@floegence/flowersec-core 0.26.0 → 0.27.0

package/dist/browser/connect.d.ts

@@ -2,11 +2,12 @@ import type { Client } from "../client.js";
 import type { DirectConnectOptions } from "../direct-client/connect.js";
 import type { TunnelConnectOptions } from "../tunnel-client/connect.js";
 import { type ConnectOptions } from "../facade.js";
+import type { ConnectArtifact } from "../connect/artifact.js";
 import type { ChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
 import type { DirectConnectInfo } from "../gen/flowersec/direct/v1.gen.js";
 export type TunnelConnectBrowserOptions = Omit<TunnelConnectOptions, "origin" | "wsFactory">;
 export type DirectConnectBrowserOptions = Omit<DirectConnectOptions, "origin" | "wsFactory">;
 export type ConnectBrowserOptions = Omit<ConnectOptions, "origin" | "wsFactory">;
-export declare function connectBrowser(input: unknown, opts?: ConnectBrowserOptions): Promise<Client>;
+export declare function connectBrowser(input: ConnectArtifact, opts?: ConnectBrowserOptions): Promise<Client>;
 export declare function connectTunnelBrowser(grant: ChannelInitGrant, opts?: TunnelConnectBrowserOptions): Promise<Client>;
 export declare function connectDirectBrowser(info: DirectConnectInfo, opts?: DirectConnectBrowserOptions): Promise<Client>;

package/dist/browser/index.d.ts

@@ -4,7 +4,7 @@ export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskA
 export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, NetworkPlaintextPolicyOptions, } from "../client-connect/transportSecurity.js";
 export type { ConnectArtifact, CorrelationContext, CorrelationKV, DirectClientConnectArtifact, ScopeMetadataEntry, TunnelClientConnectArtifact, } from "../connect/artifact.js";
 export { assertConnectArtifact } from "../connect/artifact.js";
-export type { ControlplaneConfig, EntryControlplaneConfig } from "./controlplane.js";
-export { requestChannelGrant, requestEntryChannelGrant, } from "./controlplane.js";
+export type { RequestConnectArtifactInput, RequestEntryConnectArtifactInput } from "../controlplane/request.js";
+export { requestConnectArtifact, requestEntryConnectArtifact, } from "../controlplane/request.js";
 export type { BrowserReconnectConfig, DirectBrowserReconnectConfig, TunnelBrowserReconnectConfig, } from "./reconnectConfig.js";
 export { createBrowserReconnectConfig, createDirectBrowserReconnectConfig, createTunnelBrowserReconnectConfig, } from "./reconnectConfig.js";

package/dist/browser/index.js

@@ -1,5 +1,5 @@
 export { connectBrowser, connectDirectBrowser, connectTunnelBrowser } from "./connect.js";
 export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export { assertConnectArtifact } from "../connect/artifact.js";
-export { requestChannelGrant, requestEntryChannelGrant, } from "./controlplane.js";
+export { requestConnectArtifact, requestEntryConnectArtifact, } from "../controlplane/request.js";
 export { createBrowserReconnectConfig, createDirectBrowserReconnectConfig, createTunnelBrowserReconnectConfig, } from "./reconnectConfig.js";

package/dist/client-connect/connectCore.d.ts

@@ -2,7 +2,7 @@ import { type YamuxLimits } from "../yamux/session.js";
 import { type ClientObserverLike } from "../observability/observer.js";
 import { type WebSocketLike, type WebSocketLimits } from "../ws-client/binaryTransport.js";
 import type { ClientInternal } from "../client.js";
-import type { ConnectScopeResolverMap } from "../connect/internalNormalize.js";
+import type { ConnectScopeResolverMap } from "../connect/resolveArtifact.js";
 import { type TransportSecurityPolicy } from "./transportSecurity.js";
 export type LivenessOptions = Readonly<{
     intervalMs?: number;

package/dist/connect/artifact.d.ts

@@ -33,5 +33,4 @@ export type DirectClientConnectArtifact = Readonly<{
     correlation?: CorrelationContext;
 }>;
 export type ConnectArtifact = TunnelClientConnectArtifact | DirectClientConnectArtifact;
-export declare function hasArtifactOnlyFields(value: Record<string, unknown>): boolean;
 export declare function assertConnectArtifact(value: unknown): ConnectArtifact;

package/dist/connect/artifact.js

@@ -6,7 +6,6 @@ const CORRELATION_ID_RE = /^[A-Za-z0-9._~-]{8,128}$/;
 const encoder = new TextEncoder();
 const TUNNEL_ARTIFACT_KEYS = new Set(["v", "transport", "tunnel_grant", "scoped", "correlation"]);
 const DIRECT_ARTIFACT_KEYS = new Set(["v", "transport", "direct_info", "scoped", "correlation"]);
-const ARTIFACT_ONLY_KEYS = new Set(["v", "transport", "tunnel_grant", "direct_info", "scoped", "correlation"]);
 function isRecord(v) {
     return typeof v === "object" && v != null && !Array.isArray(v);
 }
@@ -177,9 +176,6 @@ function assertArtifactTransport(value) {
         throw new Error("bad ConnectArtifact.transport");
     return value;
 }
-export function hasArtifactOnlyFields(value) {
-    return Object.keys(value).some((key) => ARTIFACT_ONLY_KEYS.has(key));
-}
 export function assertConnectArtifact(value) {
     const record = assertArtifactObject(value);
     if (record.v !== 1)

package/dist/connect/{internalNormalize.d.ts → resolveArtifact.d.ts}

@@ -1,22 +1,22 @@
+import type { ChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
+import type { DirectConnectInfo } from "../gen/flowersec/direct/v1.gen.js";
 import { type ClientObserverLike } from "../observability/observer.js";
-import { type CorrelationContext, type ScopeMetadataEntry } from "./artifact.js";
+import { type ConnectArtifact, type ScopeMetadataEntry } from "./artifact.js";
 export type ConnectScopeResolver = (entry: ScopeMetadataEntry) => void | Promise<void>;
 export type ConnectScopeResolverMap = Readonly<Record<string, ConnectScopeResolver>>;
-type NormalizeOptions = Readonly<{
+type ResolveOptions = Readonly<{
     observer?: ClientObserverLike;
     scopeResolvers?: ConnectScopeResolverMap;
     relaxedOptionalScopeValidation?: boolean;
 }>;
-export type NormalizedConnectInput = Readonly<{
+export type ResolvedConnectArtifact = Readonly<{
     kind: "tunnel";
-    input: unknown;
-    correlation?: CorrelationContext;
+    input: ChannelInitGrant;
     observer?: ClientObserverLike;
 }> | Readonly<{
     kind: "direct";
-    input: unknown;
-    correlation?: CorrelationContext;
+    input: DirectConnectInfo;
     observer?: ClientObserverLike;
 }>;
-export declare function normalizeConnectInput(input: unknown, opts?: NormalizeOptions): Promise<NormalizedConnectInput>;
+export declare function resolveConnectArtifact(input: ConnectArtifact, opts?: ResolveOptions): Promise<ResolvedConnectArtifact>;
 export {};

package/dist/connect/resolveArtifact.js

@@ -0,0 +1,87 @@
+import { emitObserverDiagnostic, normalizeObserver, withObserverContext } from "../observability/observer.js";
+import { FlowersecError } from "../utils/errors.js";
+import { assertConnectArtifact, } from "./artifact.js";
+async function validateArtifactScopes(artifact, opts, observer) {
+    const scoped = artifact.scoped ?? [];
+    if (scoped.length === 0)
+        return;
+    const path = artifact.transport;
+    for (const entry of scoped) {
+        const resolver = opts.scopeResolvers?.[entry.scope];
+        if (resolver == null) {
+            if (entry.critical) {
+                throw new FlowersecError({
+                    path,
+                    stage: "validate",
+                    code: "resolve_failed",
+                    message: `missing scope resolver for ${entry.scope}@${entry.scope_version}`,
+                });
+            }
+            emitObserverDiagnostic(observer, {
+                path,
+                stage: "scope",
+                code_domain: "event",
+                code: "scope_ignored_missing_resolver",
+                result: "skip",
+            });
+            continue;
+        }
+        try {
+            await resolver(entry);
+        }
+        catch (error) {
+            if (!entry.critical && opts.relaxedOptionalScopeValidation === true) {
+                emitObserverDiagnostic(observer, {
+                    path,
+                    stage: "scope",
+                    code_domain: "event",
+                    code: "scope_ignored_relaxed_validation",
+                    result: "skip",
+                });
+                continue;
+            }
+            throw new FlowersecError({
+                path,
+                stage: "validate",
+                code: "resolve_failed",
+                message: `scope validation failed for ${entry.scope}@${entry.scope_version}`,
+                cause: error,
+            });
+        }
+    }
+}
+export async function resolveConnectArtifact(input, opts = {}) {
+    let artifact;
+    try {
+        artifact = assertConnectArtifact(input);
+    }
+    catch (error) {
+        throw new FlowersecError({
+            path: "auto",
+            stage: "validate",
+            code: "invalid_input",
+            message: "invalid ConnectArtifact",
+            cause: error,
+        });
+    }
+    const observer = opts.observer == null
+        ? undefined
+        : normalizeObserver(withObserverContext(opts.observer, {
+            path: artifact.transport,
+            ...(artifact.correlation?.trace_id === undefined ? {} : { traceId: artifact.correlation.trace_id }),
+            ...(artifact.correlation?.session_id === undefined ? {} : { sessionId: artifact.correlation.session_id }),
+        }), { path: artifact.transport });
+    await validateArtifactScopes(artifact, opts, observer);
+    if (artifact.transport === "direct") {
+        return {
+            kind: "direct",
+            input: artifact.direct_info,
+            ...(observer === undefined ? {} : { observer }),
+        };
+    }
+    return {
+        kind: "tunnel",
+        input: artifact.tunnel_grant,
+        ...(observer === undefined ? {} : { observer }),
+    };
+}

package/dist/e2ee/record.js

@@ -1,7 +1,7 @@
 import { gcm } from "@noble/ciphers/aes";
 import { concatBytes, readU32be, readU64be, u32be, u64be } from "../utils/bin.js";
 import { PROTOCOL_VERSION, RECORD_MAGIC, RECORD_FLAG_APP, RECORD_FLAG_PING, RECORD_FLAG_REKEY } from "./constants.js";
-const te = new TextEncoder();
+const recordMagicBytes = new TextEncoder().encode(RECORD_MAGIC);
 // RecordError marks record parsing or cryptographic failures.
 export class RecordError extends Error {
 }
@@ -28,7 +28,7 @@ export function encryptRecord(key, noncePrefix, flags, seq, plaintext, maxRecord
     if (cipherLen > 0xffffffff)
         throw new RecordError("record too large");
     const header = new Uint8Array(4 + 1 + 1 + 8 + 4);
-    header.set(te.encode(RECORD_MAGIC), 0);
+    header.set(recordMagicBytes, 0);
     header[4] = PROTOCOL_VERSION;
     header[5] = flags & 0xff;
     header.set(u64be(seq), 6);
@@ -51,8 +51,12 @@ export function decryptRecord(key, noncePrefix, frame, expectSeq, maxRecordBytes
         throw new RecordError("record too large");
     if (frame.length < headerLen)
         throw new RecordError("record too short");
-    if (new TextDecoder().decode(frame.slice(0, 4)) !== RECORD_MAGIC)
+    if (frame[0] !== recordMagicBytes[0] ||
+        frame[1] !== recordMagicBytes[1] ||
+        frame[2] !== recordMagicBytes[2] ||
+        frame[3] !== recordMagicBytes[3]) {
         throw new RecordError("bad record magic");
+    }
     if (frame[4] !== PROTOCOL_VERSION)
         throw new RecordError("bad record version");
     const flags = frame[5];
@@ -67,7 +71,7 @@ export function decryptRecord(key, noncePrefix, frame, expectSeq, maxRecordBytes
         throw new RecordError("length mismatch");
     const nonce = concatBytes([noncePrefix, u64be(seq)]);
     try {
-        const plaintext = gcm(key, nonce, frame.slice(0, headerLen)).decrypt(frame.slice(headerLen));
+        const plaintext = gcm(key, nonce, frame.subarray(0, headerLen)).decrypt(frame.subarray(headerLen));
         return { flags, seq, plaintext };
     }
     catch (e) {

package/dist/e2ee/secureChannel.d.ts

@@ -88,5 +88,6 @@ export declare class SecureChannel {
     private reserveSendSeq;
     private sendLoop;
     private readLoop;
+    private clearKeyMaterial;
 }
 export {};

package/dist/e2ee/secureChannel.js

@@ -62,11 +62,11 @@ export class SecureChannel {
             throw new RangeError("maxOutboundBufferedBytes must be a non-negative safe integer");
         }
         this.maxOutboundBufferedBytes = maxOutboundBufferedBytes === 0 ? SDK_DEFAULTS.e2ee.maxOutboundBufferedBytes : maxOutboundBufferedBytes;
-        this.sendKey = args.sendKey;
-        this.recvKey = args.recvKey;
+        this.sendKey = args.sendKey.slice();
+        this.recvKey = args.recvKey.slice();
         this.sendNoncePrefix = args.sendNoncePrefix;
         this.recvNoncePrefix = args.recvNoncePrefix;
-        this.rekeyBase = args.rekeyBase;
+        this.rekeyBase = args.rekeyBase.slice();
         this.transcriptHash = args.transcriptHash;
         this.sendDir = args.sendDir;
         this.recvDir = args.recvDir;
@@ -113,11 +113,16 @@ export class SecureChannel {
         this.sendClosed = true;
         this.rejectQueuedSenders(this.sendErr ?? new Error("closed"));
         this.wakeSendWaiters();
-        this.transport.close();
         const ws = this.recvWaiters;
         this.recvWaiters = [];
         for (const w of ws)
             w();
+        try {
+            this.transport.close();
+        }
+        finally {
+            this.clearKeyMaterial();
+        }
     }
     // sendPing emits a keepalive record.
     async sendPing() {
@@ -254,6 +259,8 @@ export class SecureChannel {
                 if (req.kind === "app") {
                     const payload = req.payload ?? new Uint8Array();
                     for (let offset = 0; offset < payload.length; offset += this.outboundRecordChunkBytes) {
+                        if (this.closed || this.sendClosed)
+                            throw new Error("closed");
                         const chunk = payload.subarray(offset, Math.min(payload.length, offset + this.outboundRecordChunkBytes));
                         const seq = this.reserveSendSeq();
                         frame = encryptRecord(this.sendKey, this.sendNoncePrefix, RECORD_FLAG_APP, seq, chunk, this.maxRecordBytes);
@@ -290,6 +297,8 @@ export class SecureChannel {
         try {
             while (!this.closed) {
                 const frame = await this.transport.readBinary();
+                if (this.closed)
+                    return;
                 const { flags, seq, plaintext } = decryptRecord(this.recvKey, this.recvNoncePrefix, frame, this.recvSeq, this.maxRecordBytes);
                 if (seq >= maxRecordSeq) {
                     throw new RecordSeqExhaustedError();
@@ -325,4 +334,9 @@ export class SecureChannel {
             this.close();
         }
     }
+    clearKeyMaterial() {
+        this.sendKey.fill(0);
+        this.recvKey.fill(0);
+        this.rekeyBase.fill(0);
+    }
 }

package/dist/facade.d.ts

@@ -24,7 +24,4 @@ export type { DirectConnectOptions } from "./direct-client/connect.js";
 export type ConnectOptions = TunnelConnectOptions | DirectConnectOptions;
 export declare function connectTunnel(grant: ChannelInitGrant, opts: TunnelConnectOptions): Promise<Client>;
 export declare function connectDirect(info: DirectConnectInfo, opts: DirectConnectOptions): Promise<Client>;
-export declare function connect(input: DirectConnectInfo, opts: DirectConnectOptions): Promise<Client>;
-export declare function connect(input: ChannelInitGrant, opts: TunnelConnectOptions): Promise<Client>;
 export declare function connect(input: ConnectArtifact, opts: ConnectOptions): Promise<Client>;
-export declare function connect(input: unknown, opts: ConnectOptions): Promise<Client>;

package/dist/facade.js

@@ -1,7 +1,6 @@
 import { connectDirect as connectDirectInternal } from "./direct-client/connect.js";
 import { connectTunnel as connectTunnelInternal } from "./tunnel-client/connect.js";
-import { normalizeConnectInput } from "./connect/internalNormalize.js";
-import { withObserverContext } from "./observability/observer.js";
+import { resolveConnectArtifact } from "./connect/resolveArtifact.js";
 export { assertChannelInitGrant } from "./gen/flowersec/controlplane/v1.gen.js";
 export { assertDirectConnectInfo } from "./gen/flowersec/direct/v1.gen.js";
 export { assertConnectArtifact } from "./connect/artifact.js";
@@ -13,15 +12,10 @@ export async function connectTunnel(grant, opts) {
 export async function connectDirect(info, opts) {
     return await connectDirectInternal(info, opts);
 }
+// connect resolves an artifact to its explicit direct or tunnel transport.
 export async function connect(input, opts) {
-    const normalized = await normalizeConnectInput(input, opts);
-    const nextObserver = normalized.observer ??
-        (normalized.correlation == null
-            ? opts.observer
-            : withObserverContext(opts.observer, {
-                ...(normalized.correlation.trace_id === undefined ? {} : { traceId: normalized.correlation.trace_id }),
-                ...(normalized.correlation.session_id === undefined ? {} : { sessionId: normalized.correlation.session_id }),
-            }));
+    const normalized = await resolveConnectArtifact(input, opts);
+    const nextObserver = normalized.observer ?? opts.observer;
     const nextOpts = (nextObserver === opts.observer ? opts : { ...opts, observer: nextObserver });
     if (normalized.kind === "direct") {
         return await connectDirectInternal(normalized.input, nextOpts);

package/dist/node/connect.d.ts

@@ -5,8 +5,6 @@ import { type ConnectOptions } from "../facade.js";
 import type { ConnectArtifact } from "../connect/artifact.js";
 import type { ChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
 import type { DirectConnectInfo } from "../gen/flowersec/direct/v1.gen.js";
-export declare function connectNode(input: DirectConnectInfo, opts: DirectConnectOptions): Promise<Client>;
-export declare function connectNode(input: ChannelInitGrant, opts: TunnelConnectOptions): Promise<Client>;
 export declare function connectNode(input: ConnectArtifact, opts: ConnectOptions): Promise<Client>;
 export declare function connectTunnelNode(grant: ChannelInitGrant, opts: TunnelConnectOptions): Promise<Client>;
 export declare function connectDirectNode(info: DirectConnectInfo, opts: DirectConnectOptions): Promise<Client>;

package/dist/tunnel-client/connect.d.ts

@@ -6,4 +6,4 @@ export type TunnelConnectOptions = ConnectOptionsBase & Readonly<{
     /** Optional caller-provided endpoint instance ID (base64url). */
     endpointInstanceId?: string;
 }>;
-export declare function connectTunnel(grant: unknown, opts: TunnelConnectOptions): Promise<ClientInternal>;
+export declare function connectTunnel(input: unknown, opts: TunnelConnectOptions): Promise<ClientInternal>;

package/dist/tunnel-client/connect.js

@@ -11,18 +11,8 @@ function isRecord(v) {
 function hasOwn(o, key) {
     return Object.prototype.hasOwnProperty.call(o, key);
 }
-function unwrapGrant(v) {
-    if (!isRecord(v))
-        return v;
-    if (hasOwn(v, "grant_client"))
-        return v["grant_client"];
-    if (hasOwn(v, "grant_server"))
-        return v["grant_server"];
-    return v;
-}
 // connectTunnel attaches to a tunnel and returns an RPC-ready session.
-export async function connectTunnel(grant, opts) {
-    const input = unwrapGrant(grant);
+export async function connectTunnel(input, opts) {
     if (input == null) {
         throw new FlowersecError({ stage: "validate", code: "missing_grant", path: "tunnel", message: "missing grant" });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Flowersec core TypeScript library (browser-friendly E2EE + multiplexing over WebSocket).",
   "license": "MIT",
   "repository": {
@@ -103,10 +103,6 @@
     "./gen/flowersec/tunnel/*": {
       "types": "./dist/gen/flowersec/tunnel/*.d.ts",
       "default": "./dist/gen/flowersec/tunnel/*.js"
-    },
-    "./internal": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
     }
   },
   "engines": {
@@ -122,7 +118,9 @@
     "bench": "vitest bench --run",
     "test": "npm run build && vitest run",
     "test:browser": "npm run build && playwright test",
-    "ensure:browser": "node ./scripts/ensure-playwright-chromium.mjs",
+    "test:browser:chromium": "npm run build && playwright test --project=chromium",
+    "test:browser:webkit": "npm run build && playwright test --project=webkit-smoke",
+    "ensure:browser": "node ./scripts/ensure-playwright-browsers.mjs",
     "test:coverage": "npm run build && vitest run --coverage",
     "lint": "eslint .",
     "verify:package": "node ./scripts/verify-package-exports.mjs",

package/dist/browser/controlplane.d.ts

@@ -1,15 +0,0 @@
-import { type ChannelInitGrant } from "../facade.js";
-import type { ControlplaneBaseConfig as SharedControlplaneBaseConfig, RequestConnectArtifactInput, RequestEntryConnectArtifactInput } from "../controlplane/request.js";
-type BaseControlplaneRequestConfig = SharedControlplaneBaseConfig & Readonly<{
-    endpointId: string;
-    payload?: Record<string, unknown>;
-}>;
-export type ControlplaneConfig = BaseControlplaneRequestConfig;
-export type EntryControlplaneConfig = BaseControlplaneRequestConfig & Readonly<{
-    entryTicket: string;
-}>;
-export type ConnectArtifactRequestConfig = RequestConnectArtifactInput;
-export type EntryConnectArtifactRequestConfig = RequestEntryConnectArtifactInput;
-export declare function requestChannelGrant(config: ControlplaneConfig): Promise<ChannelInitGrant>;
-export declare function requestEntryChannelGrant(config: EntryControlplaneConfig): Promise<ChannelInitGrant>;
-export {};

package/dist/browser/controlplane.js

@@ -1,64 +0,0 @@
-import { assertChannelInitGrant } from "../facade.js";
-import { requestControlplaneJSON, } from "../controlplane/request.js";
-function buildURL(baseUrl, path) {
-    const base = String(baseUrl ?? "").trim();
-    if (base === "")
-        return path;
-    return `${base.replace(/\/+$/, "")}${path}`;
-}
-function buildPayload(endpointId, payload) {
-    const id = String(endpointId ?? "").trim();
-    if (id === "")
-        throw new Error("endpointId is required");
-    const out = { ...(payload ?? {}) };
-    const raw = out.endpoint_id;
-    if (raw !== undefined && String(raw ?? "").trim() !== id) {
-        throw new Error("payload.endpoint_id must match endpointId");
-    }
-    out.endpoint_id = id;
-    return out;
-}
-async function requestGrant(url, init) {
-    return await requestControlplaneJSON(url, init);
-}
-export async function requestChannelGrant(config) {
-    const headers = new Headers(config.headers);
-    if (!headers.has("Content-Type")) {
-        headers.set("Content-Type", "application/json");
-    }
-    const data = (await requestGrant(buildURL(config.baseUrl, "/v1/channel/init"), {
-        ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
-        method: "POST",
-        credentials: config.credentials ?? "omit",
-        headers,
-        body: JSON.stringify(buildPayload(config.endpointId, config.payload)),
-        ...(config.signal === undefined ? {} : { signal: config.signal }),
-    }));
-    if (!data?.grant_client) {
-        throw new Error("Invalid controlplane response: missing `grant_client`");
-    }
-    return assertChannelInitGrant(data.grant_client);
-}
-export async function requestEntryChannelGrant(config) {
-    const entryTicket = String(config.entryTicket ?? "").trim();
-    if (entryTicket === "")
-        throw new Error("entryTicket is required");
-    const endpointId = String(config.endpointId ?? "").trim();
-    const headers = new Headers(config.headers);
-    headers.set("Authorization", `Bearer ${entryTicket}`);
-    if (!headers.has("Content-Type")) {
-        headers.set("Content-Type", "application/json");
-    }
-    const data = (await requestGrant(buildURL(config.baseUrl, `/v1/channel/init/entry?endpoint_id=${encodeURIComponent(endpointId)}`), {
-        ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
-        method: "POST",
-        credentials: config.credentials ?? "omit",
-        headers,
-        body: JSON.stringify(buildPayload(endpointId, config.payload)),
-        ...(config.signal === undefined ? {} : { signal: config.signal }),
-    }));
-    if (!data?.grant_client) {
-        throw new Error("Invalid controlplane response: missing `grant_client`");
-    }
-    return assertChannelInitGrant(data.grant_client);
-}

package/dist/connect/internalNormalize.js

@@ -1,173 +0,0 @@
-import { Role as ControlRole } from "../gen/flowersec/controlplane/v1.gen.js";
-import { emitObserverDiagnostic, normalizeObserver, withObserverContext } from "../observability/observer.js";
-import { FlowersecError } from "../utils/errors.js";
-import { assertConnectArtifact, hasArtifactOnlyFields, } from "./artifact.js";
-function maybeParseJSON(input) {
-    if (typeof input !== "string")
-        return input;
-    const s = input.trim();
-    if (s === "")
-        return input;
-    if (s[0] !== "{" && s[0] !== "[")
-        return input;
-    try {
-        return JSON.parse(s);
-    }
-    catch (e) {
-        throw new FlowersecError({
-            path: "auto",
-            stage: "validate",
-            code: "invalid_input",
-            message: "invalid JSON string",
-            cause: e,
-        });
-    }
-}
-async function validateArtifactScopes(artifact, opts, observer) {
-    const scoped = artifact.scoped ?? [];
-    if (scoped.length === 0)
-        return;
-    const path = artifact.transport;
-    for (const entry of scoped) {
-        const resolver = opts.scopeResolvers?.[entry.scope];
-        if (resolver == null) {
-            if (entry.critical) {
-                throw new FlowersecError({
-                    path,
-                    stage: "validate",
-                    code: "resolve_failed",
-                    message: `missing scope resolver for ${entry.scope}@${entry.scope_version}`,
-                });
-            }
-            emitObserverDiagnostic(observer, {
-                path,
-                stage: "scope",
-                code_domain: "event",
-                code: "scope_ignored_missing_resolver",
-                result: "skip",
-            });
-            continue;
-        }
-        try {
-            await resolver(entry);
-        }
-        catch (e) {
-            if (!entry.critical && opts.relaxedOptionalScopeValidation === true) {
-                emitObserverDiagnostic(observer, {
-                    path,
-                    stage: "scope",
-                    code_domain: "event",
-                    code: "scope_ignored_relaxed_validation",
-                    result: "skip",
-                });
-                continue;
-            }
-            throw new FlowersecError({
-                path,
-                stage: "validate",
-                code: "resolve_failed",
-                message: `scope validation failed for ${entry.scope}@${entry.scope_version}`,
-                cause: e,
-            });
-        }
-    }
-}
-export async function normalizeConnectInput(input, opts = {}) {
-    const v = maybeParseJSON(input);
-    if (v == null || typeof v !== "object") {
-        throw new FlowersecError({
-            path: "auto",
-            stage: "validate",
-            code: "invalid_input",
-            message: "invalid input: expected an object or a JSON string",
-        });
-    }
-    const o = v;
-    const hasWsUrl = Object.prototype.hasOwnProperty.call(o, "ws_url");
-    const hasTunnelUrl = Object.prototype.hasOwnProperty.call(o, "tunnel_url");
-    const hasGrantClient = Object.prototype.hasOwnProperty.call(o, "grant_client");
-    const hasGrantServer = Object.prototype.hasOwnProperty.call(o, "grant_server");
-    const isArtifactCandidate = hasArtifactOnlyFields(o);
-    if ((hasWsUrl && (hasTunnelUrl || hasGrantClient || hasGrantServer)) || (hasTunnelUrl && (hasGrantClient || hasGrantServer))) {
-        throw new FlowersecError({
-            path: "auto",
-            stage: "validate",
-            code: "invalid_input",
-            message: "hybrid connect input is not allowed",
-        });
-    }
-    if (isArtifactCandidate && (hasWsUrl || hasTunnelUrl || hasGrantClient || hasGrantServer)) {
-        throw new FlowersecError({
-            path: "auto",
-            stage: "validate",
-            code: "invalid_input",
-            message: "artifact fields cannot be mixed with legacy connect inputs",
-        });
-    }
-    if (hasGrantServer) {
-        throw new FlowersecError({
-            path: "tunnel",
-            stage: "validate",
-            code: "role_mismatch",
-            message: "expected role=client",
-        });
-    }
-    if (hasGrantClient)
-        return { kind: "tunnel", input: v };
-    if (hasWsUrl)
-        return { kind: "direct", input: v };
-    if (hasTunnelUrl) {
-        if (typeof o.role === "number" && Number.isSafeInteger(o.role) && o.role === ControlRole.Role_server) {
-            throw new FlowersecError({
-                path: "tunnel",
-                stage: "validate",
-                code: "role_mismatch",
-                message: "expected role=client",
-            });
-        }
-        return { kind: "tunnel", input: v };
-    }
-    if (isArtifactCandidate) {
-        let artifact;
-        try {
-            artifact = assertConnectArtifact(v);
-        }
-        catch (e) {
-            throw new FlowersecError({
-                path: "auto",
-                stage: "validate",
-                code: "invalid_input",
-                message: "invalid ConnectArtifact",
-                cause: e,
-            });
-        }
-        const observer = opts.observer == null
-            ? undefined
-            : normalizeObserver(withObserverContext(opts.observer, {
-                path: artifact.transport,
-                ...(artifact.correlation?.trace_id === undefined ? {} : { traceId: artifact.correlation.trace_id }),
-                ...(artifact.correlation?.session_id === undefined ? {} : { sessionId: artifact.correlation.session_id }),
-            }), { path: artifact.transport });
-        await validateArtifactScopes(artifact, opts, observer);
-        if (artifact.transport === "direct") {
-            return {
-                kind: "direct",
-                input: artifact.direct_info,
-                ...(artifact.correlation === undefined ? {} : { correlation: artifact.correlation }),
-                ...(observer === undefined ? {} : { observer }),
-            };
-        }
-        return {
-            kind: "tunnel",
-            input: artifact.tunnel_grant,
-            ...(artifact.correlation === undefined ? {} : { correlation: artifact.correlation }),
-            ...(observer === undefined ? {} : { observer }),
-        };
-    }
-    throw new FlowersecError({
-        path: "auto",
-        stage: "validate",
-        code: "invalid_input",
-        message: "invalid input: expected DirectConnectInfo, ChannelInitGrant, wrapper, or ConnectArtifact",
-    });
-}