@floegence/flowersec-core 0.27.0 → 2.0.0

package/dist/controlplane/channelInit.js

@@ -1,116 +0,0 @@
-import { Role } from "../gen/flowersec/controlplane/v1.gen.js";
-import { base64urlEncode } from "../utils/base64url.js";
-export const CHANNEL_INIT_WINDOW_SECONDS = 120;
-export const DEFAULT_IDLE_TIMEOUT_SECONDS = 60;
-export const DEFAULT_TOKEN_EXP_SECONDS = 60;
-export class ChannelInitService {
-    issuer;
-    params;
-    nowUnixS;
-    constructor(issuer, params, nowUnixS = () => Math.floor(Date.now() / 1000)) {
-        this.issuer = issuer;
-        this.params = params;
-        this.nowUnixS = nowUnixS;
-    }
-    issue(channelIdInput) {
-        const params = normalizeParams(this.params);
-        const channelId = normalizeChannelId(channelIdInput);
-        const psk = crypto.getRandomValues(new Uint8Array(32));
-        let pskB64u;
-        try {
-            pskB64u = base64urlEncode(psk);
-        }
-        finally {
-            psk.fill(0);
-        }
-        const now = normalizeNow(this.nowUnixS());
-        const initExp = now + CHANNEL_INIT_WINDOW_SECONDS;
-        const grant = (role, token) => ({
-            tunnel_url: params.tunnelUrl,
-            channel_id: channelId,
-            channel_init_expire_at_unix_s: initExp,
-            idle_timeout_seconds: params.idleTimeoutSeconds,
-            role,
-            token,
-            e2ee_psk_b64u: pskB64u,
-            allowed_suites: [...params.allowedSuites],
-            default_suite: params.defaultSuite,
-        });
-        return {
-            client: grant(Role.Role_client, this.signRoleToken(channelId, Role.Role_client, initExp, params.idleTimeoutSeconds, params.tokenExpSeconds, now, params)),
-            server: grant(Role.Role_server, this.signRoleToken(channelId, Role.Role_server, initExp, params.idleTimeoutSeconds, params.tokenExpSeconds, now, params)),
-        };
-    }
-    reissue(grant) {
-        const params = normalizeParams(this.params);
-        if (grant.idle_timeout_seconds <= 0 || (grant.role !== Role.Role_client && grant.role !== Role.Role_server))
-            throw new Error("invalid grant");
-        const now = normalizeNow(this.nowUnixS());
-        const skewSeconds = Math.ceil(params.clockSkewMs / 1000);
-        if (now > grant.channel_init_expire_at_unix_s + skewSeconds)
-            throw new Error("channel init expired");
-        return {
-            ...grant,
-            token: this.signRoleToken(normalizeChannelId(grant.channel_id), grant.role, grant.channel_init_expire_at_unix_s, grant.idle_timeout_seconds, params.tokenExpSeconds, now, params),
-        };
-    }
-    signRoleToken(channelId, role, initExp, idleTimeoutSeconds, tokenExpSeconds, now, params) {
-        const iat = Math.min(now, initExp);
-        const exp = Math.min(initExp, iat + tokenExpSeconds);
-        const tokenId = crypto.getRandomValues(new Uint8Array(24));
-        try {
-            return this.issuer.sign({
-                aud: params.tunnelAudience,
-                iss: params.issuerId,
-                channel_id: channelId,
-                role: role,
-                token_id: base64urlEncode(tokenId),
-                init_exp: initExp,
-                idle_timeout_seconds: idleTimeoutSeconds,
-                iat,
-                exp,
-            });
-        }
-        finally {
-            tokenId.fill(0);
-        }
-    }
-}
-function normalizeParams(params) {
-    const tunnelUrl = params.tunnelUrl.trim();
-    const tunnelAudience = params.tunnelAudience.trim();
-    const issuerId = params.issuerId.trim();
-    if (tunnelUrl === "")
-        throw new Error("missing tunnel URL");
-    if (tunnelAudience === "")
-        throw new Error("missing tunnel audience");
-    if (issuerId === "")
-        throw new Error("missing issuer ID");
-    const tokenExpSeconds = normalizeNonNegative("tokenExpSeconds", params.tokenExpSeconds ?? 0) || DEFAULT_TOKEN_EXP_SECONDS;
-    const idleTimeoutSeconds = normalizeNonNegative("idleTimeoutSeconds", params.idleTimeoutSeconds ?? 0) || DEFAULT_IDLE_TIMEOUT_SECONDS;
-    const clockSkewMs = normalizeNonNegative("clockSkewMs", params.clockSkewMs ?? 0);
-    const allowedSuites = [...new Set(params.allowedSuites?.length ? params.allowedSuites : [1])];
-    for (const suite of allowedSuites)
-        if (suite !== 1 && suite !== 2)
-            throw new Error("unsupported suite");
-    const defaultSuite = params.defaultSuite ?? allowedSuites[0];
-    if (!allowedSuites.includes(defaultSuite))
-        throw new Error("default suite not allowed");
-    return { tunnelUrl, tunnelAudience, issuerId, tokenExpSeconds, idleTimeoutSeconds, clockSkewMs, allowedSuites, defaultSuite };
-}
-function normalizeChannelId(input) {
-    const value = input.trim();
-    if (value === "" || new TextEncoder().encode(value).length > 256)
-        throw new Error("invalid channel ID");
-    return value;
-}
-function normalizeNonNegative(name, value) {
-    if (!Number.isSafeInteger(value) || value < 0)
-        throw new Error(`${name} must be a non-negative integer`);
-    return value;
-}
-function normalizeNow(value) {
-    if (!Number.isSafeInteger(value) || value <= 0)
-        throw new Error("invalid clock");
-    return value;
-}

package/dist/controlplane/http.d.ts

@@ -1,16 +0,0 @@
-export type ArtifactRequest = Readonly<{
-    endpoint_id: string;
-    payload?: Record<string, unknown>;
-    correlation?: Readonly<{
-        trace_id?: string;
-    }>;
-}>;
-export declare class ControlplaneCodecError extends Error {
-    readonly status: number;
-    readonly code: string;
-    constructor(status: number, code: string, message: string);
-}
-export declare function decodeArtifactRequest(contentType: string, body: Uint8Array, maxBodyBytes?: number): ArtifactRequest;
-export declare function encodeArtifactEnvelope(artifact: unknown): Uint8Array;
-export declare function encodeControlplaneError(code: string, message: string): Uint8Array;
-export declare function bearerToken(authorization: string): string | undefined;

package/dist/controlplane/http.js

@@ -1,59 +0,0 @@
-import { assertConnectArtifact } from "../connect/artifact.js";
-import { SDK_DEFAULTS } from "../defaults.js";
-export class ControlplaneCodecError extends Error {
-    status;
-    code;
-    constructor(status, code, message) {
-        super(message);
-        this.status = status;
-        this.code = code;
-        this.name = "ControlplaneCodecError";
-    }
-}
-export function decodeArtifactRequest(contentType, body, maxBodyBytes = SDK_DEFAULTS.controlplane.maxRequestBodyBytes) {
-    if (contentType.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") {
-        throw new ControlplaneCodecError(415, "unsupported_media_type", "content type must be application/json");
-    }
-    if (body.length > maxBodyBytes)
-        throw new ControlplaneCodecError(413, "body_too_large", `request body exceeds ${maxBodyBytes} bytes`);
-    let value;
-    try {
-        value = JSON.parse(new TextDecoder().decode(body));
-    }
-    catch {
-        throw new ControlplaneCodecError(400, "invalid_json", "malformed JSON request body");
-    }
-    if (typeof value !== "object" || value == null || Array.isArray(value))
-        throw new ControlplaneCodecError(400, "invalid_json", "request body must be a JSON object");
-    const input = value;
-    const endpointId = typeof input["endpoint_id"] === "string" ? input["endpoint_id"].trim() : "";
-    if (endpointId === "")
-        throw new ControlplaneCodecError(400, "invalid_request", "bad endpoint_id");
-    const payload = input["payload"];
-    if (payload !== undefined && (typeof payload !== "object" || payload == null || Array.isArray(payload)))
-        throw new ControlplaneCodecError(400, "invalid_request", "bad payload");
-    const correlation = input["correlation"];
-    if (correlation !== undefined && (typeof correlation !== "object" || correlation == null || Array.isArray(correlation)))
-        throw new ControlplaneCodecError(400, "invalid_request", "bad correlation");
-    const traceId = typeof correlation?.["trace_id"] === "string"
-        ? String(correlation["trace_id"]).trim()
-        : "";
-    return {
-        endpoint_id: endpointId,
-        ...(payload === undefined ? {} : { payload: payload }),
-        ...(traceId === "" ? {} : { correlation: { trace_id: traceId } }),
-    };
-}
-export function encodeArtifactEnvelope(artifact) {
-    return new TextEncoder().encode(JSON.stringify({ connect_artifact: assertConnectArtifact(artifact) }));
-}
-export function encodeControlplaneError(code, message) {
-    return new TextEncoder().encode(JSON.stringify({ error: { code, message } }));
-}
-export function bearerToken(authorization) {
-    const value = authorization.trim();
-    if (!value.startsWith("Bearer "))
-        return undefined;
-    const token = value.slice("Bearer ".length).trim();
-    return token === "" ? undefined : token;
-}

package/dist/controlplane/index.d.ts

@@ -1,6 +0,0 @@
-export type { ArtifactRequestCorrelation, ConnectArtifactEnvelope, ControlplaneBaseConfig, ControlplaneErrorEnvelope, RequestConnectArtifactInput, RequestEntryConnectArtifactInput, } from "./request.js";
-export { ControlplaneRequestError, DEFAULT_CONNECT_ARTIFACT_PATH, DEFAULT_ENTRY_CONNECT_ARTIFACT_PATH, requestConnectArtifact, requestEntryConnectArtifact, } from "./request.js";
-export * from "./token.js";
-export * from "./issuer.js";
-export * from "./channelInit.js";
-export * from "./http.js";

package/dist/controlplane/index.js

@@ -1,5 +0,0 @@
-export { ControlplaneRequestError, DEFAULT_CONNECT_ARTIFACT_PATH, DEFAULT_ENTRY_CONNECT_ARTIFACT_PATH, requestConnectArtifact, requestEntryConnectArtifact, } from "./request.js";
-export * from "./token.js";
-export * from "./issuer.js";
-export * from "./channelInit.js";
-export * from "./http.js";

package/dist/controlplane/issuer.d.ts

@@ -1,18 +0,0 @@
-import { type TokenPayload } from "./token.js";
-export declare class IssuerKeyset {
-    private active;
-    private readonly verificationKeys;
-    constructor(kid: string, signingSeed: Uint8Array);
-    static random(kid: string): IssuerKeyset;
-    currentKID(): string;
-    publicKeys(): ReadonlyMap<string, Uint8Array>;
-    sign(payload: Omit<TokenPayload, "kid"> & Readonly<{
-        kid?: string;
-    }>): string;
-    addVerificationKey(kid: string, publicKey: Uint8Array): void;
-    rotate(kid: string, signingSeed: Uint8Array): void;
-    retireVerificationKey(kid: string): void;
-    exportTunnelKeyset(): Uint8Array;
-    dispose(): void;
-    private requireActive;
-}

package/dist/controlplane/issuer.js

@@ -1,113 +0,0 @@
-import { ed25519 } from "@noble/curves/ed25519";
-import { base64urlEncode } from "../utils/base64url.js";
-import { signToken } from "./token.js";
-export class IssuerKeyset {
-    active;
-    verificationKeys = new Map();
-    constructor(kid, signingSeed) {
-        const normalizedKID = normalizeKid(kid);
-        const retainedSeed = copySigningSeed(signingSeed);
-        this.active = { kid: normalizedKID, signingSeed: retainedSeed };
-        this.verificationKeys.set(normalizedKID, ed25519.getPublicKey(retainedSeed));
-    }
-    static random(kid) {
-        const seed = crypto.getRandomValues(new Uint8Array(32));
-        try {
-            return new IssuerKeyset(kid, seed);
-        }
-        finally {
-            seed.fill(0);
-        }
-    }
-    currentKID() {
-        return this.requireActive().kid;
-    }
-    publicKeys() {
-        this.requireActive();
-        return new Map([...this.verificationKeys.entries()]
-            .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
-            .map(([kid, publicKey]) => [kid, publicKey.slice()]));
-    }
-    sign(payload) {
-        const active = this.requireActive();
-        return signToken(active.signingSeed, { ...payload, kid: active.kid });
-    }
-    addVerificationKey(kid, publicKey) {
-        this.requireActive();
-        const normalizedKID = normalizeKid(kid);
-        const retainedKey = copyPublicKey(publicKey);
-        const existing = this.verificationKeys.get(normalizedKID);
-        if (existing != null) {
-            if (!equalBytes(existing, retainedKey))
-                throw new Error(`key ID ${normalizedKID} is already bound to a different public key`);
-            return;
-        }
-        this.verificationKeys.set(normalizedKID, retainedKey);
-    }
-    rotate(kid, signingSeed) {
-        const active = this.requireActive();
-        const nextKID = normalizeKid(kid);
-        const nextSeed = copySigningSeed(signingSeed);
-        const nextPublicKey = ed25519.getPublicKey(nextSeed);
-        const prepublishedKey = this.verificationKeys.get(nextKID);
-        if (prepublishedKey == null) {
-            nextSeed.fill(0);
-            throw new Error(`key ID ${nextKID} must be prepublished before rotation`);
-        }
-        if (!equalBytes(prepublishedKey, nextPublicKey)) {
-            nextSeed.fill(0);
-            throw new Error(`key ID ${nextKID} is bound to a different public key`);
-        }
-        this.active = { kid: nextKID, signingSeed: nextSeed };
-        active.signingSeed.fill(0);
-    }
-    retireVerificationKey(kid) {
-        const active = this.requireActive();
-        const normalizedKID = normalizeKid(kid);
-        if (normalizedKID === active.kid)
-            throw new Error("the active signing key cannot be retired");
-        if (!this.verificationKeys.delete(normalizedKID))
-            throw new Error(`key ID ${normalizedKID} is not published`);
-    }
-    exportTunnelKeyset() {
-        const keys = [...this.publicKeys()].map(([kid, publicKey]) => ({ kid, pubkey_b64u: base64urlEncode(publicKey) }));
-        return new TextEncoder().encode(JSON.stringify({ keys }, null, 2));
-    }
-    dispose() {
-        const active = this.active;
-        if (active == null)
-            return;
-        active.signingSeed.fill(0);
-        this.active = undefined;
-        this.verificationKeys.clear();
-    }
-    requireActive() {
-        if (this.active == null)
-            throw new Error("issuer keyset is disposed");
-        return this.active;
-    }
-}
-function copySigningSeed(signingSeed) {
-    if (signingSeed.length !== 32)
-        throw new TypeError("Ed25519 signing seed must be 32 bytes");
-    return signingSeed.slice();
-}
-function copyPublicKey(publicKey) {
-    if (publicKey.length !== 32)
-        throw new TypeError("Ed25519 public key must be 32 bytes");
-    return publicKey.slice();
-}
-function equalBytes(left, right) {
-    if (left.length !== right.length)
-        return false;
-    let diff = 0;
-    for (let index = 0; index < left.length; index++)
-        diff |= left[index] ^ right[index];
-    return diff === 0;
-}
-function normalizeKid(kid) {
-    const value = kid.trim();
-    if (value === "")
-        throw new TypeError("key ID is required");
-    return value;
-}

package/dist/controlplane/request.d.ts

@@ -1,51 +0,0 @@
-import { type ConnectArtifact } from "../connect/artifact.js";
-type FetchLike = typeof fetch;
-export type ControlplaneBaseConfig = Readonly<{
-    baseUrl?: string;
-    path?: string;
-    headers?: HeadersInit;
-    credentials?: RequestCredentials;
-    fetch?: FetchLike;
-    signal?: AbortSignal;
-    allowLoopbackHTTP?: boolean;
-}>;
-export type ArtifactRequestCorrelation = Readonly<{
-    traceId?: string;
-}>;
-export type RequestConnectArtifactInput = ControlplaneBaseConfig & Readonly<{
-    endpointId: string;
-    payload?: Record<string, unknown>;
-    correlation?: ArtifactRequestCorrelation;
-}>;
-export type RequestEntryConnectArtifactInput = RequestConnectArtifactInput & Readonly<{
-    entryTicket: string;
-}>;
-export type ConnectArtifactEnvelope = Readonly<{
-    connect_artifact: ConnectArtifact;
-}>;
-export type ControlplaneErrorEnvelope = Readonly<{
-    error: Readonly<{
-        code: string;
-        message: string;
-    }>;
-}>;
-export declare class ControlplaneRequestError extends Error {
-    readonly status: number;
-    readonly code: string;
-    readonly responseBody: unknown;
-    constructor(args: Readonly<{
-        status: number;
-        message: string;
-        code?: string;
-        responseBody?: unknown;
-    }>);
-}
-export declare const DEFAULT_CONNECT_ARTIFACT_PATH = "/v1/connect/artifact";
-export declare const DEFAULT_ENTRY_CONNECT_ARTIFACT_PATH = "/v1/connect/artifact/entry";
-export declare function buildControlplaneURL(baseUrl: string | undefined, path: string): string;
-export declare function requestControlplaneJSON(url: string, init: RequestInit & Readonly<{
-    fetch?: FetchLike;
-}>): Promise<unknown>;
-export declare function requestConnectArtifact(config: RequestConnectArtifactInput): Promise<ConnectArtifact>;
-export declare function requestEntryConnectArtifact(config: RequestEntryConnectArtifactInput): Promise<ConnectArtifact>;
-export {};

package/dist/controlplane/request.js

@@ -1,273 +0,0 @@
-import { assertConnectArtifact } from "../connect/artifact.js";
-import { SDK_DEFAULTS } from "../defaults.js";
-export class ControlplaneRequestError extends Error {
-    status;
-    code;
-    responseBody;
-    constructor(args) {
-        super(args.message);
-        this.name = "ControlplaneRequestError";
-        this.status = args.status;
-        this.code = String(args.code ?? "").trim();
-        this.responseBody = args.responseBody;
-    }
-}
-export const DEFAULT_CONNECT_ARTIFACT_PATH = "/v1/connect/artifact";
-export const DEFAULT_ENTRY_CONNECT_ARTIFACT_PATH = "/v1/connect/artifact/entry";
-const DEFAULT_MAX_CONTROLPLANE_RESPONSE_BYTES = SDK_DEFAULTS.controlplane.maxResponseBodyBytes;
-class ControlplaneResponseTooLargeError extends Error {
-    constructor(maxBytes) {
-        super(`controlplane response exceeded ${maxBytes} bytes`);
-        this.name = "ControlplaneResponseTooLargeError";
-    }
-}
-function resolveFetch(fetchImpl) {
-    if (fetchImpl)
-        return fetchImpl;
-    if (typeof globalThis.fetch === "function")
-        return globalThis.fetch.bind(globalThis);
-    throw new Error("global fetch is not available");
-}
-export function buildControlplaneURL(baseUrl, path) {
-    const base = String(baseUrl ?? "").trim();
-    if (base === "")
-        return path;
-    return `${base.replace(/\/+$/, "")}${path}`;
-}
-function transportPolicyDenied() {
-    return new ControlplaneRequestError({
-        status: 0,
-        code: "transport_policy_denied",
-        message: "controlplane transport security policy denied URL",
-    });
-}
-function validateArtifactURL(rawUrl, allowLoopbackHTTP) {
-    let target;
-    try {
-        if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(rawUrl)) {
-            target = new URL(rawUrl);
-        }
-        else {
-            const base = globalThis.location?.href;
-            if (!base)
-                throw new Error("relative URL requires a browser location");
-            target = new URL(rawUrl, base);
-        }
-    }
-    catch {
-        throw transportPolicyDenied();
-    }
-    if (target.username !== "" || target.password !== "" || target.hash !== "") {
-        throw transportPolicyDenied();
-    }
-    if (target.protocol === "https:")
-        return;
-    if (target.protocol === "http:"
-        && allowLoopbackHTTP === true
-        && isLiteralLoopbackHost(sourceHostname(rawUrl, target)))
-        return;
-    throw transportPolicyDenied();
-}
-function sourceHostname(rawUrl, target) {
-    const authority = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/([^/?#]*)/.exec(rawUrl)?.[1];
-    if (authority === undefined)
-        return target.hostname;
-    const hostPort = authority.slice(authority.lastIndexOf("@") + 1);
-    if (hostPort.startsWith("[")) {
-        const end = hostPort.indexOf("]");
-        if (end < 0 || (hostPort.length > end + 1 && !/^:\d+$/.test(hostPort.slice(end + 1)))) {
-            return hostPort;
-        }
-        return hostPort.slice(1, end);
-    }
-    const colon = hostPort.lastIndexOf(":");
-    if (colon < 0)
-        return hostPort;
-    if (hostPort.indexOf(":") !== colon || !/^\d+$/.test(hostPort.slice(colon + 1)))
-        return hostPort;
-    return hostPort.slice(0, colon);
-}
-function isLiteralLoopbackHost(rawHost) {
-    const host = rawHost.startsWith("[") && rawHost.endsWith("]")
-        ? rawHost.slice(1, -1).toLowerCase()
-        : rawHost.toLowerCase();
-    if (host === "localhost" || host === "::1")
-        return true;
-    const parts = host.split(".");
-    if (parts.length !== 4)
-        return false;
-    const octets = parts.map((part) => {
-        if (!/^(0|[1-9]\d{0,2})$/.test(part))
-            return -1;
-        const value = Number(part);
-        return value <= 255 ? value : -1;
-    });
-    return octets.every((value) => value >= 0) && octets[0] === 127;
-}
-function parseMaybeJSON(bodyText) {
-    const trimmed = String(bodyText ?? "").trim();
-    if (trimmed === "")
-        return "";
-    try {
-        return JSON.parse(trimmed);
-    }
-    catch {
-        return trimmed;
-    }
-}
-function parseContentLength(headerValue) {
-    const raw = String(headerValue ?? "").trim();
-    if (raw === "")
-        return null;
-    if (!/^[0-9]+$/.test(raw))
-        return null;
-    const parsed = Number(raw);
-    if (!Number.isSafeInteger(parsed) || parsed < 0)
-        return null;
-    return parsed;
-}
-async function readControlplaneText(response, maxBytes) {
-    const contentLength = parseContentLength(response.headers.get("Content-Length"));
-    if (contentLength !== null && contentLength > maxBytes) {
-        throw new ControlplaneResponseTooLargeError(maxBytes);
-    }
-    if (!response.body) {
-        return "";
-    }
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder();
-    let totalBytes = 0;
-    let text = "";
-    while (true) {
-        const chunk = await reader.read();
-        if (chunk.done)
-            break;
-        totalBytes += chunk.value.byteLength;
-        if (totalBytes > maxBytes) {
-            try {
-                await reader.cancel();
-            }
-            catch {
-                // The size violation is authoritative; cancellation is secondary cleanup.
-            }
-            throw new ControlplaneResponseTooLargeError(maxBytes);
-        }
-        text += decoder.decode(chunk.value, { stream: true });
-    }
-    text += decoder.decode();
-    return text;
-}
-function decodeErrorMessage(status, responseBody) {
-    let message = `controlplane request failed: ${status}`;
-    let code = "";
-    if (responseBody && typeof responseBody === "object") {
-        const error = responseBody.error;
-        if (error && typeof error === "object") {
-            const nextMessage = String(error.message ?? "").trim();
-            if (nextMessage !== "") {
-                message = nextMessage;
-            }
-            code = String(error.code ?? "").trim();
-        }
-    }
-    else if (typeof responseBody === "string" && responseBody !== "") {
-        message = responseBody;
-    }
-    return { code, message };
-}
-export async function requestControlplaneJSON(url, init) {
-    const runFetch = resolveFetch(init.fetch);
-    const response = await runFetch(url, {
-        ...init,
-        cache: "no-store",
-        redirect: "error",
-    });
-    let rawBody = "";
-    try {
-        rawBody = await readControlplaneText(response, DEFAULT_MAX_CONTROLPLANE_RESPONSE_BYTES);
-    }
-    catch (err) {
-        if (err instanceof ControlplaneResponseTooLargeError && !response.ok) {
-            throw new ControlplaneRequestError({
-                status: response.status,
-                message: err.message,
-            });
-        }
-        throw err;
-    }
-    const responseBody = parseMaybeJSON(rawBody);
-    if (!response.ok) {
-        const error = decodeErrorMessage(response.status, responseBody);
-        throw new ControlplaneRequestError({
-            status: response.status,
-            message: error.message,
-            code: error.code,
-            responseBody,
-        });
-    }
-    if (typeof responseBody === "string") {
-        if (responseBody === "") {
-            throw new Error("Invalid controlplane response: expected JSON body");
-        }
-        throw new Error("Invalid controlplane response: expected JSON body");
-    }
-    return responseBody;
-}
-function buildConnectArtifactPayload(config) {
-    const body = {
-        endpoint_id: String(config.endpointId ?? "").trim(),
-    };
-    if (body.endpoint_id === "")
-        throw new Error("endpointId is required");
-    if (config.payload !== undefined)
-        body.payload = { ...config.payload };
-    const traceId = String(config.correlation?.traceId ?? "").trim();
-    if (traceId !== "") {
-        body.correlation = { trace_id: traceId };
-    }
-    return body;
-}
-function createJSONHeaders(input) {
-    const headers = new Headers(input);
-    if (!headers.has("Content-Type")) {
-        headers.set("Content-Type", "application/json");
-    }
-    return headers;
-}
-export async function requestConnectArtifact(config) {
-    const url = buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_CONNECT_ARTIFACT_PATH);
-    validateArtifactURL(url, config.allowLoopbackHTTP);
-    const data = (await requestControlplaneJSON(url, {
-        ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
-        method: "POST",
-        credentials: config.credentials ?? "omit",
-        headers: createJSONHeaders(config.headers),
-        body: JSON.stringify(buildConnectArtifactPayload(config)),
-        ...(config.signal === undefined ? {} : { signal: config.signal }),
-    }));
-    if (!data?.connect_artifact) {
-        throw new Error("Invalid controlplane response: missing `connect_artifact`");
-    }
-    return assertConnectArtifact(data.connect_artifact);
-}
-export async function requestEntryConnectArtifact(config) {
-    const entryTicket = String(config.entryTicket ?? "").trim();
-    if (entryTicket === "")
-        throw new Error("entryTicket is required");
-    const headers = createJSONHeaders(config.headers);
-    headers.set("Authorization", `Bearer ${entryTicket}`);
-    const url = buildControlplaneURL(config.baseUrl, config.path ?? DEFAULT_ENTRY_CONNECT_ARTIFACT_PATH);
-    validateArtifactURL(url, config.allowLoopbackHTTP);
-    const data = (await requestControlplaneJSON(url, {
-        ...(config.fetch === undefined ? {} : { fetch: config.fetch }),
-        method: "POST",
-        credentials: config.credentials ?? "omit",
-        headers,
-        body: JSON.stringify(buildConnectArtifactPayload(config)),
-        ...(config.signal === undefined ? {} : { signal: config.signal }),
-    }));
-    if (!data?.connect_artifact) {
-        throw new Error("Invalid controlplane response: missing `connect_artifact`");
-    }
-    return assertConnectArtifact(data.connect_artifact);
-}