@floegence/flowersec-core 0.19.1 → 0.19.3

package/dist/proxy/integration.js

@@ -1,7 +1,7 @@
 import { profileToPresetManifest } from "./profiles.js";
 import { resolveProxyPreset } from "./preset.js";
 import { registerServiceWorkerAndEnsureControl } from "./registerServiceWorker.js";
-import { createProxyRuntime } from "./runtime.js";
+import { createProxyRuntime, ensureServiceWorkerRuntimeRegistered } from "./runtime.js";
 import { createProxyServiceWorkerScript } from "./serviceWorker.js";
 function dedupeStrings(values) {
     const out = [];
@@ -252,6 +252,7 @@ export async function registerProxyIntegration(input) {
         maxRepairAttempts,
         controllerTimeoutMs,
     });
+    await ensureServiceWorkerRuntimeRegistered({ timeoutMs: controllerTimeoutMs });
     if (expectedScriptPathSuffix !== "") {
         const ok = await waitForControllerSuffix(expectedScriptPathSuffix, controllerTimeoutMs);
         if (!ok) {

package/dist/proxy/runtime.d.ts

@@ -7,6 +7,7 @@ type ProxyFetchReq = Readonly<{
     method: string;
     path: string;
     headers: readonly Header[];
+    external_origin?: string;
     body?: ArrayBuffer;
 }>;
 export type ProxyRuntimeLimits = Readonly<{
@@ -39,5 +40,9 @@ export type ProxyRuntimeOptions = Readonly<{
     extraWsHeaders?: readonly string[];
     cookieJar?: CookieJar;
 }>;
+export type EnsureServiceWorkerRuntimeRegisteredOptions = Readonly<{
+    timeoutMs?: number;
+}>;
 export declare function createProxyRuntime(opts: ProxyRuntimeOptions): ProxyRuntime;
+export declare function ensureServiceWorkerRuntimeRegistered(opts?: EnsureServiceWorkerRuntimeRegisteredOptions): Promise<void>;
 export {};

package/dist/proxy/runtime.js

@@ -38,6 +38,27 @@ function normalizeTimeoutMs(timeoutMs) {
         throw new Error("timeout_ms must be >= 0");
     return v;
 }
+function normalizeExternalOrigin(externalOriginRaw) {
+    if (typeof externalOriginRaw !== "string")
+        return undefined;
+    const externalOrigin = externalOriginRaw.trim();
+    if (externalOrigin === "")
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(externalOrigin);
+    }
+    catch {
+        throw new Error("external_origin must be an http(s) origin");
+    }
+    if ((parsed.protocol !== "http:" && parsed.protocol !== "https:") || parsed.host === "") {
+        throw new Error("external_origin must be an http(s) origin");
+    }
+    if (parsed.username !== "" || parsed.password !== "" || (parsed.pathname !== "" && parsed.pathname !== "/") || parsed.search !== "" || parsed.hash !== "") {
+        throw new Error("external_origin must be an origin without credentials, path, query, or fragment");
+    }
+    return parsed.origin;
+}
 function normalizeMaxBytes(name, v, defaultValue) {
     if (v == null)
         return defaultValue;
@@ -97,13 +118,9 @@ export function createProxyRuntime(opts) {
     const extraResponseHeaders = opts.extraResponseHeaders ?? [];
     const extraWsHeaders = opts.extraWsHeaders ?? [];
     const registerRuntime = () => {
-        try {
-            const ctl = globalThis.navigator?.serviceWorker?.controller;
-            ctl?.postMessage({ type: "flowersec-proxy:register-runtime" });
-        }
-        catch {
+        void ensureServiceWorkerRuntimeRegistered({ timeoutMs: 2_000 }).catch(() => {
             // Best-effort: controllerchange will retry once the active Service Worker is ready.
-        }
+        });
     };
     const onMessage = (ev) => {
         const data = ev.data;
@@ -134,6 +151,7 @@ export function createProxyRuntime(opts) {
             try {
                 const path = pathOnly(req.path);
                 const requestID = req.id.trim() !== "" ? req.id : randomB64u(18);
+                const externalOrigin = normalizeExternalOrigin(req.external_origin);
                 stream = await client.openStream(PROXY_KIND_HTTP1, { signal: ac.signal });
                 const reader = createByteReader(stream, { signal: ac.signal });
                 const filteredReqHeaders = filterRequestHeaders(req.headers, { extraAllowed: extraRequestHeaders });
@@ -145,6 +163,7 @@ export function createProxyRuntime(opts) {
                     method: req.method,
                     path,
                     headers: reqHeaders,
+                    ...(externalOrigin === undefined ? {} : { external_origin: externalOrigin }),
                     timeout_ms: timeoutMs
                 });
                 const body = req.body != null ? new Uint8Array(req.body) : new Uint8Array();
@@ -237,3 +256,60 @@ export function createProxyRuntime(opts) {
         }
     };
 }
+export async function ensureServiceWorkerRuntimeRegistered(opts = {}) {
+    const ctl = globalThis.navigator?.serviceWorker?.controller;
+    if (!ctl || typeof ctl.postMessage !== "function")
+        return;
+    const timeoutMs = Math.max(0, Math.floor(opts.timeoutMs ?? 2_000));
+    const ch = new MessageChannel();
+    await new Promise((resolve, reject) => {
+        let done = false;
+        let timer = null;
+        const finish = (error) => {
+            if (done)
+                return;
+            done = true;
+            if (timer != null)
+                clearTimeout(timer);
+            ch.port1.onmessage = null;
+            ch.port1.onmessageerror = null;
+            try {
+                ch.port1.close();
+            }
+            catch {
+                // Best-effort.
+            }
+            if (error == null) {
+                resolve();
+                return;
+            }
+            reject(error instanceof Error ? error : new Error(String(error)));
+        };
+        ch.port1.onmessage = (ev) => {
+            const data = ev.data;
+            if (data == null || typeof data !== "object")
+                return;
+            if (data.type !== "flowersec-proxy:register-runtime-ack")
+                return;
+            if (data.ok !== true) {
+                finish(new Error("service worker runtime registration was rejected"));
+                return;
+            }
+            finish();
+        };
+        ch.port1.onmessageerror = () => {
+            finish(new Error("service worker runtime registration failed"));
+        };
+        if (timeoutMs > 0) {
+            timer = setTimeout(() => {
+                finish(new Error("service worker runtime registration timed out"));
+            }, timeoutMs);
+        }
+        try {
+            ctl.postMessage({ type: "flowersec-proxy:register-runtime" }, [ch.port2]);
+        }
+        catch (error) {
+            finish(error);
+        }
+    });
+}

package/dist/proxy/serviceWorker.js

@@ -13,6 +13,28 @@ function normalizePathPrefix(name, v) {
         throw new Error(`${name} must not include scheme/host`);
     return s;
 }
+function normalizeRootRelativeScriptURL(name, v) {
+    if (typeof v !== "string")
+        throw new Error(`${name} must be a string`);
+    const s = v.trim();
+    if (s === "")
+        throw new Error(`${name} must be non-empty`);
+    if (s !== v)
+        throw new Error(`${name} must not contain leading or trailing whitespace`);
+    if (!s.startsWith("/"))
+        throw new Error(`${name} must start with "/"`);
+    if (s.startsWith("//"))
+        throw new Error(`${name} must not start with "//"`);
+    if (s.includes("://"))
+        throw new Error(`${name} must not include scheme/host`);
+    if (s.includes("\\"))
+        throw new Error(`${name} must not contain backslash`);
+    if (/[\s\u0000-\u001f\u007f]/.test(s))
+        throw new Error(`${name} must not contain whitespace or control characters`);
+    if (/[<>"'`]/.test(s))
+        throw new Error(`${name} must not contain HTML attribute delimiters`);
+    return s;
+}
 function normalizePathList(name, input) {
     const out = [];
     if (input == null || input.length === 0)
@@ -116,13 +138,9 @@ export function createProxyServiceWorkerScript(opts = {}) {
             }
         }
         else {
-            injectScriptUrl =
-                "scriptUrl" in injectHTML && typeof injectHTML.scriptUrl === "string"
-                    ? injectHTML.scriptUrl.trim()
-                    : "";
-            if (injectScriptUrl === "") {
+            if (!("scriptUrl" in injectHTML))
                 throw new Error("injectHTML.scriptUrl must be non-empty");
-            }
+            injectScriptUrl = normalizeRootRelativeScriptURL("injectHTML.scriptUrl", injectHTML.scriptUrl);
         }
     }
     return `// Generated by @floegence/flowersec-core/proxy
@@ -168,7 +186,13 @@ self.addEventListener("message", (event) => {
   if (!data || typeof data !== "object") return;
   const msgType = typeof data.type === "string" ? data.type : "";
   if (msgType === "flowersec-proxy:register-runtime") {
-    if (event.source && typeof event.source.id === "string") runtimeClientId = event.source.id;
+    const ok = Boolean(event.source && typeof event.source.id === "string");
+    if (ok) runtimeClientId = event.source.id;
+    const port = event.ports && event.ports[0];
+    if (port) {
+      try { port.postMessage({ type: "flowersec-proxy:register-runtime-ack", ok }); } catch {}
+      try { port.close(); } catch {}
+    }
     return;
   }
   if (!FORWARD_FETCH_MESSAGE_TYPES.has(msgType)) return;
@@ -309,16 +333,16 @@ function injectBootstrap(html) {
   } else if (INJECT_MODE === "external_module") {
     snippet =
       '<script type="module" src="' +
-      INJECT_SCRIPT_URL +
+      escapeHTMLAttributeValue(INJECT_SCRIPT_URL) +
       '"' +
-      (RUNTIME_GLOBAL ? ' data-flowersec-runtime-global="' + RUNTIME_GLOBAL + '"' : "") +
+      (RUNTIME_GLOBAL ? ' data-flowersec-runtime-global="' + escapeHTMLAttributeValue(RUNTIME_GLOBAL) + '"' : "") +
       "></script>";
   } else if (INJECT_MODE === "external_script") {
     snippet =
       '<script src="' +
-      INJECT_SCRIPT_URL +
+      escapeHTMLAttributeValue(INJECT_SCRIPT_URL) +
       '"' +
-      (RUNTIME_GLOBAL ? ' data-flowersec-runtime-global="' + RUNTIME_GLOBAL + '"' : "") +
+      (RUNTIME_GLOBAL ? ' data-flowersec-runtime-global="' + escapeHTMLAttributeValue(RUNTIME_GLOBAL) + '"' : "") +
       "></script>";
   }
 
@@ -335,6 +359,21 @@ function injectBootstrap(html) {
   return snippet + html;
 }
 
+function escapeHTMLAttributeValue(value) {
+  return String(value).replace(/[&<>"'\`=]/g, (ch) => {
+    switch (ch) {
+      case "&": return "&amp;";
+      case "<": return "&lt;";
+      case ">": return "&gt;";
+      case '"': return "&quot;";
+      case "'": return "&#39;";
+      case "\`": return "&#96;";
+      case "=": return "&#61;";
+      default: return ch;
+    }
+  });
+}
+
 self.addEventListener("fetch", (event) => {
   const url = new URL(event.request.url);
 
@@ -362,6 +401,7 @@ async function handleFetch(event) {
     const req = event.request;
     const url = new URL(req.url);
     const id = Math.random().toString(16).slice(2) + Date.now().toString(16);
+    const externalOrigin = url.origin === self.location.origin ? url.origin : "";
 
     let body;
     if (req.method === "GET" || req.method === "HEAD") {
@@ -483,7 +523,14 @@ async function handleFetch(event) {
 
     target.postMessage({
       type: WINDOW_CLIENT_MESSAGE_TYPE,
-      req: { id, method: req.method, path, headers: headersToPairs(req.headers), body }
+      req: {
+        id,
+        method: req.method,
+        path,
+        headers: headersToPairs(req.headers),
+        ...(externalOrigin ? { external_origin: externalOrigin } : {}),
+        body
+      }
     }, [port2]);
 
     const meta = await metaPromise;

package/dist/proxy/types.d.ts

@@ -12,6 +12,7 @@ export type HttpRequestMetaV1 = Readonly<{
     method: string;
     path: string;
     headers: Header[];
+    external_origin?: string;
     timeout_ms?: number;
 }>;
 export type HttpResponseMetaV1 = Readonly<{

package/dist/proxy/windowBridgeProtocol.d.ts

@@ -13,6 +13,7 @@ export type ProxyWindowFetchRequest = Readonly<{
     method: string;
     path: string;
     headers: readonly Header[];
+    external_origin?: string;
     body?: ArrayBuffer;
 }>;
 export type ProxyWindowFetchForwardMsg = Readonly<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "0.19.1",
+  "version": "0.19.3",
   "description": "Flowersec core TypeScript library (browser-friendly E2EE + multiplexing over WebSocket).",
   "license": "MIT",
   "repository": {