@floegence/floe-webapp-boot 0.62.0 → 0.64.0

package/dist/acquisition-lifecycle.d.ts

@@ -1,7 +1,10 @@
+import type { FetchServerSentEventsOptions, ServerSentEvent } from './server-sent-events';
 import type { ConnectionSnapshot } from '@floegence/flowersec-core';
 import { type AcquisitionSource, ConnectedAcquisition } from './acquisition';
 import { ProxyBootstrapOwner } from './proxy-bootstrap';
 export interface AcquisitionConnectionLifecycle {
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    events(input: RequestInfo | URL, options?: Omit<FetchServerSentEventsOptions, 'fetch'>): AsyncGenerator<ServerSentEvent>;
     synchronize(snapshot: ConnectionSnapshot): void;
     dispose(): void;
 }

package/dist/acquisition-lifecycle.js

@@ -1,22 +1,24 @@
-import { createSessionHealthMonitor as l } from "./session-health.js";
-import { clearAcquisitionSource as u, AcquisitionError as s, synchronizeAcquisitionSourceSnapshot as a } from "./acquisition.js";
-import { closeProxyBootstrap as f, synchronizeProxyBootstrap as d } from "./proxy-bootstrap.js";
-function m(n, e = {}) {
-  let t = !1, r = null;
-  const c = l();
+import { createSessionHealthMonitor as u } from "./session-health.js";
+import { clearAcquisitionSource as a, AcquisitionError as l, synchronizeAcquisitionSourceSnapshot as f } from "./acquisition.js";
+import { createProxyBootstrapOwner as p, closeProxyBootstrap as y, synchronizeProxyBootstrap as d, readProxyBootstrapEvents as h, fetchProxyBootstrap as x } from "./proxy-bootstrap.js";
+function w(i, c = {}) {
+  let n = !1, r = null;
+  const s = u(), t = c.proxyBootstrap ?? p();
   return Object.freeze({
-    synchronize(i) {
-      if (t) throw new s("acquisition_lifecycle_disposed");
-      const o = a(n, i);
-      if (i.state === "connected" && o === null)
-        throw new s("connected_acquisition_missing");
-      e.proxyBootstrap !== void 0 && d(e.proxyBootstrap, o), o !== null && o !== r && e.onConnected?.(o), r = o, c.synchronize(i.state === "connected" ? i.currentSession ?? null : null);
+    fetch: (e, o) => x(t, e, o),
+    events: (e, o) => h(t, e, o),
+    synchronize(e) {
+      if (n) throw new l("acquisition_lifecycle_disposed");
+      const o = f(i, e);
+      if (e.state === "connected" && o === null)
+        throw new l("connected_acquisition_missing");
+      d(t, o), o !== null && o !== r && c.onConnected?.(o), r = o, s.synchronize(e.state === "connected" ? e.currentSession ?? null : null);
     },
     dispose() {
-      t || (t = !0, r = null, c.dispose(), e.proxyBootstrap !== void 0 && f(e.proxyBootstrap), u(n));
+      n || (n = !0, r = null, s.dispose(), y(t), a(i));
     }
   });
 }
 export {
-  m as createAcquisitionConnectionLifecycle
+  w as createAcquisitionConnectionLifecycle
 };

package/dist/acquisition.d.ts

@@ -75,6 +75,7 @@ export type ConnectedAcquisitionDetails = Readonly<{
     session: Session;
     scope: ProxyRuntimeScope;
     bindingIdentity: string;
+    appOrigin: string;
     attempt: number;
 }>;
 type MaterializeOptions = Readonly<{

package/dist/acquisition.js

@@ -1,10 +1,10 @@
 import { sha256 as x } from "@noble/hashes/sha2.js";
-import { createArtifactLease as A, parseArtifact as E } from "@floegence/flowersec-core";
+import { createArtifactLease as S, parseArtifact as E } from "@floegence/flowersec-core";
 import { assertProxyRuntimeScope as C } from "@floegence/flowersec-core/proxy";
-const j = 32, L = 16384, H = "#redeven=";
+const A = 32, L = 16384, H = "#redeven=";
 class r extends Error {
-  constructor(t) {
-    super(`Floe acquisition failed (code=${t})`), this.code = t, this.name = "AcquisitionError";
+  constructor(i) {
+    super(`Floe acquisition failed (code=${i})`), this.code = i, this.name = "AcquisitionError";
   }
 }
 class w {
@@ -15,8 +15,8 @@ class w {
   static create() {
     return new w();
   }
-  static assertAuthentic(t) {
-    t.#e;
+  static assertAuthentic(i) {
+    i.#e;
   }
 }
 class v {
@@ -27,46 +27,46 @@ class v {
   static create() {
     return new v();
   }
-  static assertAuthentic(t) {
-    t.#e;
+  static assertAuthentic(i) {
+    i.#e;
   }
 }
-const g = /* @__PURE__ */ new WeakMap(), O = /* @__PURE__ */ new WeakMap(), P = /* @__PURE__ */ new WeakMap(), D = /* @__PURE__ */ new Set();
+const g = /* @__PURE__ */ new WeakMap(), j = /* @__PURE__ */ new WeakMap(), P = /* @__PURE__ */ new WeakMap(), D = /* @__PURE__ */ new Set();
 function ee(e) {
   if (g.has(e)) throw new r("duplicate_acquisition_source");
   g.set(e, { pending: [] });
 }
-async function te(e, t, i) {
-  return q(e, t, i, E, A);
+async function te(e, i, t) {
+  return q(e, i, t, E, S);
 }
-async function ie(e, t, i) {
+async function ie(e, i, t) {
   const n = await import("@floegence/flowersec-core/browser");
   return q(
     e,
-    t,
     i,
+    t,
     n.parsePrivateLoopbackArtifactV1,
     n.createPrivateLoopbackArtifactLeaseV1
   );
 }
-async function ne(e, t, i) {
+async function ne(e, i, t) {
   const n = await import("@floegence/flowersec-core/browser");
   return q(
     e,
-    t,
     i,
+    t,
     n.parseHTTPDirectArtifactV1,
     n.createHTTPDirectArtifactLeaseV1
   );
 }
-async function q(e, t, i, n, c) {
+async function q(e, i, t, n, c) {
   const o = g.get(e);
   if (o === void 0) throw new r("invalid_acquisition_source");
-  const a = await R(t, i, n);
+  const a = await R(i, t, n);
   return B(
     a,
     c,
-    i.commitSpend,
+    t.commitSpend,
     (d) => {
       o.pending.push(d);
     },
@@ -75,41 +75,42 @@ async function q(e, t, i, n, c) {
     }
   );
 }
-function re(e, t) {
-  const i = g.get(e);
-  if (i === void 0) return null;
-  if (t.state !== "connected" || t.currentSession === void 0)
-    return (t.state === "idle" || t.state === "waiting" || t.state === "failed" || t.state === "closed") && (i.pending = [], i.connected = void 0, i.connectedSession = void 0), null;
-  if (i.connected !== void 0 && i.connectedSession === t.currentSession)
-    return i.connected;
-  const n = i.pending.filter((a) => a.committed);
-  if (n.length !== 1 || i.pending.length !== 1)
-    throw i.pending = [], new r("connected_acquisition_mismatch");
+function re(e, i) {
+  const t = g.get(e);
+  if (t === void 0) return null;
+  if (i.state !== "connected" || i.currentSession === void 0)
+    return (i.state === "idle" || i.state === "waiting" || i.state === "failed" || i.state === "closed") && (t.pending = [], t.connected = void 0, t.connectedSession = void 0), null;
+  if (t.connected !== void 0 && t.connectedSession === i.currentSession)
+    return t.connected;
+  const n = t.pending.filter((a) => a.committed);
+  if (n.length !== 1 || t.pending.length !== 1)
+    throw t.pending = [], new r("connected_acquisition_mismatch");
   const c = n[0];
   if (c === void 0) throw new r("connected_acquisition_mismatch");
   const o = w.create();
-  return O.set(
+  return j.set(
     o,
     Object.freeze({
-      session: t.currentSession,
+      session: i.currentSession,
       scope: c.scope,
       bindingIdentity: c.bindingIdentity,
-      attempt: t.attempt
+      appOrigin: c.appOrigin,
+      attempt: i.attempt
     })
-  ), i.pending = [], i.connected = o, i.connectedSession = t.currentSession, o;
+  ), t.pending = [], t.connected = o, t.connectedSession = i.currentSession, o;
 }
 function oe(e) {
-  const t = g.get(e);
-  t !== void 0 && (t.pending = [], t.connected = void 0, t.connectedSession = void 0);
+  const i = g.get(e);
+  i !== void 0 && (i.pending = [], i.connected = void 0, i.connectedSession = void 0);
 }
 function ce(e) {
   w.assertAuthentic(e);
-  const t = O.get(e);
-  if (t === void 0) throw new r("invalid_connected_acquisition");
-  return t;
+  const i = j.get(e);
+  if (i === void 0) throw new r("invalid_connected_acquisition");
+  return i;
 }
 async function ae(e) {
-  const t = e.rawHandoff, i = typeof t != "string" || V(`${H}${t}`) > L;
+  const i = e.rawHandoff, t = typeof i != "string" || V(`${H}${i}`) > L;
   let n = !1;
   try {
     n = e.clearSensitiveLocation() === !0;
@@ -118,8 +119,8 @@ async function ae(e) {
   }
   if (!n)
     throw e.navigateToLauncher(), new r("isolated_location_clear_failed");
-  if (i) throw new r("isolated_handoff_too_large");
-  const c = m(t, "invalid_isolated_handoff"), o = await G(c);
+  if (t) throw new r("isolated_handoff_too_large");
+  const c = m(i, "invalid_isolated_handoff"), o = await G(c);
   if (D.has(o))
     throw new r("isolated_handoff_consumed");
   D.add(o);
@@ -137,29 +138,29 @@ async function ae(e) {
   let s;
   const l = B(
     d,
-    A,
+    S,
     e.commitSpend,
-    (_) => {
-      s = _;
+    (u) => {
+      s = u;
     },
     () => {
     }
   );
   if (s === void 0 || s.lease !== l)
     throw new r("isolated_materialization_failed");
-  const u = v.create();
-  return P.set(u, { pending: s, state: "ready" }), u;
+  const p = v.create();
+  return P.set(p, { pending: s, state: "ready" }), p;
 }
-async function F(e, t, i) {
-  const n = J(e, t), c = await R(
+async function F(e, i, t) {
+  const n = J(e, i), c = await R(
     n.acquisition,
     {
-      commitSpend: i,
+      commitSpend: t,
       expectedConsumer: "isolated",
       validateSpendBinding: (o) => {
-        M(n, o, t);
+        M(n, o, i);
         try {
-          t.validateTargetBinding(o.targetBinding);
+          i.validateTargetBinding(o.targetBinding);
         } catch {
           throw new r("invalid_spend_binding");
         }
@@ -177,11 +178,11 @@ async function F(e, t, i) {
   }
   return c;
 }
-async function se(e, t, i) {
+async function se(e, i, t) {
   const n = g.get(e);
   if (n === void 0) throw new r("invalid_acquisition_source");
   const c = h(
-    t,
+    i,
     ["v", "runtime_origin", "runtime_handoff_b64u"],
     "invalid_isolated_handoff"
   ), o = c.runtime_handoff_b64u;
@@ -195,51 +196,52 @@ async function se(e, t, i) {
     throw new r("invalid_isolated_handoff");
   }
   const s = d, l = {
-    ...i.context,
+    ...t.context,
     runtimeOrigin: f(c.runtime_origin),
     appOrigin: f(s?.app_origin)
-  }, u = await F(
+  }, p = await F(
     d,
     l,
-    i.commitSpend
-  ), _ = s?.acquisition;
-  if (!_) throw new r("invalid_isolated_handoff");
-  return i.validateSpendBinding($(_.spend_scope)), B(
-    u,
-    A,
-    i.commitSpend,
-    (p) => n.pending.push(p),
-    (p) => {
-      n.pending = n.pending.filter((y) => y !== p);
+    t.commitSpend
+  ), u = s?.acquisition;
+  if (!u) throw new r("invalid_isolated_handoff");
+  return t.validateSpendBinding($(u.spend_scope)), B(
+    p,
+    S,
+    t.commitSpend,
+    (_) => n.pending.push(_),
+    (_) => {
+      n.pending = n.pending.filter((y) => y !== _);
     }
   );
 }
-async function de(e, t = {}) {
+async function de(e, i = {}) {
   v.assertAuthentic(e);
-  const i = P.get(e);
-  if (i === void 0 || i.state !== "ready")
+  const t = P.get(e);
+  if (t === void 0 || t.state !== "ready")
     throw new r("isolated_acquisition_consumed");
-  i.state = "connecting";
+  t.state = "connecting";
   try {
-    const { connect: n } = await import("@floegence/flowersec-core/browser"), c = await n(i.pending.lease, t);
-    if (!i.pending.committed)
+    const { connect: n } = await import("@floegence/flowersec-core/browser"), c = await n(t.pending.lease, i);
+    if (!t.pending.committed)
       throw await c.close().catch(() => {
       }), new r("isolated_spend_not_committed");
     const o = w.create();
-    return O.set(
+    return j.set(
       o,
       Object.freeze({
         session: c,
-        scope: i.pending.scope,
-        bindingIdentity: i.pending.bindingIdentity,
+        scope: t.pending.scope,
+        bindingIdentity: t.pending.bindingIdentity,
+        appOrigin: t.pending.appOrigin,
         attempt: 1
       })
-    ), i.state = "consumed", o;
+    ), t.state = "consumed", o;
   } catch (n) {
-    throw i.state = "consumed", n;
+    throw t.state = "consumed", n;
   }
 }
-async function R(e, t, i) {
+async function R(e, i, t) {
   const n = h(
     e,
     ["v", "connect_artifact", "critical_scope_projection_json", "spend_scope"],
@@ -247,7 +249,7 @@ async function R(e, t, i) {
   );
   if (n.v !== 1 || typeof n.connect_artifact != "string" || n.connect_artifact.length === 0 || typeof n.critical_scope_projection_json != "string" || n.critical_scope_projection_json.length === 0)
     throw new r("invalid_acquisition_envelope");
-  const c = U(n.spend_scope, t.expectedConsumer), o = new TextEncoder().encode(n.connect_artifact), a = new TextEncoder().encode(n.critical_scope_projection_json);
+  const c = U(n.spend_scope, i.expectedConsumer), o = new TextEncoder().encode(n.connect_artifact), a = new TextEncoder().encode(n.critical_scope_projection_json);
   await I(o, c.artifact_digest_b64u, "artifact_digest_mismatch"), await I(
     a,
     c.projection_digest_b64u,
@@ -272,27 +274,27 @@ async function R(e, t, i) {
   } catch {
     throw new r("invalid_proxy_runtime_scope");
   }
-  let u;
+  let p;
   try {
-    u = i(n.connect_artifact);
+    p = t(n.connect_artifact);
   } catch {
     throw new r("invalid_connect_artifact");
   }
-  const _ = $(c), p = t.validateSpendBinding(_);
-  if (p !== void 0 && (typeof p != "string" || p.trim() === "" || p !== p.trim()))
+  const u = $(c), _ = i.validateSpendBinding(u);
+  if (_ !== void 0 && (typeof _ != "string" || _.trim() === "" || _ !== _.trim()))
     throw new r("invalid_spend_binding_identity");
   return Object.freeze({
-    artifact: u,
+    artifact: p,
     scope: l,
-    binding: _,
-    bindingIdentity: p ?? `${_.artifactDigestB64u}.${_.projectionDigestB64u}`,
+    binding: u,
+    bindingIdentity: _ ?? `${u.artifactDigestB64u}.${u.projectionDigestB64u}`,
     receipt: c.receipt
   });
 }
-function B(e, t, i, n, c) {
+function B(e, i, t, n, c) {
   const o = e.artifact, a = e.scope, d = e.binding, s = e.bindingIdentity;
-  let l = e.receipt, u;
-  const _ = t(o, async (p) => {
+  let l = e.receipt, p;
+  const u = i(o, async (_) => {
     const y = l;
     if (l = void 0, y === void 0) throw new r("spend_binding_consumed");
     const k = Object.freeze({
@@ -301,15 +303,15 @@ function B(e, t, i, n, c) {
       receipt: y
     });
     try {
-      await i(k, p), u.committed = !0;
+      await t(k, _), p.committed = !0;
     } catch (N) {
-      throw c(u), N;
+      throw c(p), N;
     }
   });
-  return u = { lease: _, scope: a, bindingIdentity: s, committed: !1 }, n(u), _;
+  return p = { lease: u, scope: a, bindingIdentity: s, appOrigin: d.appOrigin, committed: !1 }, n(p), u;
 }
-function U(e, t) {
-  const i = h(
+function U(e, i) {
+  const t = h(
     e,
     [
       "v",
@@ -325,21 +327,21 @@ function U(e, t) {
     ],
     "invalid_spend_scope"
   );
-  if (i.v !== 1 || typeof i.receipt != "string" || !Z(i.receipt) || typeof i.artifact_digest_b64u != "string" || !T(i.artifact_digest_b64u) || typeof i.projection_digest_b64u != "string" || !T(i.projection_digest_b64u) || i.consumer !== t || typeof i.expires_at != "string" || !W(i.expires_at) || !b(i.target_binding))
+  if (t.v !== 1 || typeof t.receipt != "string" || !Z(t.receipt) || typeof t.artifact_digest_b64u != "string" || !T(t.artifact_digest_b64u) || typeof t.projection_digest_b64u != "string" || !T(t.projection_digest_b64u) || t.consumer !== i || typeof t.expires_at != "string" || !W(t.expires_at) || !b(t.target_binding))
     throw new r("invalid_spend_scope");
-  const n = f(i.launcher_origin), c = f(i.runtime_origin), o = f(i.app_origin);
-  if (Date.parse(i.expires_at) <= Date.now()) throw new r("expired_spend_scope");
+  const n = f(t.launcher_origin), c = f(t.runtime_origin), o = f(t.app_origin);
+  if (Date.parse(t.expires_at) <= Date.now()) throw new r("expired_spend_scope");
   return Object.freeze({
     v: 1,
-    receipt: i.receipt,
-    artifact_digest_b64u: i.artifact_digest_b64u,
-    projection_digest_b64u: i.projection_digest_b64u,
+    receipt: t.receipt,
+    artifact_digest_b64u: t.artifact_digest_b64u,
+    projection_digest_b64u: t.projection_digest_b64u,
     launcher_origin: n,
     runtime_origin: c,
     app_origin: o,
-    consumer: t,
-    target_binding: S(i.target_binding),
-    expires_at: i.expires_at
+    consumer: i,
+    target_binding: O(t.target_binding),
+    expires_at: t.expires_at
   });
 }
 function $(e) {
@@ -354,8 +356,8 @@ function $(e) {
     expiresAt: e.expires_at
   });
 }
-function J(e, t) {
-  const i = h(
+function J(e, i) {
+  const t = h(
     e,
     [
       "v",
@@ -372,46 +374,46 @@ function J(e, t) {
     ],
     "invalid_isolated_handoff"
   );
-  if (i.v !== 6 || i.env_public_id !== t.envPublicId || i.floe_app !== t.floeApp || i.code_space_id !== t.codeSpaceId || i.app_path !== t.appPath || i.launcher_kind !== t.launcherKind || i.launcher_id !== t.launcherId || i.launcher_origin !== t.launcherOrigin || i.runtime_origin !== t.runtimeOrigin || i.app_origin !== t.appOrigin)
+  if (t.v !== 6 || t.env_public_id !== i.envPublicId || t.floe_app !== i.floeApp || t.code_space_id !== i.codeSpaceId || t.app_path !== i.appPath || t.launcher_kind !== i.launcherKind || t.launcher_id !== i.launcherId || t.launcher_origin !== i.launcherOrigin || t.runtime_origin !== i.runtimeOrigin || t.app_origin !== i.appOrigin)
     throw new r("isolated_context_mismatch");
-  return f(i.launcher_origin), f(i.runtime_origin), f(i.app_origin), i;
+  return f(t.launcher_origin), f(t.runtime_origin), f(t.app_origin), t;
 }
-function M(e, t, i) {
-  if (t.consumer !== "isolated" || t.launcherOrigin !== e.launcher_origin || t.runtimeOrigin !== e.runtime_origin || t.appOrigin !== e.app_origin || e.runtime_origin !== i.runtimeOrigin || e.app_origin !== i.appOrigin)
+function M(e, i, t) {
+  if (i.consumer !== "isolated" || i.launcherOrigin !== e.launcher_origin || i.runtimeOrigin !== e.runtime_origin || i.appOrigin !== e.app_origin || e.runtime_origin !== t.runtimeOrigin || e.app_origin !== t.appOrigin)
     throw new r("isolated_spend_binding_mismatch");
 }
-function h(e, t, i) {
+function h(e, i, t) {
   if (e === null || typeof e != "object" || Array.isArray(e))
-    throw new r(i);
-  const n = e, c = new Set(t), o = Object.keys(n);
-  if (o.length !== t.length || o.some((a) => !c.has(a)))
-    throw new r(i);
+    throw new r(t);
+  const n = e, c = new Set(i), o = Object.keys(n);
+  if (o.length !== i.length || o.some((a) => !c.has(a)))
+    throw new r(t);
   return n;
 }
 function f(e) {
   if (typeof e != "string") throw new r("invalid_spend_scope");
-  let t;
+  let i;
   try {
-    t = new URL(e);
+    i = new URL(e);
   } catch {
     throw new r("invalid_spend_scope");
   }
-  if (t.protocol !== "https:" && t.protocol !== "http:" || t.origin !== e || t.username !== "" || t.password !== "")
+  if (i.protocol !== "https:" && i.protocol !== "http:" || i.origin !== e || i.username !== "" || i.password !== "")
     throw new r("invalid_spend_scope");
   return e;
 }
 function Z(e) {
-  const t = /^r1\.([A-Za-z0-9_-]{1,64})\.([A-Za-z0-9_-]+)$/u.exec(e);
-  if (t === null || t[2] === void 0) return !1;
+  const i = /^r1\.([A-Za-z0-9_-]{1,64})\.([A-Za-z0-9_-]+)$/u.exec(e);
+  if (i === null || i[2] === void 0) return !1;
   try {
-    return m(t[2], "invalid_spend_scope").length === j;
+    return m(i[2], "invalid_spend_scope").length === A;
   } catch {
     return !1;
   }
 }
 function T(e) {
   try {
-    return m(e, "invalid_spend_scope").length === j;
+    return m(e, "invalid_spend_scope").length === A;
   } catch {
     return !1;
   }
@@ -419,29 +421,29 @@ function T(e) {
 function W(e) {
   return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/u.test(e) ? Number.isFinite(Date.parse(e)) : !1;
 }
-function b(e, t = 0) {
-  return t > 32 ? !1 : e === null || typeof e == "string" || typeof e == "boolean" ? !0 : typeof e == "number" ? Number.isFinite(e) : Array.isArray(e) ? e.every((i) => b(i, t + 1)) : typeof e != "object" ? !1 : Object.values(e).every(
-    (i) => b(i, t + 1)
+function b(e, i = 0) {
+  return i > 32 ? !1 : e === null || typeof e == "string" || typeof e == "boolean" ? !0 : typeof e == "number" ? Number.isFinite(e) : Array.isArray(e) ? e.every((t) => b(t, i + 1)) : typeof e != "object" ? !1 : Object.values(e).every(
+    (t) => b(t, i + 1)
   );
 }
-function S(e) {
+function O(e) {
   if (Array.isArray(e)) {
-    for (const t of e) S(t);
+    for (const i of e) O(i);
     return Object.freeze(e);
   }
   if (e !== null && typeof e == "object") {
-    for (const t of Object.values(e)) S(t);
+    for (const i of Object.values(e)) O(i);
     return Object.freeze(e);
   }
   return e;
 }
-async function I(e, t, i) {
-  const n = await x(e), c = m(t, i);
-  if (n.length !== c.length) throw new r(i);
+async function I(e, i, t) {
+  const n = await x(e), c = m(i, t);
+  if (n.length !== c.length) throw new r(t);
   let o = 0;
   for (let a = 0; a < n.length; a += 1)
     o |= n[a] ^ c[a];
-  if (o !== 0) throw new r(i);
+  if (o !== 0) throw new r(t);
 }
 async function G(e) {
   return z(await x(e));
@@ -449,25 +451,25 @@ async function G(e) {
 function X() {
   if (globalThis.crypto?.getRandomValues === void 0)
     throw new r("acquisition_entropy_unavailable");
-  return z(globalThis.crypto.getRandomValues(new Uint8Array(j)));
+  return z(globalThis.crypto.getRandomValues(new Uint8Array(A)));
 }
-function m(e, t) {
-  if (!/^[A-Za-z0-9_-]*$/u.test(e) || e.length % 4 === 1) throw new r(t);
-  const i = e.replace(/-/gu, "+").replace(/_/gu, "/") + "=".repeat((4 - e.length % 4) % 4);
+function m(e, i) {
+  if (!/^[A-Za-z0-9_-]*$/u.test(e) || e.length % 4 === 1) throw new r(i);
+  const t = e.replace(/-/gu, "+").replace(/_/gu, "/") + "=".repeat((4 - e.length % 4) % 4);
   let n;
   try {
-    n = atob(i);
+    n = atob(t);
   } catch {
-    throw new r(t);
+    throw new r(i);
   }
   const c = Uint8Array.from(n, (o) => o.charCodeAt(0));
-  if (z(c) !== e) throw new r(t);
+  if (z(c) !== e) throw new r(i);
   return c;
 }
 function z(e) {
-  let t = "";
-  for (const i of e) t += String.fromCharCode(i);
-  return btoa(t).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
+  let i = "";
+  for (const t of e) i += String.fromCharCode(t);
+  return btoa(i).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
 }
 function V(e) {
   return new TextEncoder().encode(e).length;

package/dist/proxy-bootstrap.d.ts

@@ -1,3 +1,4 @@
+import { type FetchServerSentEventsOptions, type ServerSentEvent } from './server-sent-events';
 import { type ProxyRuntime } from '@floegence/flowersec-core/proxy';
 import { ConnectedAcquisition } from './acquisition';
 export type ProxyBootstrapBinding = Readonly<{
@@ -25,7 +26,7 @@ export type ProxyBootstrapOwnerOptions = Readonly<{
 }>;
 export type ProxyBootstrapSnapshot = Readonly<{
     generation: number;
-    mode: 'service_worker' | 'controller_bridge';
+    mode: 'session' | 'service_worker' | 'controller_bridge';
     bindingIdentity: string;
 }>;
 export declare class ProxyBootstrapOwner {
@@ -34,6 +35,8 @@ export declare class ProxyBootstrapOwner {
     static create(): ProxyBootstrapOwner;
     static assertAuthentic(value: ProxyBootstrapOwner): void;
 }
-export declare function createProxyBootstrapOwner(options: ProxyBootstrapOwnerOptions): ProxyBootstrapOwner;
+export declare function createProxyBootstrapOwner(options?: ProxyBootstrapOwnerOptions): ProxyBootstrapOwner;
 export declare function synchronizeProxyBootstrap(owner: ProxyBootstrapOwner, acquisition: ConnectedAcquisition | null): ProxyBootstrapSnapshot | null;
+export declare function fetchProxyBootstrap(owner: ProxyBootstrapOwner, input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+export declare function readProxyBootstrapEvents(owner: ProxyBootstrapOwner, input: RequestInfo | URL, options?: Omit<FetchServerSentEventsOptions, 'fetch'>): AsyncGenerator<ServerSentEvent>;
 export declare function closeProxyBootstrap(owner: ProxyBootstrapOwner): void;

package/dist/proxy-bootstrap.js

@@ -1,101 +1,133 @@
-import { createProxyRuntime as f } from "@floegence/flowersec-core/proxy";
-import { connectedAcquisitionDetails as y, AcquisitionError as s } from "./acquisition.js";
-class d {
+import { ServerSentEventStreamError as f, fetchServerSentEvents as b } from "./server-sent-events.js";
+import { createProxyRuntime as w } from "@floegence/flowersec-core/proxy";
+import { connectedAcquisitionDetails as y, AcquisitionError as a } from "./acquisition.js";
+class l {
   #e = void 0;
   constructor() {
     Object.freeze(this);
   }
   static create() {
-    return new d();
+    return new l();
   }
   static assertAuthentic(t) {
     t.#e;
   }
 }
-const b = /* @__PURE__ */ new WeakMap();
-function P(e) {
-  const t = d.create();
-  return b.set(t, { options: e, generation: 0 }), t;
+const v = /* @__PURE__ */ new WeakMap();
+function B(r) {
+  const t = l.create();
+  return v.set(t, { options: r, generation: 0 }), t;
 }
-function m(e, t) {
-  const o = h(e);
+function _(r, t) {
+  const e = h(r);
   if (t === null)
-    return l(o), null;
-  if (o.acquisition === t && o.snapshot !== void 0) return o.snapshot;
+    return u(e), null;
+  if (e.acquisition === t && e.snapshot !== void 0) return e.snapshot;
   const n = y(t);
-  l(o);
-  const c = o.generation + 1;
-  o.generation = c;
-  const r = n.scope, p = f({
+  u(e);
+  const i = e.generation + 1;
+  e.generation = i;
+  const o = n.scope, c = w({
     session: n.session,
-    ...r.limits ?? {},
-    ...r.http?.extraRequestHeaders === void 0 ? {} : { extraRequestHeaders: r.http.extraRequestHeaders },
-    ...r.appBasePath === void 0 ? {} : { pathPolicy: {
-      allowedPathPrefixes: Object.freeze([r.appBasePath, ...r.http?.additionalPathPrefixes ?? []]),
-      allowedWebSocketPathPrefixes: Object.freeze([r.appBasePath])
+    externalOrigin: n.appOrigin,
+    ...o.limits ?? {},
+    ...o.http?.extraRequestHeaders === void 0 ? {} : { extraRequestHeaders: o.http.extraRequestHeaders },
+    ...o.appBasePath === void 0 ? {} : { pathPolicy: {
+      allowedPathPrefixes: Object.freeze([o.appBasePath, ...o.http?.additionalPathPrefixes ?? []]),
+      allowedWebSocketPathPrefixes: Object.freeze([o.appBasePath])
     } }
   });
   try {
-    let i;
-    if (r.mode === "service_worker") {
-      const a = o.options.serviceWorker;
-      if (a === void 0) throw new s("service_worker_bootstrap_unavailable");
-      i = a(Object.freeze({
-        runtime: p,
-        generation: c,
-        bindingIdentity: n.bindingIdentity,
-        scriptUrl: r.serviceWorker.scriptUrl,
-        serviceWorkerScope: r.serviceWorker.scope,
-        ...r.appBasePath === void 0 ? {} : { appBasePath: r.appBasePath }
-      }));
-    } else {
-      const a = o.options.controllerBridge;
-      if (a === void 0) throw new s("controller_bridge_bootstrap_unavailable");
-      i = a(Object.freeze({
-        runtime: p,
-        generation: c,
-        bindingIdentity: n.bindingIdentity,
-        allowedOrigins: r.controllerBridge.allowedOrigins,
-        ...r.appBasePath === void 0 ? {} : { appBasePath: r.appBasePath },
-        capabilityNonce: g()
-      }));
+    let s;
+    if (e.options !== void 0)
+      if (o.mode === "service_worker") {
+        const d = e.options.serviceWorker;
+        if (d === void 0) throw new a("service_worker_bootstrap_unavailable");
+        s = d(Object.freeze({
+          runtime: c,
+          generation: i,
+          bindingIdentity: n.bindingIdentity,
+          scriptUrl: o.serviceWorker.scriptUrl,
+          serviceWorkerScope: o.serviceWorker.scope,
+          ...o.appBasePath === void 0 ? {} : { appBasePath: o.appBasePath }
+        }));
+      } else {
+        const d = e.options.controllerBridge;
+        if (d === void 0) throw new a("controller_bridge_bootstrap_unavailable");
+        s = d(Object.freeze({
+          runtime: c,
+          generation: i,
+          bindingIdentity: n.bindingIdentity,
+          allowedOrigins: o.controllerBridge.allowedOrigins,
+          ...o.appBasePath === void 0 ? {} : { appBasePath: o.appBasePath },
+          capabilityNonce: g()
+        }));
+      }
+    if (e.options !== void 0 && (s === null || typeof s != "object" || typeof s.dispose != "function"))
+      throw new a("invalid_proxy_bootstrap_binding");
+    const p = Object.freeze({ generation: i, mode: e.options === void 0 ? "session" : o.mode, bindingIdentity: n.bindingIdentity });
+    return e.acquisition = t, e.runtime = c, e.binding = s, e.snapshot = p, p;
+  } catch (s) {
+    throw c.dispose(), s;
+  }
+}
+async function O(r, t, e) {
+  const n = h(r), i = n.runtime;
+  if (i === void 0) throw new a("session_http_unavailable");
+  const o = await i.fetch(t, e);
+  if (n.runtime !== i)
+    throw await o.body?.cancel().catch(() => {
+    }), new a("session_http_replaced");
+  return o;
+}
+async function* A(r, t, e = {}) {
+  const n = h(r), i = n.runtime;
+  if (i === void 0) throw new f("transport", "session HTTP is unavailable");
+  e.signal?.throwIfAborted();
+  const o = new Headers(e.headers ?? (t instanceof Request ? t.headers : void 0));
+  o.set("Accept", "text/event-stream");
+  for await (const c of b(t, {
+    ...e,
+    headers: o,
+    fetch: (s, p) => i.fetch(s, p),
+    onActivity: () => {
+      n.runtime === i && !e.signal?.aborted && e.onActivity?.();
     }
-    if (i === null || typeof i != "object" || typeof i.dispose != "function")
-      throw new s("invalid_proxy_bootstrap_binding");
-    const u = Object.freeze({ generation: c, mode: r.mode, bindingIdentity: n.bindingIdentity });
-    return o.acquisition = t, o.runtime = p, o.binding = i, o.snapshot = u, u;
-  } catch (i) {
-    throw p.dispose(), i;
+  })) {
+    if (e.signal?.throwIfAborted(), n.runtime !== i) throw new f("transport", "session HTTP was replaced");
+    yield c;
   }
 }
-function B(e) {
-  l(h(e));
+function S(r) {
+  u(h(r));
 }
-function h(e) {
-  d.assertAuthentic(e);
-  const t = b.get(e);
-  if (t === void 0) throw new s("invalid_proxy_bootstrap_owner");
+function h(r) {
+  l.assertAuthentic(r);
+  const t = v.get(r);
+  if (t === void 0) throw new a("invalid_proxy_bootstrap_owner");
   return t;
 }
-function l(e) {
-  const t = e.binding, o = e.runtime;
-  e.acquisition = void 0, e.binding = void 0, e.runtime = void 0, e.snapshot = void 0;
+function u(r) {
+  const t = r.binding, e = r.runtime;
+  r.acquisition = void 0, r.binding = void 0, r.runtime = void 0, r.snapshot = void 0;
   try {
     t?.dispose();
   } finally {
-    o?.dispose();
+    e?.dispose();
   }
 }
 function g() {
-  if (globalThis.crypto?.getRandomValues === void 0) throw new s("acquisition_entropy_unavailable");
-  const e = globalThis.crypto.getRandomValues(new Uint8Array(32));
+  if (globalThis.crypto?.getRandomValues === void 0) throw new a("acquisition_entropy_unavailable");
+  const r = globalThis.crypto.getRandomValues(new Uint8Array(32));
   let t = "";
-  for (const o of e) t += String.fromCharCode(o);
+  for (const e of r) t += String.fromCharCode(e);
   return btoa(t).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
 }
 export {
-  d as ProxyBootstrapOwner,
-  B as closeProxyBootstrap,
-  P as createProxyBootstrapOwner,
-  m as synchronizeProxyBootstrap
+  l as ProxyBootstrapOwner,
+  S as closeProxyBootstrap,
+  B as createProxyBootstrapOwner,
+  O as fetchProxyBootstrap,
+  A as readProxyBootstrapEvents,
+  _ as synchronizeProxyBootstrap
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/floe-webapp-boot",
-  "version": "0.62.0",
+  "version": "0.64.0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -35,7 +35,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@floegence/flowersec-core": "5.2.2",
+    "@floegence/flowersec-core": "5.3.1",
     "@noble/hashes": "2.4.0"
   },
   "devDependencies": {