@floegence/flowersec-core 0.24.0 → 0.26.0

package/dist/proxy/appWindow.js

@@ -1,6 +1,6 @@
 import { createServiceWorkerControllerGuard, } from "./controllerGuard.js";
 import { createMessagePortBackedStream } from "./portStream.js";
-import { PROXY_WINDOW_FETCH_FORWARD_MSG_TYPE, PROXY_WINDOW_FETCH_MSG_TYPE, PROXY_WINDOW_WS_ERROR_MSG_TYPE, PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE, PROXY_WINDOW_WS_OPEN_MSG_TYPE, PROXY_WINDOW_WS_WRITE_ACK_CAPABILITY, } from "./windowBridgeProtocol.js";
+import { PROXY_WINDOW_FETCH_FORWARD_MSG_TYPE, PROXY_WINDOW_FETCH_MSG_TYPE, PROXY_WINDOW_STREAM_RESET_MSG_TYPE, PROXY_WINDOW_WS_ERROR_MSG_TYPE, PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY, PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE, PROXY_WINDOW_WS_OPEN_MSG_TYPE, } from "./windowBridgeProtocol.js";
 function resolveTargetWindow(raw) {
     const target = raw ?? globalThis.window;
     if (target == null)
@@ -59,6 +59,8 @@ export function registerProxyAppWindow(opts) {
     const targetWindow = resolveTargetWindow(opts.targetWindow);
     const controllerWindow = resolveControllerWindow(targetWindow, opts.controllerWindow);
     const capabilityNonce = normalizeCapabilityNonce(opts.capabilityNonce);
+    const activeWebSocketBridges = new Set();
+    let disposed = false;
     const sw = targetWindow.navigator?.serviceWorker;
     const onServiceWorkerMessage = (ev) => {
         const data = ev.data;
@@ -90,15 +92,32 @@ export function registerProxyAppWindow(opts) {
                 : { maxWsBufferedAmountBytes: opts.maxWsBufferedAmountBytes }),
         },
         openWebSocketStream: async (path, wsOpts = {}) => {
+            if (disposed)
+                throw new Error("proxy app Window bridge is disposed");
             const channel = new MessageChannel();
             const port = channel.port1;
             port.start?.();
             return await new Promise((resolve, reject) => {
                 let settled = false;
+                let terminal = false;
+                let stream = null;
+                const cleanup = () => {
+                    activeWebSocketBridges.delete(bridge);
+                    if (wsOpts.signal != null)
+                        wsOpts.signal.removeEventListener("abort", onAbort);
+                };
+                const finishTerminal = () => {
+                    if (terminal)
+                        return false;
+                    terminal = true;
+                    cleanup();
+                    return true;
+                };
                 const finishReject = (error) => {
                     if (settled)
                         return;
                     settled = true;
+                    finishTerminal();
                     try {
                         port.close();
                     }
@@ -107,16 +126,76 @@ export function registerProxyAppWindow(opts) {
                     }
                     reject(error instanceof Error ? error : new Error(String(error)));
                 };
+                const disposeBridge = (error) => {
+                    if (!finishTerminal())
+                        return;
+                    if (stream != null) {
+                        try {
+                            void Promise.resolve(stream.reset(error)).catch(() => {
+                                // The bridge is already terminal.
+                            });
+                        }
+                        catch {
+                            // The bridge is already terminal.
+                        }
+                        return;
+                    }
+                    try {
+                        port.postMessage({
+                            type: PROXY_WINDOW_STREAM_RESET_MSG_TYPE,
+                            message: error.message,
+                        });
+                    }
+                    catch {
+                        // Best-effort.
+                    }
+                    if (!settled) {
+                        settled = true;
+                        reject(error);
+                    }
+                    try {
+                        port.close();
+                    }
+                    catch {
+                        // Best-effort.
+                    }
+                };
+                const bridge = { dispose: disposeBridge };
+                const onAbort = () => {
+                    const reason = wsOpts.signal?.reason;
+                    disposeBridge(reason instanceof Error ? reason : new Error(String(reason ?? "aborted")));
+                };
+                activeWebSocketBridges.add(bridge);
                 const finishResolve = (ack) => {
-                    if (settled)
+                    if (settled || terminal)
                         return;
-                    settled = true;
                     const capabilities = Array.isArray(ack.capabilities)
                         ? ack.capabilities.filter((value) => typeof value === "string")
                         : [];
-                    const writeAcknowledgements = capabilities.includes(PROXY_WINDOW_WS_WRITE_ACK_CAPABILITY);
+                    if (!capabilities.includes(PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY)) {
+                        try {
+                            port.postMessage({
+                                type: PROXY_WINDOW_STREAM_RESET_MSG_TYPE,
+                                message: "proxy Window bridge capability mismatch",
+                            });
+                        }
+                        catch {
+                            // The capability error remains authoritative.
+                        }
+                        finishReject(new Error("proxy Window bridge does not support bidirectional stream acknowledgements"));
+                        return;
+                    }
+                    if (disposed) {
+                        disposeBridge(new Error("proxy app Window bridge is disposed"));
+                        return;
+                    }
+                    settled = true;
+                    stream = createMessagePortBackedStream(port, {
+                        maxBufferedBytes: opts.maxWsBufferedAmountBytes ?? 4 * (1 << 20),
+                        onTerminal: finishTerminal,
+                    });
                     resolve({
-                        stream: createMessagePortBackedStream(port, { writeAcknowledgements }),
+                        stream,
                         protocol: String(ack.protocol ?? ""),
                     });
                 };
@@ -135,15 +214,16 @@ export function registerProxyAppWindow(opts) {
                 };
                 if (wsOpts.signal != null) {
                     if (wsOpts.signal.aborted) {
-                        finishReject(wsOpts.signal.reason ?? new Error("aborted"));
+                        onAbort();
                         return;
                     }
-                    wsOpts.signal.addEventListener("abort", () => finishReject(wsOpts.signal?.reason ?? new Error("aborted")), { once: true });
+                    wsOpts.signal.addEventListener("abort", onAbort, { once: true });
                 }
                 try {
                     controllerWindow.postMessage({
                         type: PROXY_WINDOW_WS_OPEN_MSG_TYPE,
                         path,
+                        capabilities: [PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY],
                         ...(wsOpts.protocols === undefined ? {} : { protocols: wsOpts.protocols }),
                         ...(capabilityNonce === "" ? {} : { capabilityNonce }),
                     }, controllerOrigin, [channel.port2]);
@@ -157,7 +237,13 @@ export function registerProxyAppWindow(opts) {
     return {
         runtime,
         dispose: () => {
+            if (disposed)
+                return;
+            disposed = true;
             sw?.removeEventListener("message", onServiceWorkerMessage);
+            const error = new Error("proxy app Window bridge is disposed");
+            for (const bridge of [...activeWebSocketBridges])
+                bridge.dispose(error);
         },
     };
 }

package/dist/proxy/bootstrap.d.ts

@@ -1,20 +1,11 @@
 import type { Client } from "../client.js";
 import type { ConnectArtifact } from "../connect/artifact.js";
-import type { ConnectBrowserOptions, TunnelConnectBrowserOptions } from "../browser/connect.js";
-import type { ChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
+import type { ConnectBrowserOptions } from "../browser/connect.js";
 import { type ProxyIntegrationPlugin, type RegisterProxyIntegrationOptions, type ProxyIntegrationServiceWorkerOptions } from "./integration.js";
 import { type RegisterProxyControllerWindowOptions } from "./controllerWindow.js";
 import type { ProxyPresetInput } from "./preset.js";
 import { type ProxyRuntime } from "./runtime.js";
-export type ConnectTunnelProxyBrowserOptions = Readonly<{
-    connect?: TunnelConnectBrowserOptions;
-    preset?: ProxyPresetInput;
-    runtimeGlobalKey?: string;
-    runtime?: RegisterProxyIntegrationOptions["runtime"];
-    serviceWorker: ProxyIntegrationServiceWorkerOptions;
-    plugins?: readonly ProxyIntegrationPlugin[];
-}>;
-export type ConnectTunnelProxyBrowserHandle = Readonly<{
+export type ConnectArtifactProxyBrowserHandle = Readonly<{
     client: Client;
     runtime: ProxyRuntime;
     dispose: () => Promise<void>;
@@ -27,15 +18,7 @@ export type ConnectArtifactProxyBrowserOptions = Readonly<{
     serviceWorker?: ProxyIntegrationServiceWorkerOptions;
     plugins?: readonly ProxyIntegrationPlugin[];
 }>;
-export type ConnectTunnelProxyControllerBrowserOptions = Readonly<{
-    connect?: TunnelConnectBrowserOptions;
-    runtime?: RegisterProxyIntegrationOptions["runtime"];
-    allowedOrigins: RegisterProxyControllerWindowOptions["allowedOrigins"];
-    targetWindow?: RegisterProxyControllerWindowOptions["targetWindow"];
-    expectedSource?: RegisterProxyControllerWindowOptions["expectedSource"];
-    capabilityNonce?: RegisterProxyControllerWindowOptions["capabilityNonce"];
-}>;
-export type ConnectTunnelProxyControllerBrowserHandle = Readonly<{
+export type ConnectArtifactProxyControllerBrowserHandle = Readonly<{
     client: Client;
     runtime: ProxyRuntime;
     dispose: () => void;
@@ -48,7 +31,5 @@ export type ConnectArtifactProxyControllerBrowserOptions = Readonly<{
     expectedSource?: RegisterProxyControllerWindowOptions["expectedSource"];
     capabilityNonce?: RegisterProxyControllerWindowOptions["capabilityNonce"];
 }>;
-export declare function connectTunnelProxyBrowser(grant: ChannelInitGrant, opts: ConnectTunnelProxyBrowserOptions): Promise<ConnectTunnelProxyBrowserHandle>;
-export declare function connectArtifactProxyBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyBrowserOptions): Promise<ConnectTunnelProxyBrowserHandle>;
-export declare function connectTunnelProxyControllerBrowser(grant: ChannelInitGrant, opts: ConnectTunnelProxyControllerBrowserOptions): Promise<ConnectTunnelProxyControllerBrowserHandle>;
-export declare function connectArtifactProxyControllerBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyControllerBrowserOptions): Promise<ConnectTunnelProxyControllerBrowserHandle>;
+export declare function connectArtifactProxyBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyBrowserOptions): Promise<ConnectArtifactProxyBrowserHandle>;
+export declare function connectArtifactProxyControllerBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyControllerBrowserOptions): Promise<ConnectArtifactProxyControllerBrowserHandle>;

package/dist/proxy/bootstrap.js

@@ -1,4 +1,4 @@
-import { connectBrowser, connectTunnelBrowser } from "../browser/connect.js";
+import { connectBrowser } from "../browser/connect.js";
 import { registerProxyIntegration, } from "./integration.js";
 import { registerProxyControllerWindow } from "./controllerWindow.js";
 import { extractProxyRuntimeScopeV1, resolvePresetInputFromScope, resolveRuntimeLimitsFromScope, resolveRuntimePresetLimits, } from "./runtimeScope.js";
@@ -23,12 +23,10 @@ function scopeRuntimeToIntegrationOptions(scope, opts) {
     };
 }
 async function connectProxyBrowserClient(client, opts) {
-    const compat = opts;
     const integrationInput = {
         client,
         serviceWorker: opts.serviceWorker,
         ...(opts.preset === undefined ? {} : { preset: opts.preset }),
-        ...(compat.profile === undefined ? {} : { profile: compat.profile }),
         ...(opts.runtimeGlobalKey === undefined ? {} : { runtimeGlobalKey: opts.runtimeGlobalKey }),
         ...(opts.runtime === undefined ? {} : { runtime: opts.runtime }),
         ...(opts.plugins === undefined ? {} : { plugins: opts.plugins }),
@@ -101,20 +99,12 @@ function connectProxyControllerClient(client, opts) {
         },
     };
 }
-export async function connectTunnelProxyBrowser(grant, opts) {
-    const client = await connectTunnelBrowser(grant, opts.connect ?? {});
-    return await connectProxyBrowserClient(client, opts);
-}
 export async function connectArtifactProxyBrowser(artifact, opts = {}) {
     const scope = extractProxyRuntimeScopeV1(artifact, "service_worker");
     const client = await connectBrowser(artifact, opts.connect ?? {});
     const nextOpts = scopeRuntimeToIntegrationOptions(scope, opts);
     return await connectProxyBrowserClient(client, nextOpts);
 }
-export async function connectTunnelProxyControllerBrowser(grant, opts) {
-    const client = await connectTunnelBrowser(grant, opts.connect ?? {});
-    return connectProxyControllerClient(client, opts);
-}
 export async function connectArtifactProxyControllerBrowser(artifact, opts = {}) {
     const scope = extractProxyRuntimeScopeV1(artifact, "controller_bridge");
     const client = await connectBrowser(artifact, opts.connect ?? {});

package/dist/proxy/constants.d.ts

@@ -4,3 +4,4 @@ export declare const PROXY_KIND_WS: "flowersec-proxy/ws";
 export declare const DEFAULT_MAX_CHUNK_BYTES: number;
 export declare const DEFAULT_MAX_BODY_BYTES: number;
 export declare const DEFAULT_MAX_WS_FRAME_BYTES: number;
+export declare const DEFAULT_MAX_CONCURRENT_STREAMS: 64;

package/dist/proxy/constants.js

@@ -5,3 +5,4 @@ export const PROXY_KIND_WS = "flowersec-proxy/ws";
 export const DEFAULT_MAX_CHUNK_BYTES = SDK_DEFAULTS.proxy.maxChunkBytes;
 export const DEFAULT_MAX_BODY_BYTES = SDK_DEFAULTS.proxy.maxBodyBytes;
 export const DEFAULT_MAX_WS_FRAME_BYTES = SDK_DEFAULTS.proxy.maxWsFrameBytes;
+export const DEFAULT_MAX_CONCURRENT_STREAMS = SDK_DEFAULTS.proxy.maxConcurrentStreams;

package/dist/proxy/controllerWindow.js

@@ -1,4 +1,4 @@
-import { PROXY_WINDOW_FETCH_MSG_TYPE, PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE, PROXY_WINDOW_STREAM_CLOSE_MSG_TYPE, PROXY_WINDOW_STREAM_END_MSG_TYPE, PROXY_WINDOW_STREAM_RESET_MSG_TYPE, PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE, PROXY_WINDOW_WS_ERROR_MSG_TYPE, PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE, PROXY_WINDOW_WS_OPEN_MSG_TYPE, PROXY_WINDOW_WS_WRITE_ACK_CAPABILITY, } from "./windowBridgeProtocol.js";
+import { PROXY_WINDOW_FETCH_MSG_TYPE, PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE, PROXY_WINDOW_STREAM_CLOSE_MSG_TYPE, PROXY_WINDOW_STREAM_END_MSG_TYPE, PROXY_WINDOW_STREAM_RESET_MSG_TYPE, PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE, PROXY_WINDOW_WS_ERROR_MSG_TYPE, PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY, PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE, PROXY_WINDOW_WS_OPEN_MSG_TYPE, } from "./windowBridgeProtocol.js";
 function normalizeOrigins(origins) {
     const out = [];
     const seen = new Set();
@@ -56,14 +56,45 @@ function withTrustedExternalOrigin(req, rawOrigin) {
         ? sanitized
         : { ...sanitized, external_origin: externalOrigin };
 }
-function bridgeWebSocket(runtime, msg, port) {
+function validWriteId(value) {
+    return Number.isSafeInteger(value) && Number(value) > 0;
+}
+function bridgeWebSocket(runtime, msg, port, onTerminal) {
+    const capabilities = Array.isArray(msg.capabilities)
+        ? msg.capabilities.filter((value) => typeof value === "string")
+        : [];
+    if (!capabilities.includes(PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY)) {
+        try {
+            port.postMessage({
+                type: PROXY_WINDOW_WS_ERROR_MSG_TYPE,
+                message: "proxy Window bridge requires bidirectional stream acknowledgements",
+            });
+        }
+        catch {
+            // Best-effort.
+        }
+        finally {
+            port.close();
+        }
+        onTerminal();
+        return { dispose: () => { }, isTerminal: () => true };
+    }
     const ac = new AbortController();
     let terminal = false;
+    let terminalError = null;
     let acceptingWrites = true;
     let stream = null;
-    let pendingWriteBytes = 0;
-    let writeChain = Promise.resolve();
+    let pendingInboundWriteId = null;
+    let pendingOutboundAcknowledgement = null;
+    let nextWriteId = 1;
     const maxBufferedBytes = runtime.limits.maxWsBufferedAmountBytes ?? 4 * (1 << 20);
+    let terminalNotified = false;
+    const notifyTerminal = () => {
+        if (terminalNotified)
+            return;
+        terminalNotified = true;
+        onTerminal();
+    };
     const closePort = () => {
         try {
             port.close();
@@ -72,12 +103,16 @@ function bridgeWebSocket(runtime, msg, port) {
             // Best-effort.
         }
     };
-    const failBridge = (error) => {
+    const failBridge = (error, notifyPeer = true) => {
         if (terminal)
             return;
         terminal = true;
         acceptingWrites = false;
         const err = error instanceof Error ? error : new Error(String(error));
+        terminalError = err;
+        pendingInboundWriteId = null;
+        pendingOutboundAcknowledgement?.reject(err);
+        pendingOutboundAcknowledgement = null;
         if (stream != null) {
             void Promise.resolve(stream.reset(err)).catch(() => {
                 // The bridge error is already delivered through the terminal response.
@@ -89,17 +124,146 @@ function bridgeWebSocket(runtime, msg, port) {
         catch {
             // Best-effort.
         }
-        try {
-            port.postMessage({
-                type: PROXY_WINDOW_STREAM_RESET_MSG_TYPE,
-                message: err.message,
-            });
-        }
-        catch {
-            // Best-effort.
+        if (notifyPeer) {
+            try {
+                port.postMessage({
+                    type: PROXY_WINDOW_STREAM_RESET_MSG_TYPE,
+                    message: err.message,
+                });
+            }
+            catch {
+                // Best-effort.
+            }
         }
         closePort();
+        notifyTerminal();
+    };
+    const failProtocol = (message) => {
+        failBridge(new Error(`proxy Window stream protocol error: ${message}`));
+    };
+    const postChunkAndWait = async (chunk) => {
+        if (chunk.byteLength > maxBufferedBytes) {
+            throw new Error("proxy WebSocket inbound chunk exceeded the buffer limit");
+        }
+        if (!Number.isSafeInteger(nextWriteId)) {
+            throw new Error("proxy Window stream write identifier space exhausted");
+        }
+        if (pendingOutboundAcknowledgement != null) {
+            throw new Error("proxy Window stream already has an unacknowledged outbound chunk");
+        }
+        const writeId = nextWriteId++;
+        const ab = cloneChunk(chunk);
+        await new Promise((resolve, reject) => {
+            pendingOutboundAcknowledgement = { writeId, resolve, reject };
+            try {
+                port.postMessage({
+                    type: PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE,
+                    data: ab,
+                    writeId,
+                }, [ab]);
+            }
+            catch (error) {
+                pendingOutboundAcknowledgement = null;
+                reject(error instanceof Error ? error : new Error(String(error)));
+            }
+        });
+    };
+    port.onmessage = (ev) => {
+        const data = ev.data;
+        if (data == null || typeof data !== "object")
+            return;
+        const type = typeof data.type === "string" ? data.type : "";
+        if (stream == null) {
+            if (type === PROXY_WINDOW_STREAM_RESET_MSG_TYPE) {
+                const message = String(data.message ?? "stream reset");
+                failBridge(new Error(message), false);
+            }
+            else if (type === PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE
+                || type === PROXY_WINDOW_STREAM_CLOSE_MSG_TYPE
+                || type === PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE) {
+                failProtocol("received stream traffic before the websocket opened");
+            }
+            return;
+        }
+        switch (type) {
+            case PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE: {
+                if (!acceptingWrites)
+                    return;
+                const chunkMessage = data;
+                const raw = chunkMessage.data;
+                if (!(raw instanceof ArrayBuffer) || !validWriteId(chunkMessage.writeId)) {
+                    failProtocol("invalid stream chunk");
+                    return;
+                }
+                if (pendingInboundWriteId != null) {
+                    failProtocol("received more than one unacknowledged chunk");
+                    return;
+                }
+                if (raw.byteLength > maxBufferedBytes) {
+                    failBridge(new Error("proxy WebSocket outbound buffer exceeded"));
+                    return;
+                }
+                const writeId = chunkMessage.writeId;
+                const chunk = new Uint8Array(raw);
+                pendingInboundWriteId = writeId;
+                void stream.write(chunk)
+                    .then(() => {
+                    if (terminal)
+                        return;
+                    if (pendingInboundWriteId !== writeId) {
+                        failProtocol("completed write does not match the pending chunk");
+                        return;
+                    }
+                    pendingInboundWriteId = null;
+                    port.postMessage({
+                        type: PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE,
+                        writeId,
+                    });
+                })
+                    .catch((error) => failBridge(error));
+                return;
+            }
+            case PROXY_WINDOW_STREAM_CLOSE_MSG_TYPE: {
+                if (!acceptingWrites)
+                    return;
+                if (pendingInboundWriteId != null) {
+                    failProtocol("stream closed before the pending chunk was acknowledged");
+                    return;
+                }
+                acceptingWrites = false;
+                terminal = true;
+                const closeError = new Error("stream is closed");
+                pendingInboundWriteId = null;
+                pendingOutboundAcknowledgement?.reject(closeError);
+                pendingOutboundAcknowledgement = null;
+                void Promise.resolve(stream.close()).catch(() => {
+                    // The peer already closed its bridge endpoint.
+                });
+                closePort();
+                notifyTerminal();
+                return;
+            }
+            case PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE: {
+                const writeId = data.writeId;
+                const pending = pendingOutboundAcknowledgement;
+                if (!validWriteId(writeId) || pending == null || pending.writeId !== writeId) {
+                    failProtocol("unexpected stream write acknowledgement");
+                    return;
+                }
+                pendingOutboundAcknowledgement = null;
+                pending.resolve();
+                return;
+            }
+            case PROXY_WINDOW_STREAM_RESET_MSG_TYPE: {
+                const message = String(data.message ?? "stream reset");
+                failBridge(new Error(message), false);
+                return;
+            }
+            default:
+                return;
+        }
     };
+    port.start?.();
     void (async () => {
         try {
             const wsOpts = {
@@ -107,69 +271,15 @@ function bridgeWebSocket(runtime, msg, port) {
                 ...(msg.protocols === undefined ? {} : { protocols: msg.protocols }),
             };
             const opened = await runtime.openWebSocketStream(msg.path, wsOpts);
+            if (terminal) {
+                await Promise.resolve(opened.stream.reset(terminalError ?? new Error("proxy controller Window bridge is closed")));
+                return;
+            }
             stream = opened.stream;
-            port.onmessage = (ev) => {
-                const data = ev.data;
-                if (data == null || typeof data !== "object")
-                    return;
-                const type = typeof data.type === "string" ? data.type : "";
-                switch (type) {
-                    case PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE: {
-                        if (!acceptingWrites || stream == null)
-                            return;
-                        const raw = data.data;
-                        if (!(raw instanceof ArrayBuffer))
-                            return;
-                        if (pendingWriteBytes + raw.byteLength > maxBufferedBytes) {
-                            failBridge(new Error("proxy WebSocket outbound buffer exceeded"));
-                            return;
-                        }
-                        const rawWriteId = data.writeId;
-                        const writeId = Number.isSafeInteger(rawWriteId) && Number(rawWriteId) > 0
-                            ? Number(rawWriteId)
-                            : undefined;
-                        const chunk = new Uint8Array(raw);
-                        pendingWriteBytes += chunk.byteLength;
-                        writeChain = writeChain
-                            .then(async () => {
-                            if (terminal || stream == null)
-                                throw new Error("stream is closed");
-                            await stream.write(chunk);
-                            if (terminal || writeId === undefined)
-                                return;
-                            port.postMessage({
-                                type: PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE,
-                                writeId,
-                            });
-                        })
-                            .catch((error) => failBridge(error))
-                            .finally(() => {
-                            pendingWriteBytes = Math.max(0, pendingWriteBytes - chunk.byteLength);
-                        });
-                        return;
-                    }
-                    case PROXY_WINDOW_STREAM_CLOSE_MSG_TYPE:
-                        if (!acceptingWrites || stream == null)
-                            return;
-                        acceptingWrites = false;
-                        writeChain = writeChain
-                            .then(() => stream?.close())
-                            .catch((error) => failBridge(error));
-                        return;
-                    case PROXY_WINDOW_STREAM_RESET_MSG_TYPE: {
-                        const message = String(data.message ?? "stream reset");
-                        failBridge(new Error(message));
-                        return;
-                    }
-                    default:
-                        return;
-                }
-            };
-            port.start?.();
             port.postMessage({
                 type: PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE,
                 protocol: opened.protocol,
-                capabilities: [PROXY_WINDOW_WS_WRITE_ACK_CAPABILITY],
+                capabilities: [PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY],
             });
             while (!terminal) {
                 const chunk = await stream.read();
@@ -178,22 +288,36 @@ function bridgeWebSocket(runtime, msg, port) {
                     acceptingWrites = false;
                     port.postMessage({ type: PROXY_WINDOW_STREAM_END_MSG_TYPE });
                     closePort();
+                    notifyTerminal();
                     return;
                 }
-                const ab = cloneChunk(chunk);
-                port.postMessage({ type: PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE, data: ab }, [ab]);
+                await postChunkAndWait(chunk);
             }
         }
         catch (error) {
+            if (terminal)
+                return;
             const message = error instanceof Error ? error.message : String(error);
             if (stream == null) {
-                port.postMessage({ type: PROXY_WINDOW_WS_ERROR_MSG_TYPE, message });
-                closePort();
+                terminal = true;
+                acceptingWrites = false;
+                terminalError = error instanceof Error ? error : new Error(message);
+                try {
+                    port.postMessage({ type: PROXY_WINDOW_WS_ERROR_MSG_TYPE, message });
+                }
+                finally {
+                    closePort();
+                    notifyTerminal();
+                }
                 return;
             }
             failBridge(error);
         }
     })();
+    return {
+        dispose: (error) => failBridge(error),
+        isTerminal: () => terminal,
+    };
 }
 export function registerProxyControllerWindow(opts) {
     const allowedOrigins = normalizeOrigins(opts.allowedOrigins);
@@ -202,6 +326,8 @@ export function registerProxyControllerWindow(opts) {
     }
     const capabilityNonce = normalizeCapabilityNonce(opts.capabilityNonce);
     requireBridgeCapability(opts.expectedSource, capabilityNonce);
+    const activeWebSocketBridges = new Set();
+    let disposed = false;
     const targetWindow = opts.targetWindow ?? globalThis.window;
     if (targetWindow == null) {
         throw new Error("targetWindow is not available");
@@ -227,9 +353,18 @@ export function registerProxyControllerWindow(opts) {
                 opts.runtime.dispatchFetch(withTrustedExternalOrigin(msg.req, eventOrigin), port);
                 return;
             }
-            case PROXY_WINDOW_WS_OPEN_MSG_TYPE:
-                bridgeWebSocket(opts.runtime, data, port);
+            case PROXY_WINDOW_WS_OPEN_MSG_TYPE: {
+                if (disposed)
+                    return;
+                let bridge = null;
+                bridge = bridgeWebSocket(opts.runtime, data, port, () => {
+                    if (bridge != null)
+                        activeWebSocketBridges.delete(bridge);
+                });
+                if (!bridge.isTerminal())
+                    activeWebSocketBridges.add(bridge);
                 return;
+            }
             default:
                 return;
         }
@@ -237,7 +372,13 @@ export function registerProxyControllerWindow(opts) {
     targetWindow.addEventListener("message", onMessage);
     return {
         dispose: () => {
+            if (disposed)
+                return;
+            disposed = true;
             targetWindow.removeEventListener("message", onMessage);
+            const error = new Error("proxy controller Window bridge is disposed");
+            for (const bridge of [...activeWebSocketBridges])
+                bridge.dispose(error);
         },
     };
 }

package/dist/proxy/integration.js

@@ -1,4 +1,3 @@
-import { profileToPresetManifest } from "./profiles.js";
 import { resolveProxyPreset } from "./preset.js";
 import { registerServiceWorkerAndEnsureControl } from "./registerServiceWorker.js";
 import { createProxyRuntime, ensureServiceWorkerRuntimeRegistered } from "./runtime.js";
@@ -165,13 +164,8 @@ function shouldIgnoreMismatch(plugins, ctx) {
     return false;
 }
 function resolveIntegrationPreset(opts) {
-    if (opts.preset !== undefined && opts.profile !== undefined) {
-        throw new Error("preset and deprecated profile cannot be used together");
-    }
     if (opts.preset !== undefined)
         return resolveProxyPreset(opts.preset);
-    if (opts.profile !== undefined)
-        return resolveProxyPreset(profileToPresetManifest(opts.profile));
     return resolveProxyPreset();
 }
 function buildRuntimeOptions(preset, runtime) {