is a valid `RequestInit` containing: * - method: "POST" * - headers: { "Content-Type": "message/ohttp-req" } * - body: ArrayBuffer (encapsulated request) * * Usage: `fetch(relayUrl, init)` or `new Request(relayUrl, init)` */ interface EncapsulatedRequestInit { /** RequestInit for fetch() - POST with Content-Type: message/ohttp-req */ readonly init: RequestInit; /** Context needed to decrypt the response */ readonly context: HttpClientContext; } /** * Client context for decrypting responses (bytes API) */ interface ClientContext { /** Decrypt an encapsulated response */ decryptResponse(encapsulatedResponse: Uint8Array): Promise>; } /** * Client context for decrypting responses (Request/Response API) */ interface HttpClientContext { /** Decrypt an encapsulated response and decode to HTTP Response */ decapsulateResponse(response: Response): Promise; } /** * Context for streaming chunked requests (client-side) */ interface ChunkedRequestContext { /** The request header bytes (must be sent first) */ readonly header: Uint8Array; /** Seal a non-final chunk */ sealChunk(chunk: Uint8Array): Promise>; /** Seal the final chunk */ sealFinalChunk(chunk: Uint8Array): Promise>; /** Create a response context after receiving the response nonce */ createResponseContext(responseNonce: Uint8Array): Promise; /** HPKE sender context for streaming transforms */ readonly [kSenderContext]: SenderContext; /** Encapsulated secret for response key derivation */ readonly [kEnc]: Uint8Array; } /** * Context for streaming chunked responses (client-side decryption) */ interface ChunkedResponseContext { /** Open a non-final chunk */ openChunk(ciphertext: Uint8Array): Promise>; /** Open the final chunk */ openFinalChunk(ciphertext: Uint8Array): Promise>; /** Derived response AEAD (for the pipelined buffer path) */ readonly [kAead]: AEAD; /** Derived response AEAD key */ readonly [kAeadKey]: Uint8Array; /** Derived response AEAD base nonce */ readonly [kAeadNonce]: Uint8Array; } /** * A `RequestInit` carrying the `duplex: "half"` that a streaming request body * requires. The DOM lib types have no `duplex`, so annotate the init with this * rather than suppressing the error it raises. */ type StreamingRequestInit = RequestInit & { duplex: "half"; }; /** * Result of encapsulating a chunked HTTP request (Request/Response API) * * The `init` object is a valid `RequestInit` containing: * - method: "POST" * - headers: { "Content-Type": "message/ohttp-chunked-req" } * - body: ReadableStream (streaming encapsulated request) * - duplex: "half" (required for streaming bodies in Node.js/Workers) * * Usage: `fetch(relayUrl, init)` or `new Request(relayUrl, init)` */ interface EncapsulatedChunkedRequestInit { /** RequestInit for fetch() - POST with streaming body and Content-Type: message/ohttp-chunked-req */ readonly init: StreamingRequestInit; /** Context needed to decrypt the chunked response */ readonly context: ChunkedHttpClientContext; } /** * Client context for decrypting chunked responses (Request/Response API) */ interface ChunkedHttpClientContext { /** Decrypt a chunked encapsulated response and decode to HTTP Response */ decapsulateResponse(response: Response, options?: StreamOperationOptions): Promise; } /** * OHTTP Client for encapsulating requests */ declare class OHTTPClient { #private; readonly maxMessageSize: number; /** * Create an OHTTP client * * @param suite - The HPKE cipher suite to use * @param keyConfig - The server's public key configuration * @param options - Optional configuration */ constructor(suite: CipherSuite, keyConfig: KeyConfig$1, options?: OHTTPClientOptions); /** * Encapsulate a binary HTTP request (low-level API) * * @param request - The binary HTTP request bytes to encapsulate * @returns The encapsulated request bytes and context for decrypting the response */ encapsulate(request: Uint8Array): Promise; /** * Encapsulate an HTTP Request (high-level API) * * Encodes the request using Binary HTTP (RFC 9292), then encapsulates with OHTTP. * Returns a RequestInit ready to use with fetch() or new Request(). * * @param request - The HTTP Request to encapsulate * @returns A RequestInit for the relay and context for decapsulating the response * * @example * ```typescript * const { init, context } = await client.encapsulateRequest(request); * const response = await fetch(relayUrl, init); * const innerResponse = await context.decapsulateResponse(response); * ``` */ encapsulateRequest(request: Request): Promise; } /** * Chunked OHTTP Client for streaming requests/responses (draft-ietf-ohai-chunked-ohttp-08) */ declare class ChunkedOHTTPClient { #private; readonly maxMessageSize: number; /** * Create a chunked OHTTP client * * @param suite - The HPKE cipher suite to use * @param keyConfig - The server's public key configuration * @param options - Optional configuration */ constructor(suite: CipherSuite, keyConfig: KeyConfig$1, options?: ChunkedOHTTPClientOptions); /** * Create a streaming request context * * Use this for incremental request construction: * 1. Send ctx.header first * 2. For each chunk: frameChunk(await ctx.sealChunk(data), false) * 3. For final chunk: frameChunk(await ctx.sealFinalChunk(data), true) */ createRequestContext(): Promise; /** * Encapsulate a complete request as chunked * * Convenience method that splits the request into chunks. * Returns the full encapsulated message and a function to create response context. */ encapsulate(request: Uint8Array): Promise<{ encapsulatedRequest: Uint8Array; responseNonceLength: number; createResponseContext: (nonce: Uint8Array) => Promise; }>; /** * Decapsulate a complete chunked response * * Convenience method that parses and decrypts all response chunks. */ decapsulateResponse(createResponseContext: (responseNonce: Uint8Array) => Promise, encapsulatedResponse: Uint8Array): Promise>; /** * Encapsulate an HTTP Request as chunked OHTTP (high-level streaming API) * * Encodes the request using streaming Binary HTTP (RFC 9292 indeterminate-length), * then encapsulates with chunked OHTTP. The request body streams through without * full buffering. * * @param request - The HTTP Request to encapsulate * @returns A RequestInit for the relay (with streaming body) and context for decapsulating the response * * @example * ```typescript * const { init, context } = await client.encapsulateRequest(request); * const response = await fetch(relayUrl, init); * const innerResponse = await context.decapsulateResponse(response); * ``` */ encapsulateRequest(request: Request, options?: StreamOperationOptions): Promise; } //#endregion //#region src/server.d.ts /** * Options for OHTTP server */ interface OHTTPServerOptions { /** Custom request label (default: "message/bhttp request") */ readonly requestLabel?: string; /** Custom response label (default: "message/bhttp response") */ readonly responseLabel?: string; /** Crypto factory overrides for response encryption (default: resolved from the suite) */ readonly responseCrypto?: ResponseCrypto; /** Maximum Binary HTTP bytes in one request or response. @default 1048576 */ readonly maxMessageSize?: number; } /** * Options for chunked OHTTP server */ interface ChunkedOHTTPServerOptions { /** Custom request label (default: "message/bhttp chunked request") */ readonly requestLabel?: string; /** Custom response label (default: "message/bhttp chunked response") */ readonly responseLabel?: string; /** Crypto factory overrides for response encryption (default: resolved from the suite) */ readonly responseCrypto?: ResponseCrypto; /** * Maximum total plaintext bytes protected in one request or response. * @default 1073741824 */ readonly maxMessageSize?: number; } /** * Result of decapsulating a request (bytes API) */ interface DecapsulatedRequest { /** The decrypted binary HTTP request */ readonly request: Uint8Array; /** Context needed to encrypt the response */ readonly context: ServerContext; } /** * Result of decapsulating a request (Request/Response API) */ interface DecapsulatedHttpRequest { /** The decrypted HTTP request */ readonly request: Request; /** Context needed to encrypt the response */ readonly context: HttpServerContext; } /** * Server context for encrypting responses (bytes API) */ interface ServerContext { /** Encrypt a response */ encryptResponse(response: Uint8Array): Promise>; } /** * Server context for encrypting responses (Request/Response API) */ interface HttpServerContext { /** Encrypt a response and return as OHTTP Response */ encapsulateResponse(response: Response): Promise; } /** * Context for streaming chunked requests (server-side decryption) */ interface ChunkedServerRequestContext { /** The key config used for decryption */ readonly keyConfig: KeyConfigWithPrivate$1; /** Open a non-final chunk */ openChunk(ciphertext: Uint8Array): Promise>; /** Open the final chunk */ openFinalChunk(ciphertext: Uint8Array): Promise>; /** Create a response context for encrypting the response */ createResponseContext(): Promise; /** HPKE recipient context for streaming transforms */ readonly [kRecipientContext]: RecipientContext; /** Encapsulated secret for response key derivation */ readonly [kEnc]: Uint8Array; /** The suite the request header selected */ readonly [kSuite]: CipherSuite; } /** * Context for streaming chunked responses (server-side encryption) */ interface ChunkedServerResponseContext { /** The response nonce (must be sent first) */ readonly responseNonce: Uint8Array; /** Seal a non-final chunk */ sealChunk(chunk: Uint8Array): Promise>; /** Seal the final chunk */ sealFinalChunk(chunk: Uint8Array): Promise>; /** Derived response AEAD (for the pipelined buffer path) */ readonly [kAead]: AEAD; /** Derived response AEAD key */ readonly [kAeadKey]: Uint8Array; /** Derived response AEAD base nonce */ readonly [kAeadNonce]: Uint8Array; } /** * Result of decapsulating a chunked HTTP request (Request/Response API) */ interface DecapsulatedChunkedHttpRequest { /** The decrypted HTTP request */ readonly request: Request; /** Context needed to encrypt the chunked response */ readonly context: ChunkedHttpServerContext; } /** * Server context for encrypting chunked responses (Request/Response API) */ interface ChunkedHttpServerContext { /** Encrypt a response and return as chunked OHTTP Response */ encapsulateResponse(response: Response, options?: StreamOperationOptions): Promise; } /** * OHTTP Server (Gateway) for decapsulating requests */ declare class OHTTPServer { #private; readonly maxMessageSize: number; /** * Create an OHTTP server * * @param keyConfigs - Non-empty array of key configurations with private keys and distinct key identifiers * @param options - Optional configuration */ constructor(keyConfigs: readonly KeyConfigWithPrivate$1[], options?: OHTTPServerOptions); /** * Decapsulate an encrypted request (low-level API) * * @param encapsulatedRequest - The encapsulated request bytes * @returns The decrypted request bytes and context for encrypting the response */ decapsulate(encapsulatedRequest: Uint8Array): Promise; /** * Decapsulate an OHTTP Request (high-level API) * * Decrypts and decodes Binary HTTP to return the inner Request. * * @param request - The OHTTP request from the relay * @returns The decrypted inner Request and context for encapsulating the response */ decapsulateRequest(request: Request): Promise; } /** * Chunked OHTTP Server for streaming requests/responses (draft-ietf-ohai-chunked-ohttp-08) */ declare class ChunkedOHTTPServer { #private; readonly maxMessageSize: number; /** * Create a chunked OHTTP server * * @param keyConfigs - Non-empty array of key configurations with private keys and distinct key identifiers * @param options - Optional configuration */ constructor(keyConfigs: readonly KeyConfigWithPrivate$1[], options?: ChunkedOHTTPServerOptions); /** * Create a streaming request context from the encapsulated header * * Use this for incremental request processing: * 1. Parse header (first 7 + Nenc bytes) * 2. For each chunk: await ctx.openChunk(ciphertext) or ctx.openFinalChunk(ciphertext) */ createRequestContext(encapsulatedHeader: Uint8Array): Promise; /** * Decapsulate a complete chunked request * * Convenience method that parses and decrypts all request chunks. */ decapsulate(encapsulatedRequest: Uint8Array): Promise<{ request: Uint8Array; keyConfig: KeyConfigWithPrivate$1; createResponseContext: () => Promise; }>; /** * Encapsulate a complete chunked response * * Convenience method that splits response into chunks. */ encapsulateResponse(responseContext: ChunkedServerResponseContext, response: Uint8Array): Promise>; /** * Decapsulate a chunked OHTTP Request (high-level streaming API) * * Decrypts and decodes streaming Binary HTTP to return the inner Request. * The request body streams through without full buffering. * * @param request - The chunked OHTTP request from the relay * @returns The decrypted inner Request (with streaming body) and context for encapsulating the response */ decapsulateRequest(request: Request, options?: StreamOperationOptions): Promise; } //#endregion //#region src/incremental.d.ts /** * Serialize an Incremental header value * * @param incremental - true for incremental forwarding, false for buffering * @returns Structured field boolean string ("?1" or "?0") */ declare function serializeIncremental(incremental: boolean): string; /** * Parse an Incremental header value * * Accepts structured field boolean format: * - "?1" or "?1" with parameters → true * - "?0" or "?0" with parameters → false * - Invalid/unknown values → undefined * * @param value - The header value string * @returns true/false if valid boolean, undefined if invalid */ declare function parseIncremental(value: string): boolean | undefined; /** * Create headers with Incremental field set * * @param incremental - true to request incremental forwarding * @returns Headers object with Incremental field */ declare function createIncrementalHeaders(incremental?: boolean): Headers; /** * Check if headers indicate incremental forwarding * * @param headers - Headers to check * @returns true if Incremental: ?1, false if Incremental: ?0, undefined if not set or invalid */ declare function getIncremental(headers: Headers): boolean | undefined; /** * Set the Incremental header on existing headers * * @param headers - Headers to modify * @param incremental - true for incremental forwarding */ declare function setIncremental(headers: Headers, incremental: boolean): void; //#endregion //#region src/index.d.ts /** KeyConfig utilities for parsing, serializing, and generating OHTTP key configurations */ declare const KeyConfig: { /** Generate a new KeyConfig with random key pair */ readonly generate: typeof generateKeyConfig; /** Derive a deterministic KeyConfig from a seed */ readonly derive: typeof deriveKeyConfig; /** Import a KeyConfig from raw key bytes */ readonly import: typeof importKeyConfig; /** Parse a single KeyConfig from bytes */ readonly parse: typeof parseKeyConfig; /** Parse multiple KeyConfigs from application/ohttp-keys format */ readonly parseMultiple: typeof parseKeyConfigs; /** Pick the first config a cipher suite can use */ readonly select: typeof selectKeyConfig; /** Pick the suite a request header names, gateway side */ readonly selectSuite: typeof selectSuite; /** Serialize a KeyConfig to bytes */ readonly serialize: typeof serializeKeyConfig; /** Serialize multiple KeyConfigs to application/ohttp-keys format */ readonly serializeMultiple: typeof serializeKeyConfigs; /** Get the public key length for a KEM */ readonly getPublicKeyLength: typeof getPublicKeyLength; }; type KeyConfig = KeyConfig$1; type KeyConfigWithPrivate = KeyConfigWithPrivate$1; type SymmetricAlgorithm = SymmetricAlgorithm$1; /** Protocol labels for OHTTP request/response encryption */ declare const Labels: { /** Default label for standard OHTTP requests (RFC 9458) */ readonly REQUEST: "message/bhttp request"; /** Default label for standard OHTTP responses (RFC 9458) */ readonly RESPONSE: "message/bhttp response"; /** Label for chunked OHTTP requests (draft-08) */ readonly CHUNKED_REQUEST: "message/bhttp chunked request"; /** Label for chunked OHTTP responses (draft-08) */ readonly CHUNKED_RESPONSE: "message/bhttp chunked response"; /** AAD for final chunk in chunked OHTTP */ readonly FINAL_CHUNK_AAD: Uint8Array; /** Default maximum chunk size sent (16384 bytes) */ readonly DEFAULT_MAX_CHUNK_SIZE: 16384; /** Standard maximum ciphertext frame accepted (16384-byte chunk plus tag) */ readonly DEFAULT_MAX_FRAME_SIZE: number; /** Default aggregate plaintext limit for one chunked message (1 GiB) */ readonly DEFAULT_MAX_CHUNKED_OHTTP_MESSAGE_SIZE: number; }; /** Incremental HTTP header utilities (RFC 10036) */ declare const Incremental: { /** Header name: "Incremental" */ readonly HEADER: "Incremental"; /** Parse Incremental header value to boolean */ readonly parse: typeof parseIncremental; /** Serialize boolean to Incremental header value */ readonly serialize: typeof serializeIncremental; /** Get Incremental value from Headers object */ readonly get: typeof getIncremental; /** Set Incremental value on Headers object */ readonly set: typeof setIncremental; /** Create new Headers with Incremental header set */ readonly createHeaders: typeof createIncrementalHeaders; }; //#endregion export { AEAD_TAG_SIZE, AeadId, type ChunkedHttpClientContext, type ChunkedHttpServerContext, ChunkedOHTTPClient, type ChunkedOHTTPClientOptions, ChunkedOHTTPServer, type ChunkedOHTTPServerOptions, type ChunkedRequestContext, type ChunkedResponseContext, type ChunkedServerRequestContext, type ChunkedServerResponseContext, type ClientContext, type ClientEncapsulationContext, type DecapsulatedChunkedHttpRequest, type DecapsulatedHttpRequest, type DecapsulatedRequest, type EncapsulatedChunkedRequestInit, type EncapsulatedRequest, type EncapsulatedRequestHeader, type EncapsulatedRequestInit, type HttpClientContext, type HttpServerContext, Incremental, KdfId, KemId, KeyConfig, KeyConfigWithPrivate, Labels, MediaType, OHTTPClient, type OHTTPClientOptions, OHTTPError, OHTTPErrorCode, OHTTPServer, type OHTTPServerOptions, type ParsedChunk, type ResponseCrypto, type ServerContext, type ServerEncapsulationContext, type StreamOperationOptions, type StreamingRequestInit, SymmetricAlgorithm, frameChunk, isOHTTPError, isValidAeadId, isValidKdfId, isValidKemId, parseFramedChunk }; //# sourceMappingURL=index.d.cts.map