@floegence/flowersec-core 0.25.0 → 0.26.0

package/README.md

@@ -29,9 +29,9 @@ High-level WebSocket connections require TLS by default. Use `AllowPlaintextForL
 
 ## Node Proxy Server
 
-The Node entrypoint exports `serveProxySession(...)`, `serveProxyStream(...)`, and `ProxyServerOptions`. Request bodies remain bounded per request by `maxBodyBytes`; `maxBufferedRequestBodyBytes` additionally caps the total buffered request-body bytes owned by one proxy session. WebSocket frames remain bounded by `maxWsFrameBytes`; `maxWsQueuedBytes` additionally caps upstream-to-Yamux queued bytes per connection, while the reverse direction waits for each Node `ws` send callback.
+The Node entrypoint exports `serveProxySession(...)`, `serveProxyStream(...)`, and `ProxyServerOptions`. HTTP request and response bodies stream between Flowersec chunk frames and the upstream fetch while remaining bounded per request by `maxBodyBytes`. Proxy sessions admit at most `maxConcurrentStreams` HTTP/WebSocket streams, with a shared default of 64; RPC serving has its own concurrency controls. WebSocket frames remain bounded by `maxWsFrameBytes`; `maxWsQueuedBytes` additionally caps upstream-to-Yamux queued bytes per connection, while the reverse direction waits for each Node `ws` send callback.
 
-The defaults keep one session request-body budget equal to `maxBodyBytes` and one queued WebSocket frame plus its proxy header. Raise either limit only when the deployment has a matching memory budget.
+The defaults keep one queued WebSocket frame plus its proxy header. Raise body, concurrency, or queue limits only when the deployment has matching upstream and memory capacity.
 
 ## Runtime Boundaries
 

package/dist/browser/controlplane.d.ts

@@ -1,6 +1,5 @@
 import { type ChannelInitGrant } from "../facade.js";
 import type { ControlplaneBaseConfig as SharedControlplaneBaseConfig, RequestConnectArtifactInput, RequestEntryConnectArtifactInput } from "../controlplane/request.js";
-export { ControlplaneRequestError, requestConnectArtifact, requestEntryConnectArtifact, } from "../controlplane/request.js";
 type BaseControlplaneRequestConfig = SharedControlplaneBaseConfig & Readonly<{
     endpointId: string;
     payload?: Record<string, unknown>;
@@ -13,3 +12,4 @@ export type ConnectArtifactRequestConfig = RequestConnectArtifactInput;
 export type EntryConnectArtifactRequestConfig = RequestEntryConnectArtifactInput;
 export declare function requestChannelGrant(config: ControlplaneConfig): Promise<ChannelInitGrant>;
 export declare function requestEntryChannelGrant(config: EntryControlplaneConfig): Promise<ChannelInitGrant>;
+export {};

package/dist/browser/controlplane.js

@@ -1,6 +1,5 @@
 import { assertChannelInitGrant } from "../facade.js";
 import { requestControlplaneJSON, } from "../controlplane/request.js";
-export { ControlplaneRequestError, requestConnectArtifact, requestEntryConnectArtifact, } from "../controlplane/request.js";
 function buildURL(baseUrl, path) {
     const base = String(baseUrl ?? "").trim();
     if (base === "")

package/dist/browser/index.d.ts

@@ -1,10 +1,10 @@
 export type { ConnectBrowserOptions, DirectConnectBrowserOptions, TunnelConnectBrowserOptions } from "./connect.js";
 export { connectBrowser, connectDirectBrowser, connectTunnelBrowser } from "./connect.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, NetworkPlaintextPolicyOptions, } from "../client-connect/transportSecurity.js";
 export type { ConnectArtifact, CorrelationContext, CorrelationKV, DirectClientConnectArtifact, ScopeMetadataEntry, TunnelClientConnectArtifact, } from "../connect/artifact.js";
 export { assertConnectArtifact } from "../connect/artifact.js";
-export type { ConnectArtifactRequestConfig, ControlplaneConfig, EntryConnectArtifactRequestConfig, EntryControlplaneConfig, } from "./controlplane.js";
-export { ControlplaneRequestError, requestChannelGrant, requestConnectArtifact, requestEntryChannelGrant, requestEntryConnectArtifact, } from "./controlplane.js";
+export type { ControlplaneConfig, EntryControlplaneConfig } from "./controlplane.js";
+export { requestChannelGrant, requestEntryChannelGrant, } from "./controlplane.js";
 export type { BrowserReconnectConfig, DirectBrowserReconnectConfig, TunnelBrowserReconnectConfig, } from "./reconnectConfig.js";
 export { createBrowserReconnectConfig, createDirectBrowserReconnectConfig, createTunnelBrowserReconnectConfig, } from "./reconnectConfig.js";

package/dist/browser/index.js

@@ -1,5 +1,5 @@
 export { connectBrowser, connectDirectBrowser, connectTunnelBrowser } from "./connect.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export { assertConnectArtifact } from "../connect/artifact.js";
-export { ControlplaneRequestError, requestChannelGrant, requestConnectArtifact, requestEntryChannelGrant, requestEntryConnectArtifact, } from "./controlplane.js";
+export { requestChannelGrant, requestEntryChannelGrant, } from "./controlplane.js";
 export { createBrowserReconnectConfig, createDirectBrowserReconnectConfig, createTunnelBrowserReconnectConfig, } from "./reconnectConfig.js";

package/dist/client-connect/transportSecurity.d.ts

@@ -2,8 +2,6 @@ import type { ClientPath } from "../client.js";
 import { type ClientObserverLike } from "../observability/observer.js";
 export declare const RequireTLS: "require_tls";
 export declare const AllowPlaintextForLoopback: "allow_plaintext_for_loopback";
-/** @deprecated Use RequireTLS, AllowPlaintextForLoopback, or createNetworkPlaintextPolicy. */
-export declare const AllowPlaintext: "allow_plaintext";
 export declare const PlaintextRiskAcceptance: {
     readonly acceptPreE2ECredentialExposure: "accept_pre_e2ee_credential_exposure";
 };
@@ -18,7 +16,7 @@ export type TransportSecurityPolicyInput = Readonly<{
     host: string;
     runtime: "browser" | "node" | "other";
 }>;
-export type TransportSecurityPolicyPreset = typeof RequireTLS | typeof AllowPlaintextForLoopback | typeof AllowPlaintext;
+export type TransportSecurityPolicyPreset = typeof RequireTLS | typeof AllowPlaintextForLoopback;
 export type TransportSecurityPolicy = TransportSecurityPolicyPreset | ((input: TransportSecurityPolicyInput) => boolean | Promise<boolean>);
 export declare function createNetworkPlaintextPolicy(options: NetworkPlaintextPolicyOptions): TransportSecurityPolicy;
 export declare function enforceTransportSecurity(args: Readonly<{

package/dist/client-connect/transportSecurity.js

@@ -2,8 +2,6 @@ import { FlowersecError } from "../utils/errors.js";
 import { emitObserverDiagnostic } from "../observability/observer.js";
 export const RequireTLS = "require_tls";
 export const AllowPlaintextForLoopback = "allow_plaintext_for_loopback";
-/** @deprecated Use RequireTLS, AllowPlaintextForLoopback, or createNetworkPlaintextPolicy. */
-export const AllowPlaintext = "allow_plaintext";
 export const PlaintextRiskAcceptance = {
     acceptPreE2ECredentialExposure: "accept_pre_e2ee_credential_exposure",
 };
@@ -71,8 +69,6 @@ function evaluatePreset(policy, target) {
             return target.scheme === "wss";
         case AllowPlaintextForLoopback:
             return target.scheme === "wss" || isLiteralLoopbackHost(target.host);
-        case AllowPlaintext:
-            return true;
     }
 }
 function parseWebSocketTarget(rawUrl) {

package/dist/controlplane/request.d.ts

@@ -7,6 +7,7 @@ export type ControlplaneBaseConfig = Readonly<{
     credentials?: RequestCredentials;
     fetch?: FetchLike;
     signal?: AbortSignal;
+    allowLoopbackHTTP?: boolean;
 }>;
 export type ArtifactRequestCorrelation = Readonly<{
     traceId?: string;

package/dist/controlplane/request.js

@@ -34,6 +34,76 @@ export function buildControlplaneURL(baseUrl, path) {
         return path;
     return `${base.replace(/\/+$/, "")}${path}`;
 }
+function transportPolicyDenied() {
+    return new ControlplaneRequestError({
+        status: 0,
+        code: "transport_policy_denied",
+        message: "controlplane transport security policy denied URL",
+    });
+}
+function validateArtifactURL(rawUrl, allowLoopbackHTTP) {
+    let target;
+    try {
+        if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(rawUrl)) {
+            target = new URL(rawUrl);
+        }
+        else {
+            const base = globalThis.location?.href;
+            if (!base)
+                throw new Error("relative URL requires a browser location");
+            target = new URL(rawUrl, base);
+        }
+    }
+    catch {
+        throw transportPolicyDenied();
+    }
+    if (target.username !== "" || target.password !== "" || target.hash !== "") {
+        throw transportPolicyDenied();
+    }
+    if (target.protocol === "https:")
+        return;
+    if (target.protocol === "http:"
+        && allowLoopbackHTTP === true
+        && isLiteralLoopbackHost(sourceHostname(rawUrl, target)))
+        return;
+    throw transportPolicyDenied();
+}
+function sourceHostname(rawUrl, target) {
+    const authority = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/([^/?#]*)/.exec(rawUrl)?.[1];
+    if (authority === undefined)
+        return target.hostname;
+    const hostPort = authority.slice(authority.lastIndexOf("@") + 1);
+    if (hostPort.startsWith("[")) {
+        const end = hostPort.indexOf("]");
+        if (end < 0 || (hostPort.length > end + 1 && !/^:\d+$/.test(hostPort.slice(end + 1)))) {
+            return hostPort;
+        }
+        return hostPort.slice(1, end);
+    }
+    const colon = hostPort.lastIndexOf(":");
+    if (colon < 0)
+        return hostPort;
+    if (hostPort.indexOf(":") !== colon || !/^\d+$/.test(hostPort.slice(colon + 1)))
+        return hostPort;
+    return hostPort.slice(0, colon);
+}
+function isLiteralLoopbackHost(rawHost) {
+    const host = rawHost.startsWith("[") && rawHost.endsWith("]")
+        ? rawHost.slice(1, -1).toLowerCase()
+        : rawHost.toLowerCase();
+    if (host === "localhost" || host === "::1")
+        return true;
+    const parts = host.split(".");
+    if (parts.length !== 4)
+        return false;
+    const octets = parts.map((part) => {
+        if (!/^(0|[1-9]\d{0,2})$/.test(part))
+            return -1;
+        const value = Number(part);
+        return value <= 255 ? value : -1;
+    });
+    return octets.every((value) => value >= 0) && octets[0] === 127;
+}
 function parseMaybeJSON(bodyText) {
     const trimmed = String(bodyText ?? "").trim();
     if (trimmed === "")
@@ -110,6 +180,7 @@ export async function requestControlplaneJSON(url, init) {
     const response = await runFetch(url, {
         ...init,
         cache: "no-store",
+        redirect: "error",
     });
     let rawBody = "";
     try {
@@ -164,7 +235,9 @@ function createJSONHeaders(input) {
     return headers;
 }
 export async function requestConnectArtifact(config) {
-    const data = (await requestControlplaneJSON(buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_CONNECT_ARTIFACT_PATH), {
+    const url = buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_CONNECT_ARTIFACT_PATH);
+    validateArtifactURL(url, config.allowLoopbackHTTP);
+    const data = (await requestControlplaneJSON(url, {
         ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
         method: "POST",
         credentials: config.credentials ?? "omit",
@@ -183,7 +256,9 @@ export async function requestEntryConnectArtifact(config) {
         throw new Error("entryTicket is required");
     const headers = createJSONHeaders(config.headers);
     headers.set("Authorization", `Bearer ${entryTicket}`);
-    const data = (await requestControlplaneJSON(buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_ENTRY_CONNECT_ARTIFACT_PATH), {
+    const url = buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_ENTRY_CONNECT_ARTIFACT_PATH);
+    validateArtifactURL(url, config.allowLoopbackHTTP);
+    const data = (await requestControlplaneJSON(url, {
         ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
         method: "POST",
         credentials: config.credentials ?? "omit",

package/dist/defaults.d.ts

@@ -35,6 +35,7 @@ export declare const SDK_DEFAULTS: Readonly<{
         maxChunkBytes: number;
         maxBodyBytes: number;
         maxWsFrameBytes: number;
+        maxConcurrentStreams: 64;
         defaultTimeoutMs: 30000;
         maxTimeoutMs: 300000;
     }>;

package/dist/defaults.js

@@ -35,6 +35,7 @@ export const SDK_DEFAULTS = Object.freeze({
         maxChunkBytes: 256 * 1024,
         maxBodyBytes: 64 * 1024 * 1024,
         maxWsFrameBytes: 1024 * 1024,
+        maxConcurrentStreams: 64,
         defaultTimeoutMs: 30_000,
         maxTimeoutMs: 300_000,
     }),

package/dist/facade.d.ts

@@ -17,7 +17,7 @@ export type { WebSocketLimits } from "./ws-client/binaryTransport.js";
 export type { YamuxLimits } from "./yamux/session.js";
 export type { FlowersecErrorCode, FlowersecPath, FlowersecStage } from "./utils/errors.js";
 export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
 export type { NetworkPlaintextPolicyOptions, TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, } from "./client-connect/transportSecurity.js";
 export type { TunnelConnectOptions } from "./tunnel-client/connect.js";
 export type { DirectConnectOptions } from "./direct-client/connect.js";

package/dist/facade.js

@@ -6,7 +6,7 @@ export { assertChannelInitGrant } from "./gen/flowersec/controlplane/v1.gen.js";
 export { assertDirectConnectInfo } from "./gen/flowersec/direct/v1.gen.js";
 export { assertConnectArtifact } from "./connect/artifact.js";
 export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
 export async function connectTunnel(grant, opts) {
     return await connectTunnelInternal(grant, opts);
 }

package/dist/node/index.d.ts

@@ -1,5 +1,5 @@
 export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, NetworkPlaintextPolicyOptions, } from "../client-connect/transportSecurity.js";
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export type { DirectNodeReconnectConfig, NodeReconnectConfig, TunnelNodeReconnectConfig, } from "./reconnectConfig.js";

package/dist/node/index.js

@@ -1,5 +1,5 @@
 export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export { createDirectNodeReconnectConfig, createNodeReconnectConfig, createTunnelNodeReconnectConfig, } from "./reconnectConfig.js";
 export * from "../endpoint/index.js";

package/dist/proxy/bootstrap.d.ts

@@ -1,20 +1,11 @@
 import type { Client } from "../client.js";
 import type { ConnectArtifact } from "../connect/artifact.js";
-import type { ConnectBrowserOptions, TunnelConnectBrowserOptions } from "../browser/connect.js";
-import type { ChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
+import type { ConnectBrowserOptions } from "../browser/connect.js";
 import { type ProxyIntegrationPlugin, type RegisterProxyIntegrationOptions, type ProxyIntegrationServiceWorkerOptions } from "./integration.js";
 import { type RegisterProxyControllerWindowOptions } from "./controllerWindow.js";
 import type { ProxyPresetInput } from "./preset.js";
 import { type ProxyRuntime } from "./runtime.js";
-export type ConnectTunnelProxyBrowserOptions = Readonly<{
-    connect?: TunnelConnectBrowserOptions;
-    preset?: ProxyPresetInput;
-    runtimeGlobalKey?: string;
-    runtime?: RegisterProxyIntegrationOptions["runtime"];
-    serviceWorker: ProxyIntegrationServiceWorkerOptions;
-    plugins?: readonly ProxyIntegrationPlugin[];
-}>;
-export type ConnectTunnelProxyBrowserHandle = Readonly<{
+export type ConnectArtifactProxyBrowserHandle = Readonly<{
     client: Client;
     runtime: ProxyRuntime;
     dispose: () => Promise<void>;
@@ -27,15 +18,7 @@ export type ConnectArtifactProxyBrowserOptions = Readonly<{
     serviceWorker?: ProxyIntegrationServiceWorkerOptions;
     plugins?: readonly ProxyIntegrationPlugin[];
 }>;
-export type ConnectTunnelProxyControllerBrowserOptions = Readonly<{
-    connect?: TunnelConnectBrowserOptions;
-    runtime?: RegisterProxyIntegrationOptions["runtime"];
-    allowedOrigins: RegisterProxyControllerWindowOptions["allowedOrigins"];
-    targetWindow?: RegisterProxyControllerWindowOptions["targetWindow"];
-    expectedSource?: RegisterProxyControllerWindowOptions["expectedSource"];
-    capabilityNonce?: RegisterProxyControllerWindowOptions["capabilityNonce"];
-}>;
-export type ConnectTunnelProxyControllerBrowserHandle = Readonly<{
+export type ConnectArtifactProxyControllerBrowserHandle = Readonly<{
     client: Client;
     runtime: ProxyRuntime;
     dispose: () => void;
@@ -48,7 +31,5 @@ export type ConnectArtifactProxyControllerBrowserOptions = Readonly<{
     expectedSource?: RegisterProxyControllerWindowOptions["expectedSource"];
     capabilityNonce?: RegisterProxyControllerWindowOptions["capabilityNonce"];
 }>;
-export declare function connectTunnelProxyBrowser(grant: ChannelInitGrant, opts: ConnectTunnelProxyBrowserOptions): Promise<ConnectTunnelProxyBrowserHandle>;
-export declare function connectArtifactProxyBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyBrowserOptions): Promise<ConnectTunnelProxyBrowserHandle>;
-export declare function connectTunnelProxyControllerBrowser(grant: ChannelInitGrant, opts: ConnectTunnelProxyControllerBrowserOptions): Promise<ConnectTunnelProxyControllerBrowserHandle>;
-export declare function connectArtifactProxyControllerBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyControllerBrowserOptions): Promise<ConnectTunnelProxyControllerBrowserHandle>;
+export declare function connectArtifactProxyBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyBrowserOptions): Promise<ConnectArtifactProxyBrowserHandle>;
+export declare function connectArtifactProxyControllerBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyControllerBrowserOptions): Promise<ConnectArtifactProxyControllerBrowserHandle>;

package/dist/proxy/bootstrap.js

@@ -1,4 +1,4 @@
-import { connectBrowser, connectTunnelBrowser } from "../browser/connect.js";
+import { connectBrowser } from "../browser/connect.js";
 import { registerProxyIntegration, } from "./integration.js";
 import { registerProxyControllerWindow } from "./controllerWindow.js";
 import { extractProxyRuntimeScopeV1, resolvePresetInputFromScope, resolveRuntimeLimitsFromScope, resolveRuntimePresetLimits, } from "./runtimeScope.js";
@@ -23,12 +23,10 @@ function scopeRuntimeToIntegrationOptions(scope, opts) {
     };
 }
 async function connectProxyBrowserClient(client, opts) {
-    const compat = opts;
     const integrationInput = {
         client,
         serviceWorker: opts.serviceWorker,
         ...(opts.preset === undefined ? {} : { preset: opts.preset }),
-        ...(compat.profile === undefined ? {} : { profile: compat.profile }),
         ...(opts.runtimeGlobalKey === undefined ? {} : { runtimeGlobalKey: opts.runtimeGlobalKey }),
         ...(opts.runtime === undefined ? {} : { runtime: opts.runtime }),
         ...(opts.plugins === undefined ? {} : { plugins: opts.plugins }),
@@ -101,20 +99,12 @@ function connectProxyControllerClient(client, opts) {
         },
     };
 }
-export async function connectTunnelProxyBrowser(grant, opts) {
-    const client = await connectTunnelBrowser(grant, opts.connect ?? {});
-    return await connectProxyBrowserClient(client, opts);
-}
 export async function connectArtifactProxyBrowser(artifact, opts = {}) {
     const scope = extractProxyRuntimeScopeV1(artifact, "service_worker");
     const client = await connectBrowser(artifact, opts.connect ?? {});
     const nextOpts = scopeRuntimeToIntegrationOptions(scope, opts);
     return await connectProxyBrowserClient(client, nextOpts);
 }
-export async function connectTunnelProxyControllerBrowser(grant, opts) {
-    const client = await connectTunnelBrowser(grant, opts.connect ?? {});
-    return connectProxyControllerClient(client, opts);
-}
 export async function connectArtifactProxyControllerBrowser(artifact, opts = {}) {
     const scope = extractProxyRuntimeScopeV1(artifact, "controller_bridge");
     const client = await connectBrowser(artifact, opts.connect ?? {});

package/dist/proxy/constants.d.ts

@@ -4,3 +4,4 @@ export declare const PROXY_KIND_WS: "flowersec-proxy/ws";
 export declare const DEFAULT_MAX_CHUNK_BYTES: number;
 export declare const DEFAULT_MAX_BODY_BYTES: number;
 export declare const DEFAULT_MAX_WS_FRAME_BYTES: number;
+export declare const DEFAULT_MAX_CONCURRENT_STREAMS: 64;

package/dist/proxy/constants.js

@@ -5,3 +5,4 @@ export const PROXY_KIND_WS = "flowersec-proxy/ws";
 export const DEFAULT_MAX_CHUNK_BYTES = SDK_DEFAULTS.proxy.maxChunkBytes;
 export const DEFAULT_MAX_BODY_BYTES = SDK_DEFAULTS.proxy.maxBodyBytes;
 export const DEFAULT_MAX_WS_FRAME_BYTES = SDK_DEFAULTS.proxy.maxWsFrameBytes;
+export const DEFAULT_MAX_CONCURRENT_STREAMS = SDK_DEFAULTS.proxy.maxConcurrentStreams;

package/dist/proxy/integration.js

@@ -1,4 +1,3 @@
-import { profileToPresetManifest } from "./profiles.js";
 import { resolveProxyPreset } from "./preset.js";
 import { registerServiceWorkerAndEnsureControl } from "./registerServiceWorker.js";
 import { createProxyRuntime, ensureServiceWorkerRuntimeRegistered } from "./runtime.js";
@@ -165,13 +164,8 @@ function shouldIgnoreMismatch(plugins, ctx) {
     return false;
 }
 function resolveIntegrationPreset(opts) {
-    if (opts.preset !== undefined && opts.profile !== undefined) {
-        throw new Error("preset and deprecated profile cannot be used together");
-    }
     if (opts.preset !== undefined)
         return resolveProxyPreset(opts.preset);
-    if (opts.profile !== undefined)
-        return resolveProxyPreset(profileToPresetManifest(opts.profile));
     return resolveProxyPreset();
 }
 function buildRuntimeOptions(preset, runtime) {

package/dist/proxy/preset.d.ts

@@ -26,5 +26,4 @@ export type ResolvedProxyPreset = Readonly<{
 export declare const DEFAULT_PROXY_PRESET_MANIFEST: ProxyPresetManifest;
 export type ProxyPresetInput = ProxyPresetManifest | Partial<ProxyPresetLimits>;
 export declare function assertProxyPresetManifest(value: unknown): ProxyPresetManifest;
-export declare function resolveNamedProxyPreset(name: string): ProxyPresetManifest;
 export declare function resolveProxyPreset(input?: ProxyPresetInput): ResolvedProxyPreset;

package/dist/proxy/preset.js

@@ -75,15 +75,6 @@ export function assertProxyPresetManifest(value) {
         limits: assertLimits(value.limits),
     });
 }
-export function resolveNamedProxyPreset(name) {
-    switch (String(name ?? "").trim()) {
-        case "":
-        case "default":
-            return DEFAULT_PROXY_PRESET_MANIFEST;
-        default:
-            throw new Error(`unknown proxy preset: ${name}`);
-    }
-}
 function toResolved(manifest) {
     return Object.freeze({
         v: 1,

package/dist/proxy/runtimeScope.js

@@ -1,4 +1,4 @@
-import { assertProxyPresetManifest, resolveNamedProxyPreset, } from "./preset.js";
+import { assertProxyPresetManifest, } from "./preset.js";
 const RUNTIME_SCOPE_NAME = "proxy.runtime";
 const PRESET_ID_RE = /^[a-z][a-z0-9._-]{0,63}$/;
 const MAX_RUNTIME_PAYLOAD_BYTES = 8 * 1024;
@@ -203,12 +203,7 @@ export function resolvePresetInputFromScope(scope, presetOverride) {
         return presetOverride;
     if (scope.preset.snapshot)
         return scope.preset.snapshot;
-    try {
-        return resolveNamedProxyPreset(scope.preset.presetId);
-    }
-    catch {
-        return undefined;
-    }
+    throw new Error("proxy.runtime preset snapshot is required");
 }
 export function resolveRuntimePresetLimits(scope) {
     if (scope.limits === undefined)

package/dist/proxy/server.d.ts

@@ -9,7 +9,6 @@ export type ProxyServerOptions = Readonly<{
     maxJsonFrameBytes?: number;
     maxChunkBytes?: number;
     maxBodyBytes?: number;
-    maxBufferedRequestBodyBytes?: number;
     maxWsFrameBytes?: number;
     maxWsQueuedBytes?: number;
     defaultTimeoutMs?: number;

package/dist/proxy/server.js

@@ -3,42 +3,38 @@ import { DEFAULT_MAX_JSON_FRAME_BYTES, readJsonFrame, writeJsonFrame } from "../
 import { RpcRouter, RpcServer } from "../rpc/server.js";
 import { createByteReader } from "../streamio/index.js";
 import { readU32be, u32be } from "../utils/bin.js";
-import { DEFAULT_MAX_BODY_BYTES, DEFAULT_MAX_CHUNK_BYTES, DEFAULT_MAX_WS_FRAME_BYTES, PROXY_KIND_HTTP1, PROXY_KIND_WS, PROXY_PROTOCOL_VERSION, } from "./constants.js";
+import { DEFAULT_MAX_BODY_BYTES, DEFAULT_MAX_CHUNK_BYTES, DEFAULT_MAX_CONCURRENT_STREAMS, DEFAULT_MAX_WS_FRAME_BYTES, PROXY_KIND_HTTP1, PROXY_KIND_WS, PROXY_PROTOCOL_VERSION, } from "./constants.js";
 import { filterRequestHeaders, filterResponseHeaders, filterWsOpenHeaders, isSafeHeaderValue, isValidHeaderName, normalizeHeaderName } from "./headerPolicy.js";
 export async function serveProxySession(session, options, signal) {
     const compiled = compileOptions(options);
-    const requestBodyBudget = createRequestBodyBudget(compiled.maxBufferedRequestBodyBytes);
-    const active = new Set();
+    const activeProxy = new Set();
+    const activeRPC = new Set();
     try {
         while (!signal?.aborted) {
             const accepted = await session.acceptStream(signal === undefined ? {} : { signal });
             if (accepted.kind === "rpc") {
-                if (active.size >= compiled.maxConcurrentStreams) {
-                    await accepted.stream.reset(new Error("proxy stream concurrency exhausted"));
-                    continue;
-                }
                 const task = serveRPCStream(accepted.stream, options.rpcRouter ?? new RpcRouter(), options.rpcServerOptions, signal)
                     .catch(() => { })
-                    .finally(() => active.delete(task));
-                active.add(task);
+                    .finally(() => activeRPC.delete(task));
+                activeRPC.add(task);
                 continue;
             }
             if (accepted.kind !== PROXY_KIND_HTTP1 && accepted.kind !== PROXY_KIND_WS) {
                 await accepted.stream.reset(new Error(`unsupported proxy stream kind ${accepted.kind}`));
                 continue;
             }
-            if (active.size >= compiled.maxConcurrentStreams) {
+            if (activeProxy.size >= compiled.maxConcurrentStreams) {
                 await accepted.stream.reset(new Error("proxy stream concurrency exhausted"));
                 continue;
             }
-            const task = serveProxyStreamCompiled(accepted.kind, accepted.stream, compiled, requestBodyBudget, signal)
+            const task = serveProxyStreamCompiled(accepted.kind, accepted.stream, compiled, signal)
                 .catch(() => { })
-                .finally(() => active.delete(task));
-            active.add(task);
+                .finally(() => activeProxy.delete(task));
+            activeProxy.add(task);
         }
     }
     finally {
-        await Promise.allSettled(active);
+        await Promise.allSettled([...activeProxy, ...activeRPC]);
     }
 }
 async function serveRPCStream(stream, router, options, signal) {
@@ -52,12 +48,12 @@ async function serveRPCStream(stream, router, options, signal) {
 }
 export function serveProxyStream(kind, stream, options, signal) {
     const compiled = compileOptions(options);
-    return serveProxyStreamCompiled(kind, stream, compiled, createRequestBodyBudget(compiled.maxBufferedRequestBodyBytes), signal);
+    return serveProxyStreamCompiled(kind, stream, compiled, signal);
 }
-async function serveProxyStreamCompiled(kind, stream, options, requestBodyBudget, signal) {
+async function serveProxyStreamCompiled(kind, stream, options, signal) {
     try {
         if (kind === PROXY_KIND_HTTP1)
-            await serveHTTP(stream, options, requestBodyBudget, signal);
+            await serveHTTP(stream, options, signal);
         else
             await serveWebSocket(stream, options, signal);
     }
@@ -68,94 +64,145 @@ async function serveProxyStreamCompiled(kind, stream, options, requestBodyBudget
         catch { /* The peer may already have reset the stream. */ }
     }
 }
-async function serveHTTP(stream, options, requestBodyBudget, signal) {
-    const reader = createByteReader(stream, signal === undefined ? {} : { signal });
+async function serveHTTP(stream, options, signal) {
+    const reader = createByteReader(stream);
     let requestId = "unknown";
+    let responseStarted = false;
+    let streamReset = false;
+    let requestBody;
+    let responseBodyReader;
+    let controller;
+    let timer;
+    let removeAbortListener;
+    const resetStream = async (error) => {
+        if (streamReset)
+            return;
+        streamReset = true;
+        try {
+            await stream.reset(error);
+        }
+        catch { /* The peer may already have reset the stream. */ }
+    };
     try {
         const meta = assertHTTPRequestMeta(await readJsonFrame(reader, options.maxJsonFrameBytes));
         requestId = meta.request_id;
         const path = parsePath(meta.path);
-        const bufferedBody = await readBody(reader, options.maxChunkBytes, options.maxBodyBytes, requestBodyBudget);
-        try {
-            if (signal?.aborted)
-                throw new ProxyServerError("canceled", "proxy request canceled");
-            const headers = requestHeaders(meta.headers, options);
-            applyExternalOrigin(headers, meta.external_origin);
-            const target = new URL(options.upstream);
-            target.pathname = path.pathname;
-            target.search = path.search;
-            target.hash = "";
-            const timeoutMs = resolveTimeout(meta.timeout_ms, options);
-            const controller = new AbortController();
-            const onAbort = () => controller.abort(new ProxyServerError("canceled", "proxy request canceled"));
-            signal?.addEventListener("abort", onAbort, { once: true });
-            if (signal?.aborted)
-                onAbort();
-            const timer = timeoutMs > 0
-                ? setTimeout(() => controller.abort(new ProxyServerError("timeout", "upstream request timeout")), timeoutMs)
-                : undefined;
-            try {
-                const method = meta.method.trim().toUpperCase();
-                let response;
-                try {
-                    if (controller.signal.aborted)
-                        throw controller.signal.reason;
-                    response = await options.fetch(target, {
-                        method,
-                        headers,
-                        redirect: "manual",
-                        signal: controller.signal,
-                        ...((method === "GET" || method === "HEAD")
-                            ? {}
-                            : { body: bufferedBody.bytes.buffer }),
-                    });
-                }
-                finally {
-                    bufferedBody.release();
-                }
-                const responseHeaders = collectResponseHeaders(response.headers, options);
-                const responseMeta = {
-                    v: PROXY_PROTOCOL_VERSION,
-                    request_id: requestId,
-                    ok: true,
-                    status: response.status,
-                    headers: responseHeaders,
-                };
-                await writeJsonFrame(stream, responseMeta);
-                if (response.body == null) {
-                    await stream.write(u32be(0));
-                    return;
-                }
-                const bodyReader = response.body.getReader();
-                let total = 0;
-                while (true) {
-                    const next = await bodyReader.read();
-                    if (next.done)
-                        break;
-                    const bytes = next.value;
-                    total += bytes.length;
-                    if (total > options.maxBodyBytes)
-                        throw new ProxyServerError("response_body_too_large", "response body too large");
-                    for (let offset = 0; offset < bytes.length; offset += options.maxChunkBytes) {
-                        const chunk = bytes.subarray(offset, Math.min(bytes.length, offset + options.maxChunkBytes));
-                        await stream.write(u32be(chunk.length));
-                        await stream.write(chunk);
-                    }
-                }
-                await stream.write(u32be(0));
+        const knownRequestLength = contentLength(meta.headers, "request");
+        if (knownRequestLength != null && knownRequestLength > options.maxBodyBytes) {
+            throw new ProxyServerError("request_body_too_large", "request body too large");
+        }
+        if (signal?.aborted)
+            throw new ProxyServerError("canceled", "proxy request canceled");
+        const headers = requestHeaders(meta.headers, options);
+        applyExternalOrigin(headers, meta.external_origin);
+        const target = new URL(options.upstream);
+        target.pathname = path.pathname;
+        target.search = path.search;
+        target.hash = "";
+        controller = new AbortController();
+        const abortUpstream = (error) => {
+            if (!controller.signal.aborted)
+                controller.abort(error);
+            requestBody?.abort(error);
+            if (responseStarted)
+                void resetStream(error);
+        };
+        const onAbort = () => abortUpstream(new ProxyServerError("canceled", "proxy request canceled"));
+        signal?.addEventListener("abort", onAbort, { once: true });
+        removeAbortListener = () => signal?.removeEventListener("abort", onAbort);
+        if (signal?.aborted)
+            onAbort();
+        const timeoutMs = resolveTimeout(meta.timeout_ms, options);
+        timer = timeoutMs > 0
+            ? setTimeout(() => abortUpstream(new ProxyServerError("timeout", "upstream request timeout")), timeoutMs)
+            : undefined;
+        requestBody = createStreamingRequestBody(reader, options.maxChunkBytes, options.maxBodyBytes, abortUpstream);
+        const method = meta.method.trim().toUpperCase();
+        const requestInit = {
+            method,
+            headers,
+            redirect: "manual",
+            signal: controller.signal,
+        };
+        if (method === "GET" || method === "HEAD") {
+            requestBody.drain();
+        }
+        else {
+            requestInit.body = requestBody.stream;
+            requestInit.duplex = "half";
+        }
+        if (controller.signal.aborted)
+            throw controller.signal.reason;
+        const response = await options.fetch(target, requestInit);
+        if (requestBody.error != null)
+            throw requestBody.error;
+        requestBody.drain();
+        const knownResponseLength = contentLength(response.headers, "response");
+        if (knownResponseLength != null && knownResponseLength > options.maxBodyBytes) {
+            await response.body?.cancel();
+            throw new ProxyServerError("response_body_too_large", "response body too large");
+        }
+        const responseHeaders = collectResponseHeaders(response.headers, options);
+        const responseMeta = {
+            v: PROXY_PROTOCOL_VERSION,
+            request_id: requestId,
+            ok: true,
+            status: response.status,
+            headers: responseHeaders,
+        };
+        await writeJsonFrame(stream, responseMeta);
+        responseStarted = true;
+        if (response.body == null) {
+            await stream.write(u32be(0));
+            const requestError = await requestBody.completion;
+            if (requestError != null)
+                throw requestError;
+            return;
+        }
+        responseBodyReader = response.body.getReader();
+        let total = 0;
+        while (true) {
+            const next = await Promise.race([
+                responseBodyReader.read(),
+                requestBody.failure.then((error) => { throw error; }),
+            ]);
+            if (next.done)
+                break;
+            const bytes = next.value;
+            const nextTotal = total + bytes.length;
+            if (!Number.isSafeInteger(nextTotal) || nextTotal > options.maxBodyBytes) {
+                throw new ProxyServerError("response_body_too_large", "response body too large");
             }
-            finally {
-                if (timer != null)
-                    clearTimeout(timer);
-                signal?.removeEventListener("abort", onAbort);
+            total = nextTotal;
+            for (let offset = 0; offset < bytes.length; offset += options.maxChunkBytes) {
+                const chunk = bytes.subarray(offset, Math.min(bytes.length, offset + options.maxChunkBytes));
+                await stream.write(u32be(chunk.length));
+                await stream.write(chunk);
             }
         }
-        finally {
-            bufferedBody.release();
-        }
+        await stream.write(u32be(0));
+        const requestError = await requestBody.completion;
+        if (requestError != null)
+            throw requestError;
     }
     catch (error) {
-        await writeHTTPError(stream, requestId, classifyHTTPError(error));
+        const effective = requestBody?.error ?? controller?.signal.reason ?? asError(error);
+        if (controller != null && !controller.signal.aborted)
+            controller.abort(effective);
+        if (responseStarted)
+            await resetStream(effective);
+        else
+            await writeHTTPError(stream, requestId, classifyHTTPError(effective));
+    }
+    finally {
+        if (timer != null)
+            clearTimeout(timer);
+        removeAbortListener?.();
+        requestBody?.stop();
+        try {
+            await responseBodyReader?.cancel();
+        }
+        catch { /* The upstream body may already be closed. */ }
     }
 }
 async function serveWebSocket(stream, options, signal) {
@@ -354,7 +401,6 @@ function compileOptions(input) {
     const maxJsonFrameBytes = positive(input.maxJsonFrameBytes, DEFAULT_MAX_JSON_FRAME_BYTES, "maxJsonFrameBytes");
     const maxChunkBytes = positive(input.maxChunkBytes, DEFAULT_MAX_CHUNK_BYTES, "maxChunkBytes");
     const maxBodyBytes = positive(input.maxBodyBytes, DEFAULT_MAX_BODY_BYTES, "maxBodyBytes");
-    const maxBufferedRequestBodyBytes = positive(input.maxBufferedRequestBodyBytes, maxBodyBytes, "maxBufferedRequestBodyBytes");
     const maxWsFrameBytes = positive(input.maxWsFrameBytes, DEFAULT_MAX_WS_FRAME_BYTES, "maxWsFrameBytes");
     const defaultMaxWsQueuedBytes = maxWsFrameBytes <= Number.MAX_SAFE_INTEGER - 5
         ? maxWsFrameBytes + 5
@@ -372,12 +418,11 @@ function compileOptions(input) {
         maxJsonFrameBytes,
         maxChunkBytes,
         maxBodyBytes,
-        maxBufferedRequestBodyBytes,
         maxWsFrameBytes,
         maxWsQueuedBytes,
         defaultTimeoutMs,
         maxTimeoutMs,
-        maxConcurrentStreams: positive(input.maxConcurrentStreams, 64, "maxConcurrentStreams"),
+        maxConcurrentStreams: positive(input.maxConcurrentStreams, DEFAULT_MAX_CONCURRENT_STREAMS, "maxConcurrentStreams"),
         extraRequestHeaders: input.extraRequestHeaders ?? [],
         extraResponseHeaders: input.extraResponseHeaders ?? [],
         blockedResponseHeaders: normalizeNames(input.blockedResponseHeaders),
@@ -466,62 +511,129 @@ function applyExternalOrigin(headers, input) {
     headers.set("x-forwarded-proto", new URL(external).protocol.slice(0, -1));
     headers.set("host", new URL(external).host);
 }
-function createRequestBodyBudget(maxBytes) {
-    let usedBytes = 0;
-    return {
-        reserve: (bytes) => {
-            const next = usedBytes + bytes;
-            if (!Number.isSafeInteger(next) || next > maxBytes) {
-                throw new ProxyServerError("resource_exhausted", "proxy request body buffer exhausted");
-            }
-            usedBytes = next;
-        },
-        release: (bytes) => {
-            usedBytes = Math.max(0, usedBytes - bytes);
-        },
-    };
-}
-async function readBody(reader, maxChunkBytes, maxBodyBytes, budget) {
-    const chunks = [];
+function createStreamingRequestBody(reader, maxChunkBytes, maxBodyBytes, onFailure) {
     let total = 0;
-    let handedOff = false;
-    try {
-        while (true) {
+    let finished = false;
+    let draining = false;
+    let readChain = Promise.resolve();
+    let error;
+    let streamController;
+    let resolveFailure;
+    const failure = new Promise((resolve) => { resolveFailure = resolve; });
+    let resolveCompletion;
+    const completion = new Promise((resolve) => { resolveCompletion = resolve; });
+    const fail = (cause) => {
+        if (error != null)
+            return error;
+        const raw = asError(cause);
+        error = raw instanceof ProxyServerError
+            ? raw
+            : new ProxyServerError("request_body_invalid", raw.message);
+        finished = true;
+        try {
+            streamController?.error(error);
+        }
+        catch { /* The body consumer may already be gone. */ }
+        resolveFailure(error);
+        resolveCompletion(error);
+        onFailure(error);
+        return error;
+    };
+    const readChunkUnserialized = async () => {
+        try {
             const length = readU32be(await reader.readExactly(4), 0);
-            if (length === 0)
-                break;
-            if (length > maxChunkBytes)
+            if (length === 0) {
+                finished = true;
+                resolveCompletion(undefined);
+                return null;
+            }
+            if (length > maxChunkBytes) {
                 throw new ProxyServerError("request_body_too_large", "request chunk too large");
-            const next = total + length;
-            if (!Number.isSafeInteger(next) || next > maxBodyBytes) {
+            }
+            const nextTotal = total + length;
+            if (!Number.isSafeInteger(nextTotal) || nextTotal > maxBodyBytes) {
                 throw new ProxyServerError("request_body_too_large", "request body too large");
             }
-            budget.reserve(length);
-            total = next;
-            chunks.push(await reader.readExactly(length));
+            const chunk = await reader.readExactly(length);
+            total = nextTotal;
+            return chunk;
         }
-        const body = new Uint8Array(total);
-        let offset = 0;
-        for (const chunk of chunks) {
-            body.set(chunk, offset);
-            offset += chunk.length;
+        catch (cause) {
+            throw fail(cause);
         }
-        let released = false;
-        handedOff = true;
-        return {
-            bytes: body,
-            release: () => {
-                if (released)
-                    return;
-                released = true;
-                budget.release(total);
-            },
-        };
+    };
+    const readChunk = () => {
+        const next = readChain.then(readChunkUnserialized);
+        readChain = next.then(() => { }, () => { });
+        return next;
+    };
+    const drain = () => {
+        if (draining || finished)
+            return;
+        draining = true;
+        try {
+            streamController?.close();
+        }
+        catch { /* A pending pull will observe draining below. */ }
+        void (async () => {
+            while (!finished)
+                await readChunk();
+        })().catch(() => { });
+    };
+    const stream = new ReadableStream({
+        start(controller) { streamController = controller; },
+        async pull(controller) {
+            if (finished) {
+                if (error == null)
+                    controller.close();
+                return;
+            }
+            const chunk = await readChunk();
+            if (draining)
+                return;
+            if (chunk == null)
+                controller.close();
+            else
+                controller.enqueue(chunk);
+        },
+        cancel() { drain(); },
+    }, { highWaterMark: 0 });
+    return {
+        stream,
+        failure,
+        completion,
+        get error() { return error; },
+        drain,
+        abort: (cause) => { if (!finished)
+            fail(cause); },
+        stop: () => {
+            if (finished)
+                return;
+            finished = true;
+            try {
+                streamController?.close();
+            }
+            catch { /* The fetch implementation may own the stream. */ }
+            resolveCompletion(undefined);
+        },
+    };
+}
+function contentLength(headers, side) {
+    const rawValues = headers instanceof Headers
+        ? (headers.get("content-length") == null ? [] : [headers.get("content-length")])
+        : headers
+            .filter((header) => normalizeHeaderName(header.name) === "content-length")
+            .map((header) => header.value.trim());
+    if (rawValues.length === 0)
+        return undefined;
+    if (rawValues.length !== 1 || !/^(0|[1-9][0-9]*)$/.test(rawValues[0])) {
+        throw new ProxyServerError(side === "request" ? "invalid_request_meta" : "upstream_request_failed", `invalid ${side} content-length`);
     }
-    finally {
-        if (!handedOff)
-            budget.release(total);
+    const value = Number(rawValues[0]);
+    if (!Number.isSafeInteger(value)) {
+        throw new ProxyServerError(side === "request" ? "invalid_request_meta" : "upstream_request_failed", `invalid ${side} content-length`);
     }
+    return value;
 }
 async function writeHTTPError(stream, requestId, code) {
     const meta = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Flowersec core TypeScript library (browser-friendly E2EE + multiplexing over WebSocket).",
   "license": "MIT",
   "repository": {

package/dist/proxy/profiles.d.ts

@@ -1,18 +0,0 @@
-import { type ProxyPresetManifest } from "./preset.js";
-export type ProxyProfile = Readonly<{
-    maxJsonFrameBytes: number;
-    maxChunkBytes: number;
-    maxBodyBytes: number;
-    maxWsFrameBytes: number;
-    timeoutMs: number;
-}>;
-export type ProxyProfileName = "default";
-export declare const PROXY_PROFILE_DEFAULT: Readonly<{
-    maxJsonFrameBytes: number;
-    maxChunkBytes: number;
-    maxBodyBytes: number;
-    maxWsFrameBytes: number;
-    timeoutMs: number;
-}>;
-export declare function resolveProxyProfile(profile?: ProxyProfileName | Partial<ProxyProfile>): ProxyProfile;
-export declare function profileToPresetManifest(profile?: ProxyProfileName | Partial<ProxyProfile>): ProxyPresetManifest;

package/dist/proxy/profiles.js

@@ -1,71 +0,0 @@
-import { DEFAULT_PROXY_PRESET_MANIFEST, resolveProxyPreset, } from "./preset.js";
-function toLegacyProfile(manifest) {
-    const resolved = resolveProxyPreset(manifest);
-    return Object.freeze({
-        maxJsonFrameBytes: resolved.limits.max_json_frame_bytes,
-        maxChunkBytes: resolved.limits.max_chunk_bytes,
-        maxBodyBytes: resolved.limits.max_body_bytes,
-        maxWsFrameBytes: resolved.limits.max_ws_frame_bytes,
-        timeoutMs: resolved.limits.timeout_ms ?? 0,
-    });
-}
-const DEFAULT_PROFILE = toLegacyProfile(DEFAULT_PROXY_PRESET_MANIFEST);
-export const PROXY_PROFILE_DEFAULT = DEFAULT_PROFILE;
-function normalizeSafeInt(name, value) {
-    if (!Number.isFinite(value))
-        throw new Error(`${name} must be a finite number`);
-    const n = Math.floor(value);
-    if (!Number.isSafeInteger(n))
-        throw new Error(`${name} must be a safe integer`);
-    if (n < 0)
-        throw new Error(`${name} must be >= 0`);
-    return n;
-}
-function resolveNamedProfile(name) {
-    switch (name) {
-        case "default":
-            return DEFAULT_PROFILE;
-        default:
-            throw new Error(`unknown proxy profile: ${name}`);
-    }
-}
-export function resolveProxyProfile(profile) {
-    if (profile == null)
-        return DEFAULT_PROFILE;
-    if (typeof profile === "string") {
-        return resolveNamedProfile(profile);
-    }
-    const base = DEFAULT_PROFILE;
-    return Object.freeze({
-        maxJsonFrameBytes: normalizeSafeInt("maxJsonFrameBytes", profile.maxJsonFrameBytes ?? base.maxJsonFrameBytes),
-        maxChunkBytes: normalizeSafeInt("maxChunkBytes", profile.maxChunkBytes ?? base.maxChunkBytes),
-        maxBodyBytes: normalizeSafeInt("maxBodyBytes", profile.maxBodyBytes ?? base.maxBodyBytes),
-        maxWsFrameBytes: normalizeSafeInt("maxWsFrameBytes", profile.maxWsFrameBytes ?? base.maxWsFrameBytes),
-        timeoutMs: normalizeSafeInt("timeoutMs", profile.timeoutMs ?? base.timeoutMs),
-    });
-}
-export function profileToPresetManifest(profile) {
-    if (profile == null)
-        return DEFAULT_PROXY_PRESET_MANIFEST;
-    if (typeof profile === "string") {
-        switch (profile) {
-            case "default":
-                return DEFAULT_PROXY_PRESET_MANIFEST;
-            default:
-                throw new Error(`unknown proxy profile: ${profile}`);
-        }
-    }
-    const resolved = resolveProxyProfile(profile);
-    return Object.freeze({
-        v: 1,
-        preset_id: "legacy-profile",
-        deprecated: true,
-        limits: {
-            ...(resolved.maxJsonFrameBytes > 0 ? { max_json_frame_bytes: resolved.maxJsonFrameBytes } : {}),
-            ...(resolved.maxChunkBytes > 0 ? { max_chunk_bytes: resolved.maxChunkBytes } : {}),
-            ...(resolved.maxBodyBytes > 0 ? { max_body_bytes: resolved.maxBodyBytes } : {}),
-            ...(resolved.maxWsFrameBytes > 0 ? { max_ws_frame_bytes: resolved.maxWsFrameBytes } : {}),
-            ...(resolved.timeoutMs > 0 ? { timeout_ms: resolved.timeoutMs } : {}),
-        },
-    });
-}