@floegence/flowersec-core 0.2.2 → 0.3.1

package/dist/client-connect/common.d.ts

@@ -9,7 +9,7 @@ export declare class WsFactoryRequiredError extends Error {
 }
 export declare function createWebSocket(url: string, origin: string, wsFactory: ((url: string, origin: string) => WebSocketLike) | undefined): WebSocketLike;
 export declare function classifyConnectError(err: unknown): "websocket_error" | "websocket_closed" | "timeout" | "canceled";
-export declare function classifyHandshakeError(err: unknown): "auth_tag_mismatch" | "handshake_failed" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "timeout" | "canceled";
+export declare function classifyHandshakeError(err: unknown): "auth_tag_mismatch" | "handshake_failed" | "invalid_suite" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "timeout" | "canceled";
 export declare function withAbortAndTimeout<T>(p: Promise<T>, opts: Readonly<{
     signal?: AbortSignal;
     timeoutMs?: number;

package/dist/client-connect/tunnelAttachCloseReason.d.ts

@@ -1,3 +1,3 @@
-export declare const tunnelAttachCloseReasons: readonly ["too_many_connections", "expected_attach", "invalid_attach", "invalid_token", "channel_mismatch", "role_mismatch", "token_replay", "replace_rate_limited", "attach_failed"];
+export declare const tunnelAttachCloseReasons: readonly ["too_many_connections", "expected_attach", "invalid_attach", "invalid_token", "channel_mismatch", "init_exp_mismatch", "idle_timeout_mismatch", "role_mismatch", "token_replay", "replace_rate_limited", "attach_failed"];
 export type TunnelAttachCloseReason = (typeof tunnelAttachCloseReasons)[number];
 export declare function isTunnelAttachCloseReason(v: string | undefined): v is TunnelAttachCloseReason;

package/dist/client-connect/tunnelAttachCloseReason.js

@@ -4,6 +4,8 @@ export const tunnelAttachCloseReasons = [
     "invalid_attach",
     "invalid_token",
     "channel_mismatch",
+    "init_exp_mismatch",
+    "idle_timeout_mismatch",
     "role_mismatch",
     "token_replay",
     "replace_rate_limited",

package/dist/direct-client/connect.js

@@ -5,6 +5,9 @@ import { connectCore } from "../client-connect/connectCore.js";
 function isRecord(v) {
     return typeof v === "object" && v != null && !Array.isArray(v);
 }
+function hasOwn(o, key) {
+    return Object.prototype.hasOwnProperty.call(o, key);
+}
 // connectDirect connects to a direct websocket endpoint and returns an RPC-ready session.
 export async function connectDirect(info, opts) {
     const endpointInstanceId = opts?.endpointInstanceId;
@@ -20,6 +23,35 @@ export async function connectDirect(info, opts) {
         throw new FlowersecError({ stage: "validate", code: "missing_connect_info", path: "direct", message: "missing connect info" });
     }
     if (isRecord(info)) {
+        // Align missing/invalid field codes with Go: missing fields map to specific stable codes.
+        const okTypes = (!hasOwn(info, "ws_url") || typeof info["ws_url"] === "string") &&
+            (!hasOwn(info, "channel_id") || typeof info["channel_id"] === "string") &&
+            (!hasOwn(info, "channel_init_expire_at_unix_s") ||
+                (typeof info["channel_init_expire_at_unix_s"] === "number" && Number.isSafeInteger(info["channel_init_expire_at_unix_s"]))) &&
+            (!hasOwn(info, "e2ee_psk_b64u") || typeof info["e2ee_psk_b64u"] === "string") &&
+            (!hasOwn(info, "default_suite") || (typeof info["default_suite"] === "number" && Number.isSafeInteger(info["default_suite"])));
+        if (okTypes) {
+            if (!hasOwn(info, "ws_url")) {
+                throw new FlowersecError({ stage: "validate", code: "missing_ws_url", path: "direct", message: "missing ws_url" });
+            }
+            if (!hasOwn(info, "channel_id")) {
+                throw new FlowersecError({ stage: "validate", code: "missing_channel_id", path: "direct", message: "missing channel_id" });
+            }
+            if (!hasOwn(info, "channel_init_expire_at_unix_s")) {
+                throw new FlowersecError({
+                    stage: "validate",
+                    code: "missing_init_exp",
+                    path: "direct",
+                    message: "missing channel_init_expire_at_unix_s",
+                });
+            }
+            if (!hasOwn(info, "e2ee_psk_b64u")) {
+                throw new FlowersecError({ stage: "validate", code: "invalid_psk", path: "direct", message: "missing e2ee_psk_b64u" });
+            }
+            if (!hasOwn(info, "default_suite")) {
+                throw new FlowersecError({ stage: "validate", code: "invalid_suite", path: "direct", message: "missing default_suite" });
+            }
+        }
         const suite = info["default_suite"];
         // Keep "invalid_suite" as the stable error code even when the IDL validator rejects the enum value.
         if (typeof suite === "number" && Number.isSafeInteger(suite) && suite !== 1 && suite !== 2) {

package/dist/e2ee/errors.d.ts

@@ -1,4 +1,4 @@
-export type E2EEHandshakeErrorCode = "auth_tag_mismatch" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew";
+export type E2EEHandshakeErrorCode = "auth_tag_mismatch" | "invalid_suite" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew";
 export declare class E2EEHandshakeError extends Error {
     readonly code: E2EEHandshakeErrorCode;
     constructor(code: E2EEHandshakeErrorCode, message: string);

package/dist/e2ee/handshake.js

@@ -242,7 +242,7 @@ export async function serverHandshake(transport, cache, opts) {
         throw new Error("bad channel_id");
     const suite = init.suite;
     if (suite !== opts.suite)
-        throw new Error("bad suite");
+        throw new E2EEHandshakeError("invalid_suite", "bad suite");
     const clientPub = base64urlDecode(init.client_eph_pub_b64u);
     const nonceC = base64urlDecode(init.nonce_c_b64u);
     if (nonceC.length !== 32)

package/dist/observability/observer.d.ts

@@ -2,9 +2,9 @@ import type { ClientPath } from "../client.js";
 export type ConnectResult = "ok" | "fail";
 export type ConnectReason = "websocket_error" | "websocket_closed" | "timeout" | "canceled";
 export type AttachResult = "ok" | "fail";
-export type AttachReason = "send_failed" | "too_many_connections" | "expected_attach" | "invalid_attach" | "invalid_token" | "channel_mismatch" | "role_mismatch" | "token_replay" | "replace_rate_limited" | "attach_failed";
+export type AttachReason = "send_failed" | "too_many_connections" | "expected_attach" | "invalid_attach" | "invalid_token" | "channel_mismatch" | "role_mismatch" | "init_exp_mismatch" | "idle_timeout_mismatch" | "token_replay" | "replace_rate_limited" | "attach_failed";
 export type HandshakeResult = "ok" | "fail";
-export type HandshakeReason = "auth_tag_mismatch" | "handshake_failed" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "timeout" | "canceled";
+export type HandshakeReason = "auth_tag_mismatch" | "handshake_failed" | "invalid_suite" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "timeout" | "canceled";
 export type WsCloseKind = "local" | "peer_or_error";
 export type WsErrorReason = "error" | "recv_buffer_exceeded" | "unexpected_text_frame" | "unexpected_message_type";
 export type RpcCallResult = "ok" | "rpc_error" | "handler_not_found" | "transport_error" | "canceled";

package/dist/tunnel-client/connect.js

@@ -7,14 +7,16 @@ import { connectCore } from "../client-connect/connectCore.js";
 function isRecord(v) {
     return typeof v === "object" && v != null && !Array.isArray(v);
 }
+function hasOwn(o, key) {
+    return Object.prototype.hasOwnProperty.call(o, key);
+}
 function unwrapGrant(v) {
-    if (v == null || typeof v !== "object")
+    if (!isRecord(v))
         return v;
-    const o = v;
-    if (o["grant_client"] != null)
-        return o["grant_client"];
-    if (o["grant_server"] != null)
-        return o["grant_server"];
+    if (hasOwn(v, "grant_client"))
+        return v["grant_client"];
+    if (hasOwn(v, "grant_server"))
+        return v["grant_server"];
     return v;
 }
 // connectTunnel attaches to a tunnel and returns an RPC-ready session.
@@ -24,6 +26,39 @@ export async function connectTunnel(grant, opts) {
         throw new FlowersecError({ stage: "validate", code: "missing_grant", path: "tunnel", message: "missing grant" });
     }
     if (isRecord(input)) {
+        // Align missing/invalid field codes with Go: missing fields map to specific stable codes.
+        const okTypes = (!hasOwn(input, "role") || (typeof input["role"] === "number" && Number.isSafeInteger(input["role"]))) &&
+            (!hasOwn(input, "tunnel_url") || typeof input["tunnel_url"] === "string") &&
+            (!hasOwn(input, "channel_id") || typeof input["channel_id"] === "string") &&
+            (!hasOwn(input, "token") || typeof input["token"] === "string") &&
+            (!hasOwn(input, "channel_init_expire_at_unix_s") ||
+                (typeof input["channel_init_expire_at_unix_s"] === "number" && Number.isSafeInteger(input["channel_init_expire_at_unix_s"]))) &&
+            (!hasOwn(input, "e2ee_psk_b64u") || typeof input["e2ee_psk_b64u"] === "string") &&
+            (!hasOwn(input, "default_suite") || (typeof input["default_suite"] === "number" && Number.isSafeInteger(input["default_suite"])));
+        if (okTypes) {
+            const role = input["role"];
+            if (role === undefined || role !== ControlRole.Role_client) {
+                throw new FlowersecError({ stage: "validate", code: "role_mismatch", path: "tunnel", message: "expected role=client" });
+            }
+            if (!hasOwn(input, "tunnel_url")) {
+                throw new FlowersecError({ stage: "validate", code: "missing_tunnel_url", path: "tunnel", message: "missing tunnel_url" });
+            }
+            if (!hasOwn(input, "channel_id")) {
+                throw new FlowersecError({ stage: "validate", code: "missing_channel_id", path: "tunnel", message: "missing channel_id" });
+            }
+            if (!hasOwn(input, "token")) {
+                throw new FlowersecError({ stage: "validate", code: "missing_token", path: "tunnel", message: "missing token" });
+            }
+            if (!hasOwn(input, "channel_init_expire_at_unix_s")) {
+                throw new FlowersecError({ stage: "validate", code: "missing_init_exp", path: "tunnel", message: "missing channel_init_expire_at_unix_s" });
+            }
+            if (!hasOwn(input, "e2ee_psk_b64u")) {
+                throw new FlowersecError({ stage: "validate", code: "invalid_psk", path: "tunnel", message: "missing e2ee_psk_b64u" });
+            }
+            if (!hasOwn(input, "default_suite")) {
+                throw new FlowersecError({ stage: "validate", code: "invalid_suite", path: "tunnel", message: "missing default_suite" });
+            }
+        }
         const suite = input["default_suite"];
         // Keep "invalid_suite" as the stable error code even when the IDL validator rejects the enum value.
         if (typeof suite === "number" && Number.isSafeInteger(suite) && suite !== 1 && suite !== 2) {

package/dist/utils/errors.d.ts

@@ -6,7 +6,7 @@ export declare class AbortError extends Error {
 }
 export type FlowersecPath = "auto" | "tunnel" | "direct";
 export type FlowersecStage = "validate" | "connect" | "attach" | "handshake" | "secure" | "yamux" | "rpc" | "close";
-export type FlowersecErrorCode = "timeout" | "canceled" | "invalid_version" | "invalid_input" | "invalid_option" | "invalid_endpoint_instance_id" | "invalid_psk" | "invalid_suite" | "missing_grant" | "missing_connect_info" | "missing_conn" | "missing_handler" | "missing_stream_kind" | "role_mismatch" | "missing_tunnel_url" | "missing_ws_url" | "missing_origin" | "missing_channel_id" | "missing_token" | "missing_init_exp" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "auth_tag_mismatch" | "resolve_failed" | "random_failed" | "upgrade_failed" | "dial_failed" | "attach_failed" | "too_many_connections" | "expected_attach" | "invalid_attach" | "invalid_token" | "channel_mismatch" | "token_replay" | "replace_rate_limited" | "handshake_failed" | "ping_failed" | "mux_failed" | "accept_stream_failed" | "open_stream_failed" | "stream_hello_failed" | "not_connected";
+export type FlowersecErrorCode = "timeout" | "canceled" | "invalid_version" | "invalid_input" | "invalid_option" | "invalid_endpoint_instance_id" | "invalid_psk" | "invalid_suite" | "missing_grant" | "missing_connect_info" | "missing_conn" | "missing_handler" | "missing_stream_kind" | "role_mismatch" | "missing_tunnel_url" | "missing_ws_url" | "missing_origin" | "missing_channel_id" | "missing_token" | "missing_init_exp" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "auth_tag_mismatch" | "resolve_failed" | "random_failed" | "upgrade_failed" | "dial_failed" | "attach_failed" | "too_many_connections" | "expected_attach" | "invalid_attach" | "invalid_token" | "channel_mismatch" | "init_exp_mismatch" | "idle_timeout_mismatch" | "token_replay" | "replace_rate_limited" | "handshake_failed" | "ping_failed" | "mux_failed" | "accept_stream_failed" | "open_stream_failed" | "stream_hello_failed" | "not_connected";
 export declare class FlowersecError extends Error {
     readonly code: FlowersecErrorCode;
     readonly stage: FlowersecStage;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "description": "Flowersec core TypeScript library (browser-friendly E2EE + multiplexing over WebSocket).",
   "license": "MIT",
   "repository": {