@floegence/flowersec-core 0.24.0 → 0.26.0

package/README.md

@@ -27,6 +27,12 @@ Start with the [TypeScript cookbook](https://github.com/floegence/flowersec/tree
 
 High-level WebSocket connections require TLS by default. Use `AllowPlaintextForLoopback` only for literal local development targets.
 
+## Node Proxy Server
+
+The Node entrypoint exports `serveProxySession(...)`, `serveProxyStream(...)`, and `ProxyServerOptions`. HTTP request and response bodies stream between Flowersec chunk frames and the upstream fetch while remaining bounded per request by `maxBodyBytes`. Proxy sessions admit at most `maxConcurrentStreams` HTTP/WebSocket streams, with a shared default of 64; RPC serving has its own concurrency controls. WebSocket frames remain bounded by `maxWsFrameBytes`; `maxWsQueuedBytes` additionally caps upstream-to-Yamux queued bytes per connection, while the reverse direction waits for each Node `ws` send callback.
+
+The defaults keep one queued WebSocket frame plus its proxy header. Raise body, concurrency, or queue limits only when the deployment has matching upstream and memory capacity.
+
 ## Runtime Boundaries
 
 TypeScript owns browser and Service Worker integration. Shared tunnel, proxy gateway, and helper binaries remain Go-owned.

package/dist/browser/controlplane.d.ts

@@ -1,6 +1,5 @@
 import { type ChannelInitGrant } from "../facade.js";
 import type { ControlplaneBaseConfig as SharedControlplaneBaseConfig, RequestConnectArtifactInput, RequestEntryConnectArtifactInput } from "../controlplane/request.js";
-export { ControlplaneRequestError, requestConnectArtifact, requestEntryConnectArtifact, } from "../controlplane/request.js";
 type BaseControlplaneRequestConfig = SharedControlplaneBaseConfig & Readonly<{
     endpointId: string;
     payload?: Record<string, unknown>;
@@ -13,3 +12,4 @@ export type ConnectArtifactRequestConfig = RequestConnectArtifactInput;
 export type EntryConnectArtifactRequestConfig = RequestEntryConnectArtifactInput;
 export declare function requestChannelGrant(config: ControlplaneConfig): Promise<ChannelInitGrant>;
 export declare function requestEntryChannelGrant(config: EntryControlplaneConfig): Promise<ChannelInitGrant>;
+export {};

package/dist/browser/controlplane.js

@@ -1,6 +1,5 @@
 import { assertChannelInitGrant } from "../facade.js";
 import { requestControlplaneJSON, } from "../controlplane/request.js";
-export { ControlplaneRequestError, requestConnectArtifact, requestEntryConnectArtifact, } from "../controlplane/request.js";
 function buildURL(baseUrl, path) {
     const base = String(baseUrl ?? "").trim();
     if (base === "")

package/dist/browser/index.d.ts

@@ -1,10 +1,10 @@
 export type { ConnectBrowserOptions, DirectConnectBrowserOptions, TunnelConnectBrowserOptions } from "./connect.js";
 export { connectBrowser, connectDirectBrowser, connectTunnelBrowser } from "./connect.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, NetworkPlaintextPolicyOptions, } from "../client-connect/transportSecurity.js";
 export type { ConnectArtifact, CorrelationContext, CorrelationKV, DirectClientConnectArtifact, ScopeMetadataEntry, TunnelClientConnectArtifact, } from "../connect/artifact.js";
 export { assertConnectArtifact } from "../connect/artifact.js";
-export type { ConnectArtifactRequestConfig, ControlplaneConfig, EntryConnectArtifactRequestConfig, EntryControlplaneConfig, } from "./controlplane.js";
-export { ControlplaneRequestError, requestChannelGrant, requestConnectArtifact, requestEntryChannelGrant, requestEntryConnectArtifact, } from "./controlplane.js";
+export type { ControlplaneConfig, EntryControlplaneConfig } from "./controlplane.js";
+export { requestChannelGrant, requestEntryChannelGrant, } from "./controlplane.js";
 export type { BrowserReconnectConfig, DirectBrowserReconnectConfig, TunnelBrowserReconnectConfig, } from "./reconnectConfig.js";
 export { createBrowserReconnectConfig, createDirectBrowserReconnectConfig, createTunnelBrowserReconnectConfig, } from "./reconnectConfig.js";

package/dist/browser/index.js

@@ -1,5 +1,5 @@
 export { connectBrowser, connectDirectBrowser, connectTunnelBrowser } from "./connect.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export { assertConnectArtifact } from "../connect/artifact.js";
-export { ControlplaneRequestError, requestChannelGrant, requestConnectArtifact, requestEntryChannelGrant, requestEntryConnectArtifact, } from "./controlplane.js";
+export { requestChannelGrant, requestEntryChannelGrant, } from "./controlplane.js";
 export { createBrowserReconnectConfig, createDirectBrowserReconnectConfig, createTunnelBrowserReconnectConfig, } from "./reconnectConfig.js";

package/dist/client-connect/transportSecurity.d.ts

@@ -2,8 +2,6 @@ import type { ClientPath } from "../client.js";
 import { type ClientObserverLike } from "../observability/observer.js";
 export declare const RequireTLS: "require_tls";
 export declare const AllowPlaintextForLoopback: "allow_plaintext_for_loopback";
-/** @deprecated Use RequireTLS, AllowPlaintextForLoopback, or createNetworkPlaintextPolicy. */
-export declare const AllowPlaintext: "allow_plaintext";
 export declare const PlaintextRiskAcceptance: {
     readonly acceptPreE2ECredentialExposure: "accept_pre_e2ee_credential_exposure";
 };
@@ -18,7 +16,7 @@ export type TransportSecurityPolicyInput = Readonly<{
     host: string;
     runtime: "browser" | "node" | "other";
 }>;
-export type TransportSecurityPolicyPreset = typeof RequireTLS | typeof AllowPlaintextForLoopback | typeof AllowPlaintext;
+export type TransportSecurityPolicyPreset = typeof RequireTLS | typeof AllowPlaintextForLoopback;
 export type TransportSecurityPolicy = TransportSecurityPolicyPreset | ((input: TransportSecurityPolicyInput) => boolean | Promise<boolean>);
 export declare function createNetworkPlaintextPolicy(options: NetworkPlaintextPolicyOptions): TransportSecurityPolicy;
 export declare function enforceTransportSecurity(args: Readonly<{

package/dist/client-connect/transportSecurity.js

@@ -2,8 +2,6 @@ import { FlowersecError } from "../utils/errors.js";
 import { emitObserverDiagnostic } from "../observability/observer.js";
 export const RequireTLS = "require_tls";
 export const AllowPlaintextForLoopback = "allow_plaintext_for_loopback";
-/** @deprecated Use RequireTLS, AllowPlaintextForLoopback, or createNetworkPlaintextPolicy. */
-export const AllowPlaintext = "allow_plaintext";
 export const PlaintextRiskAcceptance = {
     acceptPreE2ECredentialExposure: "accept_pre_e2ee_credential_exposure",
 };
@@ -35,7 +33,7 @@ export async function enforceTransportSecurity(args) {
     const policy = args.policy ?? RequireTLS;
     try {
         if (typeof policy === "function") {
-            allowed = await policy(input);
+            allowed = await policy(input) === true;
         }
         else {
             allowed = evaluatePreset(policy, target);
@@ -71,8 +69,6 @@ function evaluatePreset(policy, target) {
             return target.scheme === "wss";
         case AllowPlaintextForLoopback:
             return target.scheme === "wss" || isLiteralLoopbackHost(target.host);
-        case AllowPlaintext:
-            return true;
     }
 }
 function parseWebSocketTarget(rawUrl) {

package/dist/controlplane/request.d.ts

@@ -7,6 +7,7 @@ export type ControlplaneBaseConfig = Readonly<{
     credentials?: RequestCredentials;
     fetch?: FetchLike;
     signal?: AbortSignal;
+    allowLoopbackHTTP?: boolean;
 }>;
 export type ArtifactRequestCorrelation = Readonly<{
     traceId?: string;

package/dist/controlplane/request.js

@@ -34,6 +34,76 @@ export function buildControlplaneURL(baseUrl, path) {
         return path;
     return `${base.replace(/\/+$/, "")}${path}`;
 }
+function transportPolicyDenied() {
+    return new ControlplaneRequestError({
+        status: 0,
+        code: "transport_policy_denied",
+        message: "controlplane transport security policy denied URL",
+    });
+}
+function validateArtifactURL(rawUrl, allowLoopbackHTTP) {
+    let target;
+    try {
+        if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(rawUrl)) {
+            target = new URL(rawUrl);
+        }
+        else {
+            const base = globalThis.location?.href;
+            if (!base)
+                throw new Error("relative URL requires a browser location");
+            target = new URL(rawUrl, base);
+        }
+    }
+    catch {
+        throw transportPolicyDenied();
+    }
+    if (target.username !== "" || target.password !== "" || target.hash !== "") {
+        throw transportPolicyDenied();
+    }
+    if (target.protocol === "https:")
+        return;
+    if (target.protocol === "http:"
+        && allowLoopbackHTTP === true
+        && isLiteralLoopbackHost(sourceHostname(rawUrl, target)))
+        return;
+    throw transportPolicyDenied();
+}
+function sourceHostname(rawUrl, target) {
+    const authority = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/([^/?#]*)/.exec(rawUrl)?.[1];
+    if (authority === undefined)
+        return target.hostname;
+    const hostPort = authority.slice(authority.lastIndexOf("@") + 1);
+    if (hostPort.startsWith("[")) {
+        const end = hostPort.indexOf("]");
+        if (end < 0 || (hostPort.length > end + 1 && !/^:\d+$/.test(hostPort.slice(end + 1)))) {
+            return hostPort;
+        }
+        return hostPort.slice(1, end);
+    }
+    const colon = hostPort.lastIndexOf(":");
+    if (colon < 0)
+        return hostPort;
+    if (hostPort.indexOf(":") !== colon || !/^\d+$/.test(hostPort.slice(colon + 1)))
+        return hostPort;
+    return hostPort.slice(0, colon);
+}
+function isLiteralLoopbackHost(rawHost) {
+    const host = rawHost.startsWith("[") && rawHost.endsWith("]")
+        ? rawHost.slice(1, -1).toLowerCase()
+        : rawHost.toLowerCase();
+    if (host === "localhost" || host === "::1")
+        return true;
+    const parts = host.split(".");
+    if (parts.length !== 4)
+        return false;
+    const octets = parts.map((part) => {
+        if (!/^(0|[1-9]\d{0,2})$/.test(part))
+            return -1;
+        const value = Number(part);
+        return value <= 255 ? value : -1;
+    });
+    return octets.every((value) => value >= 0) && octets[0] === 127;
+}
 function parseMaybeJSON(bodyText) {
     const trimmed = String(bodyText ?? "").trim();
     if (trimmed === "")
@@ -110,6 +180,7 @@ export async function requestControlplaneJSON(url, init) {
     const response = await runFetch(url, {
         ...init,
         cache: "no-store",
+        redirect: "error",
     });
     let rawBody = "";
     try {
@@ -164,7 +235,9 @@ function createJSONHeaders(input) {
     return headers;
 }
 export async function requestConnectArtifact(config) {
-    const data = (await requestControlplaneJSON(buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_CONNECT_ARTIFACT_PATH), {
+    const url = buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_CONNECT_ARTIFACT_PATH);
+    validateArtifactURL(url, config.allowLoopbackHTTP);
+    const data = (await requestControlplaneJSON(url, {
         ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
         method: "POST",
         credentials: config.credentials ?? "omit",
@@ -183,7 +256,9 @@ export async function requestEntryConnectArtifact(config) {
         throw new Error("entryTicket is required");
     const headers = createJSONHeaders(config.headers);
     headers.set("Authorization", `Bearer ${entryTicket}`);
-    const data = (await requestControlplaneJSON(buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_ENTRY_CONNECT_ARTIFACT_PATH), {
+    const url = buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_ENTRY_CONNECT_ARTIFACT_PATH);
+    validateArtifactURL(url, config.allowLoopbackHTTP);
+    const data = (await requestControlplaneJSON(url, {
         ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
         method: "POST",
         credentials: config.credentials ?? "omit",

package/dist/defaults.d.ts

@@ -35,6 +35,7 @@ export declare const SDK_DEFAULTS: Readonly<{
         maxChunkBytes: number;
         maxBodyBytes: number;
         maxWsFrameBytes: number;
+        maxConcurrentStreams: 64;
         defaultTimeoutMs: 30000;
         maxTimeoutMs: 300000;
     }>;

package/dist/defaults.js

@@ -35,6 +35,7 @@ export const SDK_DEFAULTS = Object.freeze({
         maxChunkBytes: 256 * 1024,
         maxBodyBytes: 64 * 1024 * 1024,
         maxWsFrameBytes: 1024 * 1024,
+        maxConcurrentStreams: 64,
         defaultTimeoutMs: 30_000,
         maxTimeoutMs: 300_000,
     }),

package/dist/endpoint/index.js

@@ -1,5 +1,6 @@
 import { Role as ControlRole, assertChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
 import { Role as TunnelRole } from "../gen/flowersec/tunnel/v1.gen.js";
+import { withAbortAndTimeout } from "../client-connect/common.js";
 import { assertTunnelGrantContract, assertValidPSK, prepareChannelId } from "../client-connect/contract.js";
 import { enforceTransportSecurity } from "../client-connect/transportSecurity.js";
 import { SDK_DEFAULTS } from "../defaults.js";
@@ -12,7 +13,7 @@ import { isYamuxPingTimeoutError } from "../yamux/errors.js";
 import { YamuxSession } from "../yamux/session.js";
 import { RpcServer } from "../rpc/server.js";
 import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
-import { AbortError, FlowersecError } from "../utils/errors.js";
+import { AbortError, FlowersecError, TimeoutError, throwIfAborted } from "../utils/errors.js";
 import { WebSocketBinaryTransport } from "../ws-client/binaryTransport.js";
 export class Session {
     secure;
@@ -152,15 +153,46 @@ export class Session {
     }
 }
 export async function acceptDirect(websocket, handshake, options = {}) {
+    const handshakeTimeoutMs = options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs;
+    if (!Number.isFinite(handshakeTimeoutMs) || handshakeTimeoutMs < 0) {
+        throw new FlowersecError({
+            path: "direct",
+            stage: "validate",
+            code: "invalid_option",
+            message: "handshakeTimeoutMs must be a non-negative number",
+        });
+    }
     await enforceIncomingDirectTransport(options);
+    const deadline = createHandshakeDeadline(handshakeTimeoutMs);
     const transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
-    return await establishSession("direct", transport, handshake, options);
+    return await establishSession("direct", transport, handshake, options, undefined, deadline);
 }
 export async function acceptDirectResolved(websocket, resolver, options = {}) {
+    const handshakeTimeoutMs = options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs;
+    if (!Number.isFinite(handshakeTimeoutMs) || handshakeTimeoutMs < 0) {
+        throw new FlowersecError({
+            path: "direct",
+            stage: "validate",
+            code: "invalid_option",
+            message: "handshakeTimeoutMs must be a non-negative number",
+        });
+    }
     await enforceIncomingDirectTransport(options);
+    const deadline = createHandshakeDeadline(handshakeTimeoutMs);
     const transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
-    const first = await transport.readBinary(readOptions(options));
+    let first;
+    try {
+        first = await runHandshakeStep(deadline, options.signal, () => transport.readBinary({
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+            timeoutMs: remainingHandshakeTimeoutMs(deadline),
+        }));
+    }
+    catch (error) {
+        transport.close();
+        throw endpointHandshakeError("direct", error, "failed to read handshake init");
+    }
     let init;
+    let channelId;
     try {
         const decoded = decodeHandshakeFrame(first, options.maxHandshakePayload ?? SDK_DEFAULTS.e2ee.maxHandshakePayloadBytes);
         if (decoded.handshakeType !== HANDSHAKE_TYPE_INIT)
@@ -168,30 +200,44 @@ export async function acceptDirectResolved(websocket, resolver, options = {}) {
         init = JSON.parse(new TextDecoder().decode(decoded.payloadJsonUtf8));
         if (init.version !== PROTOCOL_VERSION || init.role !== 1 || (init.suite !== 1 && init.suite !== 2))
             throw new Error("invalid handshake init");
+        channelId = prepareChannelId(init.channel_id, "direct");
+        if (channelId !== init.channel_id) {
+            throw new FlowersecError({
+                path: "direct",
+                stage: "validate",
+                code: "invalid_input",
+                message: "channel_id must not have leading or trailing whitespace",
+            });
+        }
     }
     catch (error) {
         transport.close();
+        if (error instanceof FlowersecError)
+            throw error;
         throw new FlowersecError({ path: "direct", stage: "handshake", code: "handshake_failed", message: "invalid handshake init", cause: error });
     }
     let credential;
     try {
-        credential = await resolver({
-            channelId: prepareChannelId(init.channel_id, "direct"),
+        credential = await runHandshakeStep(deadline, options.signal, () => resolver({
+            channelId,
             version: init.version,
             suite: init.suite,
             clientFeatures: init.client_features >>> 0,
-        });
+        }));
     }
     catch (error) {
         transport.close();
+        const interrupted = endpointHandshakeInterruption("direct", error);
+        if (interrupted != null)
+            throw interrupted;
         throw new FlowersecError({ path: "direct", stage: "validate", code: "resolve_failed", message: "credential resolution failed", cause: error });
     }
     const replay = new PrefetchedTransport(transport, first);
     return await establishSession("direct", replay, {
-        channelId: init.channel_id,
+        channelId,
         suite: init.suite,
         ...credential,
-    }, options);
+    }, options, undefined, deadline);
 }
 export async function connectTunnel(grantInput, options) {
     let grant;
@@ -202,6 +248,7 @@ export async function connectTunnel(grantInput, options) {
         throw new FlowersecError({ path: "tunnel", stage: "validate", code: "invalid_input", message: "invalid ChannelInitGrant", cause: error });
     }
     assertTunnelGrantContract(grant, ControlRole.Role_server);
+    const channelId = prepareChannelId(grant.channel_id, "tunnel");
     const tunnelUrl = grant.tunnel_url.trim();
     if (tunnelUrl === "")
         throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_tunnel_url", message: "missing tunnel_url" });
@@ -212,35 +259,63 @@ export async function connectTunnel(grantInput, options) {
     const origin = options.origin.trim();
     if (origin === "")
         throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_origin", message: "missing origin" });
+    const connectTimeoutMs = options.connectTimeoutMs ?? SDK_DEFAULTS.transport.connectTimeoutMs;
+    if (!Number.isFinite(connectTimeoutMs) || connectTimeoutMs < 0) {
+        throw new FlowersecError({
+            path: "tunnel",
+            stage: "validate",
+            code: "invalid_option",
+            message: "connectTimeoutMs must be a non-negative number",
+        });
+    }
+    const handshakeTimeoutMs = options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs;
+    if (!Number.isFinite(handshakeTimeoutMs) || handshakeTimeoutMs < 0) {
+        throw new FlowersecError({
+            path: "tunnel",
+            stage: "validate",
+            code: "invalid_option",
+            message: "handshakeTimeoutMs must be a non-negative number",
+        });
+    }
+    const psk = assertValidPSK(grant.e2ee_psk_b64u, "tunnel");
     await enforceTransportSecurity({ rawUrl: tunnelUrl, path: "tunnel", ...(options.transportSecurityPolicy === undefined ? {} : { policy: options.transportSecurityPolicy }) });
     const endpointInstanceId = normalizeEndpointInstanceId(options.endpointInstanceId);
-    const websocket = options.wsFactory(tunnelUrl, origin);
-    const transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
+    let transport;
     try {
-        await waitForOpen(websocket, options.connectTimeoutMs ?? SDK_DEFAULTS.transport.connectTimeoutMs, options.signal);
+        throwIfAborted(options.signal, "connect aborted");
+        const websocket = options.wsFactory(tunnelUrl, origin);
+        transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
+        await waitForOpen(websocket, connectTimeoutMs, options.signal);
+        throwIfAborted(options.signal, "connect aborted");
         const attach = {
             v: 1,
-            channel_id: prepareChannelId(grant.channel_id, "tunnel"),
+            channel_id: channelId,
             role: TunnelRole.Role_server,
             token: grant.token.trim(),
             endpoint_instance_id: endpointInstanceId,
         };
         websocket.send(JSON.stringify(attach));
         return await establishSession("tunnel", transport, {
-            channelId: grant.channel_id,
+            channelId,
             suite: grant.default_suite,
-            psk: assertValidPSK(grant.e2ee_psk_b64u, "tunnel"),
+            psk,
             initExpireAtUnixS: grant.channel_init_expire_at_unix_s,
         }, options, endpointInstanceId);
     }
     catch (error) {
-        transport.close();
+        transport?.close();
         if (error instanceof FlowersecError)
             throw error;
+        if (error instanceof TimeoutError) {
+            throw new FlowersecError({ path: "tunnel", stage: "connect", code: "timeout", message: "endpoint tunnel connect timed out", cause: error });
+        }
+        if (error instanceof AbortError) {
+            throw new FlowersecError({ path: "tunnel", stage: "connect", code: "canceled", message: "endpoint tunnel connect canceled", cause: error });
+        }
         throw new FlowersecError({ path: "tunnel", stage: "connect", code: "dial_failed", message: "endpoint tunnel connect failed", cause: error });
     }
 }
-async function establishSession(path, transport, handshake, options, endpointInstanceId) {
+async function establishSession(path, transport, handshake, options, endpointInstanceId, deadline) {
     let psk;
     try {
         psk = normalizePSK(handshake.psk, path);
@@ -250,7 +325,7 @@ async function establishSession(path, transport, handshake, options, endpointIns
         throw error;
     }
     try {
-        const secure = await serverHandshake(transport, options.handshakeCache ?? new ServerHandshakeCache(), {
+        const startHandshake = () => serverHandshake(transport, options.handshakeCache ?? new ServerHandshakeCache(), {
             channelId: prepareChannelId(handshake.channelId, path),
             suite: handshake.suite,
             psk,
@@ -262,25 +337,52 @@ async function establishSession(path, transport, handshake, options, endpointIns
             outboundRecordChunkBytes: options.outboundRecordChunkBytes ?? SDK_DEFAULTS.e2ee.outboundRecordChunkBytes,
             maxBufferedBytes: options.maxBufferedBytes ?? SDK_DEFAULTS.e2ee.maxInboundBufferedBytes,
             maxOutboundBufferedBytes: options.maxOutboundBufferedBytes ?? SDK_DEFAULTS.e2ee.maxOutboundBufferedBytes,
-            timeoutMs: options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs,
+            timeoutMs: deadline == null
+                ? options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs
+                : remainingHandshakeTimeoutMs(deadline),
             ...(options.signal === undefined ? {} : { signal: options.signal }),
         });
+        const secure = deadline == null
+            ? await startHandshake()
+            : await runHandshakeStep(deadline, options.signal, startHandshake);
         try {
-            await handshake.commitAuthenticated?.();
+            if (handshake.commitAuthenticated != null) {
+                if (deadline == null) {
+                    await handshake.commitAuthenticated();
+                }
+                else {
+                    await runHandshakeStep(deadline, options.signal, handshake.commitAuthenticated);
+                }
+            }
         }
         catch (error) {
             secure.close();
+            const interrupted = endpointHandshakeInterruption(path, error);
+            if (interrupted != null)
+                throw interrupted;
             throw new FlowersecError({ path, stage: "handshake", code: "credential_commit_failed", message: "credential commit failed", cause: error });
         }
-        return Session.create(path, secure, {
-            ...(options.yamuxLimits === undefined ? {} : { yamuxLimits: options.yamuxLimits }),
-            ...(endpointInstanceId === undefined ? {} : { endpointInstanceId }),
-        });
+        try {
+            throwIfAborted(options.signal, "handshake canceled");
+            if (deadline != null)
+                remainingHandshakeTimeoutMs(deadline);
+            return Session.create(path, secure, {
+                ...(options.yamuxLimits === undefined ? {} : { yamuxLimits: options.yamuxLimits }),
+                ...(endpointInstanceId === undefined ? {} : { endpointInstanceId }),
+            });
+        }
+        catch (error) {
+            secure.close();
+            throw error;
+        }
     }
     catch (error) {
         transport.close();
         if (error instanceof FlowersecError)
             throw error;
+        const interrupted = endpointHandshakeInterruption(path, error);
+        if (interrupted != null)
+            throw interrupted;
         throw new FlowersecError({ path, stage: "handshake", code: "handshake_failed", message: "endpoint handshake failed", cause: error });
     }
     finally {
@@ -352,22 +454,25 @@ function unwrapServerGrant(input) {
 function webSocketTransportOptions(options) {
     return options.webSocketLimits === undefined ? {} : { webSocketLimits: options.webSocketLimits };
 }
-function readOptions(options) {
-    return {
-        timeoutMs: options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs,
-        ...(options.signal === undefined ? {} : { signal: options.signal }),
-    };
-}
 async function enforceIncomingDirectTransport(options) {
     const rawUrl = options.secureTransport === false ? "ws://127.0.0.1/" : "wss://127.0.0.1/";
     await enforceTransportSecurity({ rawUrl, path: "direct", ...(options.transportSecurityPolicy === undefined ? {} : { policy: options.transportSecurityPolicy }) });
 }
 function waitForOpen(websocket, timeoutMs, signal) {
-    if (websocket.readyState === 1)
-        return Promise.resolve();
     if (!Number.isFinite(timeoutMs) || timeoutMs < 0)
         return Promise.reject(new RangeError("connectTimeoutMs must be non-negative"));
+    try {
+        throwIfAborted(signal, "connect aborted");
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    if (websocket.readyState === 1)
+        return Promise.resolve();
+    if (websocket.readyState >= 2)
+        return Promise.reject(new Error("websocket closed before open"));
     return new Promise((resolve, reject) => {
+        let settled = false;
         let timer;
         const cleanup = () => {
             if (timer != null)
@@ -378,6 +483,9 @@ function waitForOpen(websocket, timeoutMs, signal) {
             signal?.removeEventListener("abort", onAbort);
         };
         const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
             cleanup();
             if (error == null)
                 resolve();
@@ -392,14 +500,58 @@ function waitForOpen(websocket, timeoutMs, signal) {
         websocket.addEventListener("error", onError);
         websocket.addEventListener("close", onClose);
         signal?.addEventListener("abort", onAbort, { once: true });
-        if (timeoutMs > 0)
-            timer = setTimeout(() => finish(new Error("websocket open timeout")), timeoutMs);
+        if (signal?.aborted) {
+            onAbort();
+        }
+        else if (websocket.readyState === 1) {
+            onOpen();
+        }
+        else if (websocket.readyState >= 2) {
+            onClose();
+        }
+        if (!settled && timeoutMs > 0)
+            timer = setTimeout(() => finish(new TimeoutError("websocket open timeout")), timeoutMs);
     });
 }
 function cleanupWaiter(waiter) {
     if (waiter.onAbort != null)
         waiter.signal?.removeEventListener("abort", waiter.onAbort);
 }
+function createHandshakeDeadline(timeoutMs) {
+    return timeoutMs > 0 ? { expiresAtMs: Date.now() + timeoutMs } : {};
+}
+function remainingHandshakeTimeoutMs(deadline) {
+    if (deadline.expiresAtMs === undefined)
+        return 0;
+    const remaining = deadline.expiresAtMs - Date.now();
+    if (remaining <= 0)
+        throw new TimeoutError("handshake timeout");
+    return remaining;
+}
+async function runHandshakeStep(deadline, signal, operation) {
+    throwIfAborted(signal, "handshake canceled");
+    const timeoutMs = remainingHandshakeTimeoutMs(deadline);
+    const result = await withAbortAndTimeout(Promise.resolve().then(operation), {
+        timeoutMs,
+        ...(signal === undefined ? {} : { signal }),
+    });
+    throwIfAborted(signal, "handshake canceled");
+    remainingHandshakeTimeoutMs(deadline);
+    return result;
+}
+function endpointHandshakeInterruption(path, error) {
+    if (error instanceof TimeoutError) {
+        return new FlowersecError({ path, stage: "handshake", code: "timeout", message: "endpoint handshake timed out", cause: error });
+    }
+    if (error instanceof AbortError) {
+        return new FlowersecError({ path, stage: "handshake", code: "canceled", message: "endpoint handshake canceled", cause: error });
+    }
+    return undefined;
+}
+function endpointHandshakeError(path, error, message) {
+    return endpointHandshakeInterruption(path, error)
+        ?? new FlowersecError({ path, stage: "handshake", code: "handshake_failed", message, cause: error });
+}
 function asError(error) {
     return error instanceof Error ? error : new Error(String(error));
 }

package/dist/facade.d.ts

@@ -17,7 +17,7 @@ export type { WebSocketLimits } from "./ws-client/binaryTransport.js";
 export type { YamuxLimits } from "./yamux/session.js";
 export type { FlowersecErrorCode, FlowersecPath, FlowersecStage } from "./utils/errors.js";
 export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
 export type { NetworkPlaintextPolicyOptions, TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, } from "./client-connect/transportSecurity.js";
 export type { TunnelConnectOptions } from "./tunnel-client/connect.js";
 export type { DirectConnectOptions } from "./direct-client/connect.js";

package/dist/facade.js

@@ -6,7 +6,7 @@ export { assertChannelInitGrant } from "./gen/flowersec/controlplane/v1.gen.js";
 export { assertDirectConnectInfo } from "./gen/flowersec/direct/v1.gen.js";
 export { assertConnectArtifact } from "./connect/artifact.js";
 export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
 export async function connectTunnel(grant, opts) {
     return await connectTunnelInternal(grant, opts);
 }

package/dist/node/index.d.ts

@@ -1,5 +1,5 @@
 export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, NetworkPlaintextPolicyOptions, } from "../client-connect/transportSecurity.js";
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export type { DirectNodeReconnectConfig, NodeReconnectConfig, TunnelNodeReconnectConfig, } from "./reconnectConfig.js";

package/dist/node/index.js

@@ -1,5 +1,5 @@
 export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export { createDirectNodeReconnectConfig, createNodeReconnectConfig, createTunnelNodeReconnectConfig, } from "./reconnectConfig.js";
 export * from "../endpoint/index.js";