@floegence/flowersec-core 0.27.0 → 2.0.0

package/dist/proxy/serviceWorker.js

@@ -1,626 +1,239 @@
-import { DEFAULT_MAX_BODY_BYTES } from "./constants.js";
-function normalizePathPrefix(name, v) {
-    const s = typeof v === "string" ? v.trim() : "";
-    if (s === "")
-        return "";
-    if (!s.startsWith("/"))
-        throw new Error(`${name} must start with "/"`);
-    if (s.startsWith("//"))
-        throw new Error(`${name} must not start with "//"`);
-    if (/[ \t\r\n]/.test(s))
-        throw new Error(`${name} must not contain whitespace`);
-    if (s.includes("://"))
-        throw new Error(`${name} must not include scheme/host`);
-    return s;
-}
-function normalizeRootRelativeScriptURL(name, v) {
-    if (typeof v !== "string")
-        throw new Error(`${name} must be a string`);
-    const s = v.trim();
-    if (s === "")
-        throw new Error(`${name} must be non-empty`);
-    if (s !== v)
-        throw new Error(`${name} must not contain leading or trailing whitespace`);
-    if (!s.startsWith("/"))
-        throw new Error(`${name} must start with "/"`);
-    if (s.startsWith("//"))
-        throw new Error(`${name} must not start with "//"`);
-    if (s.includes("://"))
-        throw new Error(`${name} must not include scheme/host`);
-    if (s.includes("\\"))
-        throw new Error(`${name} must not contain backslash`);
-    if (/[\s\u0000-\u001f\u007f]/.test(s))
-        throw new Error(`${name} must not contain whitespace or control characters`);
-    if (/[<>"'`]/.test(s))
-        throw new Error(`${name} must not contain HTML attribute delimiters`);
-    return s;
-}
-function normalizePathList(name, input) {
-    const out = [];
-    if (input == null || input.length === 0)
-        return out;
-    for (const raw of input) {
-        const s = normalizePathPrefix(name, raw);
-        if (s === "")
-            continue;
-        out.push(s);
-    }
-    return Array.from(new Set(out));
-}
-function normalizeMessageTypeList(name, input) {
-    const out = [];
-    if (input == null || input.length === 0)
-        return out;
-    for (const raw of input) {
-        const s = typeof raw === "string" ? raw.trim() : "";
-        if (s === "")
-            continue;
-        if (/[\r\n]/.test(s))
-            throw new Error(`${name} must not contain newline`);
-        out.push(s);
-    }
-    return Array.from(new Set(out));
-}
-function normalizeOptionalToken(name, input) {
-    if (input == null)
-        return "";
-    const s = String(input);
-    if (s === "")
-        return "";
-    if (s.trim() !== s)
-        throw new Error(`${name} must not contain leading or trailing whitespace`);
-    if (/[\s\u0000-\u001f\u007f]/.test(s))
-        throw new Error(`${name} must not contain whitespace or control characters`);
-    return s;
-}
-const defaultMaxInjectHTMLBytes = 2 * 1024 * 1024;
-function normalizeMaxBytes(name, v, defaultValue) {
-    if (v == null)
-        return defaultValue;
-    if (typeof v !== "number" || !Number.isFinite(v))
-        throw new Error(`${name} must be a finite number`);
-    const n = Math.floor(v);
-    if (!Number.isSafeInteger(n))
-        throw new Error(`${name} must be a safe integer`);
-    if (n < 0)
-        throw new Error(`${name} must be >= 0`);
-    if (n === 0)
-        return defaultValue;
-    return n;
-}
-// createProxyServiceWorkerScript returns a Service Worker script that forwards fetches to a runtime
-// in a controlled window via postMessage + MessageChannel.
-//
-// The runtime side is implemented by createProxyRuntime(...) in this package.
-export function createProxyServiceWorkerScript(opts = {}) {
-    const sameOriginOnly = opts.sameOriginOnly ?? true;
-    if (typeof sameOriginOnly !== "boolean") {
-        throw new Error("sameOriginOnly must be a boolean");
-    }
-    const maxRequestBodyBytes = normalizeMaxBytes("maxRequestBodyBytes", opts.maxRequestBodyBytes, DEFAULT_MAX_BODY_BYTES);
-    const maxInjectHTMLBytes = normalizeMaxBytes("maxInjectHTMLBytes", opts.maxInjectHTMLBytes, defaultMaxInjectHTMLBytes);
-    const proxyPathPrefix = normalizePathPrefix("proxyPathPrefix", opts.proxyPathPrefix);
-    const stripProxyPathPrefix = opts.stripProxyPathPrefix ?? false;
-    if (typeof stripProxyPathPrefix !== "boolean") {
-        throw new Error("stripProxyPathPrefix must be a boolean");
-    }
-    const passthroughPaths = normalizePathList("passthrough.paths", opts.passthrough?.paths);
-    const passthroughPrefixes = normalizePathList("passthrough.prefixes", opts.passthrough?.prefixes);
-    const forwardFetchMessageTypes = normalizeMessageTypeList("forwardFetchMessageTypes", opts.forwardFetchMessageTypes);
-    const keepScriptPathSuffixes = normalizePathList("conflictHints.keepScriptPathSuffixes", opts.conflictHints?.keepScriptPathSuffixes);
-    const windowTarget = opts.windowTarget ?? "registered_runtime";
-    if (windowTarget !== "registered_runtime" && windowTarget !== "request_client") {
-        throw new Error('windowTarget must be either "registered_runtime" or "request_client"');
-    }
-    const windowClientMessageType = (() => {
-        const normalized = typeof opts.windowClientMessageType === "string" ? opts.windowClientMessageType.trim() : "flowersec-proxy:fetch";
-        if (normalized === "")
-            throw new Error("windowClientMessageType must be non-empty");
-        if (/[\r\n]/.test(normalized))
-            throw new Error("windowClientMessageType must not contain newline");
-        return normalized;
-    })();
-    const runtimeRegistrationToken = normalizeOptionalToken("runtimeRegistrationToken", opts.runtimeRegistrationToken);
-    const runtimeClientPathPrefix = normalizePathPrefix("runtimeClientPathPrefix", opts.runtimeClientPathPrefix);
-    const injectHTML = opts.injectHTML ?? null;
-    // Injection mode defaults to inline_module when injectHTML is provided.
-    const injectMode = injectHTML?.mode ?? "inline_module";
-    const runtimeGlobal = injectHTML != null ? (injectHTML.runtimeGlobal?.trim() ?? "__flowersecProxyRuntime") : "__flowersecProxyRuntime";
-    if (injectHTML != null && runtimeGlobal === "") {
-        throw new Error("injectHTML.runtimeGlobal must be non-empty");
-    }
-    const excludeInjectPrefixes = normalizePathList("injectHTML.excludePathPrefixes", injectHTML?.excludePathPrefixes);
-    const stripValidatorHeaders = injectHTML?.stripValidatorHeaders ?? true;
-    if (typeof stripValidatorHeaders !== "boolean") {
-        throw new Error("injectHTML.stripValidatorHeaders must be a boolean");
-    }
-    const setNoStore = injectHTML?.setNoStore ?? true;
-    if (typeof setNoStore !== "boolean") {
-        throw new Error("injectHTML.setNoStore must be a boolean");
-    }
-    let proxyModuleUrl = "";
-    let injectScriptUrl = "";
-    if (injectHTML != null) {
-        if (injectMode === "inline_module") {
-            // Note: union type guarantees proxyModuleUrl exists, but keep a runtime check for JS callers.
-            proxyModuleUrl =
-                "proxyModuleUrl" in injectHTML && typeof injectHTML.proxyModuleUrl === "string"
-                    ? injectHTML.proxyModuleUrl.trim()
-                    : "";
-            if (proxyModuleUrl === "") {
-                throw new Error("injectHTML.proxyModuleUrl must be non-empty");
-            }
+function strings(name, values, max = 64) {
+    if ((values?.length ?? 0) > max)
+        throw new TypeError(`${name} contains too many entries`);
+    const result = [];
+    for (const raw of values ?? []) {
+        if (typeof raw !== "string" || raw === "" || raw !== raw.trim() || /[\u0000-\u001f\u007f]/u.test(raw)) {
+            throw new TypeError(`${name} contains an invalid entry`);
         }
-        else {
-            if (!("scriptUrl" in injectHTML))
-                throw new Error("injectHTML.scriptUrl must be non-empty");
-            injectScriptUrl = normalizeRootRelativeScriptURL("injectHTML.scriptUrl", injectHTML.scriptUrl);
-        }
-    }
-    return `// Generated by @floegence/flowersec-core/proxy
-const SAME_ORIGIN_ONLY = ${JSON.stringify(sameOriginOnly)};
-const PROXY_PATH_PREFIX = ${JSON.stringify(proxyPathPrefix)};
-const STRIP_PROXY_PATH_PREFIX = ${JSON.stringify(stripProxyPathPrefix)};
-
-const PASSTHROUGH_PATHS = new Set(${JSON.stringify(passthroughPaths)});
-const PASSTHROUGH_PREFIXES = ${JSON.stringify(passthroughPrefixes)};
-
-const INJECT_HTML = ${JSON.stringify(injectHTML != null)};
-const INJECT_MODE = ${JSON.stringify(injectMode)};
-const PROXY_MODULE_URL = ${JSON.stringify(proxyModuleUrl)};
-const INJECT_SCRIPT_URL = ${JSON.stringify(injectScriptUrl)};
-const RUNTIME_GLOBAL = ${JSON.stringify(runtimeGlobal)};
-const INJECT_EXCLUDE_PREFIXES = ${JSON.stringify(excludeInjectPrefixes)};
-const INJECT_STRIP_VALIDATOR_HEADERS = ${JSON.stringify(stripValidatorHeaders)};
-const INJECT_SET_NO_STORE = ${JSON.stringify(setNoStore)};
-
-const MAX_REQUEST_BODY_BYTES = ${JSON.stringify(maxRequestBodyBytes)};
-const MAX_INJECT_HTML_BYTES = ${JSON.stringify(maxInjectHTMLBytes)};
-const FORWARD_FETCH_MESSAGE_TYPES = new Set(${JSON.stringify(forwardFetchMessageTypes)});
-const WINDOW_TARGET = ${JSON.stringify(windowTarget)};
-const WINDOW_CLIENT_MESSAGE_TYPE = ${JSON.stringify(windowClientMessageType)};
-const RUNTIME_REGISTRATION_TOKEN = ${JSON.stringify(runtimeRegistrationToken)};
-const RUNTIME_CLIENT_PATH_PREFIX = ${JSON.stringify(runtimeClientPathPrefix)};
-const CONFLICT_HINT_KEEP_SCRIPT_SUFFIXES = ${JSON.stringify(keepScriptPathSuffixes)};
-
-const INJECT_STRIP_HEADER_NAMES = new Set(["content-length", "etag", "last-modified", "content-md5"]);
-
-let runtimeClientId = null;
-
-self.addEventListener("install", (event) => {
-  // Take over as soon as possible.
-  event.waitUntil(self.skipWaiting());
-});
-
-self.addEventListener("activate", (event) => {
-  runtimeClientId = null;
-  event.waitUntil(self.clients.claim());
-});
-
-self.addEventListener("message", (event) => {
-  const data = event.data;
-  if (!data || typeof data !== "object") return;
-  const msgType = typeof data.type === "string" ? data.type : "";
-  if (msgType === "flowersec-proxy:register-runtime") {
-    event.waitUntil((async () => {
-      const sourceId = event.source && typeof event.source.id === "string" ? event.source.id : "";
-      let ok = sourceId !== "";
-      if (ok && RUNTIME_REGISTRATION_TOKEN) {
-        ok = typeof data.token === "string" && data.token === RUNTIME_REGISTRATION_TOKEN;
-      }
-      if (ok && RUNTIME_CLIENT_PATH_PREFIX) {
-        const c = await self.clients.get(sourceId);
-        if (!c || typeof c.url !== "string") {
-          ok = false;
-        } else {
-          try {
-            const u = new URL(c.url);
-            ok = u.origin === self.location.origin && u.pathname.startsWith(RUNTIME_CLIENT_PATH_PREFIX);
-          } catch {
-            ok = false;
-          }
+        if (!result.includes(raw))
+            result.push(raw);
+    }
+    return Object.freeze(result);
+}
+function bounded(name, value, fallback, maximum) {
+    const result = value ?? fallback;
+    if (!Number.isSafeInteger(result) || result <= 0 || result > maximum)
+        throw new TypeError(`${name} is invalid`);
+    return result;
+}
+function token(name, value, fallback = "") {
+    const result = value ?? fallback;
+    if (result !== result.trim() || /[\u0000-\u0020\u007f]/u.test(result) || result.length > 512)
+        throw new TypeError(`${name} is invalid`);
+    return result;
+}
+function normalizeOptions(options) {
+    const proxyPathPrefix = token("proxyPathPrefix", options.proxyPathPrefix, "");
+    if (proxyPathPrefix !== "" && (!proxyPathPrefix.startsWith("/") || proxyPathPrefix.startsWith("//"))) {
+        throw new TypeError("proxyPathPrefix must be an origin-relative prefix");
+    }
+    const inject = options.injectHTML;
+    if (inject !== undefined) {
+        const mode = inject.mode ?? "inline_module";
+        if (mode === "inline_module" && token("injectHTML.proxyModuleUrl", inject.proxyModuleUrl) === "") {
+            throw new TypeError("inline HTML injection requires proxyModuleUrl");
         }
-      }
-      if (ok && runtimeClientId && runtimeClientId !== sourceId) {
-        const existing = await self.clients.get(runtimeClientId);
-        if (existing) {
-          ok = false;
-        } else {
-          runtimeClientId = null;
+        if (mode !== "inline_module" && token("injectHTML.scriptUrl", inject.scriptUrl) === "") {
+            throw new TypeError("external HTML injection requires scriptUrl");
         }
-      }
-      if (ok) runtimeClientId = sourceId;
-      const port = event.ports && event.ports[0];
-      if (port) {
-        try { port.postMessage({ type: "flowersec-proxy:register-runtime-ack", ok }); } catch {}
-        try { port.close(); } catch {}
-      }
-    })());
-    return;
-  }
-  if (!FORWARD_FETCH_MESSAGE_TYPES.has(msgType)) return;
-
-  const port = event.ports && event.ports[0];
-  if (!port) return;
-
-  event.waitUntil((async () => {
-    const preferredClientId =
-      WINDOW_TARGET === "request_client" && event.source && typeof event.source.id === "string"
-        ? event.source.id
-        : "";
-    const target = await getWindowClient(preferredClientId);
-    if (!target) {
-      try { port.postMessage({ type: "flowersec-proxy:response_error", status: 503, message: "flowersec-proxy target window not available" }); } catch {}
-      try { port.close(); } catch {}
-      return;
     }
-
-    try {
-      target.postMessage({ type: WINDOW_CLIENT_MESSAGE_TYPE, req: data.req }, [port]);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      try { port.postMessage({ type: "flowersec-proxy:response_error", status: 502, message: msg }); } catch {}
-      try { port.close(); } catch {}
-    }
-  })());
-});
-
-async function getWindowClient(preferredClientId) {
-  if (WINDOW_TARGET === "request_client") {
-    if (preferredClientId) {
-      const c = await self.clients.get(preferredClientId);
-      if (c) return c;
-    }
-    const cs = await self.clients.matchAll({ type: "window", includeUncontrolled: true });
-    return cs.length > 0 ? cs[0] : null;
-  }
-
-  if (!runtimeClientId) return null;
-  const c = await self.clients.get(runtimeClientId);
-  if (c) return c;
-  runtimeClientId = null;
-  return null;
-}
-
-function shouldPassthrough(pathname) {
-  if (PASSTHROUGH_PATHS.has(pathname)) return true;
-  for (const p of PASSTHROUGH_PREFIXES) {
-    if (pathname.startsWith(p)) return true;
-  }
-  return false;
-}
-
-function shouldSkipInject(pathname) {
-  for (const p of INJECT_EXCLUDE_PREFIXES) {
-    if (pathname.startsWith(p)) return true;
-  }
-  return false;
-}
-
-function headersToPairs(headers) {
-  const out = [];
-  headers.forEach((value, name) => out.push({ name, value }));
-  return out;
-}
-
-function concatChunks(chunks) {
-  let total = 0;
-  for (const c of chunks) total += c.length;
-  const out = new Uint8Array(total);
-  let off = 0;
-  for (const c of chunks) {
-    out.set(c, off);
-    off += c.length;
-  }
-  return out;
-}
-
-function makeError(status, message) {
-  const s = Math.max(0, Math.floor(status));
-  const e = new Error(String(message || "proxy error"));
-  e.status = s > 0 ? s : 502;
-  return e;
-}
-
-function getErrorStatus(err, fallback) {
-  const raw =
-    err && typeof err === "object" && typeof err.status === "number" && Number.isFinite(err.status)
-      ? Math.floor(err.status)
-      : fallback;
-  return raw > 0 ? raw : 502;
-}
-
-async function readRequestBody(req) {
-  const clRaw = req.headers.get("content-length");
-  const cl = clRaw ? Number(clRaw) : 0;
-  if (MAX_REQUEST_BODY_BYTES > 0 && Number.isFinite(cl) && cl > MAX_REQUEST_BODY_BYTES) {
-    throw makeError(413, "request body too large");
-  }
-
-  // Prefer streaming reads so we can enforce MAX_REQUEST_BODY_BYTES without allocating unbounded buffers.
-  if (!req.body) {
-    const ab = await req.arrayBuffer();
-    if (MAX_REQUEST_BODY_BYTES > 0 && ab.byteLength > MAX_REQUEST_BODY_BYTES) {
-      throw makeError(413, "request body too large");
-    }
-    return ab;
-  }
-
-  const reader = req.body.getReader();
-  const chunks = [];
-  let total = 0;
-  while (true) {
-    const r = await reader.read();
-    if (r.done) break;
-    const b = r.value;
-    total += b.length;
-    if (MAX_REQUEST_BODY_BYTES > 0 && total > MAX_REQUEST_BODY_BYTES) {
-      try { reader.cancel(); } catch {}
-      throw makeError(413, "request body too large");
-    }
-    chunks.push(b);
-  }
-  return concatChunks(chunks).buffer;
-}
-
-function injectBootstrap(html) {
-  let snippet = "";
-
-  if (INJECT_MODE === "inline_module") {
-    snippet =
-      '<script type="module">' +
-      'import { installWebSocketPatch, disableUpstreamServiceWorkerRegister } from ' + JSON.stringify(PROXY_MODULE_URL) + ';' +
-      'const rt = window.top && window.top[' + JSON.stringify(RUNTIME_GLOBAL) + '];' +
-      'if (rt) { disableUpstreamServiceWorkerRegister(); installWebSocketPatch({ runtime: rt }); }' +
-      '</script>';
-  } else if (INJECT_MODE === "external_module") {
-    snippet =
-      '<script type="module" src="' +
-      escapeHTMLAttributeValue(INJECT_SCRIPT_URL) +
-      '"' +
-      (RUNTIME_GLOBAL ? ' data-flowersec-runtime-global="' + escapeHTMLAttributeValue(RUNTIME_GLOBAL) + '"' : "") +
-      "></script>";
-  } else if (INJECT_MODE === "external_script") {
-    snippet =
-      '<script src="' +
-      escapeHTMLAttributeValue(INJECT_SCRIPT_URL) +
-      '"' +
-      (RUNTIME_GLOBAL ? ' data-flowersec-runtime-global="' + escapeHTMLAttributeValue(RUNTIME_GLOBAL) + '"' : "") +
-      "></script>";
-  }
-
-  const lower = html.toLowerCase();
-  const closeHead = lower.indexOf("</head>");
-  if (closeHead >= 0) {
-    return html.slice(0, closeHead) + snippet + html.slice(closeHead);
-  }
-  const idx = lower.indexOf("<head");
-  if (idx >= 0) {
-    const end = html.indexOf(">", idx);
-    if (end >= 0) return html.slice(0, end + 1) + snippet + html.slice(end + 1);
-  }
-  return snippet + html;
-}
-
-function escapeHTMLAttributeValue(value) {
-  return String(value).replace(/[&<>"'\`=]/g, (ch) => {
-    switch (ch) {
-      case "&": return "&amp;";
-      case "<": return "&lt;";
-      case ">": return "&gt;";
-      case '"': return "&quot;";
-      case "'": return "&#39;";
-      case "\`": return "&#96;";
-      case "=": return "&#61;";
-      default: return ch;
-    }
-  });
-}
-
-self.addEventListener("fetch", (event) => {
-  const url = new URL(event.request.url);
-
-  // Only proxy same-origin requests by default. The runtime proxy protocol forwards path+query only.
-  if (SAME_ORIGIN_ONLY && url.origin !== self.location.origin) return;
-
-  if (PROXY_PATH_PREFIX && !url.pathname.startsWith(PROXY_PATH_PREFIX)) return;
-  if (shouldPassthrough(url.pathname)) return;
-
-  event.respondWith(handleFetch(event));
-});
-
-async function handleFetch(event) {
-  let lastErrorStatus = 502;
-  let lastErrorMessage = "proxy error";
-
-  try {
-    const preferredClientId =
-      WINDOW_TARGET === "request_client"
-        ? String(event.clientId || event.resultingClientId || "")
-        : "";
-    const target = await getWindowClient(preferredClientId);
-    if (!target) return new Response("flowersec-proxy target window not available", { status: 503 });
-
-    const req = event.request;
-    const url = new URL(req.url);
-    const id = Math.random().toString(16).slice(2) + Date.now().toString(16);
-    const externalOrigin = url.origin === self.location.origin ? url.origin : "";
-
-    let body;
-    if (req.method === "GET" || req.method === "HEAD") {
-      body = undefined;
-    } else {
-      body = await readRequestBody(req);
-    }
-
-    const ch = new MessageChannel();
-    const port = ch.port1;
-    const port2 = ch.port2;
-
-    let metaResolve;
-    let metaReject;
-    const metaPromise = new Promise((resolve, reject) => { metaResolve = resolve; metaReject = reject; });
-
-    const queued = [];
-    const htmlChunks = [];
-    let htmlBytes = 0;
-    let shouldInjectHTML = false;
-    const injectAllowed = INJECT_HTML && !shouldSkipInject(url.pathname);
-
-    let doneResolve;
-    let doneReject;
-    const donePromise = new Promise((resolve, reject) => { doneResolve = resolve; doneReject = reject; });
-
-    let controller = null;
-    let responseCreditOutstanding = false;
-
-    function requestResponseCredit() {
-      if (responseCreditOutstanding) return;
-      responseCreditOutstanding = true;
-      try { port.postMessage({ type: "flowersec-proxy:response_credit" }); } catch {}
-    }
-
-    function abortRuntimeResponse() {
-      responseCreditOutstanding = false;
-      try { port.postMessage({ type: "flowersec-proxy:abort" }); } catch {}
-      try { port.close(); } catch {}
-    }
-
-    const stream = new ReadableStream({
-      start(c) { controller = c; },
-      pull() { requestResponseCredit(); },
-      cancel() {
-        abortRuntimeResponse();
-      }
+    return Object.freeze({
+        sameOriginOnly: options.sameOriginOnly ?? true,
+        maxRequestBodyBytes: bounded("maxRequestBodyBytes", options.maxRequestBodyBytes, 64 * 1024 * 1024, 256 * 1024 * 1024),
+        maxInjectHTMLBytes: bounded("maxInjectHTMLBytes", options.maxInjectHTMLBytes, 8 * 1024 * 1024, 32 * 1024 * 1024),
+        passthroughPaths: strings("passthrough.paths", options.passthrough?.paths),
+        passthroughPrefixes: strings("passthrough.prefixes", options.passthrough?.prefixes),
+        proxyPathPrefix,
+        stripProxyPathPrefix: options.stripProxyPathPrefix ?? false,
+        injectHTML: inject === undefined ? null : Object.freeze({
+            ...inject,
+            mode: inject.mode ?? "inline_module",
+            excludePathPrefixes: strings("injectHTML.excludePathPrefixes", inject.excludePathPrefixes),
+        }),
+        forwardFetchMessageTypes: strings("forwardFetchMessageTypes", options.forwardFetchMessageTypes),
+        windowTarget: options.windowTarget ?? "registered_runtime",
+        windowClientMessageType: token("windowClientMessageType", options.windowClientMessageType, "flowersec-proxy:fetch"),
+        runtimeRegistrationToken: token("runtimeRegistrationToken", options.runtimeRegistrationToken),
+        runtimeClientPathPrefix: token("runtimeClientPathPrefix", options.runtimeClientPathPrefix),
+        conflictHints: strings("conflictHints.keepScriptPathSuffixes", options.conflictHints?.keepScriptPathSuffixes),
     });
-
-    function pushInjectChunk(b) {
-      htmlBytes += b.length;
-      if (MAX_INJECT_HTML_BYTES > 0 && htmlBytes > MAX_INJECT_HTML_BYTES) {
-        const err = makeError(502, "html response too large to inject");
-        lastErrorStatus = err.status;
-        lastErrorMessage = err.message;
-        metaReject(err);
-        doneReject(err);
-        controller?.error(err);
-        abortRuntimeResponse();
-        return false;
-      }
-      htmlChunks.push(b);
-      return true;
-    }
-
-    port.onmessage = (ev) => {
-      const m = ev.data;
-      if (!m || typeof m.type !== "string") return;
-      if (m.type === "flowersec-proxy:response_meta") {
-        if (injectAllowed) {
-          const ct = String((m.headers || []).find((h) => (h.name || "").toLowerCase() === "content-type")?.value || "");
-          shouldInjectHTML = ct.toLowerCase().includes("text/html");
-
-          if (shouldInjectHTML && MAX_INJECT_HTML_BYTES > 0) {
-            const cl = Number(
-              String((m.headers || []).find((h) => (h.name || "").toLowerCase() === "content-length")?.value || "")
-            );
-            if (Number.isFinite(cl) && cl > MAX_INJECT_HTML_BYTES) {
-              const err = makeError(502, "html response too large to inject");
-              lastErrorStatus = err.status;
-              lastErrorMessage = err.message;
-              metaReject(err);
-              doneReject(err);
-              controller?.error(err);
-              abortRuntimeResponse();
-              return;
+}
+function serviceWorkerMain(config) {
+    const worker = self;
+    let runtimeClientId = "";
+    const pathMatches = (path, values) => values.some((value) => path.startsWith(value));
+    const safeMessage = (error) => error instanceof Error && error.name === "AbortError"
+        ? "proxy request canceled"
+        : "proxy request failed";
+    worker.addEventListener("install", (event) => event.waitUntil(worker.skipWaiting()));
+    worker.addEventListener("activate", (event) => event.waitUntil(worker.clients.claim()));
+    worker.addEventListener("message", (event) => {
+        const data = event.data;
+        if (data === null || typeof data !== "object")
+            return;
+        if (data.type === "flowersec-proxy:register-runtime") {
+            const port = event.ports[0];
+            const source = event.source;
+            let ok = data.version === 2 && source !== null;
+            if (config.runtimeRegistrationToken !== "")
+                ok = ok && data.token === config.runtimeRegistrationToken;
+            if (ok && config.runtimeClientPathPrefix !== "") {
+                try {
+                    ok = new URL(source.url).pathname.startsWith(config.runtimeClientPathPrefix);
+                }
+                catch {
+                    ok = false;
+                }
             }
-          }
-        }
-        metaResolve(m);
-        if (shouldInjectHTML) requestResponseCredit();
-        if (controller && !shouldInjectHTML) for (const q of queued) controller.enqueue(q);
-        if (shouldInjectHTML) for (const q of queued) if (!pushInjectChunk(q)) return;
-        queued.length = 0;
-        return;
-      }
-      if (m.type === "flowersec-proxy:response_chunk") {
-        responseCreditOutstanding = false;
-        const b = new Uint8Array(m.data);
-        if (shouldInjectHTML) {
-          if (pushInjectChunk(b)) requestResponseCredit();
-          return;
-        }
-        if (controller) controller.enqueue(b); else queued.push(b);
-        return;
-      }
-      if (m.type === "flowersec-proxy:response_end") {
-        responseCreditOutstanding = false;
-        if (shouldInjectHTML) {
-          doneResolve(htmlChunks);
-          return;
+            if (ok)
+                runtimeClientId = source.id;
+            port?.postMessage({ type: "flowersec-proxy:register-runtime-ack", ok });
+            port?.close();
+            return;
         }
-        controller?.close();
-        return;
-      }
-      if (m.type === "flowersec-proxy:response_error") {
-        responseCreditOutstanding = false;
-        const status = typeof m.status === "number" && Number.isFinite(m.status) ? Math.floor(m.status) : 502;
-        lastErrorStatus = status > 0 ? status : 502;
-        lastErrorMessage = String(m.message || "proxy error");
-        const err = makeError(lastErrorStatus, lastErrorMessage);
-        metaReject(err);
-        doneReject(err);
-        controller?.error(err);
-        try { port.close(); } catch {}
-        return;
-      }
-    };
-
-    let path = url.pathname + url.search;
-    if (PROXY_PATH_PREFIX && STRIP_PROXY_PATH_PREFIX) {
-      let rest = url.pathname.slice(PROXY_PATH_PREFIX.length);
-      if (rest.startsWith("/")) rest = rest.slice(1);
-      path = "/" + rest + url.search;
-    }
-
-    target.postMessage({
-      type: WINDOW_CLIENT_MESSAGE_TYPE,
-      req: {
-        id,
-        method: req.method,
-        path,
-        headers: headersToPairs(req.headers),
-        ...(externalOrigin ? { external_origin: externalOrigin } : {}),
-        response_flow_control: "chunk_credit_v1",
-        body
-      }
-    }, [port2]);
-
-    const meta = await metaPromise;
-    const headers = new Headers();
-    for (const h of (meta.headers || [])) {
-      const name = String(h.name || "");
-      const lower = name.toLowerCase();
-      if (shouldInjectHTML && INJECT_STRIP_VALIDATOR_HEADERS && INJECT_STRIP_HEADER_NAMES.has(lower)) continue;
-      headers.append(name, String(h.value || ""));
-    }
-
-    if (shouldInjectHTML && INJECT_SET_NO_STORE && !headers.has("Cache-Control")) {
-      headers.set("Cache-Control", "no-store");
-    }
-
-    if (shouldInjectHTML) {
-      const chunks = await donePromise;
-      const raw = concatChunks(chunks);
-      const html = new TextDecoder().decode(raw);
-      const injected = injectBootstrap(html);
-      return new Response(new TextEncoder().encode(injected), { status: meta.status || 502, headers });
-    }
-
-    return new Response(stream, { status: meta.status || 502, headers });
-  } catch (err) {
-    const status = getErrorStatus(err, lastErrorStatus);
-    const msg = err instanceof Error ? err.message : String(err);
-    return new Response(msg || lastErrorMessage || "flowersec-proxy error", { status });
-  }
+        if (!config.forwardFetchMessageTypes.includes(String(data.type ?? "")))
+            return;
+        event.waitUntil((async () => {
+            const target = runtimeClientId === "" ? null : await worker.clients.get(runtimeClientId);
+            target?.postMessage(data, event.ports);
+        })());
+    });
+    worker.addEventListener("fetch", (event) => {
+        event.respondWith((async () => {
+            const request = event.request;
+            const url = new URL(request.url);
+            if (config.sameOriginOnly && url.origin !== worker.location.origin)
+                return await fetch(request);
+            if (config.passthroughPaths.includes(url.pathname) || pathMatches(url.pathname, config.passthroughPrefixes)) {
+                return await fetch(request);
+            }
+            let path = url.pathname + url.search;
+            if (config.proxyPathPrefix !== "") {
+                if (!url.pathname.startsWith(config.proxyPathPrefix))
+                    return await fetch(request);
+                if (config.stripProxyPathPrefix) {
+                    const stripped = url.pathname.slice(config.proxyPathPrefix.length);
+                    path = (stripped.startsWith("/") ? stripped : `/${stripped}`) + url.search;
+                }
+            }
+            const source = event.clientId === "" ? null : await worker.clients.get(event.clientId);
+            const target = config.windowTarget === "request_client"
+                ? source
+                : runtimeClientId === "" ? null : await worker.clients.get(runtimeClientId);
+            if (target === null)
+                return new Response("proxy runtime unavailable", { status: 503 });
+            let body;
+            if (request.method !== "GET" && request.method !== "HEAD") {
+                const requestBody = await request.clone().arrayBuffer();
+                if (requestBody.byteLength > config.maxRequestBodyBytes)
+                    return new Response("proxy request too large", { status: 413 });
+                body = requestBody;
+            }
+            const channel = new MessageChannel();
+            const response = await new Promise((resolve) => {
+                let metadata = null;
+                let controller = null;
+                let finished = false;
+                const finishError = (status, message) => {
+                    if (finished)
+                        return;
+                    finished = true;
+                    if (controller !== null)
+                        controller.error(new Error(message));
+                    else
+                        resolve(new Response(message, { status }));
+                    channel.port1.close();
+                };
+                channel.port1.onmessage = (message) => {
+                    const value = message.data;
+                    if (value === null || typeof value !== "object" || finished)
+                        return;
+                    if (value.type === "flowersec-proxy:response_meta") {
+                        if (!Number.isInteger(value.status) || metadata !== null)
+                            return finishError(502, "invalid proxy response");
+                        const headers = new Headers();
+                        if (Array.isArray(value.headers))
+                            for (const entry of value.headers) {
+                                if (entry && typeof entry.name === "string" && typeof entry.value === "string")
+                                    headers.append(entry.name, entry.value);
+                            }
+                        metadata = { status: value.status, headers };
+                        const stream = new ReadableStream({
+                            start(valueController) {
+                                controller = valueController;
+                                channel.port1.postMessage({ type: "flowersec-proxy:response_credit" });
+                            },
+                            pull() { channel.port1.postMessage({ type: "flowersec-proxy:response_credit" }); },
+                            cancel() { channel.port1.postMessage({ type: "flowersec-proxy:abort" }); channel.port1.close(); },
+                        });
+                        resolve(new Response(stream, { status: metadata.status, headers: metadata.headers }));
+                        return;
+                    }
+                    if (value.type === "flowersec-proxy:response_chunk") {
+                        if (controller === null || !(value.data instanceof ArrayBuffer))
+                            return finishError(502, "invalid proxy response");
+                        controller.enqueue(new Uint8Array(value.data));
+                        return;
+                    }
+                    if (value.type === "flowersec-proxy:response_end") {
+                        finished = true;
+                        controller?.close();
+                        channel.port1.close();
+                        return;
+                    }
+                    if (value.type === "flowersec-proxy:response_error") {
+                        finishError(Number.isInteger(value.status) ? value.status : 502, typeof value.message === "string" ? value.message : "proxy request failed");
+                    }
+                };
+                channel.port1.onmessageerror = () => finishError(502, "proxy request failed");
+                const headers = Array.from(request.headers.entries()).map(([name, value]) => ({ name, value }));
+                target.postMessage({
+                    type: config.windowClientMessageType,
+                    req: {
+                        id: `${Date.now()}-${Math.random().toString(16).slice(2)}`,
+                        method: request.method,
+                        path,
+                        headers,
+                        response_flow_control: "chunk_credit_v2",
+                        ...(body === undefined ? {} : { body }),
+                    },
+                }, [channel.port2, ...(body === undefined ? [] : [body])]);
+            });
+            const injection = config.injectHTML;
+            if (injection === null || pathMatches(url.pathname, injection.excludePathPrefixes ?? []))
+                return response;
+            if (!(response.headers.get("content-type") ?? "").toLowerCase().includes("text/html"))
+                return response;
+            const bytes = await response.arrayBuffer();
+            if (bytes.byteLength > config.maxInjectHTMLBytes)
+                return new Response("proxy HTML response too large", { status: 502 });
+            const decoder = new TextDecoder();
+            let html = decoder.decode(bytes);
+            const runtimeGlobal = injection.runtimeGlobal ?? "__flowersecProxyRuntime";
+            let markup;
+            if ((injection.mode ?? "inline_module") === "inline_module") {
+                markup = `<script type="module">import { installWebSocketPatch, disableUpstreamServiceWorkerRegister } from ${JSON.stringify(injection.proxyModuleUrl)};const rt=globalThis[${JSON.stringify(runtimeGlobal)}];if(rt){disableUpstreamServiceWorkerRegister();installWebSocketPatch({runtime:rt});}</script>`;
+            }
+            else {
+                const module = injection.mode === "external_module" ? " type=\"module\"" : "";
+                markup = `<script${module} src=${JSON.stringify(injection.scriptUrl)} data-flowersec-runtime-global=${JSON.stringify(runtimeGlobal)}></script>`;
+            }
+            const location = html.search(/<\/head\s*>/iu);
+            html = location >= 0 ? `${html.slice(0, location)}${markup}${html.slice(location)}` : `${markup}${html}`;
+            const headers = new Headers(response.headers);
+            headers.delete("content-length");
+            if (injection.stripValidatorHeaders !== false) {
+                headers.delete("etag");
+                headers.delete("last-modified");
+            }
+            if (injection.setNoStore !== false)
+                headers.set("cache-control", "no-store");
+            return new Response(html, { status: response.status, statusText: response.statusText, headers });
+        })().catch((error) => new Response(safeMessage(error), { status: 502 })));
+    });
 }
-`;
+export function createProxyServiceWorkerScript(options = {}) {
+    const config = normalizeOptions(options);
+    return `// Generated by @floegence/flowersec-core/proxy v2\n(${serviceWorkerMain.toString()})(${JSON.stringify(config)});\n`;
 }