@floegence/flowersec-core 0.25.0 → 0.27.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Flowersec core TypeScript library (browser-friendly E2EE + multiplexing over WebSocket).",
   "license": "MIT",
   "repository": {
@@ -103,10 +103,6 @@
     "./gen/flowersec/tunnel/*": {
       "types": "./dist/gen/flowersec/tunnel/*.d.ts",
       "default": "./dist/gen/flowersec/tunnel/*.js"
-    },
-    "./internal": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
     }
   },
   "engines": {
@@ -122,7 +118,9 @@
     "bench": "vitest bench --run",
     "test": "npm run build && vitest run",
     "test:browser": "npm run build && playwright test",
-    "ensure:browser": "node ./scripts/ensure-playwright-chromium.mjs",
+    "test:browser:chromium": "npm run build && playwright test --project=chromium",
+    "test:browser:webkit": "npm run build && playwright test --project=webkit-smoke",
+    "ensure:browser": "node ./scripts/ensure-playwright-browsers.mjs",
     "test:coverage": "npm run build && vitest run --coverage",
     "lint": "eslint .",
     "verify:package": "node ./scripts/verify-package-exports.mjs",

package/dist/browser/controlplane.d.ts

@@ -1,15 +0,0 @@
-import { type ChannelInitGrant } from "../facade.js";
-import type { ControlplaneBaseConfig as SharedControlplaneBaseConfig, RequestConnectArtifactInput, RequestEntryConnectArtifactInput } from "../controlplane/request.js";
-export { ControlplaneRequestError, requestConnectArtifact, requestEntryConnectArtifact, } from "../controlplane/request.js";
-type BaseControlplaneRequestConfig = SharedControlplaneBaseConfig & Readonly<{
-    endpointId: string;
-    payload?: Record<string, unknown>;
-}>;
-export type ControlplaneConfig = BaseControlplaneRequestConfig;
-export type EntryControlplaneConfig = BaseControlplaneRequestConfig & Readonly<{
-    entryTicket: string;
-}>;
-export type ConnectArtifactRequestConfig = RequestConnectArtifactInput;
-export type EntryConnectArtifactRequestConfig = RequestEntryConnectArtifactInput;
-export declare function requestChannelGrant(config: ControlplaneConfig): Promise<ChannelInitGrant>;
-export declare function requestEntryChannelGrant(config: EntryControlplaneConfig): Promise<ChannelInitGrant>;

package/dist/browser/controlplane.js

@@ -1,65 +0,0 @@
-import { assertChannelInitGrant } from "../facade.js";
-import { requestControlplaneJSON, } from "../controlplane/request.js";
-export { ControlplaneRequestError, requestConnectArtifact, requestEntryConnectArtifact, } from "../controlplane/request.js";
-function buildURL(baseUrl, path) {
-    const base = String(baseUrl ?? "").trim();
-    if (base === "")
-        return path;
-    return `${base.replace(/\/+$/, "")}${path}`;
-}
-function buildPayload(endpointId, payload) {
-    const id = String(endpointId ?? "").trim();
-    if (id === "")
-        throw new Error("endpointId is required");
-    const out = { ...(payload ?? {}) };
-    const raw = out.endpoint_id;
-    if (raw !== undefined && String(raw ?? "").trim() !== id) {
-        throw new Error("payload.endpoint_id must match endpointId");
-    }
-    out.endpoint_id = id;
-    return out;
-}
-async function requestGrant(url, init) {
-    return await requestControlplaneJSON(url, init);
-}
-export async function requestChannelGrant(config) {
-    const headers = new Headers(config.headers);
-    if (!headers.has("Content-Type")) {
-        headers.set("Content-Type", "application/json");
-    }
-    const data = (await requestGrant(buildURL(config.baseUrl, "/v1/channel/init"), {
-        ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
-        method: "POST",
-        credentials: config.credentials ?? "omit",
-        headers,
-        body: JSON.stringify(buildPayload(config.endpointId, config.payload)),
-        ...(config.signal === undefined ? {} : { signal: config.signal }),
-    }));
-    if (!data?.grant_client) {
-        throw new Error("Invalid controlplane response: missing `grant_client`");
-    }
-    return assertChannelInitGrant(data.grant_client);
-}
-export async function requestEntryChannelGrant(config) {
-    const entryTicket = String(config.entryTicket ?? "").trim();
-    if (entryTicket === "")
-        throw new Error("entryTicket is required");
-    const endpointId = String(config.endpointId ?? "").trim();
-    const headers = new Headers(config.headers);
-    headers.set("Authorization", `Bearer ${entryTicket}`);
-    if (!headers.has("Content-Type")) {
-        headers.set("Content-Type", "application/json");
-    }
-    const data = (await requestGrant(buildURL(config.baseUrl, `/v1/channel/init/entry?endpoint_id=${encodeURIComponent(endpointId)}`), {
-        ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
-        method: "POST",
-        credentials: config.credentials ?? "omit",
-        headers,
-        body: JSON.stringify(buildPayload(endpointId, config.payload)),
-        ...(config.signal === undefined ? {} : { signal: config.signal }),
-    }));
-    if (!data?.grant_client) {
-        throw new Error("Invalid controlplane response: missing `grant_client`");
-    }
-    return assertChannelInitGrant(data.grant_client);
-}

package/dist/connect/internalNormalize.js

@@ -1,173 +0,0 @@
-import { Role as ControlRole } from "../gen/flowersec/controlplane/v1.gen.js";
-import { emitObserverDiagnostic, normalizeObserver, withObserverContext } from "../observability/observer.js";
-import { FlowersecError } from "../utils/errors.js";
-import { assertConnectArtifact, hasArtifactOnlyFields, } from "./artifact.js";
-function maybeParseJSON(input) {
-    if (typeof input !== "string")
-        return input;
-    const s = input.trim();
-    if (s === "")
-        return input;
-    if (s[0] !== "{" && s[0] !== "[")
-        return input;
-    try {
-        return JSON.parse(s);
-    }
-    catch (e) {
-        throw new FlowersecError({
-            path: "auto",
-            stage: "validate",
-            code: "invalid_input",
-            message: "invalid JSON string",
-            cause: e,
-        });
-    }
-}
-async function validateArtifactScopes(artifact, opts, observer) {
-    const scoped = artifact.scoped ?? [];
-    if (scoped.length === 0)
-        return;
-    const path = artifact.transport;
-    for (const entry of scoped) {
-        const resolver = opts.scopeResolvers?.[entry.scope];
-        if (resolver == null) {
-            if (entry.critical) {
-                throw new FlowersecError({
-                    path,
-                    stage: "validate",
-                    code: "resolve_failed",
-                    message: `missing scope resolver for ${entry.scope}@${entry.scope_version}`,
-                });
-            }
-            emitObserverDiagnostic(observer, {
-                path,
-                stage: "scope",
-                code_domain: "event",
-                code: "scope_ignored_missing_resolver",
-                result: "skip",
-            });
-            continue;
-        }
-        try {
-            await resolver(entry);
-        }
-        catch (e) {
-            if (!entry.critical && opts.relaxedOptionalScopeValidation === true) {
-                emitObserverDiagnostic(observer, {
-                    path,
-                    stage: "scope",
-                    code_domain: "event",
-                    code: "scope_ignored_relaxed_validation",
-                    result: "skip",
-                });
-                continue;
-            }
-            throw new FlowersecError({
-                path,
-                stage: "validate",
-                code: "resolve_failed",
-                message: `scope validation failed for ${entry.scope}@${entry.scope_version}`,
-                cause: e,
-            });
-        }
-    }
-}
-export async function normalizeConnectInput(input, opts = {}) {
-    const v = maybeParseJSON(input);
-    if (v == null || typeof v !== "object") {
-        throw new FlowersecError({
-            path: "auto",
-            stage: "validate",
-            code: "invalid_input",
-            message: "invalid input: expected an object or a JSON string",
-        });
-    }
-    const o = v;
-    const hasWsUrl = Object.prototype.hasOwnProperty.call(o, "ws_url");
-    const hasTunnelUrl = Object.prototype.hasOwnProperty.call(o, "tunnel_url");
-    const hasGrantClient = Object.prototype.hasOwnProperty.call(o, "grant_client");
-    const hasGrantServer = Object.prototype.hasOwnProperty.call(o, "grant_server");
-    const isArtifactCandidate = hasArtifactOnlyFields(o);
-    if ((hasWsUrl && (hasTunnelUrl || hasGrantClient || hasGrantServer)) || (hasTunnelUrl && (hasGrantClient || hasGrantServer))) {
-        throw new FlowersecError({
-            path: "auto",
-            stage: "validate",
-            code: "invalid_input",
-            message: "hybrid connect input is not allowed",
-        });
-    }
-    if (isArtifactCandidate && (hasWsUrl || hasTunnelUrl || hasGrantClient || hasGrantServer)) {
-        throw new FlowersecError({
-            path: "auto",
-            stage: "validate",
-            code: "invalid_input",
-            message: "artifact fields cannot be mixed with legacy connect inputs",
-        });
-    }
-    if (hasGrantServer) {
-        throw new FlowersecError({
-            path: "tunnel",
-            stage: "validate",
-            code: "role_mismatch",
-            message: "expected role=client",
-        });
-    }
-    if (hasGrantClient)
-        return { kind: "tunnel", input: v };
-    if (hasWsUrl)
-        return { kind: "direct", input: v };
-    if (hasTunnelUrl) {
-        if (typeof o.role === "number" && Number.isSafeInteger(o.role) && o.role === ControlRole.Role_server) {
-            throw new FlowersecError({
-                path: "tunnel",
-                stage: "validate",
-                code: "role_mismatch",
-                message: "expected role=client",
-            });
-        }
-        return { kind: "tunnel", input: v };
-    }
-    if (isArtifactCandidate) {
-        let artifact;
-        try {
-            artifact = assertConnectArtifact(v);
-        }
-        catch (e) {
-            throw new FlowersecError({
-                path: "auto",
-                stage: "validate",
-                code: "invalid_input",
-                message: "invalid ConnectArtifact",
-                cause: e,
-            });
-        }
-        const observer = opts.observer == null
-            ? undefined
-            : normalizeObserver(withObserverContext(opts.observer, {
-                path: artifact.transport,
-                ...(artifact.correlation?.trace_id === undefined ? {} : { traceId: artifact.correlation.trace_id }),
-                ...(artifact.correlation?.session_id === undefined ? {} : { sessionId: artifact.correlation.session_id }),
-            }), { path: artifact.transport });
-        await validateArtifactScopes(artifact, opts, observer);
-        if (artifact.transport === "direct") {
-            return {
-                kind: "direct",
-                input: artifact.direct_info,
-                ...(artifact.correlation === undefined ? {} : { correlation: artifact.correlation }),
-                ...(observer === undefined ? {} : { observer }),
-            };
-        }
-        return {
-            kind: "tunnel",
-            input: artifact.tunnel_grant,
-            ...(artifact.correlation === undefined ? {} : { correlation: artifact.correlation }),
-            ...(observer === undefined ? {} : { observer }),
-        };
-    }
-    throw new FlowersecError({
-        path: "auto",
-        stage: "validate",
-        code: "invalid_input",
-        message: "invalid input: expected DirectConnectInfo, ChannelInitGrant, wrapper, or ConnectArtifact",
-    });
-}

package/dist/proxy/profiles.d.ts

@@ -1,18 +0,0 @@
-import { type ProxyPresetManifest } from "./preset.js";
-export type ProxyProfile = Readonly<{
-    maxJsonFrameBytes: number;
-    maxChunkBytes: number;
-    maxBodyBytes: number;
-    maxWsFrameBytes: number;
-    timeoutMs: number;
-}>;
-export type ProxyProfileName = "default";
-export declare const PROXY_PROFILE_DEFAULT: Readonly<{
-    maxJsonFrameBytes: number;
-    maxChunkBytes: number;
-    maxBodyBytes: number;
-    maxWsFrameBytes: number;
-    timeoutMs: number;
-}>;
-export declare function resolveProxyProfile(profile?: ProxyProfileName | Partial<ProxyProfile>): ProxyProfile;
-export declare function profileToPresetManifest(profile?: ProxyProfileName | Partial<ProxyProfile>): ProxyPresetManifest;

package/dist/proxy/profiles.js

@@ -1,71 +0,0 @@
-import { DEFAULT_PROXY_PRESET_MANIFEST, resolveProxyPreset, } from "./preset.js";
-function toLegacyProfile(manifest) {
-    const resolved = resolveProxyPreset(manifest);
-    return Object.freeze({
-        maxJsonFrameBytes: resolved.limits.max_json_frame_bytes,
-        maxChunkBytes: resolved.limits.max_chunk_bytes,
-        maxBodyBytes: resolved.limits.max_body_bytes,
-        maxWsFrameBytes: resolved.limits.max_ws_frame_bytes,
-        timeoutMs: resolved.limits.timeout_ms ?? 0,
-    });
-}
-const DEFAULT_PROFILE = toLegacyProfile(DEFAULT_PROXY_PRESET_MANIFEST);
-export const PROXY_PROFILE_DEFAULT = DEFAULT_PROFILE;
-function normalizeSafeInt(name, value) {
-    if (!Number.isFinite(value))
-        throw new Error(`${name} must be a finite number`);
-    const n = Math.floor(value);
-    if (!Number.isSafeInteger(n))
-        throw new Error(`${name} must be a safe integer`);
-    if (n < 0)
-        throw new Error(`${name} must be >= 0`);
-    return n;
-}
-function resolveNamedProfile(name) {
-    switch (name) {
-        case "default":
-            return DEFAULT_PROFILE;
-        default:
-            throw new Error(`unknown proxy profile: ${name}`);
-    }
-}
-export function resolveProxyProfile(profile) {
-    if (profile == null)
-        return DEFAULT_PROFILE;
-    if (typeof profile === "string") {
-        return resolveNamedProfile(profile);
-    }
-    const base = DEFAULT_PROFILE;
-    return Object.freeze({
-        maxJsonFrameBytes: normalizeSafeInt("maxJsonFrameBytes", profile.maxJsonFrameBytes ?? base.maxJsonFrameBytes),
-        maxChunkBytes: normalizeSafeInt("maxChunkBytes", profile.maxChunkBytes ?? base.maxChunkBytes),
-        maxBodyBytes: normalizeSafeInt("maxBodyBytes", profile.maxBodyBytes ?? base.maxBodyBytes),
-        maxWsFrameBytes: normalizeSafeInt("maxWsFrameBytes", profile.maxWsFrameBytes ?? base.maxWsFrameBytes),
-        timeoutMs: normalizeSafeInt("timeoutMs", profile.timeoutMs ?? base.timeoutMs),
-    });
-}
-export function profileToPresetManifest(profile) {
-    if (profile == null)
-        return DEFAULT_PROXY_PRESET_MANIFEST;
-    if (typeof profile === "string") {
-        switch (profile) {
-            case "default":
-                return DEFAULT_PROXY_PRESET_MANIFEST;
-            default:
-                throw new Error(`unknown proxy profile: ${profile}`);
-        }
-    }
-    const resolved = resolveProxyProfile(profile);
-    return Object.freeze({
-        v: 1,
-        preset_id: "legacy-profile",
-        deprecated: true,
-        limits: {
-            ...(resolved.maxJsonFrameBytes > 0 ? { max_json_frame_bytes: resolved.maxJsonFrameBytes } : {}),
-            ...(resolved.maxChunkBytes > 0 ? { max_chunk_bytes: resolved.maxChunkBytes } : {}),
-            ...(resolved.maxBodyBytes > 0 ? { max_body_bytes: resolved.maxBodyBytes } : {}),
-            ...(resolved.maxWsFrameBytes > 0 ? { max_ws_frame_bytes: resolved.maxWsFrameBytes } : {}),
-            ...(resolved.timeoutMs > 0 ? { timeout_ms: resolved.timeoutMs } : {}),
-        },
-    });
-}