@floegence/flowersec-core 0.21.1 → 0.22.0

package/dist/endpoint/index.d.ts

@@ -0,0 +1,83 @@
+import { type TransportSecurityPolicy } from "../client-connect/transportSecurity.js";
+import { serverHandshake, ServerHandshakeCache, type Suite } from "../e2ee/handshake.js";
+import { type YamuxLimits } from "../yamux/session.js";
+import type { YamuxStream } from "../yamux/stream.js";
+import { type RpcRouter, type RpcServerOptions } from "../rpc/server.js";
+import { type WebSocketLike, type WebSocketLimits } from "../ws-client/binaryTransport.js";
+export type { Suite } from "../e2ee/handshake.js";
+export type EndpointPath = "direct" | "tunnel";
+export type DirectHandshakeInit = Readonly<{
+    channelId: string;
+    version: number;
+    suite: Suite;
+    clientFeatures: number;
+}>;
+export type DirectHandshakeCredential = Readonly<{
+    psk: Uint8Array | string;
+    initExpireAtUnixS: number;
+    commitAuthenticated?: () => void | Promise<void>;
+}>;
+export type DirectCredentialResolver = (init: DirectHandshakeInit) => DirectHandshakeCredential | Promise<DirectHandshakeCredential>;
+export type EndpointOptions = Readonly<{
+    signal?: AbortSignal;
+    handshakeTimeoutMs?: number;
+    handshakeClockSkewMs?: number;
+    serverFeatures?: number;
+    maxHandshakePayload?: number;
+    maxRecordBytes?: number;
+    maxBufferedBytes?: number;
+    maxOutboundBufferedBytes?: number;
+    outboundRecordChunkBytes?: number;
+    webSocketLimits?: Partial<WebSocketLimits>;
+    yamuxLimits?: Partial<YamuxLimits>;
+    handshakeCache?: ServerHandshakeCache;
+}>;
+export type DirectAcceptOptions = EndpointOptions & Readonly<{
+    secureTransport?: boolean;
+    transportSecurityPolicy?: TransportSecurityPolicy;
+}>;
+export type TunnelEndpointOptions = EndpointOptions & Readonly<{
+    origin: string;
+    connectTimeoutMs?: number;
+    endpointInstanceId?: string;
+    wsFactory: (url: string, origin: string) => WebSocketLike;
+    transportSecurityPolicy?: TransportSecurityPolicy;
+}>;
+export type EndpointStream = Readonly<{
+    kind: string;
+    stream: YamuxStream;
+}>;
+export declare class Session {
+    private readonly secure;
+    private readonly mux;
+    readonly path: EndpointPath;
+    readonly endpointInstanceId: string | undefined;
+    private readonly streams;
+    private readonly waiters;
+    private terminalError;
+    private constructor();
+    static create(path: EndpointPath, secure: Awaited<ReturnType<typeof serverHandshake>>, options?: Readonly<{
+        yamuxLimits?: Partial<YamuxLimits>;
+        endpointInstanceId?: string;
+    }>): Session;
+    openStream(kind: string, options?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<YamuxStream>;
+    acceptStream(options?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<EndpointStream>;
+    serveRPC(router: RpcRouter, options?: RpcServerOptions & Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<void>;
+    probeLiveness(timeoutMs?: 10000): Promise<number>;
+    close(): void;
+    private pushStream;
+    private acceptRawStream;
+    private fail;
+}
+export declare function acceptDirect(websocket: WebSocketLike, handshake: Readonly<{
+    channelId: string;
+    suite: Suite;
+}> & DirectHandshakeCredential, options?: DirectAcceptOptions): Promise<Session>;
+export declare function acceptDirectResolved(websocket: WebSocketLike, resolver: DirectCredentialResolver, options?: DirectAcceptOptions): Promise<Session>;
+export declare function connectTunnel(grantInput: unknown, options: TunnelEndpointOptions): Promise<Session>;

package/dist/endpoint/index.js

@@ -0,0 +1,384 @@
+import { Role as ControlRole, assertChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
+import { Role as TunnelRole } from "../gen/flowersec/tunnel/v1.gen.js";
+import { assertTunnelGrantContract, assertValidPSK, prepareChannelId } from "../client-connect/contract.js";
+import { enforceTransportSecurity } from "../client-connect/transportSecurity.js";
+import { SDK_DEFAULTS } from "../defaults.js";
+import { serverHandshake, ServerHandshakeCache } from "../e2ee/handshake.js";
+import { decodeHandshakeFrame } from "../e2ee/framing.js";
+import { HANDSHAKE_TYPE_INIT, PROTOCOL_VERSION } from "../e2ee/constants.js";
+import { readStreamHello, writeStreamHello } from "../streamhello/streamHello.js";
+import { ByteReader } from "../yamux/byteReader.js";
+import { YamuxSession } from "../yamux/session.js";
+import { RpcServer } from "../rpc/server.js";
+import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
+import { AbortError, FlowersecError } from "../utils/errors.js";
+import { WebSocketBinaryTransport } from "../ws-client/binaryTransport.js";
+export class Session {
+    secure;
+    mux;
+    path;
+    endpointInstanceId;
+    streams = [];
+    waiters = [];
+    terminalError;
+    constructor(path, secure, mux, endpointInstanceId) {
+        this.secure = secure;
+        this.mux = mux;
+        this.path = path;
+        this.endpointInstanceId = endpointInstanceId;
+    }
+    static create(path, secure, options = {}) {
+        let session;
+        const mux = new YamuxSession({
+            read: () => secure.read(),
+            write: (bytes) => secure.write(bytes),
+            close: () => secure.close(),
+        }, {
+            client: false,
+            ...(options.yamuxLimits === undefined ? {} : { limits: options.yamuxLimits }),
+            onIncomingStream: (stream) => session.pushStream(stream),
+            onTerminal: (error) => session.fail(error),
+        });
+        session = new Session(path, secure, mux, options.endpointInstanceId);
+        return session;
+    }
+    async openStream(kind, options = {}) {
+        const stream = await this.mux.openStream(options);
+        try {
+            await writeStreamHello((bytes) => stream.write(bytes), normalizeStreamKind(kind, this.path));
+            return stream;
+        }
+        catch (error) {
+            await stream.reset(asError(error));
+            throw new FlowersecError({ path: this.path, stage: "rpc", code: "stream_hello_failed", message: "failed to write stream hello", cause: error });
+        }
+    }
+    async acceptStream(options = {}) {
+        const stream = await this.acceptRawStream(options.signal);
+        try {
+            const reader = new ByteReader(() => stream.read());
+            const hello = await readStreamHello((length) => reader.readExactly(length));
+            return { kind: hello.kind, stream };
+        }
+        catch (error) {
+            await stream.reset(asError(error));
+            throw new FlowersecError({ path: this.path, stage: "rpc", code: "stream_hello_failed", message: "failed to read stream hello", cause: error });
+        }
+    }
+    async serveRPC(router, options = {}) {
+        while (true) {
+            const accepted = await this.acceptStream(options.signal === undefined ? {} : { signal: options.signal });
+            if (accepted.kind !== "rpc") {
+                await accepted.stream.reset(new Error(`unexpected stream kind ${accepted.kind}`));
+                continue;
+            }
+            const reader = new ByteReader(() => accepted.stream.read());
+            const server = new RpcServer({
+                readExactly: (length) => reader.readExactly(length),
+                write: (bytes) => accepted.stream.write(bytes),
+                close: (error) => { void accepted.stream.reset(asError(error)); },
+            }, options, router);
+            await server.serve(options.signal);
+            return;
+        }
+    }
+    probeLiveness(timeoutMs = SDK_DEFAULTS.transport.handshakeTimeoutMs) {
+        return this.mux.probeLiveness(timeoutMs);
+    }
+    close() {
+        this.fail(new Error("endpoint session closed"));
+        this.mux.close();
+        this.secure.close();
+    }
+    pushStream(stream) {
+        const waiter = this.waiters.shift();
+        if (waiter == null) {
+            this.streams.push(stream);
+            return;
+        }
+        cleanupWaiter(waiter);
+        waiter.resolve(stream);
+    }
+    acceptRawStream(signal) {
+        if (signal?.aborted)
+            return Promise.reject(new AbortError("accept stream aborted"));
+        if (this.terminalError != null)
+            return Promise.reject(this.terminalError);
+        const stream = this.streams.shift();
+        if (stream != null)
+            return Promise.resolve(stream);
+        return new Promise((resolve, reject) => {
+            const waiter = { resolve, reject, ...(signal === undefined ? {} : { signal }) };
+            waiter.onAbort = () => {
+                const index = this.waiters.indexOf(waiter);
+                if (index >= 0)
+                    this.waiters.splice(index, 1);
+                cleanupWaiter(waiter);
+                reject(new AbortError("accept stream aborted"));
+            };
+            signal?.addEventListener("abort", waiter.onAbort, { once: true });
+            this.waiters.push(waiter);
+        });
+    }
+    fail(error) {
+        if (this.terminalError != null)
+            return;
+        this.terminalError = error;
+        for (const waiter of this.waiters.splice(0)) {
+            cleanupWaiter(waiter);
+            waiter.reject(error);
+        }
+    }
+}
+export async function acceptDirect(websocket, handshake, options = {}) {
+    await enforceIncomingDirectTransport(options);
+    const transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
+    return await establishSession("direct", transport, handshake, options);
+}
+export async function acceptDirectResolved(websocket, resolver, options = {}) {
+    await enforceIncomingDirectTransport(options);
+    const transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
+    const first = await transport.readBinary(readOptions(options));
+    let init;
+    try {
+        const decoded = decodeHandshakeFrame(first, options.maxHandshakePayload ?? SDK_DEFAULTS.e2ee.maxHandshakePayloadBytes);
+        if (decoded.handshakeType !== HANDSHAKE_TYPE_INIT)
+            throw new Error("expected handshake init");
+        init = JSON.parse(new TextDecoder().decode(decoded.payloadJsonUtf8));
+        if (init.version !== PROTOCOL_VERSION || init.role !== 1 || (init.suite !== 1 && init.suite !== 2))
+            throw new Error("invalid handshake init");
+    }
+    catch (error) {
+        transport.close();
+        throw new FlowersecError({ path: "direct", stage: "handshake", code: "handshake_failed", message: "invalid handshake init", cause: error });
+    }
+    let credential;
+    try {
+        credential = await resolver({
+            channelId: prepareChannelId(init.channel_id, "direct"),
+            version: init.version,
+            suite: init.suite,
+            clientFeatures: init.client_features >>> 0,
+        });
+    }
+    catch (error) {
+        transport.close();
+        throw new FlowersecError({ path: "direct", stage: "validate", code: "resolve_failed", message: "credential resolution failed", cause: error });
+    }
+    const replay = new PrefetchedTransport(transport, first);
+    return await establishSession("direct", replay, {
+        channelId: init.channel_id,
+        suite: init.suite,
+        ...credential,
+    }, options);
+}
+export async function connectTunnel(grantInput, options) {
+    let grant;
+    try {
+        grant = assertChannelInitGrant(unwrapServerGrant(grantInput));
+    }
+    catch (error) {
+        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "invalid_input", message: "invalid ChannelInitGrant", cause: error });
+    }
+    assertTunnelGrantContract(grant, ControlRole.Role_server);
+    const tunnelUrl = grant.tunnel_url.trim();
+    if (tunnelUrl === "")
+        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_tunnel_url", message: "missing tunnel_url" });
+    if (grant.token.trim() === "")
+        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_token", message: "missing token" });
+    if (grant.channel_init_expire_at_unix_s <= 0)
+        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_init_exp", message: "missing channel init expiry" });
+    const origin = options.origin.trim();
+    if (origin === "")
+        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_origin", message: "missing origin" });
+    await enforceTransportSecurity({ rawUrl: tunnelUrl, path: "tunnel", ...(options.transportSecurityPolicy === undefined ? {} : { policy: options.transportSecurityPolicy }) });
+    const endpointInstanceId = normalizeEndpointInstanceId(options.endpointInstanceId);
+    const websocket = options.wsFactory(tunnelUrl, origin);
+    const transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
+    try {
+        await waitForOpen(websocket, options.connectTimeoutMs ?? SDK_DEFAULTS.transport.connectTimeoutMs, options.signal);
+        const attach = {
+            v: 1,
+            channel_id: prepareChannelId(grant.channel_id, "tunnel"),
+            role: TunnelRole.Role_server,
+            token: grant.token.trim(),
+            endpoint_instance_id: endpointInstanceId,
+        };
+        websocket.send(JSON.stringify(attach));
+        return await establishSession("tunnel", transport, {
+            channelId: grant.channel_id,
+            suite: grant.default_suite,
+            psk: assertValidPSK(grant.e2ee_psk_b64u, "tunnel"),
+            initExpireAtUnixS: grant.channel_init_expire_at_unix_s,
+        }, options, endpointInstanceId);
+    }
+    catch (error) {
+        transport.close();
+        if (error instanceof FlowersecError)
+            throw error;
+        throw new FlowersecError({ path: "tunnel", stage: "connect", code: "dial_failed", message: "endpoint tunnel connect failed", cause: error });
+    }
+}
+async function establishSession(path, transport, handshake, options, endpointInstanceId) {
+    let psk;
+    try {
+        psk = normalizePSK(handshake.psk, path);
+    }
+    catch (error) {
+        transport.close();
+        throw error;
+    }
+    try {
+        const secure = await serverHandshake(transport, options.handshakeCache ?? new ServerHandshakeCache(), {
+            channelId: prepareChannelId(handshake.channelId, path),
+            suite: handshake.suite,
+            psk,
+            serverFeatures: options.serverFeatures ?? 0,
+            initExpireAtUnixS: handshake.initExpireAtUnixS,
+            clockSkewSeconds: Math.ceil((options.handshakeClockSkewMs ?? SDK_DEFAULTS.transport.handshakeClockSkewMs) / 1000),
+            maxHandshakePayload: options.maxHandshakePayload ?? SDK_DEFAULTS.e2ee.maxHandshakePayloadBytes,
+            maxRecordBytes: options.maxRecordBytes ?? SDK_DEFAULTS.e2ee.maxRecordBytes,
+            outboundRecordChunkBytes: options.outboundRecordChunkBytes ?? SDK_DEFAULTS.e2ee.outboundRecordChunkBytes,
+            maxBufferedBytes: options.maxBufferedBytes ?? SDK_DEFAULTS.e2ee.maxOutboundBufferedBytes,
+            maxOutboundBufferedBytes: options.maxOutboundBufferedBytes ?? SDK_DEFAULTS.e2ee.maxOutboundBufferedBytes,
+            timeoutMs: options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs,
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+        });
+        try {
+            await handshake.commitAuthenticated?.();
+        }
+        catch (error) {
+            secure.close();
+            throw new FlowersecError({ path, stage: "handshake", code: "credential_commit_failed", message: "credential commit failed", cause: error });
+        }
+        return Session.create(path, secure, {
+            ...(options.yamuxLimits === undefined ? {} : { yamuxLimits: options.yamuxLimits }),
+            ...(endpointInstanceId === undefined ? {} : { endpointInstanceId }),
+        });
+    }
+    catch (error) {
+        transport.close();
+        if (error instanceof FlowersecError)
+            throw error;
+        throw new FlowersecError({ path, stage: "handshake", code: "handshake_failed", message: "endpoint handshake failed", cause: error });
+    }
+    finally {
+        psk.fill(0);
+    }
+}
+class PrefetchedTransport {
+    inner;
+    first;
+    constructor(inner, first) {
+        this.inner = inner;
+        this.first = first;
+    }
+    readBinary(options) {
+        if (this.first != null) {
+            const first = this.first;
+            this.first = undefined;
+            return Promise.resolve(first);
+        }
+        return this.inner.readBinary(options);
+    }
+    writeBinary(frame, options) {
+        return this.inner.writeBinary(frame, options);
+    }
+    close() {
+        this.inner.close();
+    }
+}
+function normalizePSK(input, path) {
+    try {
+        const psk = typeof input === "string" ? base64urlDecode(input.trim()) : input.slice();
+        if (psk.length !== 32)
+            throw new Error("psk must be 32 bytes");
+        return psk;
+    }
+    catch (error) {
+        throw new FlowersecError({ path, stage: "validate", code: "invalid_psk", message: "invalid psk", cause: error });
+    }
+}
+function normalizeEndpointInstanceId(input) {
+    const value = input ?? randomEndpointInstanceId();
+    try {
+        const bytes = base64urlDecode(value);
+        if (bytes.length < 16 || bytes.length > 32)
+            throw new Error("endpoint instance ID must decode to 16..32 bytes");
+    }
+    catch (error) {
+        throw new FlowersecError({ path: "tunnel", stage: "validate", code: "invalid_endpoint_instance_id", message: "invalid endpoint instance ID", cause: error });
+    }
+    return value;
+}
+function randomEndpointInstanceId() {
+    const bytes = new Uint8Array(24);
+    crypto.getRandomValues(bytes);
+    return base64urlEncode(bytes);
+}
+function normalizeStreamKind(kind, path) {
+    const value = kind.trim();
+    if (value === "")
+        throw new FlowersecError({ path, stage: "validate", code: "missing_stream_kind", message: "missing stream kind" });
+    return value;
+}
+function unwrapServerGrant(input) {
+    if (typeof input !== "object" || input == null || Array.isArray(input))
+        return input;
+    const record = input;
+    return record["grant_server"] ?? input;
+}
+function webSocketTransportOptions(options) {
+    return options.webSocketLimits === undefined ? {} : { webSocketLimits: options.webSocketLimits };
+}
+function readOptions(options) {
+    return {
+        timeoutMs: options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs,
+        ...(options.signal === undefined ? {} : { signal: options.signal }),
+    };
+}
+async function enforceIncomingDirectTransport(options) {
+    const rawUrl = options.secureTransport === false ? "ws://127.0.0.1/" : "wss://127.0.0.1/";
+    await enforceTransportSecurity({ rawUrl, path: "direct", ...(options.transportSecurityPolicy === undefined ? {} : { policy: options.transportSecurityPolicy }) });
+}
+function waitForOpen(websocket, timeoutMs, signal) {
+    if (websocket.readyState === 1)
+        return Promise.resolve();
+    if (!Number.isFinite(timeoutMs) || timeoutMs < 0)
+        return Promise.reject(new RangeError("connectTimeoutMs must be non-negative"));
+    return new Promise((resolve, reject) => {
+        let timer;
+        const cleanup = () => {
+            if (timer != null)
+                clearTimeout(timer);
+            websocket.removeEventListener("open", onOpen);
+            websocket.removeEventListener("error", onError);
+            websocket.removeEventListener("close", onClose);
+            signal?.removeEventListener("abort", onAbort);
+        };
+        const finish = (error) => {
+            cleanup();
+            if (error == null)
+                resolve();
+            else
+                reject(error);
+        };
+        const onOpen = () => finish();
+        const onError = () => finish(new Error("websocket open failed"));
+        const onClose = () => finish(new Error("websocket closed before open"));
+        const onAbort = () => finish(new AbortError("connect aborted"));
+        websocket.addEventListener("open", onOpen);
+        websocket.addEventListener("error", onError);
+        websocket.addEventListener("close", onClose);
+        signal?.addEventListener("abort", onAbort, { once: true });
+        if (timeoutMs > 0)
+            timer = setTimeout(() => finish(new Error("websocket open timeout")), timeoutMs);
+    });
+}
+function cleanupWaiter(waiter) {
+    if (waiter.onAbort != null)
+        waiter.signal?.removeEventListener("abort", waiter.onAbort);
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}

package/dist/endpoint/node.d.ts

@@ -0,0 +1,9 @@
+import type { WebSocketLike } from "../ws-client/binaryTransport.js";
+import { type DirectAcceptOptions, type DirectCredentialResolver, type DirectHandshakeCredential, type Session, type Suite, type TunnelEndpointOptions } from "./index.js";
+export declare function adaptNodeWebSocket(websocket: unknown): WebSocketLike;
+export declare function acceptDirectNode(websocket: unknown, handshake: Readonly<{
+    channelId: string;
+    suite: Suite;
+}> & DirectHandshakeCredential, options?: DirectAcceptOptions): Promise<Session>;
+export declare function acceptDirectResolvedNode(websocket: unknown, resolver: DirectCredentialResolver, options?: DirectAcceptOptions): Promise<Session>;
+export declare function connectTunnelEndpointNode(grant: unknown, options: Omit<TunnelEndpointOptions, "wsFactory">): Promise<Session>;

package/dist/endpoint/node.js

@@ -0,0 +1,51 @@
+import { createNodeWsFactory } from "../node/wsFactory.js";
+import { acceptDirect, acceptDirectResolved, connectTunnel, } from "./index.js";
+export function adaptNodeWebSocket(websocket) {
+    const raw = websocket;
+    if (raw == null || typeof raw.send !== "function" || typeof raw.close !== "function") {
+        throw new TypeError("a Node WebSocket is required");
+    }
+    if (typeof raw.addEventListener === "function" && typeof raw.removeEventListener === "function") {
+        return raw;
+    }
+    const listeners = new Map();
+    return {
+        get binaryType() { return String(raw.binaryType ?? "nodebuffer"); },
+        set binaryType(value) { raw.binaryType = value; },
+        get readyState() { return Number(raw.readyState); },
+        get bufferedAmount() { return Number(raw.bufferedAmount ?? 0); },
+        send(data) { raw.send(data); },
+        close(code, reason) { raw.close(code, reason); },
+        addEventListener(type, listener) {
+            const wrapped = (...args) => {
+                if (type === "message")
+                    listener({ data: args[0] });
+                else if (type === "close")
+                    listener({ code: args[0], reason: args[1]?.toString?.() ?? "" });
+                else
+                    listener(args[0]);
+            };
+            const byListener = listeners.get(type) ?? new Map();
+            byListener.set(listener, wrapped);
+            listeners.set(type, byListener);
+            raw.on(type, wrapped);
+        },
+        removeEventListener(type, listener) {
+            const byListener = listeners.get(type);
+            const wrapped = byListener?.get(listener);
+            if (wrapped == null)
+                return;
+            byListener.delete(listener);
+            raw.off(type, wrapped);
+        },
+    };
+}
+export function acceptDirectNode(websocket, handshake, options = {}) {
+    return acceptDirect(adaptNodeWebSocket(websocket), handshake, options);
+}
+export function acceptDirectResolvedNode(websocket, resolver, options = {}) {
+    return acceptDirectResolved(adaptNodeWebSocket(websocket), resolver, options);
+}
+export function connectTunnelEndpointNode(grant, options) {
+    return connectTunnel(grant, { ...options, wsFactory: createNodeWsFactory() });
+}

package/dist/framing/jsonframe.js

@@ -1,5 +1,6 @@
 import { readU32be, u32be } from "../utils/bin.js";
-export const DEFAULT_MAX_JSON_FRAME_BYTES = 1 << 20;
+import { SDK_DEFAULTS } from "../defaults.js";
+export const DEFAULT_MAX_JSON_FRAME_BYTES = SDK_DEFAULTS.rpc.maxJsonFrameBytes;
 const te = new TextEncoder();
 const td = new TextDecoder();
 // JsonFramingError marks malformed or oversized frames.

package/dist/node/index.d.ts

@@ -4,5 +4,8 @@ export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSe
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export type { DirectNodeReconnectConfig, NodeReconnectConfig, TunnelNodeReconnectConfig, } from "./reconnectConfig.js";
 export { createDirectNodeReconnectConfig, createNodeReconnectConfig, createTunnelNodeReconnectConfig, } from "./reconnectConfig.js";
+export * from "../endpoint/index.js";
+export * from "../endpoint/node.js";
+export * from "../proxy/server.js";
 export type { ConnectArtifact, CorrelationContext, CorrelationKV, DirectClientConnectArtifact, ScopeMetadataEntry, TunnelClientConnectArtifact, } from "../connect/artifact.js";
 export { assertConnectArtifact } from "../connect/artifact.js";

package/dist/node/index.js

@@ -2,4 +2,7 @@ export { createNodeWsFactory } from "./wsFactory.js";
 export { AllowPlaintext, AllowPlaintextForLoopback, RequireTLS, } from "../client-connect/transportSecurity.js";
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export { createDirectNodeReconnectConfig, createNodeReconnectConfig, createTunnelNodeReconnectConfig, } from "./reconnectConfig.js";
+export * from "../endpoint/index.js";
+export * from "../endpoint/node.js";
+export * from "../proxy/server.js";
 export { assertConnectArtifact } from "../connect/artifact.js";

package/dist/proxy/constants.js

@@ -1,6 +1,7 @@
+import { SDK_DEFAULTS } from "../defaults.js";
 export const PROXY_PROTOCOL_VERSION = 1;
 export const PROXY_KIND_HTTP1 = "flowersec-proxy/http1";
 export const PROXY_KIND_WS = "flowersec-proxy/ws";
-export const DEFAULT_MAX_CHUNK_BYTES = 256 * 1024;
-export const DEFAULT_MAX_BODY_BYTES = 64 * 1024 * 1024;
-export const DEFAULT_MAX_WS_FRAME_BYTES = 1024 * 1024;
+export const DEFAULT_MAX_CHUNK_BYTES = SDK_DEFAULTS.proxy.maxChunkBytes;
+export const DEFAULT_MAX_BODY_BYTES = SDK_DEFAULTS.proxy.maxBodyBytes;
+export const DEFAULT_MAX_WS_FRAME_BYTES = SDK_DEFAULTS.proxy.maxWsFrameBytes;

package/dist/proxy/headerPolicy.js

@@ -7,6 +7,7 @@ const DEFAULT_REQUEST_HEADER_ALLOWLIST = new Set([
     "if-modified-since",
     "if-none-match",
     "if-unmodified-since",
+    "origin",
     "pragma",
     "range",
     "x-requested-with"

package/dist/proxy/server.d.ts

@@ -0,0 +1,27 @@
+import type { Session } from "../endpoint/index.js";
+import { RpcRouter, type RpcServerOptions } from "../rpc/server.js";
+import type { YamuxStream } from "../yamux/stream.js";
+import { PROXY_KIND_HTTP1, PROXY_KIND_WS } from "./constants.js";
+export type ProxyServerOptions = Readonly<{
+    upstream: string;
+    upstreamOrigin?: string;
+    allowedUpstreamHosts?: readonly string[];
+    maxJsonFrameBytes?: number;
+    maxChunkBytes?: number;
+    maxBodyBytes?: number;
+    maxWsFrameBytes?: number;
+    defaultTimeoutMs?: number;
+    maxTimeoutMs?: number;
+    maxConcurrentStreams?: number;
+    extraRequestHeaders?: readonly string[];
+    extraResponseHeaders?: readonly string[];
+    blockedResponseHeaders?: readonly string[];
+    extraWsHeaders?: readonly string[];
+    forbiddenCookieNames?: readonly string[];
+    forbiddenCookieNamePrefixes?: readonly string[];
+    fetch?: typeof fetch;
+    rpcRouter?: RpcRouter;
+    rpcServerOptions?: RpcServerOptions;
+}>;
+export declare function serveProxySession(session: Session, options: ProxyServerOptions, signal?: AbortSignal): Promise<void>;
+export declare function serveProxyStream(kind: typeof PROXY_KIND_HTTP1 | typeof PROXY_KIND_WS, stream: YamuxStream, options: ProxyServerOptions, signal?: AbortSignal): Promise<void>;