@floegence/flowersec-core 0.27.0 → 2.0.0

package/dist/proxy/appWindow.js

@@ -1,273 +0,0 @@
-import { createServiceWorkerControllerGuard, } from "./controllerGuard.js";
-import { createMessagePortBackedStream } from "./portStream.js";
-import { PROXY_WINDOW_FETCH_FORWARD_MSG_TYPE, PROXY_WINDOW_FETCH_MSG_TYPE, PROXY_WINDOW_STREAM_RESET_MSG_TYPE, PROXY_WINDOW_WS_ERROR_MSG_TYPE, PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY, PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE, PROXY_WINDOW_WS_OPEN_MSG_TYPE, } from "./windowBridgeProtocol.js";
-function resolveTargetWindow(raw) {
-    const target = raw ?? globalThis.window;
-    if (target == null)
-        throw new Error("targetWindow is not available");
-    return target;
-}
-function resolveControllerWindow(targetWindow, raw) {
-    if (raw != null)
-        return raw;
-    try {
-        if (targetWindow.top && targetWindow.top !== targetWindow)
-            return targetWindow.top;
-    }
-    catch {
-        // ignore
-    }
-    try {
-        if (targetWindow.parent && targetWindow.parent !== targetWindow)
-            return targetWindow.parent;
-    }
-    catch {
-        // ignore
-    }
-    throw new Error("controllerWindow is not available");
-}
-function postFetchError(port, message) {
-    try {
-        port.postMessage({ type: "flowersec-proxy:response_error", status: 502, message });
-    }
-    catch {
-        // Best-effort.
-    }
-    try {
-        port.close();
-    }
-    catch {
-        // Best-effort.
-    }
-}
-function normalizeCapabilityNonce(value) {
-    if (value == null)
-        return "";
-    const s = String(value);
-    if (s === "")
-        return "";
-    if (s.trim() !== s || /[\s\u0000-\u001f\u007f]/.test(s)) {
-        throw new Error("capabilityNonce must not contain whitespace or control characters");
-    }
-    return s;
-}
-export function registerProxyAppWindow(opts) {
-    const controllerOrigin = String(opts.controllerOrigin ?? "").trim();
-    if (controllerOrigin === "") {
-        throw new Error("controllerOrigin is required");
-    }
-    const targetWindow = resolveTargetWindow(opts.targetWindow);
-    const controllerWindow = resolveControllerWindow(targetWindow, opts.controllerWindow);
-    const capabilityNonce = normalizeCapabilityNonce(opts.capabilityNonce);
-    const activeWebSocketBridges = new Set();
-    let disposed = false;
-    const sw = targetWindow.navigator?.serviceWorker;
-    const onServiceWorkerMessage = (ev) => {
-        const data = ev.data;
-        if (data == null || typeof data !== "object")
-            return;
-        if (data.type !== PROXY_WINDOW_FETCH_FORWARD_MSG_TYPE)
-            return;
-        const port = ev.ports?.[0];
-        if (!port)
-            return;
-        try {
-            controllerWindow.postMessage({
-                type: PROXY_WINDOW_FETCH_MSG_TYPE,
-                req: data.req,
-                ...(capabilityNonce === "" ? {} : { capabilityNonce }),
-            }, controllerOrigin, [port]);
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            postFetchError(port, message);
-        }
-    };
-    sw?.addEventListener("message", onServiceWorkerMessage);
-    const runtime = {
-        limits: {
-            ...(opts.maxWsFrameBytes === undefined ? {} : { maxWsFrameBytes: opts.maxWsFrameBytes }),
-            ...(opts.maxWsBufferedAmountBytes === undefined
-                ? {}
-                : { maxWsBufferedAmountBytes: opts.maxWsBufferedAmountBytes }),
-        },
-        openWebSocketStream: async (path, wsOpts = {}) => {
-            if (disposed)
-                throw new Error("proxy app Window bridge is disposed");
-            const channel = new MessageChannel();
-            const port = channel.port1;
-            port.start?.();
-            return await new Promise((resolve, reject) => {
-                let settled = false;
-                let terminal = false;
-                let stream = null;
-                const cleanup = () => {
-                    activeWebSocketBridges.delete(bridge);
-                    if (wsOpts.signal != null)
-                        wsOpts.signal.removeEventListener("abort", onAbort);
-                };
-                const finishTerminal = () => {
-                    if (terminal)
-                        return false;
-                    terminal = true;
-                    cleanup();
-                    return true;
-                };
-                const finishReject = (error) => {
-                    if (settled)
-                        return;
-                    settled = true;
-                    finishTerminal();
-                    try {
-                        port.close();
-                    }
-                    catch {
-                        // Best-effort.
-                    }
-                    reject(error instanceof Error ? error : new Error(String(error)));
-                };
-                const disposeBridge = (error) => {
-                    if (!finishTerminal())
-                        return;
-                    if (stream != null) {
-                        try {
-                            void Promise.resolve(stream.reset(error)).catch(() => {
-                                // The bridge is already terminal.
-                            });
-                        }
-                        catch {
-                            // The bridge is already terminal.
-                        }
-                        return;
-                    }
-                    try {
-                        port.postMessage({
-                            type: PROXY_WINDOW_STREAM_RESET_MSG_TYPE,
-                            message: error.message,
-                        });
-                    }
-                    catch {
-                        // Best-effort.
-                    }
-                    if (!settled) {
-                        settled = true;
-                        reject(error);
-                    }
-                    try {
-                        port.close();
-                    }
-                    catch {
-                        // Best-effort.
-                    }
-                };
-                const bridge = { dispose: disposeBridge };
-                const onAbort = () => {
-                    const reason = wsOpts.signal?.reason;
-                    disposeBridge(reason instanceof Error ? reason : new Error(String(reason ?? "aborted")));
-                };
-                activeWebSocketBridges.add(bridge);
-                const finishResolve = (ack) => {
-                    if (settled || terminal)
-                        return;
-                    const capabilities = Array.isArray(ack.capabilities)
-                        ? ack.capabilities.filter((value) => typeof value === "string")
-                        : [];
-                    if (!capabilities.includes(PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY)) {
-                        try {
-                            port.postMessage({
-                                type: PROXY_WINDOW_STREAM_RESET_MSG_TYPE,
-                                message: "proxy Window bridge capability mismatch",
-                            });
-                        }
-                        catch {
-                            // The capability error remains authoritative.
-                        }
-                        finishReject(new Error("proxy Window bridge does not support bidirectional stream acknowledgements"));
-                        return;
-                    }
-                    if (disposed) {
-                        disposeBridge(new Error("proxy app Window bridge is disposed"));
-                        return;
-                    }
-                    settled = true;
-                    stream = createMessagePortBackedStream(port, {
-                        maxBufferedBytes: opts.maxWsBufferedAmountBytes ?? 4 * (1 << 20),
-                        onTerminal: finishTerminal,
-                    });
-                    resolve({
-                        stream,
-                        protocol: String(ack.protocol ?? ""),
-                    });
-                };
-                port.onmessage = (ev) => {
-                    const data = ev.data;
-                    if (data == null || typeof data !== "object")
-                        return;
-                    const type = typeof data.type === "string" ? data.type : "";
-                    if (type === PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE) {
-                        finishResolve(data);
-                        return;
-                    }
-                    if (type === PROXY_WINDOW_WS_ERROR_MSG_TYPE) {
-                        finishReject(new Error(String(data.message ?? "upstream ws open failed")));
-                    }
-                };
-                if (wsOpts.signal != null) {
-                    if (wsOpts.signal.aborted) {
-                        onAbort();
-                        return;
-                    }
-                    wsOpts.signal.addEventListener("abort", onAbort, { once: true });
-                }
-                try {
-                    controllerWindow.postMessage({
-                        type: PROXY_WINDOW_WS_OPEN_MSG_TYPE,
-                        path,
-                        capabilities: [PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY],
-                        ...(wsOpts.protocols === undefined ? {} : { protocols: wsOpts.protocols }),
-                        ...(capabilityNonce === "" ? {} : { capabilityNonce }),
-                    }, controllerOrigin, [channel.port2]);
-                }
-                catch (error) {
-                    finishReject(error);
-                }
-            });
-        },
-    };
-    return {
-        runtime,
-        dispose: () => {
-            if (disposed)
-                return;
-            disposed = true;
-            sw?.removeEventListener("message", onServiceWorkerMessage);
-            const error = new Error("proxy app Window bridge is disposed");
-            for (const bridge of [...activeWebSocketBridges])
-                bridge.dispose(error);
-        },
-    };
-}
-export async function registerProxyAppWindowWithServiceWorkerControl(opts) {
-    const targetWindow = resolveTargetWindow(opts.targetWindow);
-    const sw = targetWindow.navigator?.serviceWorker;
-    if (sw == null || typeof sw.register !== "function") {
-        throw new Error("serviceWorker is not available");
-    }
-    await sw.register(opts.serviceWorker.scriptUrl, {
-        ...(opts.serviceWorker.scope === undefined ? {} : { scope: opts.serviceWorker.scope }),
-    });
-    const guard = createServiceWorkerControllerGuard({
-        targetWindow,
-        expectedScriptPathSuffix: opts.serviceWorker.expectedScriptPathSuffix,
-        ...(opts.serviceWorker.repair === undefined ? {} : { repair: opts.serviceWorker.repair }),
-        ...(opts.serviceWorker.monitor === undefined ? {} : { monitor: opts.serviceWorker.monitor }),
-        ...(opts.serviceWorker.conflicts === undefined ? {} : { conflicts: opts.serviceWorker.conflicts }),
-    });
-    try {
-        await guard.ensure();
-    }
-    finally {
-        guard.dispose();
-    }
-    return registerProxyAppWindow(opts);
-}

package/dist/proxy/bootstrap.d.ts

@@ -1,35 +0,0 @@
-import type { Client } from "../client.js";
-import type { ConnectArtifact } from "../connect/artifact.js";
-import type { ConnectBrowserOptions } from "../browser/connect.js";
-import { type ProxyIntegrationPlugin, type RegisterProxyIntegrationOptions, type ProxyIntegrationServiceWorkerOptions } from "./integration.js";
-import { type RegisterProxyControllerWindowOptions } from "./controllerWindow.js";
-import type { ProxyPresetInput } from "./preset.js";
-import { type ProxyRuntime } from "./runtime.js";
-export type ConnectArtifactProxyBrowserHandle = Readonly<{
-    client: Client;
-    runtime: ProxyRuntime;
-    dispose: () => Promise<void>;
-}>;
-export type ConnectArtifactProxyBrowserOptions = Readonly<{
-    connect?: ConnectBrowserOptions;
-    preset?: ProxyPresetInput;
-    runtimeGlobalKey?: string;
-    runtime?: RegisterProxyIntegrationOptions["runtime"];
-    serviceWorker?: ProxyIntegrationServiceWorkerOptions;
-    plugins?: readonly ProxyIntegrationPlugin[];
-}>;
-export type ConnectArtifactProxyControllerBrowserHandle = Readonly<{
-    client: Client;
-    runtime: ProxyRuntime;
-    dispose: () => void;
-}>;
-export type ConnectArtifactProxyControllerBrowserOptions = Readonly<{
-    connect?: ConnectBrowserOptions;
-    runtime?: RegisterProxyIntegrationOptions["runtime"];
-    allowedOrigins?: RegisterProxyControllerWindowOptions["allowedOrigins"];
-    targetWindow?: RegisterProxyControllerWindowOptions["targetWindow"];
-    expectedSource?: RegisterProxyControllerWindowOptions["expectedSource"];
-    capabilityNonce?: RegisterProxyControllerWindowOptions["capabilityNonce"];
-}>;
-export declare function connectArtifactProxyBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyBrowserOptions): Promise<ConnectArtifactProxyBrowserHandle>;
-export declare function connectArtifactProxyControllerBrowser(artifact: ConnectArtifact, opts?: ConnectArtifactProxyControllerBrowserOptions): Promise<ConnectArtifactProxyControllerBrowserHandle>;

package/dist/proxy/bootstrap.js

@@ -1,119 +0,0 @@
-import { connectBrowser } from "../browser/connect.js";
-import { registerProxyIntegration, } from "./integration.js";
-import { registerProxyControllerWindow } from "./controllerWindow.js";
-import { extractProxyRuntimeScopeV1, resolvePresetInputFromScope, resolveRuntimeLimitsFromScope, resolveRuntimePresetLimits, } from "./runtimeScope.js";
-import { createProxyRuntime } from "./runtime.js";
-function scopeRuntimeToIntegrationOptions(scope, opts) {
-    const runtimeLimits = resolveRuntimeLimitsFromScope(scope, opts.runtime);
-    const presetFromScope = resolvePresetInputFromScope(scope, opts.preset);
-    const presetFromLimits = presetFromScope ?? resolveRuntimePresetLimits(scope);
-    const serviceWorker = opts.serviceWorker ?? (scope.mode === "service_worker" ? {
-        scriptUrl: scope.serviceWorker.scriptUrl,
-        scope: scope.serviceWorker.scope,
-    } : undefined);
-    if (!serviceWorker) {
-        throw new Error("service worker config is required for proxy runtime mode");
-    }
-    return {
-        ...(presetFromLimits === undefined ? {} : { preset: presetFromLimits }),
-        ...(opts.runtimeGlobalKey === undefined ? {} : { runtimeGlobalKey: opts.runtimeGlobalKey }),
-        ...(runtimeLimits === undefined ? {} : { runtime: runtimeLimits }),
-        serviceWorker,
-        ...(opts.plugins === undefined ? {} : { plugins: opts.plugins }),
-    };
-}
-async function connectProxyBrowserClient(client, opts) {
-    const integrationInput = {
-        client,
-        serviceWorker: opts.serviceWorker,
-        ...(opts.preset === undefined ? {} : { preset: opts.preset }),
-        ...(opts.runtimeGlobalKey === undefined ? {} : { runtimeGlobalKey: opts.runtimeGlobalKey }),
-        ...(opts.runtime === undefined ? {} : { runtime: opts.runtime }),
-        ...(opts.plugins === undefined ? {} : { plugins: opts.plugins }),
-    };
-    let registered = false;
-    let integration = null;
-    try {
-        integration = await registerProxyIntegration(integrationInput);
-        registered = true;
-    }
-    finally {
-        if (!registered) {
-            client.close();
-        }
-    }
-    return {
-        client,
-        runtime: integration.runtime,
-        dispose: async () => {
-            let firstError = null;
-            try {
-                await integration.dispose();
-            }
-            catch (error) {
-                firstError = error;
-            }
-            try {
-                client.close();
-            }
-            catch (error) {
-                if (firstError == null)
-                    firstError = error;
-            }
-            if (firstError != null)
-                throw firstError;
-        },
-    };
-}
-function connectProxyControllerClient(client, opts) {
-    let runtime = null;
-    let controller = null;
-    try {
-        runtime = createProxyRuntime({
-            client,
-            ...(opts.runtime ?? {}),
-        });
-        controller = registerProxyControllerWindow({
-            runtime,
-            allowedOrigins: opts.allowedOrigins,
-            ...(opts.targetWindow === undefined ? {} : { targetWindow: opts.targetWindow }),
-            ...(opts.expectedSource === undefined ? {} : { expectedSource: opts.expectedSource }),
-            ...(opts.capabilityNonce === undefined ? {} : { capabilityNonce: opts.capabilityNonce }),
-        });
-    }
-    catch (error) {
-        try {
-            client.close();
-        }
-        catch {
-            // Best effort cleanup.
-        }
-        throw error;
-    }
-    return {
-        client,
-        runtime,
-        dispose: () => {
-            controller?.dispose();
-            client.close();
-        },
-    };
-}
-export async function connectArtifactProxyBrowser(artifact, opts = {}) {
-    const scope = extractProxyRuntimeScopeV1(artifact, "service_worker");
-    const client = await connectBrowser(artifact, opts.connect ?? {});
-    const nextOpts = scopeRuntimeToIntegrationOptions(scope, opts);
-    return await connectProxyBrowserClient(client, nextOpts);
-}
-export async function connectArtifactProxyControllerBrowser(artifact, opts = {}) {
-    const scope = extractProxyRuntimeScopeV1(artifact, "controller_bridge");
-    const client = await connectBrowser(artifact, opts.connect ?? {});
-    const runtime = resolveRuntimeLimitsFromScope(scope, opts.runtime);
-    return connectProxyControllerClient(client, {
-        ...(runtime === undefined ? {} : { runtime }),
-        allowedOrigins: opts.allowedOrigins ?? scope.controllerBridge.allowedOrigins,
-        ...(opts.targetWindow === undefined ? {} : { targetWindow: opts.targetWindow }),
-        ...(opts.expectedSource === undefined ? {} : { expectedSource: opts.expectedSource }),
-        ...(opts.capabilityNonce === undefined ? {} : { capabilityNonce: opts.capabilityNonce }),
-    });
-}

package/dist/proxy/constants.d.ts

@@ -1,7 +0,0 @@
-export declare const PROXY_PROTOCOL_VERSION: 1;
-export declare const PROXY_KIND_HTTP1: "flowersec-proxy/http1";
-export declare const PROXY_KIND_WS: "flowersec-proxy/ws";
-export declare const DEFAULT_MAX_CHUNK_BYTES: number;
-export declare const DEFAULT_MAX_BODY_BYTES: number;
-export declare const DEFAULT_MAX_WS_FRAME_BYTES: number;
-export declare const DEFAULT_MAX_CONCURRENT_STREAMS: 64;

package/dist/proxy/constants.js

@@ -1,8 +0,0 @@
-import { SDK_DEFAULTS } from "../defaults.js";
-export const PROXY_PROTOCOL_VERSION = 1;
-export const PROXY_KIND_HTTP1 = "flowersec-proxy/http1";
-export const PROXY_KIND_WS = "flowersec-proxy/ws";
-export const DEFAULT_MAX_CHUNK_BYTES = SDK_DEFAULTS.proxy.maxChunkBytes;
-export const DEFAULT_MAX_BODY_BYTES = SDK_DEFAULTS.proxy.maxBodyBytes;
-export const DEFAULT_MAX_WS_FRAME_BYTES = SDK_DEFAULTS.proxy.maxWsFrameBytes;
-export const DEFAULT_MAX_CONCURRENT_STREAMS = SDK_DEFAULTS.proxy.maxConcurrentStreams;

package/dist/proxy/controllerWindow.d.ts

@@ -1,12 +0,0 @@
-import type { ProxyRuntime } from "./runtime.js";
-export type RegisterProxyControllerWindowOptions = Readonly<{
-    runtime: ProxyRuntime;
-    allowedOrigins: readonly string[];
-    targetWindow?: Window;
-    expectedSource?: Window | null;
-    capabilityNonce?: string;
-}>;
-export type ProxyControllerWindowHandle = Readonly<{
-    dispose: () => void;
-}>;
-export declare function registerProxyControllerWindow(opts: RegisterProxyControllerWindowOptions): ProxyControllerWindowHandle;