@floegence/flowersec-core 0.25.0 → 0.27.0

package/dist/proxy/bootstrap.js

@@ -1,4 +1,4 @@
-import { connectBrowser, connectTunnelBrowser } from "../browser/connect.js";
+import { connectBrowser } from "../browser/connect.js";
 import { registerProxyIntegration, } from "./integration.js";
 import { registerProxyControllerWindow } from "./controllerWindow.js";
 import { extractProxyRuntimeScopeV1, resolvePresetInputFromScope, resolveRuntimeLimitsFromScope, resolveRuntimePresetLimits, } from "./runtimeScope.js";
@@ -23,12 +23,10 @@ function scopeRuntimeToIntegrationOptions(scope, opts) {
     };
 }
 async function connectProxyBrowserClient(client, opts) {
-    const compat = opts;
     const integrationInput = {
         client,
         serviceWorker: opts.serviceWorker,
         ...(opts.preset === undefined ? {} : { preset: opts.preset }),
-        ...(compat.profile === undefined ? {} : { profile: compat.profile }),
         ...(opts.runtimeGlobalKey === undefined ? {} : { runtimeGlobalKey: opts.runtimeGlobalKey }),
         ...(opts.runtime === undefined ? {} : { runtime: opts.runtime }),
         ...(opts.plugins === undefined ? {} : { plugins: opts.plugins }),
@@ -101,20 +99,12 @@ function connectProxyControllerClient(client, opts) {
         },
     };
 }
-export async function connectTunnelProxyBrowser(grant, opts) {
-    const client = await connectTunnelBrowser(grant, opts.connect ?? {});
-    return await connectProxyBrowserClient(client, opts);
-}
 export async function connectArtifactProxyBrowser(artifact, opts = {}) {
     const scope = extractProxyRuntimeScopeV1(artifact, "service_worker");
     const client = await connectBrowser(artifact, opts.connect ?? {});
     const nextOpts = scopeRuntimeToIntegrationOptions(scope, opts);
     return await connectProxyBrowserClient(client, nextOpts);
 }
-export async function connectTunnelProxyControllerBrowser(grant, opts) {
-    const client = await connectTunnelBrowser(grant, opts.connect ?? {});
-    return connectProxyControllerClient(client, opts);
-}
 export async function connectArtifactProxyControllerBrowser(artifact, opts = {}) {
     const scope = extractProxyRuntimeScopeV1(artifact, "controller_bridge");
     const client = await connectBrowser(artifact, opts.connect ?? {});

package/dist/proxy/constants.d.ts

@@ -4,3 +4,4 @@ export declare const PROXY_KIND_WS: "flowersec-proxy/ws";
 export declare const DEFAULT_MAX_CHUNK_BYTES: number;
 export declare const DEFAULT_MAX_BODY_BYTES: number;
 export declare const DEFAULT_MAX_WS_FRAME_BYTES: number;
+export declare const DEFAULT_MAX_CONCURRENT_STREAMS: 64;

package/dist/proxy/constants.js

@@ -5,3 +5,4 @@ export const PROXY_KIND_WS = "flowersec-proxy/ws";
 export const DEFAULT_MAX_CHUNK_BYTES = SDK_DEFAULTS.proxy.maxChunkBytes;
 export const DEFAULT_MAX_BODY_BYTES = SDK_DEFAULTS.proxy.maxBodyBytes;
 export const DEFAULT_MAX_WS_FRAME_BYTES = SDK_DEFAULTS.proxy.maxWsFrameBytes;
+export const DEFAULT_MAX_CONCURRENT_STREAMS = SDK_DEFAULTS.proxy.maxConcurrentStreams;

package/dist/proxy/integration.js

@@ -1,4 +1,3 @@
-import { profileToPresetManifest } from "./profiles.js";
 import { resolveProxyPreset } from "./preset.js";
 import { registerServiceWorkerAndEnsureControl } from "./registerServiceWorker.js";
 import { createProxyRuntime, ensureServiceWorkerRuntimeRegistered } from "./runtime.js";
@@ -165,13 +164,8 @@ function shouldIgnoreMismatch(plugins, ctx) {
     return false;
 }
 function resolveIntegrationPreset(opts) {
-    if (opts.preset !== undefined && opts.profile !== undefined) {
-        throw new Error("preset and deprecated profile cannot be used together");
-    }
     if (opts.preset !== undefined)
         return resolveProxyPreset(opts.preset);
-    if (opts.profile !== undefined)
-        return resolveProxyPreset(profileToPresetManifest(opts.profile));
     return resolveProxyPreset();
 }
 function buildRuntimeOptions(preset, runtime) {

package/dist/proxy/preset.d.ts

@@ -26,5 +26,4 @@ export type ResolvedProxyPreset = Readonly<{
 export declare const DEFAULT_PROXY_PRESET_MANIFEST: ProxyPresetManifest;
 export type ProxyPresetInput = ProxyPresetManifest | Partial<ProxyPresetLimits>;
 export declare function assertProxyPresetManifest(value: unknown): ProxyPresetManifest;
-export declare function resolveNamedProxyPreset(name: string): ProxyPresetManifest;
 export declare function resolveProxyPreset(input?: ProxyPresetInput): ResolvedProxyPreset;

package/dist/proxy/preset.js

@@ -75,15 +75,6 @@ export function assertProxyPresetManifest(value) {
         limits: assertLimits(value.limits),
     });
 }
-export function resolveNamedProxyPreset(name) {
-    switch (String(name ?? "").trim()) {
-        case "":
-        case "default":
-            return DEFAULT_PROXY_PRESET_MANIFEST;
-        default:
-            throw new Error(`unknown proxy preset: ${name}`);
-    }
-}
 function toResolved(manifest) {
     return Object.freeze({
         v: 1,

package/dist/proxy/runtimeScope.js

@@ -1,4 +1,4 @@
-import { assertProxyPresetManifest, resolveNamedProxyPreset, } from "./preset.js";
+import { assertProxyPresetManifest, } from "./preset.js";
 const RUNTIME_SCOPE_NAME = "proxy.runtime";
 const PRESET_ID_RE = /^[a-z][a-z0-9._-]{0,63}$/;
 const MAX_RUNTIME_PAYLOAD_BYTES = 8 * 1024;
@@ -203,12 +203,7 @@ export function resolvePresetInputFromScope(scope, presetOverride) {
         return presetOverride;
     if (scope.preset.snapshot)
         return scope.preset.snapshot;
-    try {
-        return resolveNamedProxyPreset(scope.preset.presetId);
-    }
-    catch {
-        return undefined;
-    }
+    throw new Error("proxy.runtime preset snapshot is required");
 }
 export function resolveRuntimePresetLimits(scope) {
     if (scope.limits === undefined)

package/dist/proxy/server.d.ts

@@ -9,7 +9,6 @@ export type ProxyServerOptions = Readonly<{
     maxJsonFrameBytes?: number;
     maxChunkBytes?: number;
     maxBodyBytes?: number;
-    maxBufferedRequestBodyBytes?: number;
     maxWsFrameBytes?: number;
     maxWsQueuedBytes?: number;
     defaultTimeoutMs?: number;

package/dist/proxy/server.js

@@ -3,42 +3,38 @@ import { DEFAULT_MAX_JSON_FRAME_BYTES, readJsonFrame, writeJsonFrame } from "../
 import { RpcRouter, RpcServer } from "../rpc/server.js";
 import { createByteReader } from "../streamio/index.js";
 import { readU32be, u32be } from "../utils/bin.js";
-import { DEFAULT_MAX_BODY_BYTES, DEFAULT_MAX_CHUNK_BYTES, DEFAULT_MAX_WS_FRAME_BYTES, PROXY_KIND_HTTP1, PROXY_KIND_WS, PROXY_PROTOCOL_VERSION, } from "./constants.js";
+import { DEFAULT_MAX_BODY_BYTES, DEFAULT_MAX_CHUNK_BYTES, DEFAULT_MAX_CONCURRENT_STREAMS, DEFAULT_MAX_WS_FRAME_BYTES, PROXY_KIND_HTTP1, PROXY_KIND_WS, PROXY_PROTOCOL_VERSION, } from "./constants.js";
 import { filterRequestHeaders, filterResponseHeaders, filterWsOpenHeaders, isSafeHeaderValue, isValidHeaderName, normalizeHeaderName } from "./headerPolicy.js";
 export async function serveProxySession(session, options, signal) {
     const compiled = compileOptions(options);
-    const requestBodyBudget = createRequestBodyBudget(compiled.maxBufferedRequestBodyBytes);
-    const active = new Set();
+    const activeProxy = new Set();
+    const activeRPC = new Set();
     try {
         while (!signal?.aborted) {
             const accepted = await session.acceptStream(signal === undefined ? {} : { signal });
             if (accepted.kind === "rpc") {
-                if (active.size >= compiled.maxConcurrentStreams) {
-                    await accepted.stream.reset(new Error("proxy stream concurrency exhausted"));
-                    continue;
-                }
                 const task = serveRPCStream(accepted.stream, options.rpcRouter ?? new RpcRouter(), options.rpcServerOptions, signal)
                     .catch(() => { })
-                    .finally(() => active.delete(task));
-                active.add(task);
+                    .finally(() => activeRPC.delete(task));
+                activeRPC.add(task);
                 continue;
             }
             if (accepted.kind !== PROXY_KIND_HTTP1 && accepted.kind !== PROXY_KIND_WS) {
                 await accepted.stream.reset(new Error(`unsupported proxy stream kind ${accepted.kind}`));
                 continue;
             }
-            if (active.size >= compiled.maxConcurrentStreams) {
+            if (activeProxy.size >= compiled.maxConcurrentStreams) {
                 await accepted.stream.reset(new Error("proxy stream concurrency exhausted"));
                 continue;
             }
-            const task = serveProxyStreamCompiled(accepted.kind, accepted.stream, compiled, requestBodyBudget, signal)
+            const task = serveProxyStreamCompiled(accepted.kind, accepted.stream, compiled, signal)
                 .catch(() => { })
-                .finally(() => active.delete(task));
-            active.add(task);
+                .finally(() => activeProxy.delete(task));
+            activeProxy.add(task);
         }
     }
     finally {
-        await Promise.allSettled(active);
+        await Promise.allSettled([...activeProxy, ...activeRPC]);
     }
 }
 async function serveRPCStream(stream, router, options, signal) {
@@ -52,12 +48,12 @@ async function serveRPCStream(stream, router, options, signal) {
 }
 export function serveProxyStream(kind, stream, options, signal) {
     const compiled = compileOptions(options);
-    return serveProxyStreamCompiled(kind, stream, compiled, createRequestBodyBudget(compiled.maxBufferedRequestBodyBytes), signal);
+    return serveProxyStreamCompiled(kind, stream, compiled, signal);
 }
-async function serveProxyStreamCompiled(kind, stream, options, requestBodyBudget, signal) {
+async function serveProxyStreamCompiled(kind, stream, options, signal) {
     try {
         if (kind === PROXY_KIND_HTTP1)
-            await serveHTTP(stream, options, requestBodyBudget, signal);
+            await serveHTTP(stream, options, signal);
         else
             await serveWebSocket(stream, options, signal);
     }
@@ -68,94 +64,145 @@ async function serveProxyStreamCompiled(kind, stream, options, requestBodyBudget
         catch { /* The peer may already have reset the stream. */ }
     }
 }
-async function serveHTTP(stream, options, requestBodyBudget, signal) {
-    const reader = createByteReader(stream, signal === undefined ? {} : { signal });
+async function serveHTTP(stream, options, signal) {
+    const reader = createByteReader(stream);
     let requestId = "unknown";
+    let responseStarted = false;
+    let streamReset = false;
+    let requestBody;
+    let responseBodyReader;
+    let controller;
+    let timer;
+    let removeAbortListener;
+    const resetStream = async (error) => {
+        if (streamReset)
+            return;
+        streamReset = true;
+        try {
+            await stream.reset(error);
+        }
+        catch { /* The peer may already have reset the stream. */ }
+    };
     try {
         const meta = assertHTTPRequestMeta(await readJsonFrame(reader, options.maxJsonFrameBytes));
         requestId = meta.request_id;
         const path = parsePath(meta.path);
-        const bufferedBody = await readBody(reader, options.maxChunkBytes, options.maxBodyBytes, requestBodyBudget);
-        try {
-            if (signal?.aborted)
-                throw new ProxyServerError("canceled", "proxy request canceled");
-            const headers = requestHeaders(meta.headers, options);
-            applyExternalOrigin(headers, meta.external_origin);
-            const target = new URL(options.upstream);
-            target.pathname = path.pathname;
-            target.search = path.search;
-            target.hash = "";
-            const timeoutMs = resolveTimeout(meta.timeout_ms, options);
-            const controller = new AbortController();
-            const onAbort = () => controller.abort(new ProxyServerError("canceled", "proxy request canceled"));
-            signal?.addEventListener("abort", onAbort, { once: true });
-            if (signal?.aborted)
-                onAbort();
-            const timer = timeoutMs > 0
-                ? setTimeout(() => controller.abort(new ProxyServerError("timeout", "upstream request timeout")), timeoutMs)
-                : undefined;
-            try {
-                const method = meta.method.trim().toUpperCase();
-                let response;
-                try {
-                    if (controller.signal.aborted)
-                        throw controller.signal.reason;
-                    response = await options.fetch(target, {
-                        method,
-                        headers,
-                        redirect: "manual",
-                        signal: controller.signal,
-                        ...((method === "GET" || method === "HEAD")
-                            ? {}
-                            : { body: bufferedBody.bytes.buffer }),
-                    });
-                }
-                finally {
-                    bufferedBody.release();
-                }
-                const responseHeaders = collectResponseHeaders(response.headers, options);
-                const responseMeta = {
-                    v: PROXY_PROTOCOL_VERSION,
-                    request_id: requestId,
-                    ok: true,
-                    status: response.status,
-                    headers: responseHeaders,
-                };
-                await writeJsonFrame(stream, responseMeta);
-                if (response.body == null) {
-                    await stream.write(u32be(0));
-                    return;
-                }
-                const bodyReader = response.body.getReader();
-                let total = 0;
-                while (true) {
-                    const next = await bodyReader.read();
-                    if (next.done)
-                        break;
-                    const bytes = next.value;
-                    total += bytes.length;
-                    if (total > options.maxBodyBytes)
-                        throw new ProxyServerError("response_body_too_large", "response body too large");
-                    for (let offset = 0; offset < bytes.length; offset += options.maxChunkBytes) {
-                        const chunk = bytes.subarray(offset, Math.min(bytes.length, offset + options.maxChunkBytes));
-                        await stream.write(u32be(chunk.length));
-                        await stream.write(chunk);
-                    }
-                }
-                await stream.write(u32be(0));
+        const knownRequestLength = contentLength(meta.headers, "request");
+        if (knownRequestLength != null && knownRequestLength > options.maxBodyBytes) {
+            throw new ProxyServerError("request_body_too_large", "request body too large");
+        }
+        if (signal?.aborted)
+            throw new ProxyServerError("canceled", "proxy request canceled");
+        const headers = requestHeaders(meta.headers, options);
+        applyExternalOrigin(headers, meta.external_origin);
+        const target = new URL(options.upstream);
+        target.pathname = path.pathname;
+        target.search = path.search;
+        target.hash = "";
+        controller = new AbortController();
+        const abortUpstream = (error) => {
+            if (!controller.signal.aborted)
+                controller.abort(error);
+            requestBody?.abort(error);
+            if (responseStarted)
+                void resetStream(error);
+        };
+        const onAbort = () => abortUpstream(new ProxyServerError("canceled", "proxy request canceled"));
+        signal?.addEventListener("abort", onAbort, { once: true });
+        removeAbortListener = () => signal?.removeEventListener("abort", onAbort);
+        if (signal?.aborted)
+            onAbort();
+        const timeoutMs = resolveTimeout(meta.timeout_ms, options);
+        timer = timeoutMs > 0
+            ? setTimeout(() => abortUpstream(new ProxyServerError("timeout", "upstream request timeout")), timeoutMs)
+            : undefined;
+        requestBody = createStreamingRequestBody(reader, options.maxChunkBytes, options.maxBodyBytes, abortUpstream);
+        const method = meta.method.trim().toUpperCase();
+        const requestInit = {
+            method,
+            headers,
+            redirect: "manual",
+            signal: controller.signal,
+        };
+        if (method === "GET" || method === "HEAD") {
+            requestBody.drain();
+        }
+        else {
+            requestInit.body = requestBody.stream;
+            requestInit.duplex = "half";
+        }
+        if (controller.signal.aborted)
+            throw controller.signal.reason;
+        const response = await options.fetch(target, requestInit);
+        if (requestBody.error != null)
+            throw requestBody.error;
+        requestBody.drain();
+        const knownResponseLength = contentLength(response.headers, "response");
+        if (knownResponseLength != null && knownResponseLength > options.maxBodyBytes) {
+            await response.body?.cancel();
+            throw new ProxyServerError("response_body_too_large", "response body too large");
+        }
+        const responseHeaders = collectResponseHeaders(response.headers, options);
+        const responseMeta = {
+            v: PROXY_PROTOCOL_VERSION,
+            request_id: requestId,
+            ok: true,
+            status: response.status,
+            headers: responseHeaders,
+        };
+        await writeJsonFrame(stream, responseMeta);
+        responseStarted = true;
+        if (response.body == null) {
+            await stream.write(u32be(0));
+            const requestError = await requestBody.completion;
+            if (requestError != null)
+                throw requestError;
+            return;
+        }
+        responseBodyReader = response.body.getReader();
+        let total = 0;
+        while (true) {
+            const next = await Promise.race([
+                responseBodyReader.read(),
+                requestBody.failure.then((error) => { throw error; }),
+            ]);
+            if (next.done)
+                break;
+            const bytes = next.value;
+            const nextTotal = total + bytes.length;
+            if (!Number.isSafeInteger(nextTotal) || nextTotal > options.maxBodyBytes) {
+                throw new ProxyServerError("response_body_too_large", "response body too large");
             }
-            finally {
-                if (timer != null)
-                    clearTimeout(timer);
-                signal?.removeEventListener("abort", onAbort);
+            total = nextTotal;
+            for (let offset = 0; offset < bytes.length; offset += options.maxChunkBytes) {
+                const chunk = bytes.subarray(offset, Math.min(bytes.length, offset + options.maxChunkBytes));
+                await stream.write(u32be(chunk.length));
+                await stream.write(chunk);
             }
         }
-        finally {
-            bufferedBody.release();
-        }
+        await stream.write(u32be(0));
+        const requestError = await requestBody.completion;
+        if (requestError != null)
+            throw requestError;
     }
     catch (error) {
-        await writeHTTPError(stream, requestId, classifyHTTPError(error));
+        const effective = requestBody?.error ?? controller?.signal.reason ?? asError(error);
+        if (controller != null && !controller.signal.aborted)
+            controller.abort(effective);
+        if (responseStarted)
+            await resetStream(effective);
+        else
+            await writeHTTPError(stream, requestId, classifyHTTPError(effective));
+    }
+    finally {
+        if (timer != null)
+            clearTimeout(timer);
+        removeAbortListener?.();
+        requestBody?.stop();
+        try {
+            await responseBodyReader?.cancel();
+        }
+        catch { /* The upstream body may already be closed. */ }
     }
 }
 async function serveWebSocket(stream, options, signal) {
@@ -354,7 +401,6 @@ function compileOptions(input) {
     const maxJsonFrameBytes = positive(input.maxJsonFrameBytes, DEFAULT_MAX_JSON_FRAME_BYTES, "maxJsonFrameBytes");
     const maxChunkBytes = positive(input.maxChunkBytes, DEFAULT_MAX_CHUNK_BYTES, "maxChunkBytes");
     const maxBodyBytes = positive(input.maxBodyBytes, DEFAULT_MAX_BODY_BYTES, "maxBodyBytes");
-    const maxBufferedRequestBodyBytes = positive(input.maxBufferedRequestBodyBytes, maxBodyBytes, "maxBufferedRequestBodyBytes");
     const maxWsFrameBytes = positive(input.maxWsFrameBytes, DEFAULT_MAX_WS_FRAME_BYTES, "maxWsFrameBytes");
     const defaultMaxWsQueuedBytes = maxWsFrameBytes <= Number.MAX_SAFE_INTEGER - 5
         ? maxWsFrameBytes + 5
@@ -372,12 +418,11 @@ function compileOptions(input) {
         maxJsonFrameBytes,
         maxChunkBytes,
         maxBodyBytes,
-        maxBufferedRequestBodyBytes,
         maxWsFrameBytes,
         maxWsQueuedBytes,
         defaultTimeoutMs,
         maxTimeoutMs,
-        maxConcurrentStreams: positive(input.maxConcurrentStreams, 64, "maxConcurrentStreams"),
+        maxConcurrentStreams: positive(input.maxConcurrentStreams, DEFAULT_MAX_CONCURRENT_STREAMS, "maxConcurrentStreams"),
         extraRequestHeaders: input.extraRequestHeaders ?? [],
         extraResponseHeaders: input.extraResponseHeaders ?? [],
         blockedResponseHeaders: normalizeNames(input.blockedResponseHeaders),
@@ -466,62 +511,129 @@ function applyExternalOrigin(headers, input) {
     headers.set("x-forwarded-proto", new URL(external).protocol.slice(0, -1));
     headers.set("host", new URL(external).host);
 }
-function createRequestBodyBudget(maxBytes) {
-    let usedBytes = 0;
-    return {
-        reserve: (bytes) => {
-            const next = usedBytes + bytes;
-            if (!Number.isSafeInteger(next) || next > maxBytes) {
-                throw new ProxyServerError("resource_exhausted", "proxy request body buffer exhausted");
-            }
-            usedBytes = next;
-        },
-        release: (bytes) => {
-            usedBytes = Math.max(0, usedBytes - bytes);
-        },
-    };
-}
-async function readBody(reader, maxChunkBytes, maxBodyBytes, budget) {
-    const chunks = [];
+function createStreamingRequestBody(reader, maxChunkBytes, maxBodyBytes, onFailure) {
     let total = 0;
-    let handedOff = false;
-    try {
-        while (true) {
+    let finished = false;
+    let draining = false;
+    let readChain = Promise.resolve();
+    let error;
+    let streamController;
+    let resolveFailure;
+    const failure = new Promise((resolve) => { resolveFailure = resolve; });
+    let resolveCompletion;
+    const completion = new Promise((resolve) => { resolveCompletion = resolve; });
+    const fail = (cause) => {
+        if (error != null)
+            return error;
+        const raw = asError(cause);
+        error = raw instanceof ProxyServerError
+            ? raw
+            : new ProxyServerError("request_body_invalid", raw.message);
+        finished = true;
+        try {
+            streamController?.error(error);
+        }
+        catch { /* The body consumer may already be gone. */ }
+        resolveFailure(error);
+        resolveCompletion(error);
+        onFailure(error);
+        return error;
+    };
+    const readChunkUnserialized = async () => {
+        try {
             const length = readU32be(await reader.readExactly(4), 0);
-            if (length === 0)
-                break;
-            if (length > maxChunkBytes)
+            if (length === 0) {
+                finished = true;
+                resolveCompletion(undefined);
+                return null;
+            }
+            if (length > maxChunkBytes) {
                 throw new ProxyServerError("request_body_too_large", "request chunk too large");
-            const next = total + length;
-            if (!Number.isSafeInteger(next) || next > maxBodyBytes) {
+            }
+            const nextTotal = total + length;
+            if (!Number.isSafeInteger(nextTotal) || nextTotal > maxBodyBytes) {
                 throw new ProxyServerError("request_body_too_large", "request body too large");
             }
-            budget.reserve(length);
-            total = next;
-            chunks.push(await reader.readExactly(length));
+            const chunk = await reader.readExactly(length);
+            total = nextTotal;
+            return chunk;
         }
-        const body = new Uint8Array(total);
-        let offset = 0;
-        for (const chunk of chunks) {
-            body.set(chunk, offset);
-            offset += chunk.length;
+        catch (cause) {
+            throw fail(cause);
         }
-        let released = false;
-        handedOff = true;
-        return {
-            bytes: body,
-            release: () => {
-                if (released)
-                    return;
-                released = true;
-                budget.release(total);
-            },
-        };
+    };
+    const readChunk = () => {
+        const next = readChain.then(readChunkUnserialized);
+        readChain = next.then(() => { }, () => { });
+        return next;
+    };
+    const drain = () => {
+        if (draining || finished)
+            return;
+        draining = true;
+        try {
+            streamController?.close();
+        }
+        catch { /* A pending pull will observe draining below. */ }
+        void (async () => {
+            while (!finished)
+                await readChunk();
+        })().catch(() => { });
+    };
+    const stream = new ReadableStream({
+        start(controller) { streamController = controller; },
+        async pull(controller) {
+            if (finished) {
+                if (error == null)
+                    controller.close();
+                return;
+            }
+            const chunk = await readChunk();
+            if (draining)
+                return;
+            if (chunk == null)
+                controller.close();
+            else
+                controller.enqueue(chunk);
+        },
+        cancel() { drain(); },
+    }, { highWaterMark: 0 });
+    return {
+        stream,
+        failure,
+        completion,
+        get error() { return error; },
+        drain,
+        abort: (cause) => { if (!finished)
+            fail(cause); },
+        stop: () => {
+            if (finished)
+                return;
+            finished = true;
+            try {
+                streamController?.close();
+            }
+            catch { /* The fetch implementation may own the stream. */ }
+            resolveCompletion(undefined);
+        },
+    };
+}
+function contentLength(headers, side) {
+    const rawValues = headers instanceof Headers
+        ? (headers.get("content-length") == null ? [] : [headers.get("content-length")])
+        : headers
+            .filter((header) => normalizeHeaderName(header.name) === "content-length")
+            .map((header) => header.value.trim());
+    if (rawValues.length === 0)
+        return undefined;
+    if (rawValues.length !== 1 || !/^(0|[1-9][0-9]*)$/.test(rawValues[0])) {
+        throw new ProxyServerError(side === "request" ? "invalid_request_meta" : "upstream_request_failed", `invalid ${side} content-length`);
     }
-    finally {
-        if (!handedOff)
-            budget.release(total);
+    const value = Number(rawValues[0]);
+    if (!Number.isSafeInteger(value)) {
+        throw new ProxyServerError(side === "request" ? "invalid_request_meta" : "upstream_request_failed", `invalid ${side} content-length`);
     }
+    return value;
 }
 async function writeHTTPError(stream, requestId, code) {
     const meta = {

package/dist/tunnel-client/connect.d.ts

@@ -6,4 +6,4 @@ export type TunnelConnectOptions = ConnectOptionsBase & Readonly<{
     /** Optional caller-provided endpoint instance ID (base64url). */
     endpointInstanceId?: string;
 }>;
-export declare function connectTunnel(grant: unknown, opts: TunnelConnectOptions): Promise<ClientInternal>;
+export declare function connectTunnel(input: unknown, opts: TunnelConnectOptions): Promise<ClientInternal>;

package/dist/tunnel-client/connect.js

@@ -11,18 +11,8 @@ function isRecord(v) {
 function hasOwn(o, key) {
     return Object.prototype.hasOwnProperty.call(o, key);
 }
-function unwrapGrant(v) {
-    if (!isRecord(v))
-        return v;
-    if (hasOwn(v, "grant_client"))
-        return v["grant_client"];
-    if (hasOwn(v, "grant_server"))
-        return v["grant_server"];
-    return v;
-}
 // connectTunnel attaches to a tunnel and returns an RPC-ready session.
-export async function connectTunnel(grant, opts) {
-    const input = unwrapGrant(grant);
+export async function connectTunnel(input, opts) {
     if (input == null) {
         throw new FlowersecError({ stage: "validate", code: "missing_grant", path: "tunnel", message: "missing grant" });
     }