@floegence/flowersec-core 0.26.0 → 2.0.0

package/dist/client-connect/contract.js

@@ -1,51 +0,0 @@
-import { base64urlDecode } from "../utils/base64url.js";
-import { FlowersecError } from "../utils/errors.js";
-const textEncoder = new TextEncoder();
-export const CHANNEL_ID_MAX_BYTES = 256;
-export function prepareChannelId(raw, path) {
-    const channelId = typeof raw === "string" ? raw.trim() : "";
-    if (channelId === "") {
-        throw new FlowersecError({ path, stage: "validate", code: "missing_channel_id", message: "missing channel_id" });
-    }
-    if (textEncoder.encode(channelId).length > CHANNEL_ID_MAX_BYTES) {
-        throw new FlowersecError({ path, stage: "validate", code: "invalid_input", message: "channel_id too long" });
-    }
-    return channelId;
-}
-export function assertTunnelGrantContract(grant, expectedRole) {
-    if (grant.role !== expectedRole) {
-        throw new FlowersecError({ stage: "validate", code: "role_mismatch", path: "tunnel", message: `expected role=${expectedRole === 1 ? "client" : "server"}` });
-    }
-    const allowedSuites = Array.isArray(grant.allowed_suites) ? grant.allowed_suites : [];
-    if (allowedSuites.length === 0) {
-        throw new FlowersecError({ stage: "validate", code: "invalid_suite", path: "tunnel", message: "allowed_suites must be non-empty" });
-    }
-    for (const suite of allowedSuites) {
-        assertSupportedSuite(suite, "tunnel");
-    }
-    assertSupportedSuite(grant.default_suite, "tunnel");
-    if (!allowedSuites.includes(grant.default_suite)) {
-        throw new FlowersecError({ stage: "validate", code: "invalid_suite", path: "tunnel", message: "default_suite must be included in allowed_suites" });
-    }
-}
-export function assertDirectConnectContract(info) {
-    assertSupportedSuite(info.default_suite, "direct");
-}
-export function assertValidPSK(raw, path) {
-    const pskB64u = typeof raw === "string" ? raw.trim() : "";
-    try {
-        const psk = base64urlDecode(pskB64u);
-        if (psk.length !== 32) {
-            throw new Error("psk must be 32 bytes");
-        }
-    }
-    catch (e) {
-        throw new FlowersecError({ stage: "validate", code: "invalid_psk", path, message: "invalid e2ee_psk_b64u", cause: e });
-    }
-    return pskB64u;
-}
-function assertSupportedSuite(suite, path) {
-    if (suite !== 1 && suite !== 2) {
-        throw new FlowersecError({ stage: "validate", code: "invalid_suite", path, message: "invalid suite" });
-    }
-}

package/dist/client-connect/termination.d.ts

@@ -1,6 +0,0 @@
-import type { Client } from "../client.js";
-export type ClientTermination = Readonly<{
-    error: Error;
-}>;
-export declare function registerClientTermination(client: Client, termination: Promise<ClientTermination>): void;
-export declare function getClientTermination(client: Client): Promise<ClientTermination> | undefined;

package/dist/client-connect/termination.js

@@ -1,7 +0,0 @@
-const clientTerminations = new WeakMap();
-export function registerClientTermination(client, termination) {
-    clientTerminations.set(client, termination);
-}
-export function getClientTermination(client) {
-    return clientTerminations.get(client);
-}

package/dist/client-connect/transportSecurity.d.ts

@@ -1,27 +0,0 @@
-import type { ClientPath } from "../client.js";
-import { type ClientObserverLike } from "../observability/observer.js";
-export declare const RequireTLS: "require_tls";
-export declare const AllowPlaintextForLoopback: "allow_plaintext_for_loopback";
-export declare const PlaintextRiskAcceptance: {
-    readonly acceptPreE2ECredentialExposure: "accept_pre_e2ee_credential_exposure";
-};
-export type PlaintextRiskAcceptance = typeof PlaintextRiskAcceptance[keyof typeof PlaintextRiskAcceptance];
-export type NetworkPlaintextPolicyOptions = Readonly<{
-    allowedHosts: readonly string[];
-    riskAcceptance: PlaintextRiskAcceptance;
-}>;
-export type TransportSecurityPolicyInput = Readonly<{
-    path: ClientPath;
-    scheme: "ws" | "wss";
-    host: string;
-    runtime: "browser" | "node" | "other";
-}>;
-export type TransportSecurityPolicyPreset = typeof RequireTLS | typeof AllowPlaintextForLoopback;
-export type TransportSecurityPolicy = TransportSecurityPolicyPreset | ((input: TransportSecurityPolicyInput) => boolean | Promise<boolean>);
-export declare function createNetworkPlaintextPolicy(options: NetworkPlaintextPolicyOptions): TransportSecurityPolicy;
-export declare function enforceTransportSecurity(args: Readonly<{
-    rawUrl: string;
-    path: ClientPath;
-    policy?: TransportSecurityPolicy;
-    observer?: ClientObserverLike;
-}>): Promise<void>;

package/dist/client-connect/transportSecurity.js

@@ -1,199 +0,0 @@
-import { FlowersecError } from "../utils/errors.js";
-import { emitObserverDiagnostic } from "../observability/observer.js";
-export const RequireTLS = "require_tls";
-export const AllowPlaintextForLoopback = "allow_plaintext_for_loopback";
-export const PlaintextRiskAcceptance = {
-    acceptPreE2ECredentialExposure: "accept_pre_e2ee_credential_exposure",
-};
-export function createNetworkPlaintextPolicy(options) {
-    if (options?.riskAcceptance !== PlaintextRiskAcceptance.acceptPreE2ECredentialExposure) {
-        throw new Error("network plaintext policy requires explicit pre-E2EE credential exposure acceptance");
-    }
-    if (!Array.isArray(options.allowedHosts) || options.allowedHosts.length === 0) {
-        throw new Error("network plaintext policy requires at least one allowed host");
-    }
-    const allowedHosts = new Set(options.allowedHosts.map(canonicalNetworkPlaintextHost));
-    return (input) => input.scheme === "wss" || (input.scheme === "ws" && allowedHosts.has(input.host));
-}
-export async function enforceTransportSecurity(args) {
-    let target;
-    try {
-        target = parseWebSocketTarget(args.rawUrl);
-    }
-    catch (cause) {
-        throw denied(args.path, cause);
-    }
-    const input = {
-        path: args.path,
-        scheme: target.scheme,
-        host: target.host,
-        runtime: detectRuntime(),
-    };
-    let allowed = false;
-    const policy = args.policy ?? RequireTLS;
-    try {
-        if (typeof policy === "function") {
-            allowed = await policy(input) === true;
-        }
-        else {
-            allowed = evaluatePreset(policy, target);
-        }
-    }
-    catch (cause) {
-        throw denied(args.path, cause);
-    }
-    if (!allowed)
-        throw denied(args.path);
-    if (target.scheme === "ws") {
-        emitObserverDiagnostic(args.observer, {
-            path: args.path,
-            stage: "transport",
-            code_domain: "event",
-            code: "plaintext_transport",
-            result: "skip",
-        });
-    }
-}
-function denied(path, cause) {
-    return new FlowersecError({
-        path,
-        stage: "validate",
-        code: "transport_policy_denied",
-        message: "transport security policy denied websocket URL",
-        ...(cause === undefined ? {} : { cause }),
-    });
-}
-function evaluatePreset(policy, target) {
-    switch (policy) {
-        case RequireTLS:
-            return target.scheme === "wss";
-        case AllowPlaintextForLoopback:
-            return target.scheme === "wss" || isLiteralLoopbackHost(target.host);
-    }
-}
-function parseWebSocketTarget(rawUrl) {
-    const raw = rawUrl.trim();
-    const match = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/([^/?#]*)(?:[/?#]|$)/.exec(raw);
-    const scheme = match?.[1]?.toLowerCase();
-    const authority = match?.[2] ?? "";
-    if ((scheme !== "ws" && scheme !== "wss") || authority === "" || authority.includes("@")) {
-        throw new Error("invalid websocket URL");
-    }
-    let host;
-    if (authority.startsWith("[")) {
-        const end = authority.indexOf("]");
-        if (end <= 1 || (authority.slice(end + 1) !== "" && !/^:\d+$/.test(authority.slice(end + 1)))) {
-            throw new Error("invalid websocket URL");
-        }
-        host = authority.slice(1, end).toLowerCase();
-    }
-    else {
-        const pieces = authority.split(":");
-        if (pieces.length > 2 || (pieces.length === 2 && !/^\d+$/.test(pieces[1] ?? ""))) {
-            throw new Error("invalid websocket URL");
-        }
-        host = (pieces[0] ?? "").toLowerCase();
-    }
-    if (host === "")
-        throw new Error("invalid websocket URL");
-    return { scheme, host };
-}
-function isLiteralLoopbackHost(host) {
-    if (host === "localhost" || host === "::1")
-        return true;
-    const parts = host.split(".");
-    if (parts.length !== 4)
-        return false;
-    const octets = [];
-    for (const part of parts) {
-        if (!/^(0|[1-9]\d{0,2})$/.test(part))
-            return false;
-        const value = Number(part);
-        if (value > 255)
-            return false;
-        octets.push(value);
-    }
-    return octets[0] === 127;
-}
-function canonicalNetworkPlaintextHost(rawHost) {
-    const host = String(rawHost ?? "").trim();
-    if (host === "" || host !== host.toLowerCase() || /[@/?#%\[\]]/.test(host)) {
-        throw new Error(`invalid network plaintext allowed host ${JSON.stringify(rawHost)}`);
-    }
-    if (host.includes(":")) {
-        return canonicalNetworkIPv6Host(host);
-    }
-    const octets = canonicalIPv4Octets(host);
-    const firstOctet = octets[0];
-    const secondOctet = octets[1];
-    if (firstOctet == null || secondOctet == null) {
-        throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(rawHost)}`);
-    }
-    if (firstOctet === 127 || (firstOctet === 169 && secondOctet === 254) || firstOctet >= 224 || octets.every((value) => value === 0)) {
-        throw new Error(`network plaintext allowed host must be a non-loopback unicast IP literal: ${JSON.stringify(rawHost)}`);
-    }
-    return host;
-}
-function canonicalIPv4Octets(host) {
-    const parts = host.split(".");
-    if (parts.length !== 4) {
-        throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(host)}`);
-    }
-    const octets = parts.map((part) => {
-        if (!/^(0|[1-9]\d{0,2})$/.test(part)) {
-            throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(host)}`);
-        }
-        const value = Number(part);
-        if (value > 255) {
-            throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(host)}`);
-        }
-        return value;
-    });
-    return octets;
-}
-function canonicalNetworkIPv6Host(host) {
-    let parsed;
-    try {
-        parsed = new URL(`http://[${host}]/`);
-    }
-    catch {
-        throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(host)}`);
-    }
-    const canonical = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
-    if (canonical !== host) {
-        throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(host)}`);
-    }
-    const words = expandIPv6Words(canonical);
-    const unspecified = words.every((word) => word === 0);
-    const loopback = words.slice(0, 7).every((word) => word === 0) && words[7] === 1;
-    const mappedIPv4 = words.slice(0, 5).every((word) => word === 0) && words[5] === 0xffff;
-    const multicast = (words[0] & 0xff00) === 0xff00;
-    const linkLocal = (words[0] & 0xffc0) === 0xfe80;
-    if (unspecified || loopback || mappedIPv4 || multicast || linkLocal) {
-        throw new Error(`network plaintext allowed host must be a non-loopback unicast IP literal: ${JSON.stringify(host)}`);
-    }
-    return canonical;
-}
-function expandIPv6Words(host) {
-    const halves = host.split("::");
-    if (halves.length > 2)
-        throw new Error("invalid IPv6 host");
-    const left = halves[0] === "" ? [] : halves[0].split(":");
-    const right = halves.length === 1 || halves[1] === "" ? [] : halves[1].split(":");
-    const missing = 8 - left.length - right.length;
-    if ((halves.length === 1 && missing !== 0) || (halves.length === 2 && missing < 1)) {
-        throw new Error("invalid IPv6 host");
-    }
-    const words = [...left, ...Array.from({ length: missing }, () => "0"), ...right].map((part) => Number.parseInt(part, 16));
-    if (words.length !== 8 || words.some((word) => !Number.isInteger(word) || word < 0 || word > 0xffff)) {
-        throw new Error("invalid IPv6 host");
-    }
-    return words;
-}
-function detectRuntime() {
-    if (typeof window !== "undefined" && typeof window.document !== "undefined")
-        return "browser";
-    if (typeof process !== "undefined" && process.versions?.node != null)
-        return "node";
-    return "other";
-}

package/dist/client-connect/tunnelAttachCloseReason.d.ts

@@ -1,3 +0,0 @@
-export declare const tunnelAttachCloseReasons: readonly ["too_many_connections", "expected_attach", "invalid_attach", "invalid_token", "channel_mismatch", "init_exp_mismatch", "idle_timeout_mismatch", "role_mismatch", "token_replay", "tenant_mismatch", "policy_denied", "policy_error", "replace_rate_limited", "attach_failed", "timeout", "canceled"];
-export type TunnelAttachCloseReason = (typeof tunnelAttachCloseReasons)[number];
-export declare function isTunnelAttachCloseReason(v: string | undefined): v is TunnelAttachCloseReason;

package/dist/client-connect/tunnelAttachCloseReason.js

@@ -1,23 +0,0 @@
-export const tunnelAttachCloseReasons = [
-    "too_many_connections",
-    "expected_attach",
-    "invalid_attach",
-    "invalid_token",
-    "channel_mismatch",
-    "init_exp_mismatch",
-    "idle_timeout_mismatch",
-    "role_mismatch",
-    "token_replay",
-    "tenant_mismatch",
-    "policy_denied",
-    "policy_error",
-    "replace_rate_limited",
-    "attach_failed",
-    "timeout",
-    "canceled",
-];
-export function isTunnelAttachCloseReason(v) {
-    if (v == null)
-        return false;
-    return tunnelAttachCloseReasons.includes(v);
-}

package/dist/client.d.ts

@@ -1,23 +0,0 @@
-import type { SecureChannel } from "./e2ee/secureChannel.js";
-import type { RpcClient } from "./rpc/client.js";
-import type { YamuxSession } from "./yamux/session.js";
-import type { YamuxStream } from "./yamux/stream.js";
-export type ClientPath = "tunnel" | "direct";
-export type Client = Readonly<{
-    path: ClientPath;
-    endpointInstanceId?: string;
-    rpc: RpcClient;
-    openStream: (kind: string, opts?: Readonly<{
-        signal?: AbortSignal;
-    }>) => Promise<YamuxStream>;
-    ping: () => Promise<void>;
-    /** Emits an authenticated rekey record and advances the E2EE send key. */
-    rekey: () => Promise<void>;
-    /** Performs an acknowledged Yamux round trip and returns RTT in milliseconds. */
-    probeLiveness: () => Promise<number>;
-    close: () => void;
-}>;
-export type ClientInternal = Client & Readonly<{
-    secure: SecureChannel;
-    mux: YamuxSession;
-}>;

package/dist/connect/artifact.d.ts

@@ -1,37 +0,0 @@
-import { type ChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
-import { type DirectConnectInfo } from "../gen/flowersec/direct/v1.gen.js";
-export type ConnectArtifactTransport = "tunnel" | "direct";
-export type CorrelationKV = Readonly<{
-    key: string;
-    value: string;
-}>;
-export type CorrelationContext = Readonly<{
-    v: 1;
-    trace_id?: string;
-    session_id?: string;
-    tags: readonly CorrelationKV[];
-}>;
-export type ScopePayload = Record<string, unknown>;
-export type ScopeMetadataEntry = Readonly<{
-    scope: string;
-    scope_version: number;
-    critical: boolean;
-    payload: ScopePayload;
-}>;
-export type TunnelClientConnectArtifact = Readonly<{
-    v: 1;
-    transport: "tunnel";
-    tunnel_grant: ChannelInitGrant;
-    scoped?: readonly ScopeMetadataEntry[];
-    correlation?: CorrelationContext;
-}>;
-export type DirectClientConnectArtifact = Readonly<{
-    v: 1;
-    transport: "direct";
-    direct_info: DirectConnectInfo;
-    scoped?: readonly ScopeMetadataEntry[];
-    correlation?: CorrelationContext;
-}>;
-export type ConnectArtifact = TunnelClientConnectArtifact | DirectClientConnectArtifact;
-export declare function hasArtifactOnlyFields(value: Record<string, unknown>): boolean;
-export declare function assertConnectArtifact(value: unknown): ConnectArtifact;

package/dist/connect/artifact.js

@@ -1,217 +0,0 @@
-import { assertChannelInitGrant, Role as ControlRole } from "../gen/flowersec/controlplane/v1.gen.js";
-import { assertDirectConnectInfo } from "../gen/flowersec/direct/v1.gen.js";
-const SCOPE_NAME_RE = /^[a-z][a-z0-9._-]{0,63}$/;
-const TAG_KEY_RE = /^[a-z][a-z0-9._-]{0,31}$/;
-const CORRELATION_ID_RE = /^[A-Za-z0-9._~-]{8,128}$/;
-const encoder = new TextEncoder();
-const TUNNEL_ARTIFACT_KEYS = new Set(["v", "transport", "tunnel_grant", "scoped", "correlation"]);
-const DIRECT_ARTIFACT_KEYS = new Set(["v", "transport", "direct_info", "scoped", "correlation"]);
-const ARTIFACT_ONLY_KEYS = new Set(["v", "transport", "tunnel_grant", "direct_info", "scoped", "correlation"]);
-function isRecord(v) {
-    return typeof v === "object" && v != null && !Array.isArray(v);
-}
-function hasOwn(o, key) {
-    return Object.prototype.hasOwnProperty.call(o, key);
-}
-function assertNoUnknownFields(kind, obj, allowed) {
-    for (const key of Object.keys(obj)) {
-        if (!allowed.has(key))
-            throw new Error(`bad ${kind}.${key}`);
-    }
-}
-function assertPositiveInt(name, value, min, max) {
-    if (typeof value !== "number" || !Number.isSafeInteger(value))
-        throw new Error(`bad ${name}`);
-    if (value < min || value > max)
-        throw new Error(`bad ${name}`);
-    return value;
-}
-function utf8Len(value) {
-    return encoder.encode(value).length;
-}
-function normalizedJSONForSize(value) {
-    return serializeNormalizedJSON(normalizeJSONValue(value));
-}
-function normalizeJSONValue(value) {
-    if (value === null)
-        return null;
-    switch (typeof value) {
-        case "string":
-        case "boolean":
-            return value;
-        case "number":
-            if (!Number.isFinite(value))
-                throw new Error("bad payload.number");
-            return value;
-        case "object": {
-            if (Array.isArray(value)) {
-                return value.map((entry) => normalizeJSONValue(entry));
-            }
-            if (!isRecord(value))
-                throw new Error("bad payload.object");
-            const out = {};
-            for (const key of Object.keys(value).sort()) {
-                out[key] = normalizeJSONValue(value[key]);
-            }
-            return out;
-        }
-        default:
-            throw new Error("bad payload.value");
-    }
-}
-function serializeNormalizedJSON(value) {
-    return JSON.stringify(value);
-}
-function maxContainerDepth(value) {
-    if (Array.isArray(value)) {
-        let best = 1;
-        for (const entry of value)
-            best = Math.max(best, 1 + maxContainerDepth(entry));
-        return best;
-    }
-    if (isRecord(value)) {
-        let best = 1;
-        for (const entry of Object.values(value))
-            best = Math.max(best, 1 + maxContainerDepth(entry));
-        return best;
-    }
-    return 0;
-}
-function sanitizeCorrelationID(value) {
-    if (typeof value !== "string")
-        return undefined;
-    const trimmed = value.trim();
-    if (!CORRELATION_ID_RE.test(trimmed))
-        return undefined;
-    return trimmed;
-}
-function assertCorrelationKV(value) {
-    if (!isRecord(value))
-        throw new Error("bad CorrelationKV");
-    assertNoUnknownFields("CorrelationKV", value, new Set(["key", "value"]));
-    if (typeof value.key !== "string" || !TAG_KEY_RE.test(value.key))
-        throw new Error("bad CorrelationKV.key");
-    if (typeof value.value !== "string")
-        throw new Error("bad CorrelationKV.value");
-    if (utf8Len(value.key) > 32)
-        throw new Error("bad CorrelationKV.key");
-    if (utf8Len(value.value) > 128)
-        throw new Error("bad CorrelationKV.value");
-    return Object.freeze({ key: value.key, value: value.value });
-}
-function assertCorrelationContext(value) {
-    if (!isRecord(value))
-        throw new Error("bad CorrelationContext");
-    assertNoUnknownFields("CorrelationContext", value, new Set(["v", "trace_id", "session_id", "tags"]));
-    if (value.v !== 1)
-        throw new Error("bad CorrelationContext.v");
-    const rawTags = value.tags;
-    if (rawTags !== undefined && !Array.isArray(rawTags))
-        throw new Error("bad CorrelationContext.tags");
-    const tags = (rawTags ?? []).map((entry) => assertCorrelationKV(entry));
-    const seen = new Set();
-    for (const tag of tags) {
-        if (seen.has(tag.key))
-            throw new Error("bad CorrelationContext.tags");
-        seen.add(tag.key);
-    }
-    if (tags.length > 8)
-        throw new Error("bad CorrelationContext.tags");
-    const traceId = sanitizeCorrelationID(value.trace_id);
-    const sessionId = sanitizeCorrelationID(value.session_id);
-    return Object.freeze({
-        v: 1,
-        ...(traceId === undefined ? {} : { trace_id: traceId }),
-        ...(sessionId === undefined ? {} : { session_id: sessionId }),
-        tags: Object.freeze(tags),
-    });
-}
-function assertPayloadObject(value) {
-    if (!isRecord(value))
-        throw new Error("bad ScopeMetadataEntry.payload");
-    const normalized = normalizedJSONForSize(value);
-    if (utf8Len(normalized) > 8192)
-        throw new Error("bad ScopeMetadataEntry.payload");
-    if (maxContainerDepth(value) > 8)
-        throw new Error("bad ScopeMetadataEntry.payload");
-    return value;
-}
-function assertScopeMetadataEntry(value) {
-    if (!isRecord(value))
-        throw new Error("bad ScopeMetadataEntry");
-    assertNoUnknownFields("ScopeMetadataEntry", value, new Set(["scope", "scope_version", "critical", "payload"]));
-    if (typeof value.scope !== "string" || !SCOPE_NAME_RE.test(value.scope))
-        throw new Error("bad ScopeMetadataEntry.scope");
-    if (typeof value.critical !== "boolean")
-        throw new Error("bad ScopeMetadataEntry.critical");
-    const scopeVersion = assertPositiveInt("ScopeMetadataEntry.scope_version", value.scope_version, 1, 65535);
-    const payload = assertPayloadObject(value.payload);
-    return Object.freeze({
-        scope: value.scope,
-        scope_version: scopeVersion,
-        critical: value.critical,
-        payload,
-    });
-}
-function assertScopedEntries(value) {
-    if (!Array.isArray(value))
-        throw new Error("bad ConnectArtifact.scoped");
-    if (value.length > 8)
-        throw new Error("bad ConnectArtifact.scoped");
-    const out = value.map((entry) => assertScopeMetadataEntry(entry));
-    const seen = new Set();
-    for (const entry of out) {
-        if (seen.has(entry.scope))
-            throw new Error("bad ConnectArtifact.scoped");
-        seen.add(entry.scope);
-    }
-    return Object.freeze(out);
-}
-function assertArtifactObject(value) {
-    if (!isRecord(value))
-        throw new Error("bad ConnectArtifact");
-    return value;
-}
-function assertArtifactTransport(value) {
-    if (value !== "tunnel" && value !== "direct")
-        throw new Error("bad ConnectArtifact.transport");
-    return value;
-}
-export function hasArtifactOnlyFields(value) {
-    return Object.keys(value).some((key) => ARTIFACT_ONLY_KEYS.has(key));
-}
-export function assertConnectArtifact(value) {
-    const record = assertArtifactObject(value);
-    if (record.v !== 1)
-        throw new Error("bad ConnectArtifact.v");
-    const transport = assertArtifactTransport(record.transport);
-    const scoped = record.scoped === undefined ? undefined : assertScopedEntries(record.scoped);
-    const correlation = record.correlation === undefined ? undefined : assertCorrelationContext(record.correlation);
-    if (transport === "tunnel") {
-        assertNoUnknownFields("TunnelClientConnectArtifact", record, TUNNEL_ARTIFACT_KEYS);
-        if (!hasOwn(record, "tunnel_grant"))
-            throw new Error("bad TunnelClientConnectArtifact.tunnel_grant");
-        const tunnelGrant = assertChannelInitGrant(record.tunnel_grant);
-        if (tunnelGrant.role !== ControlRole.Role_client) {
-            throw new Error("bad TunnelClientConnectArtifact.tunnel_grant.role");
-        }
-        return Object.freeze({
-            v: 1,
-            transport,
-            tunnel_grant: tunnelGrant,
-            ...(scoped === undefined ? {} : { scoped }),
-            ...(correlation === undefined ? {} : { correlation }),
-        });
-    }
-    assertNoUnknownFields("DirectClientConnectArtifact", record, DIRECT_ARTIFACT_KEYS);
-    if (!hasOwn(record, "direct_info"))
-        throw new Error("bad DirectClientConnectArtifact.direct_info");
-    const directInfo = assertDirectConnectInfo(record.direct_info);
-    return Object.freeze({
-        v: 1,
-        transport,
-        direct_info: directInfo,
-        ...(scoped === undefined ? {} : { scoped }),
-        ...(correlation === undefined ? {} : { correlation }),
-    });
-}

package/dist/connect/internalNormalize.d.ts

@@ -1,22 +0,0 @@
-import { type ClientObserverLike } from "../observability/observer.js";
-import { type CorrelationContext, type ScopeMetadataEntry } from "./artifact.js";
-export type ConnectScopeResolver = (entry: ScopeMetadataEntry) => void | Promise<void>;
-export type ConnectScopeResolverMap = Readonly<Record<string, ConnectScopeResolver>>;
-type NormalizeOptions = Readonly<{
-    observer?: ClientObserverLike;
-    scopeResolvers?: ConnectScopeResolverMap;
-    relaxedOptionalScopeValidation?: boolean;
-}>;
-export type NormalizedConnectInput = Readonly<{
-    kind: "tunnel";
-    input: unknown;
-    correlation?: CorrelationContext;
-    observer?: ClientObserverLike;
-}> | Readonly<{
-    kind: "direct";
-    input: unknown;
-    correlation?: CorrelationContext;
-    observer?: ClientObserverLike;
-}>;
-export declare function normalizeConnectInput(input: unknown, opts?: NormalizeOptions): Promise<NormalizedConnectInput>;
-export {};