@floegence/flowersec-core 0.21.1 → 0.22.1

package/dist/endpoint/node.d.ts

@@ -0,0 +1,9 @@
+import type { WebSocketLike } from "../ws-client/binaryTransport.js";
+import { type DirectAcceptOptions, type DirectCredentialResolver, type DirectHandshakeCredential, type Session, type Suite, type TunnelEndpointOptions } from "./index.js";
+export declare function adaptNodeWebSocket(websocket: unknown): WebSocketLike;
+export declare function acceptDirectNode(websocket: unknown, handshake: Readonly<{
+    channelId: string;
+    suite: Suite;
+}> & DirectHandshakeCredential, options?: DirectAcceptOptions): Promise<Session>;
+export declare function acceptDirectResolvedNode(websocket: unknown, resolver: DirectCredentialResolver, options?: DirectAcceptOptions): Promise<Session>;
+export declare function connectTunnelEndpointNode(grant: unknown, options: Omit<TunnelEndpointOptions, "wsFactory">): Promise<Session>;

package/dist/endpoint/node.js

@@ -0,0 +1,51 @@
+import { createNodeWsFactory } from "../node/wsFactory.js";
+import { acceptDirect, acceptDirectResolved, connectTunnel, } from "./index.js";
+export function adaptNodeWebSocket(websocket) {
+    const raw = websocket;
+    if (raw == null || typeof raw.send !== "function" || typeof raw.close !== "function") {
+        throw new TypeError("a Node WebSocket is required");
+    }
+    if (typeof raw.addEventListener === "function" && typeof raw.removeEventListener === "function") {
+        return raw;
+    }
+    const listeners = new Map();
+    return {
+        get binaryType() { return String(raw.binaryType ?? "nodebuffer"); },
+        set binaryType(value) { raw.binaryType = value; },
+        get readyState() { return Number(raw.readyState); },
+        get bufferedAmount() { return Number(raw.bufferedAmount ?? 0); },
+        send(data) { raw.send(data); },
+        close(code, reason) { raw.close(code, reason); },
+        addEventListener(type, listener) {
+            const wrapped = (...args) => {
+                if (type === "message")
+                    listener({ data: args[0] });
+                else if (type === "close")
+                    listener({ code: args[0], reason: args[1]?.toString?.() ?? "" });
+                else
+                    listener(args[0]);
+            };
+            const byListener = listeners.get(type) ?? new Map();
+            byListener.set(listener, wrapped);
+            listeners.set(type, byListener);
+            raw.on(type, wrapped);
+        },
+        removeEventListener(type, listener) {
+            const byListener = listeners.get(type);
+            const wrapped = byListener?.get(listener);
+            if (wrapped == null)
+                return;
+            byListener.delete(listener);
+            raw.off(type, wrapped);
+        },
+    };
+}
+export function acceptDirectNode(websocket, handshake, options = {}) {
+    return acceptDirect(adaptNodeWebSocket(websocket), handshake, options);
+}
+export function acceptDirectResolvedNode(websocket, resolver, options = {}) {
+    return acceptDirectResolved(adaptNodeWebSocket(websocket), resolver, options);
+}
+export function connectTunnelEndpointNode(grant, options) {
+    return connectTunnel(grant, { ...options, wsFactory: createNodeWsFactory() });
+}

package/dist/facade.d.ts

@@ -17,8 +17,8 @@ export type { WebSocketLimits } from "./ws-client/binaryTransport.js";
 export type { YamuxLimits } from "./yamux/session.js";
 export type { FlowersecErrorCode, FlowersecPath, FlowersecStage } from "./utils/errors.js";
 export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, RequireTLS, } from "./client-connect/transportSecurity.js";
-export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, } from "./client-connect/transportSecurity.js";
+export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
+export type { NetworkPlaintextPolicyOptions, TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, } from "./client-connect/transportSecurity.js";
 export type { TunnelConnectOptions } from "./tunnel-client/connect.js";
 export type { DirectConnectOptions } from "./direct-client/connect.js";
 export type ConnectOptions = TunnelConnectOptions | DirectConnectOptions;

package/dist/facade.js

@@ -6,7 +6,7 @@ export { assertChannelInitGrant } from "./gen/flowersec/controlplane/v1.gen.js";
 export { assertDirectConnectInfo } from "./gen/flowersec/direct/v1.gen.js";
 export { assertConnectArtifact } from "./connect/artifact.js";
 export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, RequireTLS, } from "./client-connect/transportSecurity.js";
+export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
 export async function connectTunnel(grant, opts) {
     return await connectTunnelInternal(grant, opts);
 }

package/dist/framing/jsonframe.js

@@ -1,5 +1,6 @@
 import { readU32be, u32be } from "../utils/bin.js";
-export const DEFAULT_MAX_JSON_FRAME_BYTES = 1 << 20;
+import { SDK_DEFAULTS } from "../defaults.js";
+export const DEFAULT_MAX_JSON_FRAME_BYTES = SDK_DEFAULTS.rpc.maxJsonFrameBytes;
 const te = new TextEncoder();
 const td = new TextDecoder();
 // JsonFramingError marks malformed or oversized frames.

package/dist/node/index.d.ts

@@ -1,8 +1,11 @@
 export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, RequireTLS, } from "../client-connect/transportSecurity.js";
-export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, NetworkPlaintextPolicyOptions, } from "../client-connect/transportSecurity.js";
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export type { DirectNodeReconnectConfig, NodeReconnectConfig, TunnelNodeReconnectConfig, } from "./reconnectConfig.js";
 export { createDirectNodeReconnectConfig, createNodeReconnectConfig, createTunnelNodeReconnectConfig, } from "./reconnectConfig.js";
+export * from "../endpoint/index.js";
+export * from "../endpoint/node.js";
+export * from "../proxy/server.js";
 export type { ConnectArtifact, CorrelationContext, CorrelationKV, DirectClientConnectArtifact, ScopeMetadataEntry, TunnelClientConnectArtifact, } from "../connect/artifact.js";
 export { assertConnectArtifact } from "../connect/artifact.js";

package/dist/node/index.js

@@ -1,5 +1,8 @@
 export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export { createDirectNodeReconnectConfig, createNodeReconnectConfig, createTunnelNodeReconnectConfig, } from "./reconnectConfig.js";
+export * from "../endpoint/index.js";
+export * from "../endpoint/node.js";
+export * from "../proxy/server.js";
 export { assertConnectArtifact } from "../connect/artifact.js";

package/dist/proxy/constants.js

@@ -1,6 +1,7 @@
+import { SDK_DEFAULTS } from "../defaults.js";
 export const PROXY_PROTOCOL_VERSION = 1;
 export const PROXY_KIND_HTTP1 = "flowersec-proxy/http1";
 export const PROXY_KIND_WS = "flowersec-proxy/ws";
-export const DEFAULT_MAX_CHUNK_BYTES = 256 * 1024;
-export const DEFAULT_MAX_BODY_BYTES = 64 * 1024 * 1024;
-export const DEFAULT_MAX_WS_FRAME_BYTES = 1024 * 1024;
+export const DEFAULT_MAX_CHUNK_BYTES = SDK_DEFAULTS.proxy.maxChunkBytes;
+export const DEFAULT_MAX_BODY_BYTES = SDK_DEFAULTS.proxy.maxBodyBytes;
+export const DEFAULT_MAX_WS_FRAME_BYTES = SDK_DEFAULTS.proxy.maxWsFrameBytes;

package/dist/proxy/headerPolicy.js

@@ -7,6 +7,7 @@ const DEFAULT_REQUEST_HEADER_ALLOWLIST = new Set([
     "if-modified-since",
     "if-none-match",
     "if-unmodified-since",
+    "origin",
     "pragma",
     "range",
     "x-requested-with"

package/dist/proxy/server.d.ts

@@ -0,0 +1,27 @@
+import type { Session } from "../endpoint/index.js";
+import { RpcRouter, type RpcServerOptions } from "../rpc/server.js";
+import type { YamuxStream } from "../yamux/stream.js";
+import { PROXY_KIND_HTTP1, PROXY_KIND_WS } from "./constants.js";
+export type ProxyServerOptions = Readonly<{
+    upstream: string;
+    upstreamOrigin?: string;
+    allowedUpstreamHosts?: readonly string[];
+    maxJsonFrameBytes?: number;
+    maxChunkBytes?: number;
+    maxBodyBytes?: number;
+    maxWsFrameBytes?: number;
+    defaultTimeoutMs?: number;
+    maxTimeoutMs?: number;
+    maxConcurrentStreams?: number;
+    extraRequestHeaders?: readonly string[];
+    extraResponseHeaders?: readonly string[];
+    blockedResponseHeaders?: readonly string[];
+    extraWsHeaders?: readonly string[];
+    forbiddenCookieNames?: readonly string[];
+    forbiddenCookieNamePrefixes?: readonly string[];
+    fetch?: typeof fetch;
+    rpcRouter?: RpcRouter;
+    rpcServerOptions?: RpcServerOptions;
+}>;
+export declare function serveProxySession(session: Session, options: ProxyServerOptions, signal?: AbortSignal): Promise<void>;
+export declare function serveProxyStream(kind: typeof PROXY_KIND_HTTP1 | typeof PROXY_KIND_WS, stream: YamuxStream, options: ProxyServerOptions, signal?: AbortSignal): Promise<void>;

package/dist/proxy/server.js

@@ -0,0 +1,480 @@
+import { createRequire } from "node:module";
+import { DEFAULT_MAX_JSON_FRAME_BYTES, readJsonFrame, writeJsonFrame } from "../framing/jsonframe.js";
+import { RpcRouter, RpcServer } from "../rpc/server.js";
+import { createByteReader } from "../streamio/index.js";
+import { readU32be, u32be } from "../utils/bin.js";
+import { DEFAULT_MAX_BODY_BYTES, DEFAULT_MAX_CHUNK_BYTES, DEFAULT_MAX_WS_FRAME_BYTES, PROXY_KIND_HTTP1, PROXY_KIND_WS, PROXY_PROTOCOL_VERSION, } from "./constants.js";
+import { filterRequestHeaders, filterResponseHeaders, filterWsOpenHeaders, isSafeHeaderValue, isValidHeaderName, normalizeHeaderName } from "./headerPolicy.js";
+export async function serveProxySession(session, options, signal) {
+    const compiled = compileOptions(options);
+    const active = new Set();
+    try {
+        while (!signal?.aborted) {
+            const accepted = await session.acceptStream(signal === undefined ? {} : { signal });
+            if (accepted.kind === "rpc") {
+                if (active.size >= compiled.maxConcurrentStreams) {
+                    await accepted.stream.reset(new Error("proxy stream concurrency exhausted"));
+                    continue;
+                }
+                const task = serveRPCStream(accepted.stream, options.rpcRouter ?? new RpcRouter(), options.rpcServerOptions, signal)
+                    .catch(() => { })
+                    .finally(() => active.delete(task));
+                active.add(task);
+                continue;
+            }
+            if (accepted.kind !== PROXY_KIND_HTTP1 && accepted.kind !== PROXY_KIND_WS) {
+                await accepted.stream.reset(new Error(`unsupported proxy stream kind ${accepted.kind}`));
+                continue;
+            }
+            if (active.size >= compiled.maxConcurrentStreams) {
+                await accepted.stream.reset(new Error("proxy stream concurrency exhausted"));
+                continue;
+            }
+            const task = serveProxyStreamCompiled(accepted.kind, accepted.stream, compiled, signal)
+                .catch(() => { })
+                .finally(() => active.delete(task));
+            active.add(task);
+        }
+    }
+    finally {
+        await Promise.allSettled(active);
+    }
+}
+async function serveRPCStream(stream, router, options, signal) {
+    const reader = createByteReader(stream, signal === undefined ? {} : { signal });
+    const server = new RpcServer({
+        readExactly: (length) => reader.readExactly(length),
+        write: (bytes) => stream.write(bytes),
+        close: (error) => { void stream.reset(asError(error)); },
+    }, options, router);
+    await server.serve(signal);
+}
+export function serveProxyStream(kind, stream, options, signal) {
+    return serveProxyStreamCompiled(kind, stream, compileOptions(options), signal);
+}
+async function serveProxyStreamCompiled(kind, stream, options, signal) {
+    try {
+        if (kind === PROXY_KIND_HTTP1)
+            await serveHTTP(stream, options, signal);
+        else
+            await serveWebSocket(stream, options, signal);
+    }
+    finally {
+        try {
+            await stream.close();
+        }
+        catch { /* The peer may already have reset the stream. */ }
+    }
+}
+async function serveHTTP(stream, options, signal) {
+    const reader = createByteReader(stream, signal === undefined ? {} : { signal });
+    let requestId = "unknown";
+    try {
+        const meta = assertHTTPRequestMeta(await readJsonFrame(reader, options.maxJsonFrameBytes));
+        requestId = meta.request_id;
+        const path = parsePath(meta.path);
+        const body = await readBody(reader, options.maxChunkBytes, options.maxBodyBytes);
+        const headers = requestHeaders(meta.headers, options);
+        applyExternalOrigin(headers, meta.external_origin);
+        const target = new URL(options.upstream);
+        target.pathname = path.pathname;
+        target.search = path.search;
+        target.hash = "";
+        const timeoutMs = resolveTimeout(meta.timeout_ms, options);
+        const controller = new AbortController();
+        const onAbort = () => controller.abort(signal?.reason);
+        signal?.addEventListener("abort", onAbort, { once: true });
+        const timer = timeoutMs > 0 ? setTimeout(() => controller.abort(new Error("upstream request timeout")), timeoutMs) : undefined;
+        try {
+            const method = meta.method.trim().toUpperCase();
+            const response = await options.fetch(target, {
+                method,
+                headers,
+                redirect: "manual",
+                signal: controller.signal,
+                ...((method === "GET" || method === "HEAD") ? {} : { body: body.slice().buffer }),
+            });
+            const responseHeaders = collectResponseHeaders(response.headers, options);
+            const responseMeta = {
+                v: PROXY_PROTOCOL_VERSION,
+                request_id: requestId,
+                ok: true,
+                status: response.status,
+                headers: responseHeaders,
+            };
+            await writeJsonFrame(stream, responseMeta);
+            if (response.body == null) {
+                await stream.write(u32be(0));
+                return;
+            }
+            const bodyReader = response.body.getReader();
+            let total = 0;
+            while (true) {
+                const next = await bodyReader.read();
+                if (next.done)
+                    break;
+                const bytes = next.value;
+                total += bytes.length;
+                if (total > options.maxBodyBytes)
+                    throw new ProxyServerError("response_body_too_large", "response body too large");
+                for (let offset = 0; offset < bytes.length; offset += options.maxChunkBytes) {
+                    const chunk = bytes.subarray(offset, Math.min(bytes.length, offset + options.maxChunkBytes));
+                    await stream.write(u32be(chunk.length));
+                    await stream.write(chunk);
+                }
+            }
+            await stream.write(u32be(0));
+        }
+        finally {
+            if (timer != null)
+                clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+        }
+    }
+    catch (error) {
+        await writeHTTPError(stream, requestId, classifyHTTPError(error), error);
+    }
+}
+async function serveWebSocket(stream, options, signal) {
+    const reader = createByteReader(stream, signal === undefined ? {} : { signal });
+    let connId = "unknown";
+    let raw;
+    try {
+        const meta = assertWSOpenMeta(await readJsonFrame(reader, options.maxJsonFrameBytes));
+        connId = meta.conn_id;
+        const path = parsePath(meta.path);
+        const target = new URL(options.upstream);
+        target.protocol = target.protocol === "https:" ? "wss:" : "ws:";
+        target.pathname = path.pathname;
+        target.search = path.search;
+        target.hash = "";
+        const filtered = serverWSHeaders(meta.headers, options);
+        const protocolsHeader = filtered.find((header) => header.name === "sec-websocket-protocol")?.value ?? "";
+        const protocols = protocolsHeader.split(",").map((value) => value.trim()).filter((value) => value !== "");
+        const headers = { Origin: options.upstreamOrigin };
+        for (const header of filtered) {
+            if (header.name === "sec-websocket-protocol")
+                continue;
+            headers[header.name] = headers[header.name] == null ? header.value : `${headers[header.name]}, ${header.value}`;
+        }
+        const require = createRequire(import.meta.url);
+        const module = require("ws");
+        const WebSocketCtor = module.WebSocket ?? module;
+        raw = new WebSocketCtor(target.toString(), protocols, {
+            headers,
+            maxPayload: options.maxWsFrameBytes,
+            perMessageDeflate: false,
+            handshakeTimeout: Math.min(options.defaultTimeoutMs, options.maxTimeoutMs),
+        });
+        await waitForUpstreamOpen(raw, signal);
+        const response = {
+            v: PROXY_PROTOCOL_VERSION,
+            conn_id: connId,
+            ok: true,
+            protocol: String(raw.protocol ?? ""),
+        };
+        await writeJsonFrame(stream, response);
+        let writeChain = Promise.resolve();
+        let terminalResolve;
+        const terminal = new Promise((resolve) => { terminalResolve = resolve; });
+        const writeFrame = (op, payload) => {
+            const write = writeChain.then(() => writeWSFrame(stream, op, payload, options.maxWsFrameBytes));
+            writeChain = write.catch(() => { });
+            void write.catch((error) => terminalResolve(asError(error)));
+        };
+        raw.on("message", (data, isBinary) => writeFrame(isBinary ? 2 : 1, toBytes(data)));
+        raw.on("ping", (data) => writeFrame(9, toBytes(data)));
+        raw.on("pong", (data) => writeFrame(10, toBytes(data)));
+        raw.on("close", (code, reason) => {
+            const reasonBytes = toBytes(reason);
+            const payload = new Uint8Array(2 + reasonBytes.length);
+            payload[0] = (code >>> 8) & 0xff;
+            payload[1] = code & 0xff;
+            payload.set(reasonBytes, 2);
+            writeFrame(8, payload);
+            terminalResolve();
+        });
+        raw.on("error", (error) => terminalResolve(error));
+        const inbound = (async () => {
+            while (true) {
+                const frame = await readWSFrame(reader, options.maxWsFrameBytes);
+                switch (frame.op) {
+                    case 1:
+                        raw.send(frame.payload, { binary: false });
+                        break;
+                    case 2:
+                        raw.send(frame.payload, { binary: true });
+                        break;
+                    case 8:
+                        raw.close(frame.payload.length >= 2 ? (frame.payload[0] << 8) | frame.payload[1] : 1000, new TextDecoder().decode(frame.payload.subarray(2)));
+                        return;
+                    case 9:
+                        raw.ping(frame.payload);
+                        break;
+                    case 10:
+                        raw.pong(frame.payload);
+                        break;
+                    default: throw new Error("invalid websocket frame operation");
+                }
+            }
+        })();
+        const result = await Promise.race([inbound.then(() => undefined), terminal]);
+        if (result != null)
+            throw result;
+        await writeChain;
+    }
+    catch (error) {
+        if (raw == null || raw.readyState !== 1)
+            await writeWSOpenError(stream, connId, classifyWSError(error), error);
+    }
+    finally {
+        try {
+            raw?.close();
+        }
+        catch { /* Best effort. */ }
+    }
+}
+function compileOptions(input) {
+    const upstream = new URL(input.upstream);
+    if ((upstream.protocol !== "http:" && upstream.protocol !== "https:") || upstream.username !== "" || upstream.password !== "") {
+        throw new Error("upstream must be an http(s) URL without credentials");
+    }
+    const allowedHosts = new Set((input.allowedUpstreamHosts?.length ? input.allowedUpstreamHosts : ["127.0.0.1"]).map((host) => host.trim().toLowerCase()));
+    if (!allowedHosts.has(upstream.hostname.toLowerCase()))
+        throw new Error("upstream host is not allowed");
+    const upstreamOrigin = normalizeOrigin(input.upstreamOrigin ?? upstream.origin);
+    const maxJsonFrameBytes = positive(input.maxJsonFrameBytes, DEFAULT_MAX_JSON_FRAME_BYTES, "maxJsonFrameBytes");
+    const maxChunkBytes = positive(input.maxChunkBytes, DEFAULT_MAX_CHUNK_BYTES, "maxChunkBytes");
+    const maxBodyBytes = positive(input.maxBodyBytes, DEFAULT_MAX_BODY_BYTES, "maxBodyBytes");
+    const maxWsFrameBytes = positive(input.maxWsFrameBytes, DEFAULT_MAX_WS_FRAME_BYTES, "maxWsFrameBytes");
+    const defaultTimeoutMs = nonNegative(input.defaultTimeoutMs, 30_000, "defaultTimeoutMs");
+    const maxTimeoutMs = nonNegative(input.maxTimeoutMs, 300_000, "maxTimeoutMs");
+    if (maxTimeoutMs > 0 && defaultTimeoutMs > maxTimeoutMs)
+        throw new Error("defaultTimeoutMs exceeds maxTimeoutMs");
+    return {
+        upstream,
+        upstreamOrigin,
+        maxJsonFrameBytes,
+        maxChunkBytes,
+        maxBodyBytes,
+        maxWsFrameBytes,
+        defaultTimeoutMs,
+        maxTimeoutMs,
+        maxConcurrentStreams: positive(input.maxConcurrentStreams, 64, "maxConcurrentStreams"),
+        extraRequestHeaders: input.extraRequestHeaders ?? [],
+        extraResponseHeaders: input.extraResponseHeaders ?? [],
+        blockedResponseHeaders: normalizeNames(input.blockedResponseHeaders),
+        extraWsHeaders: input.extraWsHeaders ?? [],
+        forbiddenCookieNames: normalizeNames(input.forbiddenCookieNames),
+        forbiddenCookieNamePrefixes: [...normalizeNames(input.forbiddenCookieNamePrefixes)],
+        fetch: input.fetch ?? globalThis.fetch.bind(globalThis),
+    };
+}
+function assertHTTPRequestMeta(input) {
+    if (typeof input !== "object" || input == null || Array.isArray(input))
+        throw new ProxyServerError("invalid_request_meta", "invalid HTTP request meta");
+    const meta = input;
+    if (meta.v !== PROXY_PROTOCOL_VERSION || typeof meta.request_id !== "string" || meta.request_id.trim() === "")
+        throw new ProxyServerError("invalid_request_meta", "invalid request ID");
+    if (typeof meta.method !== "string" || meta.method.trim() === "" || typeof meta.path !== "string" || !Array.isArray(meta.headers))
+        throw new ProxyServerError("invalid_request_meta", "invalid HTTP request meta");
+    if (meta.timeout_ms !== undefined && (!Number.isSafeInteger(meta.timeout_ms) || meta.timeout_ms < 0))
+        throw new ProxyServerError("invalid_request_meta", "invalid timeout_ms");
+    return { ...meta, request_id: meta.request_id.trim(), method: meta.method.trim() };
+}
+function assertWSOpenMeta(input) {
+    if (typeof input !== "object" || input == null || Array.isArray(input))
+        throw new ProxyServerError("invalid_ws_open_meta", "invalid websocket open meta");
+    const meta = input;
+    if (meta.v !== PROXY_PROTOCOL_VERSION || typeof meta.conn_id !== "string" || meta.conn_id.trim() === "" || typeof meta.path !== "string" || !Array.isArray(meta.headers)) {
+        throw new ProxyServerError("invalid_ws_open_meta", "invalid websocket open meta");
+    }
+    return { ...meta, conn_id: meta.conn_id.trim() };
+}
+function parsePath(input) {
+    const path = input.trim();
+    if (!path.startsWith("/") || path.startsWith("//") || path.includes("://") || /[\r\n\t ]/.test(path))
+        throw new ProxyServerError("invalid_request_meta", "invalid path");
+    return new URL(path, "http://flowersec.invalid");
+}
+function requestHeaders(input, options) {
+    const filtered = filterRequestHeaders(input, { extraAllowed: options.extraRequestHeaders });
+    const headers = new Headers();
+    for (const header of filtered)
+        headers.append(header.name, header.value);
+    for (const header of input) {
+        if (normalizeHeaderName(header.name) !== "cookie" || !isSafeHeaderValue(header.value))
+            continue;
+        const cookie = filterCookie(header.value, options);
+        if (cookie !== "")
+            headers.append("cookie", cookie);
+    }
+    return headers;
+}
+function serverWSHeaders(input, options) {
+    const filtered = filterWsOpenHeaders(input, { extraAllowed: options.extraWsHeaders });
+    return filtered.flatMap((header) => header.name === "cookie" ? [{ ...header, value: filterCookie(header.value, options) }] : [header]).filter((header) => header.value !== "");
+}
+function filterCookie(input, options) {
+    return input.split(";").map((part) => part.trim()).filter((part) => {
+        const index = part.indexOf("=");
+        if (index <= 0)
+            return false;
+        const name = part.slice(0, index).trim().toLowerCase();
+        if (options.forbiddenCookieNames.has(name))
+            return false;
+        return !options.forbiddenCookieNamePrefixes.some((prefix) => name.startsWith(prefix));
+    }).join("; ");
+}
+function collectResponseHeaders(input, options) {
+    const raw = [];
+    const setCookies = input.getSetCookie?.() ?? [];
+    input.forEach((value, name) => {
+        if (name.toLowerCase() !== "set-cookie")
+            raw.push({ name, value });
+    });
+    for (const value of setCookies)
+        raw.push({ name: "set-cookie", value });
+    return filterResponseHeaders(raw, { extraAllowed: options.extraResponseHeaders }).passthrough
+        .concat(raw.filter((header) => normalizeHeaderName(header.name) === "set-cookie"))
+        .filter((header) => !options.blockedResponseHeaders.has(normalizeHeaderName(header.name)));
+}
+function applyExternalOrigin(headers, input) {
+    if (input == null || input.trim() === "")
+        return;
+    const external = normalizeOrigin(input);
+    const current = headers.get("origin");
+    if (current != null && normalizeOrigin(current) !== external)
+        throw new ProxyServerError("invalid_request_meta", "external_origin conflicts with origin header");
+    headers.set("x-forwarded-proto", new URL(external).protocol.slice(0, -1));
+    headers.set("host", new URL(external).host);
+}
+async function readBody(reader, maxChunkBytes, maxBodyBytes) {
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const length = readU32be(await reader.readExactly(4), 0);
+        if (length === 0)
+            break;
+        if (length > maxChunkBytes)
+            throw new ProxyServerError("request_body_too_large", "request chunk too large");
+        total += length;
+        if (total > maxBodyBytes)
+            throw new ProxyServerError("request_body_too_large", "request body too large");
+        chunks.push(await reader.readExactly(length));
+    }
+    const body = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        body.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return body;
+}
+async function writeHTTPError(stream, requestId, code, error) {
+    const meta = { v: PROXY_PROTOCOL_VERSION, request_id: requestId.trim() || "unknown", ok: false, error: { code, message: asError(error).message } };
+    try {
+        await writeJsonFrame(stream, meta);
+        await stream.write(u32be(0));
+    }
+    catch { /* The peer may be gone. */ }
+}
+async function readWSFrame(reader, maxBytes) {
+    const header = await reader.readExactly(5);
+    const length = readU32be(header, 1);
+    if (length > maxBytes)
+        throw new Error("websocket frame too large");
+    return { op: header[0], payload: await reader.readExactly(length) };
+}
+async function writeWSFrame(stream, op, payload, maxBytes) {
+    if (payload.length > maxBytes)
+        throw new Error("websocket frame too large");
+    const header = new Uint8Array(5);
+    header[0] = op;
+    header.set(u32be(payload.length), 1);
+    await stream.write(header);
+    if (payload.length > 0)
+        await stream.write(payload);
+}
+async function writeWSOpenError(stream, connId, code, error) {
+    const response = { v: PROXY_PROTOCOL_VERSION, conn_id: connId.trim() || "unknown", ok: false, error: { code, message: asError(error).message } };
+    try {
+        await writeJsonFrame(stream, response);
+    }
+    catch { /* The peer may be gone. */ }
+}
+function waitForUpstreamOpen(websocket, signal) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => { websocket.off("open", onOpen); websocket.off("error", onError); signal?.removeEventListener("abort", onAbort); };
+        const onOpen = () => { cleanup(); resolve(); };
+        const onError = (error) => { cleanup(); reject(error); };
+        const onAbort = () => { cleanup(); reject(signal?.reason ?? new Error("aborted")); };
+        websocket.once("open", onOpen);
+        websocket.once("error", onError);
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function resolveTimeout(input, options) {
+    const timeout = input == null || input === 0 ? options.defaultTimeoutMs : input;
+    return options.maxTimeoutMs > 0 ? Math.min(timeout, options.maxTimeoutMs) : timeout;
+}
+function normalizeOrigin(input) {
+    const url = new URL(input);
+    if ((url.protocol !== "http:" && url.protocol !== "https:") || url.username !== "" || url.password !== "" || (url.pathname !== "" && url.pathname !== "/") || url.search !== "" || url.hash !== "")
+        throw new Error("invalid origin");
+    return url.origin;
+}
+function normalizeNames(input) {
+    const result = new Set();
+    for (const item of input ?? []) {
+        const name = normalizeHeaderName(item);
+        if (name === "" || !isValidHeaderName(name))
+            throw new Error("invalid policy name");
+        result.add(name);
+    }
+    return result;
+}
+function positive(input, fallback, name) {
+    const value = input ?? fallback;
+    if (!Number.isSafeInteger(value) || value <= 0)
+        throw new Error(`${name} must be a positive integer`);
+    return value;
+}
+function nonNegative(input, fallback, name) {
+    const value = input ?? fallback;
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new Error(`${name} must be a non-negative integer`);
+    return value;
+}
+function classifyHTTPError(error) {
+    if (error instanceof ProxyServerError)
+        return error.code;
+    if (asError(error).name === "AbortError")
+        return "timeout";
+    return "upstream_request_failed";
+}
+function classifyWSError(error) {
+    if (error instanceof ProxyServerError)
+        return error.code;
+    return "upstream_ws_dial_failed";
+}
+function toBytes(input) {
+    if (input instanceof Uint8Array)
+        return input;
+    if (input instanceof ArrayBuffer)
+        return new Uint8Array(input);
+    if (ArrayBuffer.isView(input))
+        return new Uint8Array(input.buffer, input.byteOffset, input.byteLength);
+    return new TextEncoder().encode(String(input ?? ""));
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+class ProxyServerError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "ProxyServerError";
+    }
+}