@floegence/floe-webapp-boot 0.44.1 → 0.45.0

package/dist/acquisition-lifecycle.d.ts

@@ -1,4 +1,5 @@
 import type { ArtifactSource, ConnectionSnapshot } from '@floegence/flowersec-core';
+import type { PrivateLoopbackArtifactSourceV1 } from '@floegence/flowersec-core/browser';
 import { ConnectedAcquisition } from './acquisition';
 import { ProxyBootstrapOwner } from './proxy-bootstrap';
 export interface AcquisitionConnectionLifecycle {
@@ -9,4 +10,4 @@ export type AcquisitionConnectionLifecycleOptions = Readonly<{
     proxyBootstrap?: ProxyBootstrapOwner;
     onConnected?: (acquisition: ConnectedAcquisition) => void;
 }>;
-export declare function createAcquisitionConnectionLifecycle(source: ArtifactSource, options?: AcquisitionConnectionLifecycleOptions): AcquisitionConnectionLifecycle;
+export declare function createAcquisitionConnectionLifecycle(source: ArtifactSource | PrivateLoopbackArtifactSourceV1, options?: AcquisitionConnectionLifecycleOptions): AcquisitionConnectionLifecycle;

package/dist/acquisition.d.ts

@@ -1,5 +1,5 @@
 import { type ArtifactLease, type ArtifactSource, type ConnectionSnapshot, type JsonValue, type Session } from '@floegence/flowersec-core';
-import type { ConnectionControllerOptions, SessionOptions } from '@floegence/flowersec-core/browser';
+import type { ConnectionControllerOptions, PrivateLoopbackArtifactLeaseV1, PrivateLoopbackArtifactSourceV1, SessionOptions } from '@floegence/flowersec-core/browser';
 import { type ProxyRuntimeScope } from '@floegence/flowersec-core/proxy';
 export type CriticalScopeProjectionV1 = Readonly<{
     scope: 'proxy.runtime';
@@ -70,6 +70,7 @@ export declare class IsolatedOneShotAcquisition {
     static create(): IsolatedOneShotAcquisition;
     static assertAuthentic(value: IsolatedOneShotAcquisition): void;
 }
+type AcquisitionSource = ArtifactSource | PrivateLoopbackArtifactSourceV1;
 export type ConnectedAcquisitionDetails = Readonly<{
     session: Session;
     scope: ProxyRuntimeScope;
@@ -81,10 +82,11 @@ type MaterializeOptions = Readonly<{
     validateSpendBinding: ValidateSpendBinding;
     expectedConsumer: 'trusted' | 'isolated';
 }>;
-export declare function registerAcquisitionSource(source: ArtifactSource): void;
+export declare function registerAcquisitionSource(source: AcquisitionSource): void;
 export declare function materializeAcquisitionForSource(source: ArtifactSource, value: unknown, options: MaterializeOptions): Promise<ArtifactLease>;
-export declare function synchronizeAcquisitionSourceSnapshot(source: ArtifactSource, snapshot: ConnectionSnapshot): ConnectedAcquisition | null;
-export declare function clearAcquisitionSource(source: ArtifactSource): void;
+export declare function materializePrivateLoopbackAcquisitionForSource(source: PrivateLoopbackArtifactSourceV1, value: unknown, options: MaterializeOptions): Promise<PrivateLoopbackArtifactLeaseV1>;
+export declare function synchronizeAcquisitionSourceSnapshot(source: AcquisitionSource, snapshot: ConnectionSnapshot): ConnectedAcquisition | null;
+export declare function clearAcquisitionSource(source: AcquisitionSource): void;
 export declare function connectedAcquisitionDetails(acquisition: ConnectedAcquisition): ConnectedAcquisitionDetails;
 export type IsolatedHandoffValidationContext = Readonly<{
     envPublicId: string;

package/dist/acquisition.js

@@ -1,9 +1,9 @@
-import { parseArtifact as R, createArtifactLease as $ } from "@floegence/flowersec-core";
-import { assertProxyRuntimeScope as C } from "@floegence/flowersec-core/proxy";
-const j = 32, F = 16384, L = "#redeven=";
-class n extends Error {
-  constructor(i) {
-    super(`Floe acquisition failed (code=${i})`), this.code = i, this.name = "AcquisitionError";
+import { createArtifactLease as I, parseArtifact as T } from "@floegence/flowersec-core";
+import { assertProxyRuntimeScope as F } from "@floegence/flowersec-core/proxy";
+const j = 32, C = 16384, P = "#redeven=";
+class r extends Error {
+  constructor(t) {
+    super(`Floe acquisition failed (code=${t})`), this.code = t, this.name = "AcquisitionError";
   }
 }
 class h {
@@ -14,8 +14,8 @@ class h {
   static create() {
     return new h();
   }
-  static assertAuthentic(i) {
-    i.#e;
+  static assertAuthentic(t) {
+    t.#e;
   }
 }
 class m {
@@ -26,203 +26,266 @@ class m {
   static create() {
     return new m();
   }
-  static assertAuthentic(i) {
-    i.#e;
+  static assertAuthentic(t) {
+    t.#e;
   }
 }
-const g = /* @__PURE__ */ new WeakMap(), S = /* @__PURE__ */ new WeakMap(), z = /* @__PURE__ */ new WeakMap(), O = /* @__PURE__ */ new Set();
-function X(e) {
-  if (g.has(e)) throw new n("duplicate_acquisition_source");
+const g = /* @__PURE__ */ new WeakMap(), A = /* @__PURE__ */ new WeakMap(), E = /* @__PURE__ */ new WeakMap(), z = /* @__PURE__ */ new Set();
+function Y(e) {
+  if (g.has(e)) throw new r("duplicate_acquisition_source");
   g.set(e, { pending: [] });
 }
-async function Y(e, i, t) {
-  const r = g.get(e);
-  if (r === void 0) throw new n("invalid_acquisition_source");
-  const c = await x(i, t);
-  return D(c, t.commitSpend, (o) => {
-    r.pending.push(o);
-  }, (o) => {
-    r.pending = r.pending.filter((a) => a !== o);
-  });
+async function K(e, t, i) {
+  const n = g.get(e);
+  if (n === void 0) throw new r("invalid_acquisition_source");
+  const o = await S(t, i, T);
+  return O(
+    o,
+    I,
+    i.commitSpend,
+    (c) => {
+      n.pending.push(c);
+    },
+    (c) => {
+      n.pending = n.pending.filter((a) => a !== c);
+    }
+  );
 }
-function K(e, i) {
-  const t = g.get(e);
-  if (t === void 0) return null;
-  if (i.state !== "connected" || i.currentSession === void 0)
-    return (i.state === "idle" || i.state === "waiting" || i.state === "failed" || i.state === "closed") && (t.pending = [], t.connected = void 0, t.connectedSession = void 0), null;
-  if (t.connected !== void 0 && t.connectedSession === i.currentSession) return t.connected;
-  const r = t.pending.filter((a) => a.committed);
-  if (r.length !== 1 || t.pending.length !== 1)
-    throw t.pending = [], new n("connected_acquisition_mismatch");
-  const c = r[0];
-  if (c === void 0) throw new n("connected_acquisition_mismatch");
-  const o = h.create();
-  return S.set(o, Object.freeze({
-    session: i.currentSession,
-    scope: c.scope,
-    bindingIdentity: c.bindingIdentity,
-    attempt: i.attempt
-  })), t.pending = [], t.connected = o, t.connectedSession = i.currentSession, o;
+async function Q(e, t, i) {
+  const n = g.get(e);
+  if (n === void 0) throw new r("invalid_acquisition_source");
+  const o = await import("@floegence/flowersec-core/browser"), c = await S(
+    t,
+    i,
+    o.parsePrivateLoopbackArtifactV1
+  );
+  return O(
+    c,
+    o.createPrivateLoopbackArtifactLeaseV1,
+    i.commitSpend,
+    (a) => {
+      n.pending.push(a);
+    },
+    (a) => {
+      n.pending = n.pending.filter((d) => d !== a);
+    }
+  );
 }
-function Q(e) {
+function ee(e, t) {
   const i = g.get(e);
-  i !== void 0 && (i.pending = [], i.connected = void 0, i.connectedSession = void 0);
+  if (i === void 0) return null;
+  if (t.state !== "connected" || t.currentSession === void 0)
+    return (t.state === "idle" || t.state === "waiting" || t.state === "failed" || t.state === "closed") && (i.pending = [], i.connected = void 0, i.connectedSession = void 0), null;
+  if (i.connected !== void 0 && i.connectedSession === t.currentSession)
+    return i.connected;
+  const n = i.pending.filter((a) => a.committed);
+  if (n.length !== 1 || i.pending.length !== 1)
+    throw i.pending = [], new r("connected_acquisition_mismatch");
+  const o = n[0];
+  if (o === void 0) throw new r("connected_acquisition_mismatch");
+  const c = h.create();
+  return A.set(
+    c,
+    Object.freeze({
+      session: t.currentSession,
+      scope: o.scope,
+      bindingIdentity: o.bindingIdentity,
+      attempt: t.attempt
+    })
+  ), i.pending = [], i.connected = c, i.connectedSession = t.currentSession, c;
 }
-function ee(e) {
+function te(e) {
+  const t = g.get(e);
+  t !== void 0 && (t.pending = [], t.connected = void 0, t.connectedSession = void 0);
+}
+function ie(e) {
   h.assertAuthentic(e);
-  const i = S.get(e);
-  if (i === void 0) throw new n("invalid_connected_acquisition");
-  return i;
+  const t = A.get(e);
+  if (t === void 0) throw new r("invalid_connected_acquisition");
+  return t;
 }
-async function te(e) {
-  const i = e.rawHandoff, t = typeof i != "string" || Z(`${L}${i}`) > F;
-  let r = !1;
+async function ne(e) {
+  const t = e.rawHandoff, i = typeof t != "string" || W(`${P}${t}`) > C;
+  let n = !1;
   try {
-    r = e.clearSensitiveLocation() === !0;
+    n = e.clearSensitiveLocation() === !0;
   } catch {
-    r = !1;
+    n = !1;
   }
-  if (!r)
-    throw e.navigateToLauncher(), new n("isolated_location_clear_failed");
-  if (t) throw new n("isolated_handoff_too_large");
-  const c = y(i, "invalid_isolated_handoff"), o = await V(c);
-  if (O.has(o)) throw new n("isolated_handoff_consumed");
-  O.add(o);
+  if (!n)
+    throw e.navigateToLauncher(), new r("isolated_location_clear_failed");
+  if (i) throw new r("isolated_handoff_too_large");
+  const o = y(t, "invalid_isolated_handoff"), c = await J(o);
+  if (z.has(c))
+    throw new r("isolated_handoff_consumed");
+  z.add(c);
   let a;
   try {
-    a = JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(c));
+    a = JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(o));
   } catch {
-    throw new n("invalid_isolated_handoff");
+    throw new r("invalid_isolated_handoff");
   }
-  const _ = P(a, e.validationContext), u = await x(_.acquisition, {
-    commitSpend: e.commitSpend,
-    expectedConsumer: "isolated",
-    validateSpendBinding: (d) => (k(_, d, e.validationContext), e.validationContext.validateTargetBinding(d.targetBinding), `${d.artifactDigestB64u}.${d.projectionDigestB64u}`)
-  });
-  if (u.scope.appBasePath !== _.app_path) throw new n("isolated_app_path_mismatch");
-  if (u.scope.mode === "controller_bridge") {
-    const d = u.scope.controllerBridge.allowedOrigins;
-    if (d.length !== 1 || d[0] !== _.app_origin)
-      throw new n("isolated_allowed_origins_mismatch");
+  const d = V(a, e.validationContext), p = await S(
+    d.acquisition,
+    {
+      commitSpend: e.commitSpend,
+      expectedConsumer: "isolated",
+      validateSpendBinding: (s) => (N(d, s, e.validationContext), e.validationContext.validateTargetBinding(s.targetBinding), `${s.artifactDigestB64u}.${s.projectionDigestB64u}`)
+    },
+    T
+  );
+  if (p.scope.appBasePath !== d.app_path)
+    throw new r("isolated_app_path_mismatch");
+  if (p.scope.mode === "controller_bridge") {
+    const s = p.scope.controllerBridge.allowedOrigins;
+    if (s.length !== 1 || s[0] !== d.app_origin)
+      throw new r("isolated_allowed_origins_mismatch");
   }
-  let s;
-  const l = D(u, e.commitSpend, (d) => {
-    s = d;
-  }, () => {
-  });
-  if (s === void 0 || s.lease !== l) throw new n("isolated_materialization_failed");
-  const p = m.create();
-  return z.set(p, { pending: s, state: "ready" }), p;
+  let u;
+  const l = O(
+    p,
+    I,
+    e.commitSpend,
+    (s) => {
+      u = s;
+    },
+    () => {
+    }
+  );
+  if (u === void 0 || u.lease !== l)
+    throw new r("isolated_materialization_failed");
+  const _ = m.create();
+  return E.set(_, { pending: u, state: "ready" }), _;
 }
-async function ie(e, i = {}) {
+async function re(e, t = {}) {
   m.assertAuthentic(e);
-  const t = z.get(e);
-  if (t === void 0 || t.state !== "ready") throw new n("isolated_acquisition_consumed");
-  t.state = "connecting";
+  const i = E.get(e);
+  if (i === void 0 || i.state !== "ready")
+    throw new r("isolated_acquisition_consumed");
+  i.state = "connecting";
   try {
-    const { connect: r } = await import("@floegence/flowersec-core/browser"), c = await r(t.pending.lease, i);
-    if (!t.pending.committed)
-      throw await c.close().catch(() => {
-      }), new n("isolated_spend_not_committed");
-    const o = h.create();
-    return S.set(o, Object.freeze({
-      session: c,
-      scope: t.pending.scope,
-      bindingIdentity: t.pending.bindingIdentity,
-      attempt: 1
-    })), t.state = "consumed", o;
-  } catch (r) {
-    throw t.state = "consumed", r;
+    const { connect: n } = await import("@floegence/flowersec-core/browser"), o = await n(i.pending.lease, t);
+    if (!i.pending.committed)
+      throw await o.close().catch(() => {
+      }), new r("isolated_spend_not_committed");
+    const c = h.create();
+    return A.set(
+      c,
+      Object.freeze({
+        session: o,
+        scope: i.pending.scope,
+        bindingIdentity: i.pending.bindingIdentity,
+        attempt: 1
+      })
+    ), i.state = "consumed", c;
+  } catch (n) {
+    throw i.state = "consumed", n;
   }
 }
-async function x(e, i) {
-  const t = w(e, ["v", "connect_artifact", "critical_scope_projection_json", "spend_scope"], "invalid_acquisition_envelope");
-  if (t.v !== 1 || typeof t.connect_artifact != "string" || t.connect_artifact.length === 0 || typeof t.critical_scope_projection_json != "string" || t.critical_scope_projection_json.length === 0)
-    throw new n("invalid_acquisition_envelope");
-  const r = U(t.spend_scope, i.expectedConsumer), c = new TextEncoder().encode(t.connect_artifact), o = new TextEncoder().encode(t.critical_scope_projection_json);
-  await q(c, r.artifact_digest_b64u, "artifact_digest_mismatch"), await q(o, r.projection_digest_b64u, "projection_digest_mismatch");
-  let a;
+async function S(e, t, i) {
+  const n = w(
+    e,
+    ["v", "connect_artifact", "critical_scope_projection_json", "spend_scope"],
+    "invalid_acquisition_envelope"
+  );
+  if (n.v !== 1 || typeof n.connect_artifact != "string" || n.connect_artifact.length === 0 || typeof n.critical_scope_projection_json != "string" || n.critical_scope_projection_json.length === 0)
+    throw new r("invalid_acquisition_envelope");
+  const o = k(n.spend_scope, t.expectedConsumer), c = new TextEncoder().encode(n.connect_artifact), a = new TextEncoder().encode(n.critical_scope_projection_json);
+  await D(c, o.artifact_digest_b64u, "artifact_digest_mismatch"), await D(
+    a,
+    o.projection_digest_b64u,
+    "projection_digest_mismatch"
+  );
+  let d;
   try {
-    a = JSON.parse(t.critical_scope_projection_json);
+    d = JSON.parse(n.critical_scope_projection_json);
   } catch {
-    throw new n("invalid_critical_scope_projection");
+    throw new r("invalid_critical_scope_projection");
   }
-  const _ = w(a, ["scope", "scope_version", "critical", "payload"], "invalid_critical_scope_projection");
-  if (_.scope !== "proxy.runtime" || _.scope_version !== 2 || _.critical !== !0)
-    throw new n("invalid_critical_scope_projection");
+  const p = w(
+    d,
+    ["scope", "scope_version", "critical", "payload"],
+    "invalid_critical_scope_projection"
+  );
+  if (p.scope !== "proxy.runtime" || p.scope_version !== 2 || p.critical !== !0)
+    throw new r("invalid_critical_scope_projection");
   let u;
   try {
-    u = C(_.payload);
+    u = F(p.payload);
   } catch {
-    throw new n("invalid_proxy_runtime_scope");
+    throw new r("invalid_proxy_runtime_scope");
   }
-  let s;
+  let l;
   try {
-    s = R(t.connect_artifact);
+    l = i(n.connect_artifact);
   } catch {
-    throw new n("invalid_connect_artifact");
+    throw new r("invalid_connect_artifact");
   }
-  const l = N(r), p = i.validateSpendBinding(l);
-  if (p !== void 0 && (typeof p != "string" || p.trim() === "" || p !== p.trim()))
-    throw new n("invalid_spend_binding_identity");
+  const _ = U(o), s = t.validateSpendBinding(_);
+  if (s !== void 0 && (typeof s != "string" || s.trim() === "" || s !== s.trim()))
+    throw new r("invalid_spend_binding_identity");
   return Object.freeze({
-    artifact: s,
+    artifact: l,
     scope: u,
-    binding: l,
-    bindingIdentity: p ?? `${l.artifactDigestB64u}.${l.projectionDigestB64u}`,
-    receipt: r.receipt
+    binding: _,
+    bindingIdentity: s ?? `${_.artifactDigestB64u}.${_.projectionDigestB64u}`,
+    receipt: o.receipt
   });
 }
-function D(e, i, t, r) {
-  const c = e.artifact, o = e.scope, a = e.binding, _ = e.bindingIdentity;
-  let u = e.receipt, s;
-  const l = $(c, async (p) => {
-    const d = u;
-    if (u = void 0, d === void 0) throw new n("spend_binding_consumed");
-    const T = Object.freeze({
-      ...a,
-      attemptId: J(),
-      receipt: d
+function O(e, t, i, n, o) {
+  const c = e.artifact, a = e.scope, d = e.binding, p = e.bindingIdentity;
+  let u = e.receipt, l;
+  const _ = t(c, async (s) => {
+    const q = u;
+    if (u = void 0, q === void 0) throw new r("spend_binding_consumed");
+    const R = Object.freeze({
+      ...d,
+      attemptId: Z(),
+      receipt: q
     });
     try {
-      await i(T, p), s.committed = !0;
-    } catch (E) {
-      throw r(s), E;
+      await i(R, s), l.committed = !0;
+    } catch ($) {
+      throw o(l), $;
     }
   });
-  return s = { lease: l, scope: o, bindingIdentity: _, committed: !1 }, t(s), l;
+  return l = { lease: _, scope: a, bindingIdentity: p, committed: !1 }, n(l), _;
 }
-function U(e, i) {
-  const t = w(e, [
-    "v",
-    "receipt",
-    "artifact_digest_b64u",
-    "projection_digest_b64u",
-    "launcher_origin",
-    "runtime_origin",
-    "app_origin",
-    "consumer",
-    "target_binding",
-    "expires_at"
-  ], "invalid_spend_scope");
-  if (t.v !== 1 || typeof t.receipt != "string" || !H(t.receipt) || typeof t.artifact_digest_b64u != "string" || !B(t.artifact_digest_b64u) || typeof t.projection_digest_b64u != "string" || !B(t.projection_digest_b64u) || t.consumer !== i || typeof t.expires_at != "string" || !M(t.expires_at) || !b(t.target_binding))
-    throw new n("invalid_spend_scope");
-  const r = f(t.launcher_origin), c = f(t.runtime_origin), o = f(t.app_origin);
-  if (Date.parse(t.expires_at) <= Date.now()) throw new n("expired_spend_scope");
+function k(e, t) {
+  const i = w(
+    e,
+    [
+      "v",
+      "receipt",
+      "artifact_digest_b64u",
+      "projection_digest_b64u",
+      "launcher_origin",
+      "runtime_origin",
+      "app_origin",
+      "consumer",
+      "target_binding",
+      "expires_at"
+    ],
+    "invalid_spend_scope"
+  );
+  if (i.v !== 1 || typeof i.receipt != "string" || !H(i.receipt) || typeof i.artifact_digest_b64u != "string" || !x(i.artifact_digest_b64u) || typeof i.projection_digest_b64u != "string" || !x(i.projection_digest_b64u) || i.consumer !== t || typeof i.expires_at != "string" || !M(i.expires_at) || !b(i.target_binding))
+    throw new r("invalid_spend_scope");
+  const n = f(i.launcher_origin), o = f(i.runtime_origin), c = f(i.app_origin);
+  if (Date.parse(i.expires_at) <= Date.now()) throw new r("expired_spend_scope");
   return Object.freeze({
     v: 1,
-    receipt: t.receipt,
-    artifact_digest_b64u: t.artifact_digest_b64u,
-    projection_digest_b64u: t.projection_digest_b64u,
-    launcher_origin: r,
-    runtime_origin: c,
-    app_origin: o,
-    consumer: i,
-    target_binding: v(t.target_binding),
-    expires_at: t.expires_at
+    receipt: i.receipt,
+    artifact_digest_b64u: i.artifact_digest_b64u,
+    projection_digest_b64u: i.projection_digest_b64u,
+    launcher_origin: n,
+    runtime_origin: o,
+    app_origin: c,
+    consumer: t,
+    target_binding: v(i.target_binding),
+    expires_at: i.expires_at
   });
 }
-function N(e) {
+function U(e) {
   return Object.freeze({
     artifactDigestB64u: e.artifact_digest_b64u,
     projectionDigestB64u: e.projection_digest_b64u,
@@ -234,56 +297,62 @@ function N(e) {
     expiresAt: e.expires_at
   });
 }
-function P(e, i) {
-  const t = w(e, [
-    "v",
-    "env_public_id",
-    "floe_app",
-    "code_space_id",
-    "app_path",
-    "launcher_kind",
-    "launcher_id",
-    "launcher_origin",
-    "runtime_origin",
-    "app_origin",
-    "acquisition"
-  ], "invalid_isolated_handoff");
-  if (t.v !== 6 || t.env_public_id !== i.envPublicId || t.floe_app !== i.floeApp || t.code_space_id !== i.codeSpaceId || t.app_path !== i.appPath || t.launcher_kind !== i.launcherKind || t.launcher_id !== i.launcherId || t.launcher_origin !== i.launcherOrigin || t.runtime_origin !== i.runtimeOrigin || t.app_origin !== i.appOrigin)
-    throw new n("isolated_context_mismatch");
-  return f(t.launcher_origin), f(t.runtime_origin), f(t.app_origin), t;
+function V(e, t) {
+  const i = w(
+    e,
+    [
+      "v",
+      "env_public_id",
+      "floe_app",
+      "code_space_id",
+      "app_path",
+      "launcher_kind",
+      "launcher_id",
+      "launcher_origin",
+      "runtime_origin",
+      "app_origin",
+      "acquisition"
+    ],
+    "invalid_isolated_handoff"
+  );
+  if (i.v !== 6 || i.env_public_id !== t.envPublicId || i.floe_app !== t.floeApp || i.code_space_id !== t.codeSpaceId || i.app_path !== t.appPath || i.launcher_kind !== t.launcherKind || i.launcher_id !== t.launcherId || i.launcher_origin !== t.launcherOrigin || i.runtime_origin !== t.runtimeOrigin || i.app_origin !== t.appOrigin)
+    throw new r("isolated_context_mismatch");
+  return f(i.launcher_origin), f(i.runtime_origin), f(i.app_origin), i;
 }
-function k(e, i, t) {
-  if (i.consumer !== "isolated" || i.launcherOrigin !== e.launcher_origin || i.runtimeOrigin !== e.runtime_origin || i.appOrigin !== e.app_origin || e.runtime_origin !== t.runtimeOrigin || e.app_origin !== t.appOrigin)
-    throw new n("isolated_spend_binding_mismatch");
+function N(e, t, i) {
+  if (t.consumer !== "isolated" || t.launcherOrigin !== e.launcher_origin || t.runtimeOrigin !== e.runtime_origin || t.appOrigin !== e.app_origin || e.runtime_origin !== i.runtimeOrigin || e.app_origin !== i.appOrigin)
+    throw new r("isolated_spend_binding_mismatch");
 }
-function w(e, i, t) {
-  if (e === null || typeof e != "object" || Array.isArray(e)) throw new n(t);
-  const r = e, c = new Set(i), o = Object.keys(r);
-  if (o.length !== i.length || o.some((a) => !c.has(a))) throw new n(t);
-  return r;
+function w(e, t, i) {
+  if (e === null || typeof e != "object" || Array.isArray(e))
+    throw new r(i);
+  const n = e, o = new Set(t), c = Object.keys(n);
+  if (c.length !== t.length || c.some((a) => !o.has(a)))
+    throw new r(i);
+  return n;
 }
 function f(e) {
-  if (typeof e != "string") throw new n("invalid_spend_scope");
-  let i;
+  if (typeof e != "string") throw new r("invalid_spend_scope");
+  let t;
   try {
-    i = new URL(e);
+    t = new URL(e);
   } catch {
-    throw new n("invalid_spend_scope");
+    throw new r("invalid_spend_scope");
   }
-  if (i.protocol !== "https:" && i.protocol !== "http:" || i.origin !== e || i.username !== "" || i.password !== "")
-    throw new n("invalid_spend_scope");
+  if (t.protocol !== "https:" && t.protocol !== "http:" || t.origin !== e || t.username !== "" || t.password !== "")
+    throw new r("invalid_spend_scope");
   return e;
 }
 function H(e) {
-  const i = /^r1\.([A-Za-z0-9_-]{1,64})\.([A-Za-z0-9_-]+)$/u.exec(e);
-  if (i === null || i[2] === void 0) return !1;
+  const t = /^r1\.([A-Za-z0-9_-]{1,64})\.([A-Za-z0-9_-]+)$/u.exec(e);
+  if (t === null || t[2] === void 0) return !1;
   try {
-    return y(i[2], "invalid_spend_scope").length === j;
+    return y(t[2], "invalid_spend_scope").length === j;
   } catch {
     return !1;
   }
 }
-function B(e) {
+function x(e) {
   try {
     return y(e, "invalid_spend_scope").length === j;
   } catch {
@@ -293,69 +362,78 @@ function B(e) {
 function M(e) {
   return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/u.test(e) ? Number.isFinite(Date.parse(e)) : !1;
 }
-function b(e, i = 0) {
-  return i > 32 ? !1 : e === null || typeof e == "string" || typeof e == "boolean" ? !0 : typeof e == "number" ? Number.isFinite(e) : Array.isArray(e) ? e.every((t) => b(t, i + 1)) : typeof e != "object" ? !1 : Object.values(e).every((t) => b(t, i + 1));
+function b(e, t = 0) {
+  return t > 32 ? !1 : e === null || typeof e == "string" || typeof e == "boolean" ? !0 : typeof e == "number" ? Number.isFinite(e) : Array.isArray(e) ? e.every((i) => b(i, t + 1)) : typeof e != "object" ? !1 : Object.values(e).every(
+    (i) => b(i, t + 1)
+  );
 }
 function v(e) {
   if (Array.isArray(e)) {
-    for (const i of e) v(i);
+    for (const t of e) v(t);
     return Object.freeze(e);
   }
   if (e !== null && typeof e == "object") {
-    for (const i of Object.values(e)) v(i);
+    for (const t of Object.values(e)) v(t);
     return Object.freeze(e);
   }
   return e;
 }
-async function q(e, i, t) {
-  const r = await I(e), c = y(i, t);
-  if (r.length !== c.length) throw new n(t);
-  let o = 0;
-  for (let a = 0; a < r.length; a += 1) o |= r[a] ^ c[a];
-  if (o !== 0) throw new n(t);
+async function D(e, t, i) {
+  const n = await L(e), o = y(t, i);
+  if (n.length !== o.length) throw new r(i);
+  let c = 0;
+  for (let a = 0; a < n.length; a += 1)
+    c |= n[a] ^ o[a];
+  if (c !== 0) throw new r(i);
 }
-async function V(e) {
-  return A(await I(e));
+async function J(e) {
+  return B(await L(e));
 }
-async function I(e) {
-  if (globalThis.crypto?.subtle === void 0) throw new n("acquisition_crypto_unavailable");
-  const i = e.buffer.slice(e.byteOffset, e.byteOffset + e.byteLength), t = await globalThis.crypto.subtle.digest("SHA-256", i);
-  return new Uint8Array(t);
+async function L(e) {
+  if (globalThis.crypto?.subtle === void 0)
+    throw new r("acquisition_crypto_unavailable");
+  const t = e.buffer.slice(
+    e.byteOffset,
+    e.byteOffset + e.byteLength
+  ), i = await globalThis.crypto.subtle.digest("SHA-256", t);
+  return new Uint8Array(i);
 }
-function J() {
-  if (globalThis.crypto?.getRandomValues === void 0) throw new n("acquisition_entropy_unavailable");
-  return A(globalThis.crypto.getRandomValues(new Uint8Array(j)));
+function Z() {
+  if (globalThis.crypto?.getRandomValues === void 0)
+    throw new r("acquisition_entropy_unavailable");
+  return B(globalThis.crypto.getRandomValues(new Uint8Array(j)));
 }
-function y(e, i) {
-  if (!/^[A-Za-z0-9_-]*$/u.test(e) || e.length % 4 === 1) throw new n(i);
-  const t = e.replace(/-/gu, "+").replace(/_/gu, "/") + "=".repeat((4 - e.length % 4) % 4);
-  let r;
+function y(e, t) {
+  if (!/^[A-Za-z0-9_-]*$/u.test(e) || e.length % 4 === 1) throw new r(t);
+  const i = e.replace(/-/gu, "+").replace(/_/gu, "/") + "=".repeat((4 - e.length % 4) % 4);
+  let n;
   try {
-    r = atob(t);
+    n = atob(i);
   } catch {
-    throw new n(i);
+    throw new r(t);
   }
-  const c = Uint8Array.from(r, (o) => o.charCodeAt(0));
-  if (A(c) !== e) throw new n(i);
-  return c;
+  const o = Uint8Array.from(n, (c) => c.charCodeAt(0));
+  if (B(o) !== e) throw new r(t);
+  return o;
 }
-function A(e) {
-  let i = "";
-  for (const t of e) i += String.fromCharCode(t);
-  return btoa(i).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
+function B(e) {
+  let t = "";
+  for (const i of e) t += String.fromCharCode(i);
+  return btoa(t).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
 }
-function Z(e) {
+function W(e) {
   return new TextEncoder().encode(e).length;
 }
 export {
-  n as AcquisitionError,
+  r as AcquisitionError,
   h as ConnectedAcquisition,
   m as IsolatedOneShotAcquisition,
-  Q as clearAcquisitionSource,
-  ie as connectIsolatedOneShot,
-  ee as connectedAcquisitionDetails,
-  Y as materializeAcquisitionForSource,
-  te as materializeIsolatedOneShot,
-  X as registerAcquisitionSource,
-  K as synchronizeAcquisitionSourceSnapshot
+  te as clearAcquisitionSource,
+  re as connectIsolatedOneShot,
+  ie as connectedAcquisitionDetails,
+  K as materializeAcquisitionForSource,
+  ne as materializeIsolatedOneShot,
+  Q as materializePrivateLoopbackAcquisitionForSource,
+  Y as registerAcquisitionSource,
+  ee as synchronizeAcquisitionSourceSnapshot
 };

package/dist/artifact-source.d.ts

@@ -1,4 +1,5 @@
 import type { ArtifactSource, JsonObject, RetryDisposition } from '@floegence/flowersec-core';
+import type { PrivateLoopbackArtifactSourceV1 } from '@floegence/flowersec-core/browser';
 import { type CommitSpend, type ValidateSpendBinding } from './acquisition';
 export type ControlplaneArtifactSourceOptions = Readonly<{
     baseUrl: string;
@@ -14,6 +15,7 @@ export type ControlplaneArtifactSourceOptions = Readonly<{
     validateSpendBinding: ValidateSpendBinding;
     retryableBusinessCodes?: readonly string[];
 }>;
+export type PrivateLoopbackControlplaneArtifactSourceOptions = Omit<ControlplaneArtifactSourceOptions, 'allowLoopbackHTTP' | 'entryTicket'>;
 export declare class ControlplaneRequestError extends Error {
     readonly status: number;
     readonly code: string;
@@ -32,3 +34,4 @@ export type ClassifiedControlplaneFailure = Readonly<{
 }>;
 export declare function classifyControlplaneFailure(input: ControlplaneFailureInput): ClassifiedControlplaneFailure;
 export declare function createControlplaneArtifactSource(options: ControlplaneArtifactSourceOptions): ArtifactSource;
+export declare function createPrivateLoopbackControlplaneArtifactSource(options: PrivateLoopbackControlplaneArtifactSourceOptions): PrivateLoopbackArtifactSourceV1;

package/dist/artifact-source.js

@@ -1,56 +1,71 @@
-import { registerAcquisitionSource as b, materializeAcquisitionForSource as h, AcquisitionError as u } from "./acquisition.js";
+import { registerAcquisitionSource as b, AcquisitionError as p, materializeAcquisitionForSource as w, materializePrivateLoopbackAcquisitionForSource as k } from "./acquisition.js";
 const y = /^[a-z][a-z0-9_]{0,63}$/u;
-class f extends Error {
-  constructor(t, r) {
-    super(`Floe controlplane request failed (code=${r})`), this.status = t, this.code = r, this.name = "ControlplaneRequestError";
+class a extends Error {
+  constructor(r, t) {
+    super(`Floe controlplane request failed (code=${t})`), this.status = r, this.code = t, this.name = "ControlplaneRequestError";
   }
 }
-function m(e) {
-  const t = e.toLowerCase();
-  return t === "localhost" || t === "::1" || t === "127.0.0.1" || t.startsWith("127.");
+function S(e) {
+  const r = e.toLowerCase();
+  return r === "localhost" || r === "::1" || r === "127.0.0.1" || r.startsWith("127.");
 }
-function w(e, t) {
-  let r;
+function _(e, r) {
+  let t;
   try {
-    r = new URL(e);
+    t = new URL(e);
   } catch {
-    throw new f(0, "transport_policy_denied");
+    throw new a(0, "transport_policy_denied");
   }
-  if (r.protocol !== "https:" && !(t && r.protocol === "http:" && m(r.hostname)))
-    throw new f(0, "transport_policy_denied");
-  return r.pathname = r.pathname.replace(/\/+$/u, ""), r;
+  if (t.protocol !== "https:" && !(r && t.protocol === "http:" && S(t.hostname)))
+    throw new a(0, "transport_policy_denied");
+  return t.pathname = t.pathname.replace(/\/+$/u, ""), t;
 }
-function j(e, t) {
-  const r = t === void 0 ? "/v1/connect/artifact" : "/v1/connect/artifact/entry";
-  return new URL(`${e.pathname}${r}`, e).toString();
+function j(e, r) {
+  const t = r === void 0 ? "/v1/connect/artifact" : "/v1/connect/artifact/entry";
+  return new URL(`${e.pathname}${t}`, e).toString();
 }
 function v(e) {
   if (!y.test(e.code))
-    return Object.freeze({ code: "invalid_error_code", disposition: Object.freeze({ kind: "terminal" }) });
+    return Object.freeze({
+      code: "invalid_error_code",
+      disposition: Object.freeze({ kind: "terminal" })
+    });
   if (new Set(e.retryableBusinessCodes ?? []).has(e.code))
     return Object.freeze({ code: e.code, disposition: Object.freeze({ kind: "retryable" }) });
   if (e.status === 429) {
-    const r = O(e.retryAfter, e.nowUnixMilliseconds ?? Date.now());
+    const t = g(e.retryAfter, e.nowUnixMilliseconds ?? Date.now());
     return Object.freeze({
       code: e.code,
-      disposition: Object.freeze(r === void 0 ? { kind: "retryable" } : { kind: "retry_after", notBeforeUnixMilliseconds: r })
+      disposition: Object.freeze(t === void 0 ? { kind: "retryable" } : { kind: "retry_after", notBeforeUnixMilliseconds: t })
     });
   }
   return e.status === 408 || e.status === 425 || e.status >= 500 ? Object.freeze({ code: e.code, disposition: Object.freeze({ kind: "retryable" }) }) : Object.freeze({ code: e.code, disposition: Object.freeze({ kind: "terminal" }) });
 }
-function _(e) {
+function B(e) {
+  const r = m(e, w);
+  return b(r), r;
+}
+function L(e) {
+  const r = z(e.baseUrl), t = m(
+    { ...e, baseUrl: r.origin, allowLoopbackHTTP: !0 },
+    k
+  );
+  return b(t), t;
+}
+function m(e, r) {
   if (typeof e.commitSpend != "function") throw new TypeError("commitSpend is required");
-  if (typeof e.validateSpendBinding != "function") throw new TypeError("validateSpendBinding is required");
+  if (typeof e.validateSpendBinding != "function")
+    throw new TypeError("validateSpendBinding is required");
   const t = e.fetch ?? globalThis.fetch;
   if (typeof t != "function") throw new TypeError("fetch is required");
-  const r = w(e.baseUrl, e.allowLoopbackHTTP === !0), n = j(r, e.entryTicket), c = {
-    acquire: async ({ signal: i }) => {
+  const n = _(e.baseUrl, e.allowLoopbackHTTP === !0), s = j(n, e.entryTicket), i = {
+    acquire: async ({ signal: d }) => {
       try {
         const o = {
           endpoint_id: e.endpointId,
           ...e.payload === void 0 ? {} : { payload: e.payload },
           ...e.entryTicket === void 0 && e.correlation !== void 0 ? { correlation: { trace_id: e.correlation.traceId } } : {}
-        }, a = await t(n, {
+        }, c = await t(s, {
           method: "POST",
           headers: {
             accept: "application/json",
@@ -60,39 +75,39 @@ function _(e) {
           body: JSON.stringify(o),
           credentials: "omit",
           redirect: "error",
-          signal: i
+          signal: d
         });
-        if (!a.ok) {
-          const s = await z(a);
+        if (!c.ok) {
+          const l = await E(c);
           return { kind: "failure", ...v({
-            status: a.status,
-            code: s,
-            retryAfter: a.headers.get("retry-after"),
+            status: c.status,
+            code: l,
+            retryAfter: c.headers.get("retry-after"),
             retryableBusinessCodes: e.retryableBusinessCodes
           }) };
         }
-        let l;
+        let u;
         try {
-          l = await a.json();
+          u = await c.json();
         } catch {
-          return d("invalid_controlplane_response");
+          return f("invalid_controlplane_response");
         }
-        const p = await h(c, l, {
+        const h = await r(i, u, {
           commitSpend: e.commitSpend,
-          validateSpendBinding: (s) => {
+          validateSpendBinding: (l) => {
             try {
-              return e.validateSpendBinding(s);
+              return e.validateSpendBinding(l);
             } catch {
-              throw new u("invalid_spend_binding");
+              throw new p("invalid_spend_binding");
             }
           },
           expectedConsumer: "trusted"
         });
-        return Object.freeze({ kind: "lease", lease: p });
+        return Object.freeze({ kind: "lease", lease: h });
       } catch (o) {
-        if (i.aborted) throw i.reason ?? new DOMException("Aborted", "AbortError");
+        if (d.aborted) throw d.reason ?? new DOMException("Aborted", "AbortError");
         if (o instanceof DOMException && o.name === "AbortError") throw o;
-        return o instanceof u || o instanceof f ? d(o.code) : Object.freeze({
+        return o instanceof p || o instanceof a ? f(o.code) : Object.freeze({
           kind: "failure",
           code: "network_error",
           disposition: Object.freeze({ kind: "retryable" })
@@ -100,15 +115,34 @@ function _(e) {
       }
     }
   };
-  return b(c), c;
+  return i;
+}
+function z(e) {
+  let r;
+  try {
+    r = new URL(e);
+  } catch {
+    throw new a(0, "transport_policy_denied");
+  }
+  if (e !== r.origin || r.protocol !== "http:" || r.username !== "" || r.password !== "" || !O(r.port) || !A(r.hostname))
+    throw new a(0, "transport_policy_denied");
+  return r;
+}
+function O(e) {
+  if (!/^[1-9][0-9]*$/u.test(e)) return !1;
+  const r = Number(e);
+  return Number.isSafeInteger(r) && r >= 1024 && r <= 65535;
+}
+function A(e) {
+  return e === "127.0.0.1" || e === "[::1]";
 }
-async function z(e) {
+async function E(e) {
   try {
-    const t = await e.json();
-    if (t !== null && typeof t == "object" && !Array.isArray(t)) {
-      const r = t.error;
-      if (r !== null && typeof r == "object" && !Array.isArray(r)) {
-        const n = r.code;
+    const r = await e.json();
+    if (r !== null && typeof r == "object" && !Array.isArray(r)) {
+      const t = r.error;
+      if (t !== null && typeof t == "object" && !Array.isArray(t)) {
+        const n = t.code;
         if (typeof n == "string") return n;
       }
     }
@@ -116,19 +150,19 @@ async function z(e) {
   }
   return "request_failed";
 }
-function O(e, t) {
+function g(e, r) {
   if (e == null) return;
-  const r = e.trim();
-  if (/^\d+$/u.test(r)) {
-    const c = Number(r);
-    if (!Number.isSafeInteger(c)) return;
-    const i = t + c * 1e3;
-    return Number.isSafeInteger(i) && i > t ? i : void 0;
+  const t = e.trim();
+  if (/^\d+$/u.test(t)) {
+    const s = Number(t);
+    if (!Number.isSafeInteger(s)) return;
+    const i = r + s * 1e3;
+    return Number.isSafeInteger(i) && i > r ? i : void 0;
   }
-  const n = Date.parse(r);
-  return Number.isSafeInteger(n) && n > t ? n : void 0;
+  const n = Date.parse(t);
+  return Number.isSafeInteger(n) && n > r ? n : void 0;
 }
-function d(e) {
+function f(e) {
   return Object.freeze({
     kind: "failure",
     code: y.test(e) ? e : "invalid_error_code",
@@ -136,7 +170,8 @@ function d(e) {
   });
 }
 export {
-  f as ControlplaneRequestError,
+  a as ControlplaneRequestError,
   v as classifyControlplaneFailure,
-  _ as createControlplaneArtifactSource
+  B as createControlplaneArtifactSource,
+  L as createPrivateLoopbackControlplaneArtifactSource
 };

package/dist/connection.d.ts

@@ -1,13 +1,20 @@
 import type { ArtifactSource } from '@floegence/flowersec-core';
-import type { ConnectionControllerOptions } from '@floegence/flowersec-core/browser';
+import type { ConnectionControllerOptions, PrivateLoopbackArtifactSourceV1, PrivateLoopbackConnectionControllerOptionsV1 } from '@floegence/flowersec-core/browser';
 import { type AcquisitionConnectionLifecycle } from './acquisition-lifecycle';
 import type { ConnectedAcquisition } from './acquisition';
 import type { ProxyBootstrapOwner } from './proxy-bootstrap';
-export type FlowersecConnectionConfig = Readonly<{
-    source: ArtifactSource;
-    controller?: ConnectionControllerOptions;
+type SharedFlowersecConnectionConfig = Readonly<{
     lifecycle: AcquisitionConnectionLifecycle;
 }>;
+export type FlowersecConnectionConfig = SharedFlowersecConnectionConfig & (Readonly<{
+    source: ArtifactSource;
+    controller?: ConnectionControllerOptions;
+    privateLoopback?: never;
+}> | Readonly<{
+    source: PrivateLoopbackArtifactSourceV1;
+    privateLoopback: PrivateLoopbackConnectionControllerOptionsV1;
+    controller?: never;
+}>);
 type AcquisitionConnectionOptions = Readonly<{
     source: ArtifactSource;
     controller?: ConnectionControllerOptions;
@@ -15,10 +22,16 @@ type AcquisitionConnectionOptions = Readonly<{
 }>;
 export type TunnelArtifactConnectionOptions = AcquisitionConnectionOptions;
 export type DirectArtifactConnectionOptions = AcquisitionConnectionOptions;
+export type PrivateLoopbackDirectConnectionOptions = Readonly<{
+    source: PrivateLoopbackArtifactSourceV1;
+    privateLoopback: PrivateLoopbackConnectionControllerOptionsV1;
+    onConnected?: (acquisition: ConnectedAcquisition) => void;
+}>;
 export type ProxyRuntimeTunnelConnectionOptions = AcquisitionConnectionOptions & Readonly<{
     proxyBootstrap: ProxyBootstrapOwner;
 }>;
 export declare function createArtifactTunnelConnectionConfig(options: TunnelArtifactConnectionOptions): FlowersecConnectionConfig;
 export declare function createProxyRuntimeTunnelConnectionConfig(options: ProxyRuntimeTunnelConnectionOptions): FlowersecConnectionConfig;
 export declare function createArtifactDirectConnectionConfig(options: DirectArtifactConnectionOptions): FlowersecConnectionConfig;
+export declare function createPrivateLoopbackDirectConnectionConfig(options: PrivateLoopbackDirectConnectionOptions): FlowersecConnectionConfig;
 export {};

package/dist/connection.js

@@ -1,5 +1,5 @@
 import { createAcquisitionConnectionLifecycle as r } from "./acquisition-lifecycle.js";
-function o(e) {
+function t(e) {
   return n(e);
 }
 function i(e) {
@@ -8,6 +8,15 @@ function i(e) {
 function u(e) {
   return n(e);
 }
+function f(e) {
+  return Object.freeze({
+    source: e.source,
+    privateLoopback: e.privateLoopback,
+    lifecycle: r(e.source, {
+      ...e.onConnected === void 0 ? {} : { onConnected: e.onConnected }
+    })
+  });
+}
 function n(e, c) {
   return Object.freeze({
     source: e.source,
@@ -20,6 +29,7 @@ function n(e, c) {
 }
 export {
   u as createArtifactDirectConnectionConfig,
-  o as createArtifactTunnelConnectionConfig,
+  t as createArtifactTunnelConnectionConfig,
+  f as createPrivateLoopbackDirectConnectionConfig,
   i as createProxyRuntimeTunnelConnectionConfig
 };

package/dist/index.d.ts

@@ -1,19 +1,19 @@
-export { clearLocationHash, parseHashParam, } from './hash';
+export { clearLocationHash, parseHashParam } from './hash';
 export type { WaitForMessageOptions } from './messaging';
 export { postMessageToOrigins, waitForMessage } from './messaging';
 export { getSessionStorage, removeSessionStorage, setSessionStorage } from './storage';
 export type { ArtifactSource, ArtifactSourceResult } from '@floegence/flowersec-core';
-export { createControlplaneArtifactSource, ControlplaneRequestError } from './artifact-source';
+export { createControlplaneArtifactSource, createPrivateLoopbackControlplaneArtifactSource, ControlplaneRequestError, } from './artifact-source';
 export { classifyControlplaneFailure } from './artifact-source';
-export type { ClassifiedControlplaneFailure, ControlplaneArtifactSourceOptions, ControlplaneFailureInput, } from './artifact-source';
-export { AcquisitionError, clearAcquisitionSource, connectIsolatedOneShot, ConnectedAcquisition, IsolatedOneShotAcquisition, materializeIsolatedOneShot, synchronizeAcquisitionSourceSnapshot, } from './acquisition';
+export type { ClassifiedControlplaneFailure, ControlplaneArtifactSourceOptions, ControlplaneFailureInput, PrivateLoopbackControlplaneArtifactSourceOptions, } from './artifact-source';
+export { AcquisitionError, clearAcquisitionSource, connectIsolatedOneShot, ConnectedAcquisition, IsolatedOneShotAcquisition, materializePrivateLoopbackAcquisitionForSource, materializeIsolatedOneShot, synchronizeAcquisitionSourceSnapshot, } from './acquisition';
 export type { CommitSpend, CriticalScopeProjectionV1, IsolatedHandoffValidationContext, MaterializeIsolatedOneShotOptions, RuntimeBootInitPayloadV6, SerializedAcquisitionEnvelopeV1, SpendBindingView, SpendCommitRequest, SpendScopeV1, ValidateSpendBinding, } from './acquisition';
 export { createAcquisitionConnectionLifecycle } from './acquisition-lifecycle';
 export type { AcquisitionConnectionLifecycle, AcquisitionConnectionLifecycleOptions, } from './acquisition-lifecycle';
-export type { DirectArtifactConnectionOptions, FlowersecConnectionConfig, ProxyRuntimeTunnelConnectionOptions, TunnelArtifactConnectionOptions, } from './connection';
-export { createArtifactDirectConnectionConfig, createArtifactTunnelConnectionConfig, createProxyRuntimeTunnelConnectionConfig, } from './connection';
+export type { DirectArtifactConnectionOptions, FlowersecConnectionConfig, PrivateLoopbackDirectConnectionOptions, ProxyRuntimeTunnelConnectionOptions, TunnelArtifactConnectionOptions, } from './connection';
+export { createArtifactDirectConnectionConfig, createArtifactTunnelConnectionConfig, createPrivateLoopbackDirectConnectionConfig, createProxyRuntimeTunnelConnectionConfig, } from './connection';
 export type { FetchServerSentEventsOptions, ServerSentEvent, ServerSentEventStreamErrorCode, } from './server-sent-events';
-export { fetchServerSentEvents, ServerSentEventStreamError, } from './server-sent-events';
+export { fetchServerSentEvents, ServerSentEventStreamError } from './server-sent-events';
 export { closeProxyBootstrap, createProxyBootstrapOwner, ProxyBootstrapOwner, synchronizeProxyBootstrap, } from './proxy-bootstrap';
 export type { ControllerBridgeProxyBootstrapContext, ProxyBootstrapBinding, ProxyBootstrapOwnerOptions, ProxyBootstrapSnapshot, ServiceWorkerProxyBootstrapContext, } from './proxy-bootstrap';
 export type { ScopeEnvelope, ScopeResolver, ScopeResolverMap, ValidatedCriticalScopeProjection, } from './scope';

package/dist/index.js

@@ -1,43 +1,46 @@
 import { clearLocationHash as r, parseHashParam as t } from "./hash.js";
 import { postMessageToOrigins as i, waitForMessage as a } from "./messaging.js";
-import { getSessionStorage as c, removeSessionStorage as S, setSessionStorage as p } from "./storage.js";
-import { ControlplaneRequestError as f, classifyControlplaneFailure as m, createControlplaneArtifactSource as x } from "./artifact-source.js";
-import { AcquisitionError as C, ConnectedAcquisition as E, IsolatedOneShotAcquisition as O, clearAcquisitionSource as y, connectIsolatedOneShot as A, materializeIsolatedOneShot as P, synchronizeAcquisitionSourceSnapshot as g } from "./acquisition.js";
-import { createAcquisitionConnectionLifecycle as h } from "./acquisition-lifecycle.js";
-import { createArtifactDirectConnectionConfig as v, createArtifactTunnelConnectionConfig as B, createProxyRuntimeTunnelConnectionConfig as T } from "./connection.js";
-import { ServerSentEventStreamError as d, fetchServerSentEvents as I } from "./server-sent-events.js";
-import { ProxyBootstrapOwner as M, closeProxyBootstrap as w, createProxyBootstrapOwner as z, synchronizeProxyBootstrap as F } from "./proxy-bootstrap.js";
-import { FLOWERSEC_BOOTSTRAP_SCOPE_RESOLVERS as N, PROXY_RUNTIME_SCOPE_NAME as D, createBootstrapScopeResolvers as U, validateProxyRuntimeScopeEntry as V } from "./scope.js";
+import { getSessionStorage as s, removeSessionStorage as S, setSessionStorage as p } from "./storage.js";
+import { ControlplaneRequestError as f, classifyControlplaneFailure as u, createControlplaneArtifactSource as m, createPrivateLoopbackControlplaneArtifactSource as C } from "./artifact-source.js";
+import { AcquisitionError as E, ConnectedAcquisition as P, IsolatedOneShotAcquisition as A, clearAcquisitionSource as O, connectIsolatedOneShot as g, materializeIsolatedOneShot as y, materializePrivateLoopbackAcquisitionForSource as v, synchronizeAcquisitionSourceSnapshot as R } from "./acquisition.js";
+import { createAcquisitionConnectionLifecycle as q } from "./acquisition-lifecycle.js";
+import { createArtifactDirectConnectionConfig as B, createArtifactTunnelConnectionConfig as T, createPrivateLoopbackDirectConnectionConfig as _, createProxyRuntimeTunnelConnectionConfig as d } from "./connection.js";
+import { ServerSentEventStreamError as F, fetchServerSentEvents as I } from "./server-sent-events.js";
+import { ProxyBootstrapOwner as b, closeProxyBootstrap as k, createProxyBootstrapOwner as w, synchronizeProxyBootstrap as D } from "./proxy-bootstrap.js";
+import { FLOWERSEC_BOOTSTRAP_SCOPE_RESOLVERS as N, PROXY_RUNTIME_SCOPE_NAME as U, createBootstrapScopeResolvers as V, validateProxyRuntimeScopeEntry as W } from "./scope.js";
 export {
-  C as AcquisitionError,
-  E as ConnectedAcquisition,
+  E as AcquisitionError,
+  P as ConnectedAcquisition,
   f as ControlplaneRequestError,
   N as FLOWERSEC_BOOTSTRAP_SCOPE_RESOLVERS,
-  O as IsolatedOneShotAcquisition,
-  D as PROXY_RUNTIME_SCOPE_NAME,
-  M as ProxyBootstrapOwner,
-  d as ServerSentEventStreamError,
-  m as classifyControlplaneFailure,
-  y as clearAcquisitionSource,
+  A as IsolatedOneShotAcquisition,
+  U as PROXY_RUNTIME_SCOPE_NAME,
+  b as ProxyBootstrapOwner,
+  F as ServerSentEventStreamError,
+  u as classifyControlplaneFailure,
+  O as clearAcquisitionSource,
   r as clearLocationHash,
-  w as closeProxyBootstrap,
-  A as connectIsolatedOneShot,
-  h as createAcquisitionConnectionLifecycle,
-  v as createArtifactDirectConnectionConfig,
-  B as createArtifactTunnelConnectionConfig,
-  U as createBootstrapScopeResolvers,
-  x as createControlplaneArtifactSource,
-  z as createProxyBootstrapOwner,
-  T as createProxyRuntimeTunnelConnectionConfig,
+  k as closeProxyBootstrap,
+  g as connectIsolatedOneShot,
+  q as createAcquisitionConnectionLifecycle,
+  B as createArtifactDirectConnectionConfig,
+  T as createArtifactTunnelConnectionConfig,
+  V as createBootstrapScopeResolvers,
+  m as createControlplaneArtifactSource,
+  C as createPrivateLoopbackControlplaneArtifactSource,
+  _ as createPrivateLoopbackDirectConnectionConfig,
+  w as createProxyBootstrapOwner,
+  d as createProxyRuntimeTunnelConnectionConfig,
   I as fetchServerSentEvents,
-  c as getSessionStorage,
-  P as materializeIsolatedOneShot,
+  s as getSessionStorage,
+  y as materializeIsolatedOneShot,
+  v as materializePrivateLoopbackAcquisitionForSource,
   t as parseHashParam,
   i as postMessageToOrigins,
   S as removeSessionStorage,
   p as setSessionStorage,
-  g as synchronizeAcquisitionSourceSnapshot,
-  F as synchronizeProxyBootstrap,
-  V as validateProxyRuntimeScopeEntry,
+  R as synchronizeAcquisitionSourceSnapshot,
+  D as synchronizeProxyBootstrap,
+  W as validateProxyRuntimeScopeEntry,
   a as waitForMessage
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/floe-webapp-boot",
-  "version": "0.44.1",
+  "version": "0.45.0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -35,7 +35,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@floegence/flowersec-core": "3.1.1"
+    "@floegence/flowersec-core": "3.2.0"
   },
   "devDependencies": {
     "typescript": "^5.9.3",