@floegence/flowersec-core 0.25.0 → 0.27.0

package/README.md

@@ -29,9 +29,9 @@ High-level WebSocket connections require TLS by default. Use `AllowPlaintextForL
 
 ## Node Proxy Server
 
-The Node entrypoint exports `serveProxySession(...)`, `serveProxyStream(...)`, and `ProxyServerOptions`. Request bodies remain bounded per request by `maxBodyBytes`; `maxBufferedRequestBodyBytes` additionally caps the total buffered request-body bytes owned by one proxy session. WebSocket frames remain bounded by `maxWsFrameBytes`; `maxWsQueuedBytes` additionally caps upstream-to-Yamux queued bytes per connection, while the reverse direction waits for each Node `ws` send callback.
+The Node entrypoint exports `serveProxySession(...)`, `serveProxyStream(...)`, and `ProxyServerOptions`. HTTP request and response bodies stream between Flowersec chunk frames and the upstream fetch while remaining bounded per request by `maxBodyBytes`. Proxy sessions admit at most `maxConcurrentStreams` HTTP/WebSocket streams, with a shared default of 64; RPC serving has its own concurrency controls. WebSocket frames remain bounded by `maxWsFrameBytes`; `maxWsQueuedBytes` additionally caps upstream-to-Yamux queued bytes per connection, while the reverse direction waits for each Node `ws` send callback.
 
-The defaults keep one session request-body budget equal to `maxBodyBytes` and one queued WebSocket frame plus its proxy header. Raise either limit only when the deployment has a matching memory budget.
+The defaults keep one queued WebSocket frame plus its proxy header. Raise body, concurrency, or queue limits only when the deployment has matching upstream and memory capacity.
 
 ## Runtime Boundaries
 

package/dist/browser/connect.d.ts

@@ -2,11 +2,12 @@ import type { Client } from "../client.js";
 import type { DirectConnectOptions } from "../direct-client/connect.js";
 import type { TunnelConnectOptions } from "../tunnel-client/connect.js";
 import { type ConnectOptions } from "../facade.js";
+import type { ConnectArtifact } from "../connect/artifact.js";
 import type { ChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
 import type { DirectConnectInfo } from "../gen/flowersec/direct/v1.gen.js";
 export type TunnelConnectBrowserOptions = Omit<TunnelConnectOptions, "origin" | "wsFactory">;
 export type DirectConnectBrowserOptions = Omit<DirectConnectOptions, "origin" | "wsFactory">;
 export type ConnectBrowserOptions = Omit<ConnectOptions, "origin" | "wsFactory">;
-export declare function connectBrowser(input: unknown, opts?: ConnectBrowserOptions): Promise<Client>;
+export declare function connectBrowser(input: ConnectArtifact, opts?: ConnectBrowserOptions): Promise<Client>;
 export declare function connectTunnelBrowser(grant: ChannelInitGrant, opts?: TunnelConnectBrowserOptions): Promise<Client>;
 export declare function connectDirectBrowser(info: DirectConnectInfo, opts?: DirectConnectBrowserOptions): Promise<Client>;

package/dist/browser/index.d.ts

@@ -1,10 +1,10 @@
 export type { ConnectBrowserOptions, DirectConnectBrowserOptions, TunnelConnectBrowserOptions } from "./connect.js";
 export { connectBrowser, connectDirectBrowser, connectTunnelBrowser } from "./connect.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, NetworkPlaintextPolicyOptions, } from "../client-connect/transportSecurity.js";
 export type { ConnectArtifact, CorrelationContext, CorrelationKV, DirectClientConnectArtifact, ScopeMetadataEntry, TunnelClientConnectArtifact, } from "../connect/artifact.js";
 export { assertConnectArtifact } from "../connect/artifact.js";
-export type { ConnectArtifactRequestConfig, ControlplaneConfig, EntryConnectArtifactRequestConfig, EntryControlplaneConfig, } from "./controlplane.js";
-export { ControlplaneRequestError, requestChannelGrant, requestConnectArtifact, requestEntryChannelGrant, requestEntryConnectArtifact, } from "./controlplane.js";
+export type { RequestConnectArtifactInput, RequestEntryConnectArtifactInput } from "../controlplane/request.js";
+export { requestConnectArtifact, requestEntryConnectArtifact, } from "../controlplane/request.js";
 export type { BrowserReconnectConfig, DirectBrowserReconnectConfig, TunnelBrowserReconnectConfig, } from "./reconnectConfig.js";
 export { createBrowserReconnectConfig, createDirectBrowserReconnectConfig, createTunnelBrowserReconnectConfig, } from "./reconnectConfig.js";

package/dist/browser/index.js

@@ -1,5 +1,5 @@
 export { connectBrowser, connectDirectBrowser, connectTunnelBrowser } from "./connect.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export { assertConnectArtifact } from "../connect/artifact.js";
-export { ControlplaneRequestError, requestChannelGrant, requestConnectArtifact, requestEntryChannelGrant, requestEntryConnectArtifact, } from "./controlplane.js";
+export { requestConnectArtifact, requestEntryConnectArtifact, } from "../controlplane/request.js";
 export { createBrowserReconnectConfig, createDirectBrowserReconnectConfig, createTunnelBrowserReconnectConfig, } from "./reconnectConfig.js";

package/dist/client-connect/connectCore.d.ts

@@ -2,7 +2,7 @@ import { type YamuxLimits } from "../yamux/session.js";
 import { type ClientObserverLike } from "../observability/observer.js";
 import { type WebSocketLike, type WebSocketLimits } from "../ws-client/binaryTransport.js";
 import type { ClientInternal } from "../client.js";
-import type { ConnectScopeResolverMap } from "../connect/internalNormalize.js";
+import type { ConnectScopeResolverMap } from "../connect/resolveArtifact.js";
 import { type TransportSecurityPolicy } from "./transportSecurity.js";
 export type LivenessOptions = Readonly<{
     intervalMs?: number;

package/dist/client-connect/transportSecurity.d.ts

@@ -2,8 +2,6 @@ import type { ClientPath } from "../client.js";
 import { type ClientObserverLike } from "../observability/observer.js";
 export declare const RequireTLS: "require_tls";
 export declare const AllowPlaintextForLoopback: "allow_plaintext_for_loopback";
-/** @deprecated Use RequireTLS, AllowPlaintextForLoopback, or createNetworkPlaintextPolicy. */
-export declare const AllowPlaintext: "allow_plaintext";
 export declare const PlaintextRiskAcceptance: {
     readonly acceptPreE2ECredentialExposure: "accept_pre_e2ee_credential_exposure";
 };
@@ -18,7 +16,7 @@ export type TransportSecurityPolicyInput = Readonly<{
     host: string;
     runtime: "browser" | "node" | "other";
 }>;
-export type TransportSecurityPolicyPreset = typeof RequireTLS | typeof AllowPlaintextForLoopback | typeof AllowPlaintext;
+export type TransportSecurityPolicyPreset = typeof RequireTLS | typeof AllowPlaintextForLoopback;
 export type TransportSecurityPolicy = TransportSecurityPolicyPreset | ((input: TransportSecurityPolicyInput) => boolean | Promise<boolean>);
 export declare function createNetworkPlaintextPolicy(options: NetworkPlaintextPolicyOptions): TransportSecurityPolicy;
 export declare function enforceTransportSecurity(args: Readonly<{

package/dist/client-connect/transportSecurity.js

@@ -2,8 +2,6 @@ import { FlowersecError } from "../utils/errors.js";
 import { emitObserverDiagnostic } from "../observability/observer.js";
 export const RequireTLS = "require_tls";
 export const AllowPlaintextForLoopback = "allow_plaintext_for_loopback";
-/** @deprecated Use RequireTLS, AllowPlaintextForLoopback, or createNetworkPlaintextPolicy. */
-export const AllowPlaintext = "allow_plaintext";
 export const PlaintextRiskAcceptance = {
     acceptPreE2ECredentialExposure: "accept_pre_e2ee_credential_exposure",
 };
@@ -71,8 +69,6 @@ function evaluatePreset(policy, target) {
             return target.scheme === "wss";
         case AllowPlaintextForLoopback:
             return target.scheme === "wss" || isLiteralLoopbackHost(target.host);
-        case AllowPlaintext:
-            return true;
     }
 }
 function parseWebSocketTarget(rawUrl) {

package/dist/connect/artifact.d.ts

@@ -33,5 +33,4 @@ export type DirectClientConnectArtifact = Readonly<{
     correlation?: CorrelationContext;
 }>;
 export type ConnectArtifact = TunnelClientConnectArtifact | DirectClientConnectArtifact;
-export declare function hasArtifactOnlyFields(value: Record<string, unknown>): boolean;
 export declare function assertConnectArtifact(value: unknown): ConnectArtifact;

package/dist/connect/artifact.js

@@ -6,7 +6,6 @@ const CORRELATION_ID_RE = /^[A-Za-z0-9._~-]{8,128}$/;
 const encoder = new TextEncoder();
 const TUNNEL_ARTIFACT_KEYS = new Set(["v", "transport", "tunnel_grant", "scoped", "correlation"]);
 const DIRECT_ARTIFACT_KEYS = new Set(["v", "transport", "direct_info", "scoped", "correlation"]);
-const ARTIFACT_ONLY_KEYS = new Set(["v", "transport", "tunnel_grant", "direct_info", "scoped", "correlation"]);
 function isRecord(v) {
     return typeof v === "object" && v != null && !Array.isArray(v);
 }
@@ -177,9 +176,6 @@ function assertArtifactTransport(value) {
         throw new Error("bad ConnectArtifact.transport");
     return value;
 }
-export function hasArtifactOnlyFields(value) {
-    return Object.keys(value).some((key) => ARTIFACT_ONLY_KEYS.has(key));
-}
 export function assertConnectArtifact(value) {
     const record = assertArtifactObject(value);
     if (record.v !== 1)

package/dist/connect/{internalNormalize.d.ts → resolveArtifact.d.ts}

@@ -1,22 +1,22 @@
+import type { ChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
+import type { DirectConnectInfo } from "../gen/flowersec/direct/v1.gen.js";
 import { type ClientObserverLike } from "../observability/observer.js";
-import { type CorrelationContext, type ScopeMetadataEntry } from "./artifact.js";
+import { type ConnectArtifact, type ScopeMetadataEntry } from "./artifact.js";
 export type ConnectScopeResolver = (entry: ScopeMetadataEntry) => void | Promise<void>;
 export type ConnectScopeResolverMap = Readonly<Record<string, ConnectScopeResolver>>;
-type NormalizeOptions = Readonly<{
+type ResolveOptions = Readonly<{
     observer?: ClientObserverLike;
     scopeResolvers?: ConnectScopeResolverMap;
     relaxedOptionalScopeValidation?: boolean;
 }>;
-export type NormalizedConnectInput = Readonly<{
+export type ResolvedConnectArtifact = Readonly<{
     kind: "tunnel";
-    input: unknown;
-    correlation?: CorrelationContext;
+    input: ChannelInitGrant;
     observer?: ClientObserverLike;
 }> | Readonly<{
     kind: "direct";
-    input: unknown;
-    correlation?: CorrelationContext;
+    input: DirectConnectInfo;
     observer?: ClientObserverLike;
 }>;
-export declare function normalizeConnectInput(input: unknown, opts?: NormalizeOptions): Promise<NormalizedConnectInput>;
+export declare function resolveConnectArtifact(input: ConnectArtifact, opts?: ResolveOptions): Promise<ResolvedConnectArtifact>;
 export {};

package/dist/connect/resolveArtifact.js

@@ -0,0 +1,87 @@
+import { emitObserverDiagnostic, normalizeObserver, withObserverContext } from "../observability/observer.js";
+import { FlowersecError } from "../utils/errors.js";
+import { assertConnectArtifact, } from "./artifact.js";
+async function validateArtifactScopes(artifact, opts, observer) {
+    const scoped = artifact.scoped ?? [];
+    if (scoped.length === 0)
+        return;
+    const path = artifact.transport;
+    for (const entry of scoped) {
+        const resolver = opts.scopeResolvers?.[entry.scope];
+        if (resolver == null) {
+            if (entry.critical) {
+                throw new FlowersecError({
+                    path,
+                    stage: "validate",
+                    code: "resolve_failed",
+                    message: `missing scope resolver for ${entry.scope}@${entry.scope_version}`,
+                });
+            }
+            emitObserverDiagnostic(observer, {
+                path,
+                stage: "scope",
+                code_domain: "event",
+                code: "scope_ignored_missing_resolver",
+                result: "skip",
+            });
+            continue;
+        }
+        try {
+            await resolver(entry);
+        }
+        catch (error) {
+            if (!entry.critical && opts.relaxedOptionalScopeValidation === true) {
+                emitObserverDiagnostic(observer, {
+                    path,
+                    stage: "scope",
+                    code_domain: "event",
+                    code: "scope_ignored_relaxed_validation",
+                    result: "skip",
+                });
+                continue;
+            }
+            throw new FlowersecError({
+                path,
+                stage: "validate",
+                code: "resolve_failed",
+                message: `scope validation failed for ${entry.scope}@${entry.scope_version}`,
+                cause: error,
+            });
+        }
+    }
+}
+export async function resolveConnectArtifact(input, opts = {}) {
+    let artifact;
+    try {
+        artifact = assertConnectArtifact(input);
+    }
+    catch (error) {
+        throw new FlowersecError({
+            path: "auto",
+            stage: "validate",
+            code: "invalid_input",
+            message: "invalid ConnectArtifact",
+            cause: error,
+        });
+    }
+    const observer = opts.observer == null
+        ? undefined
+        : normalizeObserver(withObserverContext(opts.observer, {
+            path: artifact.transport,
+            ...(artifact.correlation?.trace_id === undefined ? {} : { traceId: artifact.correlation.trace_id }),
+            ...(artifact.correlation?.session_id === undefined ? {} : { sessionId: artifact.correlation.session_id }),
+        }), { path: artifact.transport });
+    await validateArtifactScopes(artifact, opts, observer);
+    if (artifact.transport === "direct") {
+        return {
+            kind: "direct",
+            input: artifact.direct_info,
+            ...(observer === undefined ? {} : { observer }),
+        };
+    }
+    return {
+        kind: "tunnel",
+        input: artifact.tunnel_grant,
+        ...(observer === undefined ? {} : { observer }),
+    };
+}

package/dist/controlplane/request.d.ts

@@ -7,6 +7,7 @@ export type ControlplaneBaseConfig = Readonly<{
     credentials?: RequestCredentials;
     fetch?: FetchLike;
     signal?: AbortSignal;
+    allowLoopbackHTTP?: boolean;
 }>;
 export type ArtifactRequestCorrelation = Readonly<{
     traceId?: string;

package/dist/controlplane/request.js

@@ -34,6 +34,76 @@ export function buildControlplaneURL(baseUrl, path) {
         return path;
     return `${base.replace(/\/+$/, "")}${path}`;
 }
+function transportPolicyDenied() {
+    return new ControlplaneRequestError({
+        status: 0,
+        code: "transport_policy_denied",
+        message: "controlplane transport security policy denied URL",
+    });
+}
+function validateArtifactURL(rawUrl, allowLoopbackHTTP) {
+    let target;
+    try {
+        if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(rawUrl)) {
+            target = new URL(rawUrl);
+        }
+        else {
+            const base = globalThis.location?.href;
+            if (!base)
+                throw new Error("relative URL requires a browser location");
+            target = new URL(rawUrl, base);
+        }
+    }
+    catch {
+        throw transportPolicyDenied();
+    }
+    if (target.username !== "" || target.password !== "" || target.hash !== "") {
+        throw transportPolicyDenied();
+    }
+    if (target.protocol === "https:")
+        return;
+    if (target.protocol === "http:"
+        && allowLoopbackHTTP === true
+        && isLiteralLoopbackHost(sourceHostname(rawUrl, target)))
+        return;
+    throw transportPolicyDenied();
+}
+function sourceHostname(rawUrl, target) {
+    const authority = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/([^/?#]*)/.exec(rawUrl)?.[1];
+    if (authority === undefined)
+        return target.hostname;
+    const hostPort = authority.slice(authority.lastIndexOf("@") + 1);
+    if (hostPort.startsWith("[")) {
+        const end = hostPort.indexOf("]");
+        if (end < 0 || (hostPort.length > end + 1 && !/^:\d+$/.test(hostPort.slice(end + 1)))) {
+            return hostPort;
+        }
+        return hostPort.slice(1, end);
+    }
+    const colon = hostPort.lastIndexOf(":");
+    if (colon < 0)
+        return hostPort;
+    if (hostPort.indexOf(":") !== colon || !/^\d+$/.test(hostPort.slice(colon + 1)))
+        return hostPort;
+    return hostPort.slice(0, colon);
+}
+function isLiteralLoopbackHost(rawHost) {
+    const host = rawHost.startsWith("[") && rawHost.endsWith("]")
+        ? rawHost.slice(1, -1).toLowerCase()
+        : rawHost.toLowerCase();
+    if (host === "localhost" || host === "::1")
+        return true;
+    const parts = host.split(".");
+    if (parts.length !== 4)
+        return false;
+    const octets = parts.map((part) => {
+        if (!/^(0|[1-9]\d{0,2})$/.test(part))
+            return -1;
+        const value = Number(part);
+        return value <= 255 ? value : -1;
+    });
+    return octets.every((value) => value >= 0) && octets[0] === 127;
+}
 function parseMaybeJSON(bodyText) {
     const trimmed = String(bodyText ?? "").trim();
     if (trimmed === "")
@@ -110,6 +180,7 @@ export async function requestControlplaneJSON(url, init) {
     const response = await runFetch(url, {
         ...init,
         cache: "no-store",
+        redirect: "error",
     });
     let rawBody = "";
     try {
@@ -164,7 +235,9 @@ function createJSONHeaders(input) {
     return headers;
 }
 export async function requestConnectArtifact(config) {
-    const data = (await requestControlplaneJSON(buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_CONNECT_ARTIFACT_PATH), {
+    const url = buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_CONNECT_ARTIFACT_PATH);
+    validateArtifactURL(url, config.allowLoopbackHTTP);
+    const data = (await requestControlplaneJSON(url, {
         ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
         method: "POST",
         credentials: config.credentials ?? "omit",
@@ -183,7 +256,9 @@ export async function requestEntryConnectArtifact(config) {
         throw new Error("entryTicket is required");
     const headers = createJSONHeaders(config.headers);
     headers.set("Authorization", `Bearer ${entryTicket}`);
-    const data = (await requestControlplaneJSON(buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_ENTRY_CONNECT_ARTIFACT_PATH), {
+    const url = buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_ENTRY_CONNECT_ARTIFACT_PATH);
+    validateArtifactURL(url, config.allowLoopbackHTTP);
+    const data = (await requestControlplaneJSON(url, {
         ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
         method: "POST",
         credentials: config.credentials ?? "omit",

package/dist/defaults.d.ts

@@ -35,6 +35,7 @@ export declare const SDK_DEFAULTS: Readonly<{
         maxChunkBytes: number;
         maxBodyBytes: number;
         maxWsFrameBytes: number;
+        maxConcurrentStreams: 64;
         defaultTimeoutMs: 30000;
         maxTimeoutMs: 300000;
     }>;

package/dist/defaults.js

@@ -35,6 +35,7 @@ export const SDK_DEFAULTS = Object.freeze({
         maxChunkBytes: 256 * 1024,
         maxBodyBytes: 64 * 1024 * 1024,
         maxWsFrameBytes: 1024 * 1024,
+        maxConcurrentStreams: 64,
         defaultTimeoutMs: 30_000,
         maxTimeoutMs: 300_000,
     }),

package/dist/e2ee/record.js

@@ -1,7 +1,7 @@
 import { gcm } from "@noble/ciphers/aes";
 import { concatBytes, readU32be, readU64be, u32be, u64be } from "../utils/bin.js";
 import { PROTOCOL_VERSION, RECORD_MAGIC, RECORD_FLAG_APP, RECORD_FLAG_PING, RECORD_FLAG_REKEY } from "./constants.js";
-const te = new TextEncoder();
+const recordMagicBytes = new TextEncoder().encode(RECORD_MAGIC);
 // RecordError marks record parsing or cryptographic failures.
 export class RecordError extends Error {
 }
@@ -28,7 +28,7 @@ export function encryptRecord(key, noncePrefix, flags, seq, plaintext, maxRecord
     if (cipherLen > 0xffffffff)
         throw new RecordError("record too large");
     const header = new Uint8Array(4 + 1 + 1 + 8 + 4);
-    header.set(te.encode(RECORD_MAGIC), 0);
+    header.set(recordMagicBytes, 0);
     header[4] = PROTOCOL_VERSION;
     header[5] = flags & 0xff;
     header.set(u64be(seq), 6);
@@ -51,8 +51,12 @@ export function decryptRecord(key, noncePrefix, frame, expectSeq, maxRecordBytes
         throw new RecordError("record too large");
     if (frame.length < headerLen)
         throw new RecordError("record too short");
-    if (new TextDecoder().decode(frame.slice(0, 4)) !== RECORD_MAGIC)
+    if (frame[0] !== recordMagicBytes[0] ||
+        frame[1] !== recordMagicBytes[1] ||
+        frame[2] !== recordMagicBytes[2] ||
+        frame[3] !== recordMagicBytes[3]) {
         throw new RecordError("bad record magic");
+    }
     if (frame[4] !== PROTOCOL_VERSION)
         throw new RecordError("bad record version");
     const flags = frame[5];
@@ -67,7 +71,7 @@ export function decryptRecord(key, noncePrefix, frame, expectSeq, maxRecordBytes
         throw new RecordError("length mismatch");
     const nonce = concatBytes([noncePrefix, u64be(seq)]);
     try {
-        const plaintext = gcm(key, nonce, frame.slice(0, headerLen)).decrypt(frame.slice(headerLen));
+        const plaintext = gcm(key, nonce, frame.subarray(0, headerLen)).decrypt(frame.subarray(headerLen));
         return { flags, seq, plaintext };
     }
     catch (e) {

package/dist/e2ee/secureChannel.d.ts

@@ -88,5 +88,6 @@ export declare class SecureChannel {
     private reserveSendSeq;
     private sendLoop;
     private readLoop;
+    private clearKeyMaterial;
 }
 export {};

package/dist/e2ee/secureChannel.js

@@ -62,11 +62,11 @@ export class SecureChannel {
             throw new RangeError("maxOutboundBufferedBytes must be a non-negative safe integer");
         }
         this.maxOutboundBufferedBytes = maxOutboundBufferedBytes === 0 ? SDK_DEFAULTS.e2ee.maxOutboundBufferedBytes : maxOutboundBufferedBytes;
-        this.sendKey = args.sendKey;
-        this.recvKey = args.recvKey;
+        this.sendKey = args.sendKey.slice();
+        this.recvKey = args.recvKey.slice();
         this.sendNoncePrefix = args.sendNoncePrefix;
         this.recvNoncePrefix = args.recvNoncePrefix;
-        this.rekeyBase = args.rekeyBase;
+        this.rekeyBase = args.rekeyBase.slice();
         this.transcriptHash = args.transcriptHash;
         this.sendDir = args.sendDir;
         this.recvDir = args.recvDir;
@@ -113,11 +113,16 @@ export class SecureChannel {
         this.sendClosed = true;
         this.rejectQueuedSenders(this.sendErr ?? new Error("closed"));
         this.wakeSendWaiters();
-        this.transport.close();
         const ws = this.recvWaiters;
         this.recvWaiters = [];
         for (const w of ws)
             w();
+        try {
+            this.transport.close();
+        }
+        finally {
+            this.clearKeyMaterial();
+        }
     }
     // sendPing emits a keepalive record.
     async sendPing() {
@@ -254,6 +259,8 @@ export class SecureChannel {
                 if (req.kind === "app") {
                     const payload = req.payload ?? new Uint8Array();
                     for (let offset = 0; offset < payload.length; offset += this.outboundRecordChunkBytes) {
+                        if (this.closed || this.sendClosed)
+                            throw new Error("closed");
                         const chunk = payload.subarray(offset, Math.min(payload.length, offset + this.outboundRecordChunkBytes));
                         const seq = this.reserveSendSeq();
                         frame = encryptRecord(this.sendKey, this.sendNoncePrefix, RECORD_FLAG_APP, seq, chunk, this.maxRecordBytes);
@@ -290,6 +297,8 @@ export class SecureChannel {
         try {
             while (!this.closed) {
                 const frame = await this.transport.readBinary();
+                if (this.closed)
+                    return;
                 const { flags, seq, plaintext } = decryptRecord(this.recvKey, this.recvNoncePrefix, frame, this.recvSeq, this.maxRecordBytes);
                 if (seq >= maxRecordSeq) {
                     throw new RecordSeqExhaustedError();
@@ -325,4 +334,9 @@ export class SecureChannel {
             this.close();
         }
     }
+    clearKeyMaterial() {
+        this.sendKey.fill(0);
+        this.recvKey.fill(0);
+        this.rekeyBase.fill(0);
+    }
 }

package/dist/facade.d.ts

@@ -17,14 +17,11 @@ export type { WebSocketLimits } from "./ws-client/binaryTransport.js";
 export type { YamuxLimits } from "./yamux/session.js";
 export type { FlowersecErrorCode, FlowersecPath, FlowersecStage } from "./utils/errors.js";
 export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
 export type { NetworkPlaintextPolicyOptions, TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, } from "./client-connect/transportSecurity.js";
 export type { TunnelConnectOptions } from "./tunnel-client/connect.js";
 export type { DirectConnectOptions } from "./direct-client/connect.js";
 export type ConnectOptions = TunnelConnectOptions | DirectConnectOptions;
 export declare function connectTunnel(grant: ChannelInitGrant, opts: TunnelConnectOptions): Promise<Client>;
 export declare function connectDirect(info: DirectConnectInfo, opts: DirectConnectOptions): Promise<Client>;
-export declare function connect(input: DirectConnectInfo, opts: DirectConnectOptions): Promise<Client>;
-export declare function connect(input: ChannelInitGrant, opts: TunnelConnectOptions): Promise<Client>;
 export declare function connect(input: ConnectArtifact, opts: ConnectOptions): Promise<Client>;
-export declare function connect(input: unknown, opts: ConnectOptions): Promise<Client>;

package/dist/facade.js

@@ -1,27 +1,21 @@
 import { connectDirect as connectDirectInternal } from "./direct-client/connect.js";
 import { connectTunnel as connectTunnelInternal } from "./tunnel-client/connect.js";
-import { normalizeConnectInput } from "./connect/internalNormalize.js";
-import { withObserverContext } from "./observability/observer.js";
+import { resolveConnectArtifact } from "./connect/resolveArtifact.js";
 export { assertChannelInitGrant } from "./gen/flowersec/controlplane/v1.gen.js";
 export { assertDirectConnectInfo } from "./gen/flowersec/direct/v1.gen.js";
 export { assertConnectArtifact } from "./connect/artifact.js";
 export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
 export async function connectTunnel(grant, opts) {
     return await connectTunnelInternal(grant, opts);
 }
 export async function connectDirect(info, opts) {
     return await connectDirectInternal(info, opts);
 }
+// connect resolves an artifact to its explicit direct or tunnel transport.
 export async function connect(input, opts) {
-    const normalized = await normalizeConnectInput(input, opts);
-    const nextObserver = normalized.observer ??
-        (normalized.correlation == null
-            ? opts.observer
-            : withObserverContext(opts.observer, {
-                ...(normalized.correlation.trace_id === undefined ? {} : { traceId: normalized.correlation.trace_id }),
-                ...(normalized.correlation.session_id === undefined ? {} : { sessionId: normalized.correlation.session_id }),
-            }));
+    const normalized = await resolveConnectArtifact(input, opts);
+    const nextObserver = normalized.observer ?? opts.observer;
     const nextOpts = (nextObserver === opts.observer ? opts : { ...opts, observer: nextObserver });
     if (normalized.kind === "direct") {
         return await connectDirectInternal(normalized.input, nextOpts);

package/dist/node/connect.d.ts

@@ -5,8 +5,6 @@ import { type ConnectOptions } from "../facade.js";
 import type { ConnectArtifact } from "../connect/artifact.js";
 import type { ChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
 import type { DirectConnectInfo } from "../gen/flowersec/direct/v1.gen.js";
-export declare function connectNode(input: DirectConnectInfo, opts: DirectConnectOptions): Promise<Client>;
-export declare function connectNode(input: ChannelInitGrant, opts: TunnelConnectOptions): Promise<Client>;
 export declare function connectNode(input: ConnectArtifact, opts: ConnectOptions): Promise<Client>;
 export declare function connectTunnelNode(grant: ChannelInitGrant, opts: TunnelConnectOptions): Promise<Client>;
 export declare function connectDirectNode(info: DirectConnectInfo, opts: DirectConnectOptions): Promise<Client>;

package/dist/node/index.d.ts

@@ -1,5 +1,5 @@
 export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, NetworkPlaintextPolicyOptions, } from "../client-connect/transportSecurity.js";
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export type { DirectNodeReconnectConfig, NodeReconnectConfig, TunnelNodeReconnectConfig, } from "./reconnectConfig.js";

package/dist/node/index.js

@@ -1,5 +1,5 @@
 export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export { createDirectNodeReconnectConfig, createNodeReconnectConfig, createTunnelNodeReconnectConfig, } from "./reconnectConfig.js";
 export * from "../endpoint/index.js";

package/dist/proxy/bootstrap.d.ts

@@ -1,20 +1,11 @@
 import type { Client } from "../client.js";
 import type { ConnectArtifact } from "../connect/artifact.js";
-import type { ConnectBrowserOptions, TunnelConnectBrowserOptions } from "../browser/connect.js";
-import type { ChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
+import type { ConnectBrowserOptions } from "../browser/connect.js";
 import { type ProxyIntegrationPlugin, type RegisterProxyIntegrationOptions, type ProxyIntegrationServiceWorkerOptions } from "./integration.js";
 import { type RegisterProxyControllerWindowOptions } from "./controllerWindow.js";
 import type { ProxyPresetInput } from "./preset.js";
 import { type ProxyRuntime } from "./runtime.js";
-export type ConnectTunnelProxyBrowserOptions = Readonly<{
-    connect?: TunnelConnectBrowserOptions;
-    preset?: ProxyPresetInput;
-    runtimeGlobalKey?: string;
-    runtime?: RegisterProxyIntegrationOptions["runtime"];
-    serviceWorker: ProxyIntegrationServiceWorkerOptions;
-    plugins?: readonly ProxyIntegrationPlugin[];
-}>;
-export type ConnectTunnelProxyBrowserHandle = Readonly<{
+export type ConnectArtifactProxyBrowserHandle = Readonly<{
     client: Client;
     runtime: ProxyRuntime;
     dispose: () => Promise<void>;
@@ -27,15 +18,7 @@ export type ConnectArtifactProxyBrowserOptions = Readonly<{
     serviceWorker?: ProxyIntegrationServiceWorkerOptions;
     plugins?: readonly ProxyIntegrationPlugin[];
 }>;
-export type ConnectTunnelProxyControllerBrowserOptions = Readonly<{
-    connect?: TunnelConnectBrowserOptions;
-    runtime?: RegisterProxyIntegrationOptions["runtime"];
-    allowedOrigins: RegisterProxyControllerWindowOptions["allowedOrigins"];
-    targetWindow?: RegisterProxyControllerWindowOptions["targetWindow"];
-    expectedSource?: RegisterProxyControllerWindowOptions["expectedSource"];
-    capabilityNonce?: RegisterProxyControllerWindowOptions["capabilityNonce"];
-}>;
-export type ConnectTunnelProxyControllerBrowserHandle = Readonly<{
+export type ConnectArtifactProxyControllerBrowserHandle = Readonly<{
     client: Client;
     runtime: ProxyRuntime;
     dispose: () => void;
@@ -48,7 +31,5 @@ export type ConnectArtifactProxyControllerBrowserOptions = Readonly<{
     expectedSource?: RegisterProxyControllerWindowOptions["expectedSource"];
     capabilityNonce?: RegisterProxyControllerWindowOptions["capabilityNonce"];
 }>;
-export declare function connectTunnelProxyBrowser(grant: ChannelInitGrant, opts: ConnectTunnelProxyBrowserOptions): Promise<ConnectTunnelProxyBrowserHandle>;
-export declare function connectArtifactProxyBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyBrowserOptions): Promise<ConnectTunnelProxyBrowserHandle>;
-export declare function connectTunnelProxyControllerBrowser(grant: ChannelInitGrant, opts: ConnectTunnelProxyControllerBrowserOptions): Promise<ConnectTunnelProxyControllerBrowserHandle>;
-export declare function connectArtifactProxyControllerBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyControllerBrowserOptions): Promise<ConnectTunnelProxyControllerBrowserHandle>;
+export declare function connectArtifactProxyBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyBrowserOptions): Promise<ConnectArtifactProxyBrowserHandle>;
+export declare function connectArtifactProxyControllerBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyControllerBrowserOptions): Promise<ConnectArtifactProxyControllerBrowserHandle>;