@floegence/floe-webapp-boot 0.40.21 → 0.41.0

package/dist/acquisition-lifecycle.d.ts

@@ -0,0 +1,12 @@
+import type { ArtifactSource, ConnectionSnapshot } from '@floegence/flowersec-core';
+import { ConnectedAcquisition } from './acquisition';
+import { ProxyBootstrapOwner } from './proxy-bootstrap';
+export interface AcquisitionConnectionLifecycle {
+    synchronize(snapshot: ConnectionSnapshot): void;
+    dispose(): void;
+}
+export type AcquisitionConnectionLifecycleOptions = Readonly<{
+    proxyBootstrap?: ProxyBootstrapOwner;
+    onConnected?: (acquisition: ConnectedAcquisition) => void;
+}>;
+export declare function createAcquisitionConnectionLifecycle(source: ArtifactSource, options?: AcquisitionConnectionLifecycleOptions): AcquisitionConnectionLifecycle;

package/dist/acquisition-lifecycle.js

@@ -0,0 +1,20 @@
+import { clearAcquisitionSource as s, AcquisitionError as c, synchronizeAcquisitionSourceSnapshot as u } from "./acquisition.js";
+import { closeProxyBootstrap as l, synchronizeProxyBootstrap as a } from "./proxy-bootstrap.js";
+function y(t, i = {}) {
+  let e = !1, r = null;
+  return Object.freeze({
+    synchronize(n) {
+      if (e) throw new c("acquisition_lifecycle_disposed");
+      const o = u(t, n);
+      if (n.state === "connected" && o === null)
+        throw new c("connected_acquisition_missing");
+      i.proxyBootstrap !== void 0 && a(i.proxyBootstrap, o), o !== null && o !== r && i.onConnected?.(o), r = o;
+    },
+    dispose() {
+      e || (e = !0, r = null, i.proxyBootstrap !== void 0 && l(i.proxyBootstrap), s(t));
+    }
+  });
+}
+export {
+  y as createAcquisitionConnectionLifecycle
+};

package/dist/acquisition.d.ts

@@ -0,0 +1,111 @@
+import { type ArtifactLease, type ArtifactSource, type ConnectionSnapshot, type JsonValue, type Session } from '@floegence/flowersec-core';
+import type { ConnectionControllerOptions, SessionOptions } from '@floegence/flowersec-core/browser';
+import { type ProxyRuntimeScope } from '@floegence/flowersec-core/proxy';
+export type CriticalScopeProjectionV1 = Readonly<{
+    scope: 'proxy.runtime';
+    scope_version: 2;
+    critical: true;
+    payload: JsonValue;
+}>;
+export type SpendScopeV1 = Readonly<{
+    v: 1;
+    receipt: string;
+    artifact_digest_b64u: string;
+    projection_digest_b64u: string;
+    launcher_origin: string;
+    runtime_origin: string;
+    app_origin: string;
+    consumer: 'trusted' | 'isolated';
+    target_binding: JsonValue;
+    expires_at: string;
+}>;
+export type SerializedAcquisitionEnvelopeV1 = Readonly<{
+    v: 1;
+    connect_artifact: string;
+    critical_scope_projection_json: string;
+    spend_scope: SpendScopeV1;
+}>;
+export type RuntimeBootInitPayloadV6 = Readonly<{
+    v: 6;
+    env_public_id: string;
+    floe_app: string;
+    code_space_id: string;
+    app_path: string;
+    launcher_kind: 'cs' | 'pf';
+    launcher_id: string;
+    launcher_origin: string;
+    runtime_origin: string;
+    app_origin: string;
+    acquisition: SerializedAcquisitionEnvelopeV1;
+}>;
+export type SpendBindingView = Readonly<{
+    artifactDigestB64u: string;
+    projectionDigestB64u: string;
+    launcherOrigin: string;
+    runtimeOrigin: string;
+    appOrigin: string;
+    consumer: 'trusted' | 'isolated';
+    targetBinding: JsonValue;
+    expiresAt: string;
+}>;
+export type SpendCommitRequest = SpendBindingView & Readonly<{
+    attemptId: string;
+    receipt: string;
+}>;
+export type CommitSpend = (request: SpendCommitRequest, signal?: AbortSignal) => Promise<void>;
+export type ValidateSpendBinding = (binding: SpendBindingView) => string | void;
+export declare class AcquisitionError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+export declare class ConnectedAcquisition {
+    #private;
+    private constructor();
+    static create(): ConnectedAcquisition;
+    static assertAuthentic(value: ConnectedAcquisition): void;
+}
+export declare class IsolatedOneShotAcquisition {
+    #private;
+    private constructor();
+    static create(): IsolatedOneShotAcquisition;
+    static assertAuthentic(value: IsolatedOneShotAcquisition): void;
+}
+export type ConnectedAcquisitionDetails = Readonly<{
+    session: Session;
+    scope: ProxyRuntimeScope;
+    bindingIdentity: string;
+    attempt: number;
+}>;
+type MaterializeOptions = Readonly<{
+    commitSpend: CommitSpend;
+    validateSpendBinding: ValidateSpendBinding;
+    expectedConsumer: 'trusted' | 'isolated';
+}>;
+export declare function registerAcquisitionSource(source: ArtifactSource): void;
+export declare function materializeAcquisitionForSource(source: ArtifactSource, value: unknown, options: MaterializeOptions): Promise<ArtifactLease>;
+export declare function synchronizeAcquisitionSourceSnapshot(source: ArtifactSource, snapshot: ConnectionSnapshot): ConnectedAcquisition | null;
+export declare function clearAcquisitionSource(source: ArtifactSource): void;
+export declare function connectedAcquisitionDetails(acquisition: ConnectedAcquisition): ConnectedAcquisitionDetails;
+export type IsolatedHandoffValidationContext = Readonly<{
+    envPublicId: string;
+    floeApp: string;
+    codeSpaceId: string;
+    appPath: string;
+    launcherKind: 'cs' | 'pf';
+    launcherId: string;
+    launcherOrigin: string;
+    runtimeOrigin: string;
+    appOrigin: string;
+    validateTargetBinding: (targetBinding: JsonValue) => void;
+}>;
+export type MaterializeIsolatedOneShotOptions = Readonly<{
+    rawHandoff: string;
+    clearSensitiveLocation: () => boolean;
+    navigateToLauncher: () => void;
+    validationContext: IsolatedHandoffValidationContext;
+    commitSpend: CommitSpend;
+}>;
+export declare function materializeIsolatedOneShot(options: MaterializeIsolatedOneShotOptions): Promise<IsolatedOneShotAcquisition>;
+export declare function connectIsolatedOneShot(acquisition: IsolatedOneShotAcquisition, options?: SessionOptions): Promise<ConnectedAcquisition>;
+export type BrowserControllerOptions = ConnectionControllerOptions;
+export {};

package/dist/acquisition.js

@@ -0,0 +1,361 @@
+import { parseArtifact as R, createArtifactLease as $ } from "@floegence/flowersec-core";
+import { assertProxyRuntimeScope as C } from "@floegence/flowersec-core/proxy";
+const j = 32, F = 16384, L = "#redeven=";
+class n extends Error {
+  constructor(i) {
+    super(`Floe acquisition failed (code=${i})`), this.code = i, this.name = "AcquisitionError";
+  }
+}
+class h {
+  #e = void 0;
+  constructor() {
+    Object.freeze(this);
+  }
+  static create() {
+    return new h();
+  }
+  static assertAuthentic(i) {
+    i.#e;
+  }
+}
+class m {
+  #e = void 0;
+  constructor() {
+    Object.freeze(this);
+  }
+  static create() {
+    return new m();
+  }
+  static assertAuthentic(i) {
+    i.#e;
+  }
+}
+const g = /* @__PURE__ */ new WeakMap(), S = /* @__PURE__ */ new WeakMap(), z = /* @__PURE__ */ new WeakMap(), O = /* @__PURE__ */ new Set();
+function X(e) {
+  if (g.has(e)) throw new n("duplicate_acquisition_source");
+  g.set(e, { pending: [] });
+}
+async function Y(e, i, t) {
+  const r = g.get(e);
+  if (r === void 0) throw new n("invalid_acquisition_source");
+  const c = await x(i, t);
+  return D(c, t.commitSpend, (o) => {
+    r.pending.push(o);
+  }, (o) => {
+    r.pending = r.pending.filter((a) => a !== o);
+  });
+}
+function K(e, i) {
+  const t = g.get(e);
+  if (t === void 0) return null;
+  if (i.state !== "connected" || i.currentSession === void 0)
+    return (i.state === "idle" || i.state === "waiting" || i.state === "failed" || i.state === "closed") && (t.pending = [], t.connected = void 0, t.connectedSession = void 0), null;
+  if (t.connected !== void 0 && t.connectedSession === i.currentSession) return t.connected;
+  const r = t.pending.filter((a) => a.committed);
+  if (r.length !== 1 || t.pending.length !== 1)
+    throw t.pending = [], new n("connected_acquisition_mismatch");
+  const c = r[0];
+  if (c === void 0) throw new n("connected_acquisition_mismatch");
+  const o = h.create();
+  return S.set(o, Object.freeze({
+    session: i.currentSession,
+    scope: c.scope,
+    bindingIdentity: c.bindingIdentity,
+    attempt: i.attempt
+  })), t.pending = [], t.connected = o, t.connectedSession = i.currentSession, o;
+}
+function Q(e) {
+  const i = g.get(e);
+  i !== void 0 && (i.pending = [], i.connected = void 0, i.connectedSession = void 0);
+}
+function ee(e) {
+  h.assertAuthentic(e);
+  const i = S.get(e);
+  if (i === void 0) throw new n("invalid_connected_acquisition");
+  return i;
+}
+async function te(e) {
+  const i = e.rawHandoff, t = typeof i != "string" || Z(`${L}${i}`) > F;
+  let r = !1;
+  try {
+    r = e.clearSensitiveLocation() === !0;
+  } catch {
+    r = !1;
+  }
+  if (!r)
+    throw e.navigateToLauncher(), new n("isolated_location_clear_failed");
+  if (t) throw new n("isolated_handoff_too_large");
+  const c = y(i, "invalid_isolated_handoff"), o = await V(c);
+  if (O.has(o)) throw new n("isolated_handoff_consumed");
+  O.add(o);
+  let a;
+  try {
+    a = JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(c));
+  } catch {
+    throw new n("invalid_isolated_handoff");
+  }
+  const _ = P(a, e.validationContext), p = await x(_.acquisition, {
+    commitSpend: e.commitSpend,
+    expectedConsumer: "isolated",
+    validateSpendBinding: (d) => (k(_, d, e.validationContext), e.validationContext.validateTargetBinding(d.targetBinding), `${d.artifactDigestB64u}.${d.projectionDigestB64u}`)
+  });
+  if (p.scope.appBasePath !== _.app_path) throw new n("isolated_app_path_mismatch");
+  if (p.scope.mode === "controller_bridge") {
+    const d = p.scope.controllerBridge.allowedOrigins;
+    if (d.length !== 1 || d[0] !== _.app_origin)
+      throw new n("isolated_allowed_origins_mismatch");
+  }
+  let s;
+  const l = D(p, e.commitSpend, (d) => {
+    s = d;
+  }, () => {
+  });
+  if (s === void 0 || s.lease !== l) throw new n("isolated_materialization_failed");
+  const u = m.create();
+  return z.set(u, { pending: s, state: "ready" }), u;
+}
+async function ie(e, i = {}) {
+  m.assertAuthentic(e);
+  const t = z.get(e);
+  if (t === void 0 || t.state !== "ready") throw new n("isolated_acquisition_consumed");
+  t.state = "connecting";
+  try {
+    const { connect: r } = await import("@floegence/flowersec-core/browser"), c = await r(t.pending.lease, i);
+    if (!t.pending.committed)
+      throw await c.close().catch(() => {
+      }), new n("isolated_spend_not_committed");
+    const o = h.create();
+    return S.set(o, Object.freeze({
+      session: c,
+      scope: t.pending.scope,
+      bindingIdentity: t.pending.bindingIdentity,
+      attempt: 1
+    })), t.state = "consumed", o;
+  } catch (r) {
+    throw t.state = "consumed", r;
+  }
+}
+async function x(e, i) {
+  const t = w(e, ["v", "connect_artifact", "critical_scope_projection_json", "spend_scope"], "invalid_acquisition_envelope");
+  if (t.v !== 1 || typeof t.connect_artifact != "string" || t.connect_artifact.length === 0 || typeof t.critical_scope_projection_json != "string" || t.critical_scope_projection_json.length === 0)
+    throw new n("invalid_acquisition_envelope");
+  const r = U(t.spend_scope, i.expectedConsumer), c = new TextEncoder().encode(t.connect_artifact), o = new TextEncoder().encode(t.critical_scope_projection_json);
+  await q(c, r.artifact_digest_b64u, "artifact_digest_mismatch"), await q(o, r.projection_digest_b64u, "projection_digest_mismatch");
+  let a;
+  try {
+    a = JSON.parse(t.critical_scope_projection_json);
+  } catch {
+    throw new n("invalid_critical_scope_projection");
+  }
+  const _ = w(a, ["scope", "scope_version", "critical", "payload"], "invalid_critical_scope_projection");
+  if (_.scope !== "proxy.runtime" || _.scope_version !== 2 || _.critical !== !0)
+    throw new n("invalid_critical_scope_projection");
+  let p;
+  try {
+    p = C(_.payload);
+  } catch {
+    throw new n("invalid_proxy_runtime_scope");
+  }
+  let s;
+  try {
+    s = R(t.connect_artifact);
+  } catch {
+    throw new n("invalid_connect_artifact");
+  }
+  const l = N(r), u = i.validateSpendBinding(l);
+  if (u !== void 0 && (u.trim() === "" || u !== u.trim()))
+    throw new n("invalid_spend_binding_identity");
+  return Object.freeze({
+    artifact: s,
+    scope: p,
+    binding: l,
+    bindingIdentity: u ?? `${l.artifactDigestB64u}.${l.projectionDigestB64u}`,
+    receipt: r.receipt
+  });
+}
+function D(e, i, t, r) {
+  const c = e.artifact, o = e.scope, a = e.binding, _ = e.bindingIdentity;
+  let p = e.receipt, s;
+  const l = $(c, async (u) => {
+    const d = p;
+    if (p = void 0, d === void 0) throw new n("spend_binding_consumed");
+    const T = Object.freeze({
+      ...a,
+      attemptId: J(),
+      receipt: d
+    });
+    try {
+      await i(T, u), s.committed = !0;
+    } catch (E) {
+      throw r(s), E;
+    }
+  });
+  return s = { lease: l, scope: o, bindingIdentity: _, committed: !1 }, t(s), l;
+}
+function U(e, i) {
+  const t = w(e, [
+    "v",
+    "receipt",
+    "artifact_digest_b64u",
+    "projection_digest_b64u",
+    "launcher_origin",
+    "runtime_origin",
+    "app_origin",
+    "consumer",
+    "target_binding",
+    "expires_at"
+  ], "invalid_spend_scope");
+  if (t.v !== 1 || typeof t.receipt != "string" || !H(t.receipt) || typeof t.artifact_digest_b64u != "string" || !B(t.artifact_digest_b64u) || typeof t.projection_digest_b64u != "string" || !B(t.projection_digest_b64u) || t.consumer !== i || typeof t.expires_at != "string" || !M(t.expires_at) || !b(t.target_binding))
+    throw new n("invalid_spend_scope");
+  const r = f(t.launcher_origin), c = f(t.runtime_origin), o = f(t.app_origin);
+  if (Date.parse(t.expires_at) <= Date.now()) throw new n("expired_spend_scope");
+  return Object.freeze({
+    v: 1,
+    receipt: t.receipt,
+    artifact_digest_b64u: t.artifact_digest_b64u,
+    projection_digest_b64u: t.projection_digest_b64u,
+    launcher_origin: r,
+    runtime_origin: c,
+    app_origin: o,
+    consumer: i,
+    target_binding: v(t.target_binding),
+    expires_at: t.expires_at
+  });
+}
+function N(e) {
+  return Object.freeze({
+    artifactDigestB64u: e.artifact_digest_b64u,
+    projectionDigestB64u: e.projection_digest_b64u,
+    launcherOrigin: e.launcher_origin,
+    runtimeOrigin: e.runtime_origin,
+    appOrigin: e.app_origin,
+    consumer: e.consumer,
+    targetBinding: e.target_binding,
+    expiresAt: e.expires_at
+  });
+}
+function P(e, i) {
+  const t = w(e, [
+    "v",
+    "env_public_id",
+    "floe_app",
+    "code_space_id",
+    "app_path",
+    "launcher_kind",
+    "launcher_id",
+    "launcher_origin",
+    "runtime_origin",
+    "app_origin",
+    "acquisition"
+  ], "invalid_isolated_handoff");
+  if (t.v !== 6 || t.env_public_id !== i.envPublicId || t.floe_app !== i.floeApp || t.code_space_id !== i.codeSpaceId || t.app_path !== i.appPath || t.launcher_kind !== i.launcherKind || t.launcher_id !== i.launcherId || t.launcher_origin !== i.launcherOrigin || t.runtime_origin !== i.runtimeOrigin || t.app_origin !== i.appOrigin)
+    throw new n("isolated_context_mismatch");
+  return f(t.launcher_origin), f(t.runtime_origin), f(t.app_origin), t;
+}
+function k(e, i, t) {
+  if (i.consumer !== "isolated" || i.launcherOrigin !== e.launcher_origin || i.runtimeOrigin !== e.runtime_origin || i.appOrigin !== e.app_origin || e.runtime_origin !== t.runtimeOrigin || e.app_origin !== t.appOrigin)
+    throw new n("isolated_spend_binding_mismatch");
+}
+function w(e, i, t) {
+  if (e === null || typeof e != "object" || Array.isArray(e)) throw new n(t);
+  const r = e, c = new Set(i), o = Object.keys(r);
+  if (o.length !== i.length || o.some((a) => !c.has(a))) throw new n(t);
+  return r;
+}
+function f(e) {
+  if (typeof e != "string") throw new n("invalid_spend_scope");
+  let i;
+  try {
+    i = new URL(e);
+  } catch {
+    throw new n("invalid_spend_scope");
+  }
+  if (i.protocol !== "https:" && i.protocol !== "http:" || i.origin !== e || i.username !== "" || i.password !== "")
+    throw new n("invalid_spend_scope");
+  return e;
+}
+function H(e) {
+  const i = /^r1\.([A-Za-z0-9_-]{1,64})\.([A-Za-z0-9_-]+)$/u.exec(e);
+  if (i === null || i[2] === void 0) return !1;
+  try {
+    return y(i[2], "invalid_spend_scope").length === j;
+  } catch {
+    return !1;
+  }
+}
+function B(e) {
+  try {
+    return y(e, "invalid_spend_scope").length === j;
+  } catch {
+    return !1;
+  }
+}
+function M(e) {
+  return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/u.test(e) ? Number.isFinite(Date.parse(e)) : !1;
+}
+function b(e, i = 0) {
+  return i > 32 ? !1 : e === null || typeof e == "string" || typeof e == "boolean" ? !0 : typeof e == "number" ? Number.isFinite(e) : Array.isArray(e) ? e.every((t) => b(t, i + 1)) : typeof e != "object" ? !1 : Object.values(e).every((t) => b(t, i + 1));
+}
+function v(e) {
+  if (Array.isArray(e)) {
+    for (const i of e) v(i);
+    return Object.freeze(e);
+  }
+  if (e !== null && typeof e == "object") {
+    for (const i of Object.values(e)) v(i);
+    return Object.freeze(e);
+  }
+  return e;
+}
+async function q(e, i, t) {
+  const r = await I(e), c = y(i, t);
+  if (r.length !== c.length) throw new n(t);
+  let o = 0;
+  for (let a = 0; a < r.length; a += 1) o |= r[a] ^ c[a];
+  if (o !== 0) throw new n(t);
+}
+async function V(e) {
+  return A(await I(e));
+}
+async function I(e) {
+  if (globalThis.crypto?.subtle === void 0) throw new n("acquisition_crypto_unavailable");
+  const i = e.buffer.slice(e.byteOffset, e.byteOffset + e.byteLength), t = await globalThis.crypto.subtle.digest("SHA-256", i);
+  return new Uint8Array(t);
+}
+function J() {
+  if (globalThis.crypto?.getRandomValues === void 0) throw new n("acquisition_entropy_unavailable");
+  return A(globalThis.crypto.getRandomValues(new Uint8Array(j)));
+}
+function y(e, i) {
+  if (!/^[A-Za-z0-9_-]*$/u.test(e) || e.length % 4 === 1) throw new n(i);
+  const t = e.replace(/-/gu, "+").replace(/_/gu, "/") + "=".repeat((4 - e.length % 4) % 4);
+  let r;
+  try {
+    r = atob(t);
+  } catch {
+    throw new n(i);
+  }
+  const c = Uint8Array.from(r, (o) => o.charCodeAt(0));
+  if (A(c) !== e) throw new n(i);
+  return c;
+}
+function A(e) {
+  let i = "";
+  for (const t of e) i += String.fromCharCode(t);
+  return btoa(i).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
+}
+function Z(e) {
+  return new TextEncoder().encode(e).length;
+}
+export {
+  n as AcquisitionError,
+  h as ConnectedAcquisition,
+  m as IsolatedOneShotAcquisition,
+  Q as clearAcquisitionSource,
+  ie as connectIsolatedOneShot,
+  ee as connectedAcquisitionDetails,
+  Y as materializeAcquisitionForSource,
+  te as materializeIsolatedOneShot,
+  X as registerAcquisitionSource,
+  K as synchronizeAcquisitionSourceSnapshot
+};

package/dist/artifact-source.d.ts

@@ -1,4 +1,5 @@
-import { type ArtifactSource, type JsonObject } from '@floegence/flowersec-core';
+import type { ArtifactSource, JsonObject, RetryDisposition } from '@floegence/flowersec-core';
+import { type CommitSpend, type ValidateSpendBinding } from './acquisition';
 export type ControlplaneArtifactSourceOptions = Readonly<{
     baseUrl: string;
     endpointId: string;
@@ -9,10 +10,25 @@ export type ControlplaneArtifactSourceOptions = Readonly<{
     entryTicket?: string;
     allowLoopbackHTTP?: boolean;
     fetch?: typeof globalThis.fetch;
+    commitSpend: CommitSpend;
+    validateSpendBinding: ValidateSpendBinding;
+    retryableBusinessCodes?: readonly string[];
 }>;
 export declare class ControlplaneRequestError extends Error {
     readonly status: number;
     readonly code: string;
-    constructor(status: number, code: string, message: string);
+    constructor(status: number, code: string);
 }
+export type ControlplaneFailureInput = Readonly<{
+    status: number;
+    code: string;
+    retryAfter?: string | null;
+    retryableBusinessCodes?: readonly string[];
+    nowUnixMilliseconds?: number;
+}>;
+export type ClassifiedControlplaneFailure = Readonly<{
+    code: string;
+    disposition: RetryDisposition;
+}>;
+export declare function classifyControlplaneFailure(input: ControlplaneFailureInput): ClassifiedControlplaneFailure;
 export declare function createControlplaneArtifactSource(options: ControlplaneArtifactSourceOptions): ArtifactSource;

package/dist/artifact-source.js

@@ -1,75 +1,136 @@
-import { parseArtifact as d, createArtifactLease as f } from "@floegence/flowersec-core";
-class a extends Error {
-  status;
-  code;
-  constructor(e, r, c) {
-    super(c), this.name = "ControlplaneRequestError", this.status = e, this.code = r;
+import { registerAcquisitionSource as p, materializeAcquisitionForSource as b, AcquisitionError as m } from "./acquisition.js";
+const l = /^[a-z][a-z0-9_]{0,63}$/u;
+class d extends Error {
+  constructor(t, r) {
+    super(`Floe controlplane request failed (code=${r})`), this.status = t, this.code = r, this.name = "ControlplaneRequestError";
   }
 }
-function p(t) {
-  const e = t.toLowerCase();
-  return e === "localhost" || e === "::1" || e === "127.0.0.1" || e.startsWith("127.");
+function h(e) {
+  const t = e.toLowerCase();
+  return t === "localhost" || t === "::1" || t === "127.0.0.1" || t.startsWith("127.");
 }
-function u(t, e) {
-  const r = new URL(t);
-  if (r.protocol !== "https:" && !(e && r.protocol === "http:" && p(r.hostname)))
-    throw new a(0, "transport_policy_denied", "controlplane transport policy denied");
+function w(e, t) {
+  let r;
+  try {
+    r = new URL(e);
+  } catch {
+    throw new d(0, "transport_policy_denied");
+  }
+  if (r.protocol !== "https:" && !(t && r.protocol === "http:" && h(r.hostname)))
+    throw new d(0, "transport_policy_denied");
   return r.pathname = r.pathname.replace(/\/+$/u, ""), r;
 }
-function h(t, e) {
-  const r = e === void 0 ? "/v1/connect/artifact" : "/v1/connect/artifact/entry";
-  return new URL(`${t.pathname}${r}`, t).toString();
+function j(e, t) {
+  const r = t === void 0 ? "/v1/connect/artifact" : "/v1/connect/artifact/entry";
+  return new URL(`${e.pathname}${r}`, e).toString();
 }
-function y(t) {
-  if (!t || typeof t != "object" || !("connect_artifact" in t))
-    throw new a(200, "invalid_request", "Invalid controlplane response: missing `connect_artifact`");
-  return JSON.stringify(t.connect_artifact);
+function z(e) {
+  if (!l.test(e.code))
+    return Object.freeze({ code: "invalid_error_code", disposition: Object.freeze({ kind: "terminal" }) });
+  if (new Set(e.retryableBusinessCodes ?? []).has(e.code))
+    return Object.freeze({ code: e.code, disposition: Object.freeze({ kind: "retryable" }) });
+  if (e.status === 429) {
+    const r = S(e.retryAfter, e.nowUnixMilliseconds ?? Date.now());
+    return Object.freeze({
+      code: e.code,
+      disposition: Object.freeze(r === void 0 ? { kind: "retryable" } : { kind: "retry_after", notBeforeUnixMilliseconds: r })
+    });
+  }
+  return e.status === 408 || e.status === 425 || e.status >= 500 ? Object.freeze({ code: e.code, disposition: Object.freeze({ kind: "retryable" }) }) : Object.freeze({ code: e.code, disposition: Object.freeze({ kind: "terminal" }) });
 }
-function k(t) {
-  const e = t.fetch ?? globalThis.fetch, r = u(t.baseUrl, t.allowLoopbackHTTP === !0), c = h(r, t.entryTicket);
-  return {
-    acquire: async ({ signal: s }) => {
+function _(e) {
+  if (typeof e.commitSpend != "function") throw new TypeError("commitSpend is required");
+  if (typeof e.validateSpendBinding != "function") throw new TypeError("validateSpendBinding is required");
+  const t = e.fetch ?? globalThis.fetch;
+  if (typeof t != "function") throw new TypeError("fetch is required");
+  const r = w(e.baseUrl, e.allowLoopbackHTTP === !0), n = j(r, e.entryTicket), c = {
+    acquire: async ({ signal: i }) => {
       try {
         const o = {
-          endpoint_id: t.endpointId,
-          ...t.payload === void 0 ? {} : { payload: t.payload },
-          ...t.entryTicket === void 0 && t.correlation !== void 0 ? { correlation: { trace_id: t.correlation.traceId } } : {}
-        }, n = await e(c, {
+          endpoint_id: e.endpointId,
+          ...e.payload === void 0 ? {} : { payload: e.payload },
+          ...e.entryTicket === void 0 && e.correlation !== void 0 ? { correlation: { trace_id: e.correlation.traceId } } : {}
+        }, a = await t(n, {
           method: "POST",
           headers: {
             accept: "application/json",
             "content-type": "application/json",
-            ...t.entryTicket === void 0 ? {} : { authorization: `Bearer ${t.entryTicket}` }
+            ...e.entryTicket === void 0 ? {} : { authorization: `Bearer ${e.entryTicket}` }
           },
           body: JSON.stringify(o),
           credentials: "omit",
           redirect: "error",
-          signal: s
+          signal: i
         });
-        if (!n.ok) {
-          let i = "request_failed";
-          try {
-            i = (await n.json()).error?.code ?? i;
-          } catch {
-          }
-          throw new a(n.status, i, `controlplane request failed: ${n.status}`);
+        if (!a.ok) {
+          const y = await O(a);
+          return { kind: "failure", ...z({
+            status: a.status,
+            code: y,
+            retryAfter: a.headers.get("retry-after"),
+            retryableBusinessCodes: e.retryableBusinessCodes
+          }) };
+        }
+        let f;
+        try {
+          f = await a.json();
+        } catch {
+          return s("invalid_controlplane_response");
         }
-        const l = d(y(await n.json()));
-        return {
-          kind: "lease",
-          lease: f(l, async () => {
-          })
-        };
+        const u = await b(c, f, {
+          commitSpend: e.commitSpend,
+          validateSpendBinding: e.validateSpendBinding,
+          expectedConsumer: "trusted"
+        });
+        return Object.freeze({ kind: "lease", lease: u });
       } catch (o) {
+        if (i.aborted) throw i.reason ?? new DOMException("Aborted", "AbortError");
         if (o instanceof DOMException && o.name === "AbortError") throw o;
-        if (o instanceof a)
-          return { kind: "failure", code: o.code, disposition: { kind: "retryable" } };
-        throw o;
+        return o instanceof m || o instanceof d ? s(o.code) : Object.freeze({
+          kind: "failure",
+          code: "network_error",
+          disposition: Object.freeze({ kind: "retryable" })
+        });
       }
     }
   };
+  return p(c), c;
+}
+async function O(e) {
+  try {
+    const t = await e.json();
+    if (t !== null && typeof t == "object" && !Array.isArray(t)) {
+      const r = t.error;
+      if (r !== null && typeof r == "object" && !Array.isArray(r)) {
+        const n = r.code;
+        if (typeof n == "string") return n;
+      }
+    }
+  } catch {
+  }
+  return "request_failed";
+}
+function S(e, t) {
+  if (e == null) return;
+  const r = e.trim();
+  if (/^\d+$/u.test(r)) {
+    const c = Number(r);
+    if (!Number.isSafeInteger(c)) return;
+    const i = t + c * 1e3;
+    return Number.isSafeInteger(i) && i > t ? i : void 0;
+  }
+  const n = Date.parse(r);
+  return Number.isSafeInteger(n) && n > t ? n : void 0;
+}
+function s(e) {
+  return Object.freeze({
+    kind: "failure",
+    code: l.test(e) ? e : "invalid_error_code",
+    disposition: Object.freeze({ kind: "terminal" })
+  });
 }
 export {
-  a as ControlplaneRequestError,
-  k as createControlplaneArtifactSource
+  d as ControlplaneRequestError,
+  z as classifyControlplaneFailure,
+  _ as createControlplaneArtifactSource
 };

package/dist/connection.d.ts

@@ -1,10 +1,24 @@
-import type { ArtifactSource, ConnectionControllerOptions } from '@floegence/flowersec-core';
+import type { ArtifactSource } from '@floegence/flowersec-core';
+import type { ConnectionControllerOptions } from '@floegence/flowersec-core/browser';
+import { type AcquisitionConnectionLifecycle } from './acquisition-lifecycle';
+import type { ConnectedAcquisition } from './acquisition';
+import type { ProxyBootstrapOwner } from './proxy-bootstrap';
 export type FlowersecConnectionConfig = Readonly<{
     source: ArtifactSource;
     controller?: ConnectionControllerOptions;
+    lifecycle: AcquisitionConnectionLifecycle;
+}>;
+type AcquisitionConnectionOptions = Readonly<{
+    source: ArtifactSource;
+    controller?: ConnectionControllerOptions;
+    onConnected?: (acquisition: ConnectedAcquisition) => void;
+}>;
+export type TunnelArtifactConnectionOptions = AcquisitionConnectionOptions;
+export type DirectArtifactConnectionOptions = AcquisitionConnectionOptions;
+export type ProxyRuntimeTunnelConnectionOptions = AcquisitionConnectionOptions & Readonly<{
+    proxyBootstrap: ProxyBootstrapOwner;
 }>;
-export type TunnelArtifactConnectionOptions = FlowersecConnectionConfig;
-export type DirectArtifactConnectionOptions = FlowersecConnectionConfig;
 export declare function createArtifactTunnelConnectionConfig(options: TunnelArtifactConnectionOptions): FlowersecConnectionConfig;
-export declare function createProxyRuntimeTunnelConnectionConfig(options: TunnelArtifactConnectionOptions): FlowersecConnectionConfig;
+export declare function createProxyRuntimeTunnelConnectionConfig(options: ProxyRuntimeTunnelConnectionOptions): FlowersecConnectionConfig;
 export declare function createArtifactDirectConnectionConfig(options: DirectArtifactConnectionOptions): FlowersecConnectionConfig;
+export {};

package/dist/connection.js

@@ -1,14 +1,25 @@
-function t(n) {
-  return n;
+import { createAcquisitionConnectionLifecycle as r } from "./acquisition-lifecycle.js";
+function o(e) {
+  return n(e);
 }
-function e(n) {
-  return n;
+function i(e) {
+  return n(e, e.proxyBootstrap);
 }
-function o(n) {
-  return n;
+function u(e) {
+  return n(e);
+}
+function n(e, c) {
+  return Object.freeze({
+    source: e.source,
+    ...e.controller === void 0 ? {} : { controller: e.controller },
+    lifecycle: r(e.source, {
+      ...c === void 0 ? {} : { proxyBootstrap: c },
+      ...e.onConnected === void 0 ? {} : { onConnected: e.onConnected }
+    })
+  });
 }
 export {
-  o as createArtifactDirectConnectionConfig,
-  t as createArtifactTunnelConnectionConfig,
-  e as createProxyRuntimeTunnelConnectionConfig
+  u as createArtifactDirectConnectionConfig,
+  o as createArtifactTunnelConnectionConfig,
+  i as createProxyRuntimeTunnelConnectionConfig
 };

package/dist/hash.d.ts

@@ -1,4 +1,2 @@
-export declare function base64UrlToBase64(s: string): string;
 export declare function parseHashParam(key: string): string | null;
-export declare function parseBase64UrlJsonFromHash<T>(key: string): T | null;
 export declare function clearLocationHash(): void;

package/dist/hash.js

@@ -1,39 +1,22 @@
-function l(r) {
-  let t = String(r ?? "").replace(/-/g, "+").replace(/_/g, "/");
-  for (; t.length % 4 !== 0; ) t += "=";
-  return t;
-}
 function o(r) {
-  const t = String(r ?? "").trim();
-  if (!t) return null;
-  const n = String(window.location.hash ?? "").trim(), e = n.startsWith("#") ? n.slice(1) : n;
-  if (!e) return null;
-  try {
-    const a = new URLSearchParams(e);
-    return String(a.get(t) ?? "").trim() || null;
-  } catch {
-    return null;
-  }
-}
-function i(r) {
-  const t = o(r);
-  if (!t) return null;
+  const n = String(r ?? "").trim();
+  if (!n) return null;
+  const t = String(window.location.hash ?? "").trim(), a = t.startsWith("#") ? t.slice(1) : t;
+  if (!a) return null;
   try {
-    const n = atob(l(t));
-    return n ? JSON.parse(n) : null;
+    const e = new URLSearchParams(a);
+    return String(e.get(n) ?? "").trim() || null;
   } catch {
     return null;
   }
 }
-function s() {
+function c() {
   try {
     history.replaceState(null, document.title, window.location.pathname + window.location.search);
   } catch {
   }
 }
 export {
-  l as base64UrlToBase64,
-  s as clearLocationHash,
-  i as parseBase64UrlJsonFromHash,
+  c as clearLocationHash,
   o as parseHashParam
 };

package/dist/index.d.ts

@@ -1,13 +1,20 @@
-export { base64UrlToBase64, clearLocationHash, parseBase64UrlJsonFromHash, parseHashParam, } from './hash';
+export { clearLocationHash, parseHashParam, } from './hash';
 export type { WaitForMessageOptions } from './messaging';
 export { postMessageToOrigins, waitForMessage } from './messaging';
 export { getSessionStorage, removeSessionStorage, setSessionStorage } from './storage';
 export type { ArtifactSource, ArtifactSourceResult } from '@floegence/flowersec-core';
 export { createControlplaneArtifactSource, ControlplaneRequestError } from './artifact-source';
-export type { ControlplaneArtifactSourceOptions } from './artifact-source';
-export type { DirectArtifactConnectionOptions, TunnelArtifactConnectionOptions, FlowersecConnectionConfig } from './connection';
+export { classifyControlplaneFailure } from './artifact-source';
+export type { ClassifiedControlplaneFailure, ControlplaneArtifactSourceOptions, ControlplaneFailureInput, } from './artifact-source';
+export { AcquisitionError, clearAcquisitionSource, connectIsolatedOneShot, ConnectedAcquisition, IsolatedOneShotAcquisition, materializeIsolatedOneShot, synchronizeAcquisitionSourceSnapshot, } from './acquisition';
+export type { CommitSpend, CriticalScopeProjectionV1, IsolatedHandoffValidationContext, MaterializeIsolatedOneShotOptions, RuntimeBootInitPayloadV6, SerializedAcquisitionEnvelopeV1, SpendBindingView, SpendCommitRequest, SpendScopeV1, ValidateSpendBinding, } from './acquisition';
+export { createAcquisitionConnectionLifecycle } from './acquisition-lifecycle';
+export type { AcquisitionConnectionLifecycle, AcquisitionConnectionLifecycleOptions, } from './acquisition-lifecycle';
+export type { DirectArtifactConnectionOptions, FlowersecConnectionConfig, ProxyRuntimeTunnelConnectionOptions, TunnelArtifactConnectionOptions, } from './connection';
 export { createArtifactDirectConnectionConfig, createArtifactTunnelConnectionConfig, createProxyRuntimeTunnelConnectionConfig, } from './connection';
 export type { FetchServerSentEventsOptions, ServerSentEvent, ServerSentEventStreamErrorCode, } from './server-sent-events';
 export { fetchServerSentEvents, ServerSentEventStreamError, } from './server-sent-events';
-export type { ScopeEnvelope, ScopeResolver, ScopeResolverMap } from './scope';
+export { closeProxyBootstrap, createProxyBootstrapOwner, ProxyBootstrapOwner, synchronizeProxyBootstrap, } from './proxy-bootstrap';
+export type { ControllerBridgeProxyBootstrapContext, ProxyBootstrapBinding, ProxyBootstrapOwnerOptions, ProxyBootstrapSnapshot, ServiceWorkerProxyBootstrapContext, } from './proxy-bootstrap';
+export type { ScopeEnvelope, ScopeResolver, ScopeResolverMap, ValidatedCriticalScopeProjection, } from './scope';
 export { createBootstrapScopeResolvers, FLOWERSEC_BOOTSTRAP_SCOPE_RESOLVERS, PROXY_RUNTIME_SCOPE_NAME, validateProxyRuntimeScopeEntry, } from './scope';

package/dist/index.js

@@ -1,29 +1,43 @@
-import { base64UrlToBase64 as o, clearLocationHash as t, parseBase64UrlJsonFromHash as n, parseHashParam as a } from "./hash.js";
-import { postMessageToOrigins as i, waitForMessage as S } from "./messaging.js";
-import { getSessionStorage as p, removeSessionStorage as f, setSessionStorage as m } from "./storage.js";
-import { ControlplaneRequestError as l, createControlplaneArtifactSource as C } from "./artifact-source.js";
-import { createArtifactDirectConnectionConfig as R, createArtifactTunnelConnectionConfig as x, createProxyRuntimeTunnelConnectionConfig as O } from "./connection.js";
-import { ServerSentEventStreamError as P, fetchServerSentEvents as T } from "./server-sent-events.js";
-import { FLOWERSEC_BOOTSTRAP_SCOPE_RESOLVERS as _, PROXY_RUNTIME_SCOPE_NAME as A, createBootstrapScopeResolvers as h, validateProxyRuntimeScopeEntry as B } from "./scope.js";
+import { clearLocationHash as r, parseHashParam as t } from "./hash.js";
+import { postMessageToOrigins as i, waitForMessage as a } from "./messaging.js";
+import { getSessionStorage as c, removeSessionStorage as S, setSessionStorage as p } from "./storage.js";
+import { ControlplaneRequestError as f, classifyControlplaneFailure as m, createControlplaneArtifactSource as x } from "./artifact-source.js";
+import { AcquisitionError as C, ConnectedAcquisition as E, IsolatedOneShotAcquisition as O, clearAcquisitionSource as y, connectIsolatedOneShot as A, materializeIsolatedOneShot as P, synchronizeAcquisitionSourceSnapshot as g } from "./acquisition.js";
+import { createAcquisitionConnectionLifecycle as h } from "./acquisition-lifecycle.js";
+import { createArtifactDirectConnectionConfig as v, createArtifactTunnelConnectionConfig as B, createProxyRuntimeTunnelConnectionConfig as T } from "./connection.js";
+import { ServerSentEventStreamError as d, fetchServerSentEvents as I } from "./server-sent-events.js";
+import { ProxyBootstrapOwner as M, closeProxyBootstrap as w, createProxyBootstrapOwner as z, synchronizeProxyBootstrap as F } from "./proxy-bootstrap.js";
+import { FLOWERSEC_BOOTSTRAP_SCOPE_RESOLVERS as N, PROXY_RUNTIME_SCOPE_NAME as D, createBootstrapScopeResolvers as U, validateProxyRuntimeScopeEntry as V } from "./scope.js";
 export {
-  l as ControlplaneRequestError,
-  _ as FLOWERSEC_BOOTSTRAP_SCOPE_RESOLVERS,
-  A as PROXY_RUNTIME_SCOPE_NAME,
-  P as ServerSentEventStreamError,
-  o as base64UrlToBase64,
-  t as clearLocationHash,
-  R as createArtifactDirectConnectionConfig,
-  x as createArtifactTunnelConnectionConfig,
-  h as createBootstrapScopeResolvers,
-  C as createControlplaneArtifactSource,
-  O as createProxyRuntimeTunnelConnectionConfig,
-  T as fetchServerSentEvents,
-  p as getSessionStorage,
-  n as parseBase64UrlJsonFromHash,
-  a as parseHashParam,
+  C as AcquisitionError,
+  E as ConnectedAcquisition,
+  f as ControlplaneRequestError,
+  N as FLOWERSEC_BOOTSTRAP_SCOPE_RESOLVERS,
+  O as IsolatedOneShotAcquisition,
+  D as PROXY_RUNTIME_SCOPE_NAME,
+  M as ProxyBootstrapOwner,
+  d as ServerSentEventStreamError,
+  m as classifyControlplaneFailure,
+  y as clearAcquisitionSource,
+  r as clearLocationHash,
+  w as closeProxyBootstrap,
+  A as connectIsolatedOneShot,
+  h as createAcquisitionConnectionLifecycle,
+  v as createArtifactDirectConnectionConfig,
+  B as createArtifactTunnelConnectionConfig,
+  U as createBootstrapScopeResolvers,
+  x as createControlplaneArtifactSource,
+  z as createProxyBootstrapOwner,
+  T as createProxyRuntimeTunnelConnectionConfig,
+  I as fetchServerSentEvents,
+  c as getSessionStorage,
+  P as materializeIsolatedOneShot,
+  t as parseHashParam,
   i as postMessageToOrigins,
-  f as removeSessionStorage,
-  m as setSessionStorage,
-  B as validateProxyRuntimeScopeEntry,
-  S as waitForMessage
+  S as removeSessionStorage,
+  p as setSessionStorage,
+  g as synchronizeAcquisitionSourceSnapshot,
+  F as synchronizeProxyBootstrap,
+  V as validateProxyRuntimeScopeEntry,
+  a as waitForMessage
 };

package/dist/proxy-bootstrap.d.ts

@@ -0,0 +1,39 @@
+import { type ProxyRuntime } from '@floegence/flowersec-core/proxy';
+import { ConnectedAcquisition } from './acquisition';
+export type ProxyBootstrapBinding = Readonly<{
+    dispose(): void;
+}>;
+export type ServiceWorkerProxyBootstrapContext = Readonly<{
+    runtime: ProxyRuntime;
+    generation: number;
+    bindingIdentity: string;
+    scriptUrl: string;
+    serviceWorkerScope: string;
+    appBasePath?: string;
+}>;
+export type ControllerBridgeProxyBootstrapContext = Readonly<{
+    runtime: ProxyRuntime;
+    generation: number;
+    bindingIdentity: string;
+    allowedOrigins: readonly string[];
+    appBasePath?: string;
+    capabilityNonce: string;
+}>;
+export type ProxyBootstrapOwnerOptions = Readonly<{
+    serviceWorker?: (context: ServiceWorkerProxyBootstrapContext) => ProxyBootstrapBinding;
+    controllerBridge?: (context: ControllerBridgeProxyBootstrapContext) => ProxyBootstrapBinding;
+}>;
+export type ProxyBootstrapSnapshot = Readonly<{
+    generation: number;
+    mode: 'service_worker' | 'controller_bridge';
+    bindingIdentity: string;
+}>;
+export declare class ProxyBootstrapOwner {
+    #private;
+    private constructor();
+    static create(): ProxyBootstrapOwner;
+    static assertAuthentic(value: ProxyBootstrapOwner): void;
+}
+export declare function createProxyBootstrapOwner(options: ProxyBootstrapOwnerOptions): ProxyBootstrapOwner;
+export declare function synchronizeProxyBootstrap(owner: ProxyBootstrapOwner, acquisition: ConnectedAcquisition | null): ProxyBootstrapSnapshot | null;
+export declare function closeProxyBootstrap(owner: ProxyBootstrapOwner): void;

package/dist/proxy-bootstrap.js

@@ -0,0 +1,97 @@
+import { createProxyRuntime as f } from "@floegence/flowersec-core/proxy";
+import { connectedAcquisitionDetails as g, AcquisitionError as a } from "./acquisition.js";
+class d {
+  #e = void 0;
+  constructor() {
+    Object.freeze(this);
+  }
+  static create() {
+    return new d();
+  }
+  static assertAuthentic(t) {
+    t.#e;
+  }
+}
+const b = /* @__PURE__ */ new WeakMap();
+function m(e) {
+  const t = d.create();
+  return b.set(t, { options: e, generation: 0 }), t;
+}
+function B(e, t) {
+  const o = y(e);
+  if (t === null)
+    return l(o), null;
+  if (o.acquisition === t && o.snapshot !== void 0) return o.snapshot;
+  const r = g(t);
+  l(o);
+  const c = o.generation + 1;
+  o.generation = c;
+  const n = r.scope, p = f({
+    session: r.session,
+    ...n.limits ?? {},
+    ...n.appBasePath === void 0 ? {} : { pathPolicy: { allowedPathPrefixes: Object.freeze([n.appBasePath]) } }
+  });
+  try {
+    let i;
+    if (n.mode === "service_worker") {
+      const s = o.options.serviceWorker;
+      if (s === void 0) throw new a("service_worker_bootstrap_unavailable");
+      i = s(Object.freeze({
+        runtime: p,
+        generation: c,
+        bindingIdentity: r.bindingIdentity,
+        scriptUrl: n.serviceWorker.scriptUrl,
+        serviceWorkerScope: n.serviceWorker.scope,
+        ...n.appBasePath === void 0 ? {} : { appBasePath: n.appBasePath }
+      }));
+    } else {
+      const s = o.options.controllerBridge;
+      if (s === void 0) throw new a("controller_bridge_bootstrap_unavailable");
+      i = s(Object.freeze({
+        runtime: p,
+        generation: c,
+        bindingIdentity: r.bindingIdentity,
+        allowedOrigins: n.controllerBridge.allowedOrigins,
+        ...n.appBasePath === void 0 ? {} : { appBasePath: n.appBasePath },
+        capabilityNonce: h()
+      }));
+    }
+    if (i === null || typeof i != "object" || typeof i.dispose != "function")
+      throw new a("invalid_proxy_bootstrap_binding");
+    const u = Object.freeze({ generation: c, mode: n.mode, bindingIdentity: r.bindingIdentity });
+    return o.acquisition = t, o.runtime = p, o.binding = i, o.snapshot = u, u;
+  } catch (i) {
+    throw p.dispose(), i;
+  }
+}
+function P(e) {
+  l(y(e));
+}
+function y(e) {
+  d.assertAuthentic(e);
+  const t = b.get(e);
+  if (t === void 0) throw new a("invalid_proxy_bootstrap_owner");
+  return t;
+}
+function l(e) {
+  const t = e.binding, o = e.runtime;
+  e.acquisition = void 0, e.binding = void 0, e.runtime = void 0, e.snapshot = void 0;
+  try {
+    t?.dispose();
+  } finally {
+    o?.dispose();
+  }
+}
+function h() {
+  if (globalThis.crypto?.getRandomValues === void 0) throw new a("acquisition_entropy_unavailable");
+  const e = globalThis.crypto.getRandomValues(new Uint8Array(32));
+  let t = "";
+  for (const o of e) t += String.fromCharCode(o);
+  return btoa(t).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
+}
+export {
+  d as ProxyBootstrapOwner,
+  P as closeProxyBootstrap,
+  m as createProxyBootstrapOwner,
+  B as synchronizeProxyBootstrap
+};

package/dist/scope.d.ts

@@ -1,11 +1,20 @@
+import { type ProxyRuntimeScope } from '@floegence/flowersec-core/proxy';
 export declare const PROXY_RUNTIME_SCOPE_NAME = "proxy.runtime";
 export type ScopeEnvelope = Readonly<{
+    scope: string;
     scope_version: number;
+    critical: boolean;
     payload: unknown;
 }>;
-export type ScopeResolver = (entry: ScopeEnvelope) => void;
+export type ValidatedCriticalScopeProjection = Readonly<{
+    scope: 'proxy.runtime';
+    scope_version: 2;
+    critical: true;
+    payload: ProxyRuntimeScope;
+}>;
+export type ScopeResolver = (entry: ScopeEnvelope) => ValidatedCriticalScopeProjection;
 export type ScopeResolverMap = Readonly<Record<string, ScopeResolver>>;
-export declare function validateProxyRuntimeScopeEntry(entry: ScopeEnvelope): void;
+export declare function validateProxyRuntimeScopeEntry(entry: ScopeEnvelope): ValidatedCriticalScopeProjection;
 export declare const FLOWERSEC_BOOTSTRAP_SCOPE_RESOLVERS: Readonly<{
     "proxy.runtime": typeof validateProxyRuntimeScopeEntry;
 }>;

package/dist/scope.js

@@ -1,22 +1,29 @@
-import { PROXY_RUNTIME_SCOPE as t, assertProxyRuntimeScope as n } from "@floegence/flowersec-core/proxy";
-const o = "proxy.runtime";
-function r(e) {
-  if (e.scope_version !== t.version)
-    throw new Error(`unsupported ${o} scope_version: ${e.scope_version}`);
-  n(e.payload);
+import { PROXY_RUNTIME_SCOPE as o, assertProxyRuntimeScope as t } from "@floegence/flowersec-core/proxy";
+const r = "proxy.runtime";
+function c(e) {
+  if (e === null || typeof e != "object" || Array.isArray(e) || Object.keys(e).length !== 4 || !Object.keys(e).every((i) => ["scope", "scope_version", "critical", "payload"].includes(i)))
+    throw new TypeError(`invalid ${r} projection envelope`);
+  if (e.scope !== o.name || e.scope_version !== o.version || e.critical !== !0)
+    throw new TypeError(`unsupported ${r} critical scope projection`);
+  return Object.freeze({
+    scope: o.name,
+    scope_version: o.version,
+    critical: !0,
+    payload: t(e.payload)
+  });
 }
-const s = Object.freeze({
-  [o]: r
+const p = Object.freeze({
+  [r]: c
 });
-function i(e) {
+function n(e) {
   return e ? Object.freeze({
     ...e,
-    [o]: r
-  }) : s;
+    [r]: c
+  }) : p;
 }
 export {
-  s as FLOWERSEC_BOOTSTRAP_SCOPE_RESOLVERS,
-  o as PROXY_RUNTIME_SCOPE_NAME,
-  i as createBootstrapScopeResolvers,
-  r as validateProxyRuntimeScopeEntry
+  p as FLOWERSEC_BOOTSTRAP_SCOPE_RESOLVERS,
+  r as PROXY_RUNTIME_SCOPE_NAME,
+  n as createBootstrapScopeResolvers,
+  c as validateProxyRuntimeScopeEntry
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/floe-webapp-boot",
-  "version": "0.40.21",
+  "version": "0.41.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -34,7 +34,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@floegence/flowersec-core": "2.4.2"
+    "@floegence/flowersec-core": "2.5.0"
   },
   "devDependencies": {
     "typescript": "^5.9.3",