@floegence/flowersec-core 0.27.0 → 2.0.0

package/dist/defaults.js

@@ -4,6 +4,13 @@ export const SDK_DEFAULTS = Object.freeze({
         handshakeTimeoutMs: 10_000,
         handshakeClockSkewMs: 30_000,
     }),
+    connectionController: Object.freeze({
+        initialDelayMs: 250,
+        maxDelayMs: 30_000,
+        factor: 2,
+        jitterRatio: 0,
+        defaultAttemptLimit: null,
+    }),
     e2ee: Object.freeze({
         maxHandshakePayloadBytes: 8 * 1024,
         maxRecordBytes: 1024 * 1024,
@@ -39,11 +46,4 @@ export const SDK_DEFAULTS = Object.freeze({
         defaultTimeoutMs: 30_000,
         maxTimeoutMs: 300_000,
     }),
-    reconnect: Object.freeze({
-        maxAttempts: 5,
-        initialDelayMs: 500,
-        maxDelayMs: 10_000,
-        factor: 1.8,
-        jitterRatio: 0.2,
-    }),
 });

package/dist/facade.d.ts

@@ -1,27 +1,12 @@
-import type { Client } from "./client.js";
-import type { DirectConnectOptions } from "./direct-client/connect.js";
-import type { TunnelConnectOptions } from "./tunnel-client/connect.js";
-import { type ConnectArtifact, type CorrelationContext, type CorrelationKV, type DirectClientConnectArtifact, type ScopeMetadataEntry, type TunnelClientConnectArtifact } from "./connect/artifact.js";
-import type { ChannelInitGrant } from "./gen/flowersec/controlplane/v1.gen.js";
-import type { DirectConnectInfo } from "./gen/flowersec/direct/v1.gen.js";
-export type { ChannelInitGrant } from "./gen/flowersec/controlplane/v1.gen.js";
-export { assertChannelInitGrant } from "./gen/flowersec/controlplane/v1.gen.js";
-export type { DirectConnectInfo } from "./gen/flowersec/direct/v1.gen.js";
-export { assertDirectConnectInfo } from "./gen/flowersec/direct/v1.gen.js";
-export type { ConnectArtifact, CorrelationContext, CorrelationKV, DirectClientConnectArtifact, ScopeMetadataEntry, TunnelClientConnectArtifact, };
-export { assertConnectArtifact } from "./connect/artifact.js";
-export type { ClientObserverLike } from "./observability/observer.js";
-export type { Client, ClientPath } from "./client.js";
-export type { LivenessOptions } from "./client-connect/connectCore.js";
-export type { WebSocketLimits } from "./ws-client/binaryTransport.js";
-export type { YamuxLimits } from "./yamux/session.js";
-export type { FlowersecErrorCode, FlowersecPath, FlowersecStage } from "./utils/errors.js";
-export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
-export type { NetworkPlaintextPolicyOptions, TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, } from "./client-connect/transportSecurity.js";
-export type { TunnelConnectOptions } from "./tunnel-client/connect.js";
-export type { DirectConnectOptions } from "./direct-client/connect.js";
-export type ConnectOptions = TunnelConnectOptions | DirectConnectOptions;
-export declare function connectTunnel(grant: ChannelInitGrant, opts: TunnelConnectOptions): Promise<Client>;
-export declare function connectDirect(info: DirectConnectInfo, opts: DirectConnectOptions): Promise<Client>;
-export declare function connect(input: ConnectArtifact, opts: ConnectOptions): Promise<Client>;
+export type { ByteStream, IncomingStream, JsonObject, JsonPrimitive, JsonValue, OperationOptions, RpcPeer, RpcResult, SessionErrorCode, StreamOpenOptions, UnreliableMessageChannel, UnreliableMessageSendOptions, UnreliableMessageSendResult, SessionTermination, Session, } from "./public/contract.js";
+export { SessionError, UnreliableMessageError } from "./public/contract.js";
+export { createStreamMetadata, StreamMetadataError } from "./public/streamMetadata.js";
+export type { StreamMetadata } from "./public/streamMetadata.js";
+export { ArtifactLeaseError, createArtifactLease, } from "./public/artifactLease.js";
+export type { ArtifactLease } from "./public/artifactLease.js";
+export { Artifact, ArtifactError, parseArtifact } from "./public/artifact.js";
+export type { ArtifactErrorCode } from "./public/artifact.js";
+export type { ConnectErrorCode } from "./public/connectError.js";
+export { ConnectError } from "./public/connectError.js";
+export { ConnectionControllerError } from "./connectionController.js";
+export type { ArtifactSource, ArtifactSourceResult, ConnectionController, ConnectionControllerFailure, ConnectionControllerOptions, ConnectionSnapshot, ConnectionState, RetryDisposition, } from "./connectionController.js";

package/dist/facade.js

@@ -1,24 +1,6 @@
-import { connectDirect as connectDirectInternal } from "./direct-client/connect.js";
-import { connectTunnel as connectTunnelInternal } from "./tunnel-client/connect.js";
-import { resolveConnectArtifact } from "./connect/resolveArtifact.js";
-export { assertChannelInitGrant } from "./gen/flowersec/controlplane/v1.gen.js";
-export { assertDirectConnectInfo } from "./gen/flowersec/direct/v1.gen.js";
-export { assertConnectArtifact } from "./connect/artifact.js";
-export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
-export async function connectTunnel(grant, opts) {
-    return await connectTunnelInternal(grant, opts);
-}
-export async function connectDirect(info, opts) {
-    return await connectDirectInternal(info, opts);
-}
-// connect resolves an artifact to its explicit direct or tunnel transport.
-export async function connect(input, opts) {
-    const normalized = await resolveConnectArtifact(input, opts);
-    const nextObserver = normalized.observer ?? opts.observer;
-    const nextOpts = (nextObserver === opts.observer ? opts : { ...opts, observer: nextObserver });
-    if (normalized.kind === "direct") {
-        return await connectDirectInternal(normalized.input, nextOpts);
-    }
-    return await connectTunnelInternal(normalized.input, nextOpts);
-}
+export { SessionError, UnreliableMessageError } from "./public/contract.js";
+export { createStreamMetadata, StreamMetadataError } from "./public/streamMetadata.js";
+export { ArtifactLeaseError, createArtifactLease, } from "./public/artifactLease.js";
+export { Artifact, ArtifactError, parseArtifact } from "./public/artifact.js";
+export { ConnectError } from "./public/connectError.js";
+export { ConnectionControllerError } from "./connectionController.js";

package/dist/node/connectSession.d.ts

@@ -0,0 +1,21 @@
+import type { ArtifactLease } from "../public/artifactLease.js";
+import type { Session } from "../public/contract.js";
+import { type ArtifactSource, type ConnectionController } from "../connectionController.js";
+export type SessionTLSOptions = Readonly<{
+    ca?: string | Uint8Array;
+    serverCertificateHash?: Uint8Array;
+}>;
+export type SessionOptions = Readonly<{
+    origin: string;
+    signal?: AbortSignal;
+    connectTimeoutMs?: number;
+    tls?: SessionTLSOptions;
+}>;
+export type ConnectionControllerOptions = Readonly<{
+    origin: string;
+    connectTimeoutMs?: number;
+    tls?: SessionTLSOptions;
+    maximumAttempts?: number;
+}>;
+export declare function createConnectionController(source: ArtifactSource, options: ConnectionControllerOptions): ConnectionController;
+export declare function connect(lease: ArtifactLease, options: SessionOptions): Promise<Session>;

package/dist/node/connectSession.js

@@ -0,0 +1,62 @@
+import { NODE_RUNTIME_CAPABILITY_V2 } from "./runtimeCapability.js";
+import { composeCandidateAttemptFactoryV2, SessionConnectorV2, } from "../connector/sessionConnector.js";
+import { createWebSocketCandidateFactoryV2 } from "../connector/adapters/webSocketCandidate.js";
+import { createWebTransportCandidateFactoryV2 } from "../connector/adapters/webTransportCandidate.js";
+import { createNodeWsFactory } from "./wsFactory.js";
+import { createNodeWebTransportClientV2 } from "./webTransportClient.js";
+import { projectSessionV2 } from "../v2/publicSession.js";
+import { ConnectError } from "../public/connectError.js";
+import { nodeSessionRuntimeV2 } from "./sessionRuntime.js";
+import { createConnectionControllerV2, } from "../connectionController.js";
+export function createConnectionController(source, options) {
+    const controllerOptions = options.maximumAttempts === undefined
+        ? {}
+        : { maximumAttempts: options.maximumAttempts };
+    return createConnectionControllerV2(source, async (lease, signal) => await connect(lease, {
+        origin: options.origin,
+        signal,
+        ...(options.connectTimeoutMs === undefined ? {} : { connectTimeoutMs: options.connectTimeoutMs }),
+        ...(options.tls === undefined ? {} : { tls: options.tls }),
+    }), controllerOptions);
+}
+export async function connect(lease, options) {
+    let origin;
+    let wsFactory;
+    try {
+        origin = normalizeOrigin(options.origin);
+        wsFactory = createNodeWsFactory(options.tls);
+    }
+    catch {
+        throw new ConnectError("invalid_options");
+    }
+    const connector = new SessionConnectorV2(lease, composeCandidateAttemptFactoryV2({
+        websocket: createWebSocketCandidateFactoryV2((url, subprotocol) => wsFactory(url, origin, subprotocol)),
+        webtransport: createWebTransportCandidateFactoryV2(async (candidate, artifact, signal) => await createNodeWebTransportClientV2(candidate.normalized_url, {
+            path: artifact.path.kind,
+            inboundBidirectionalStreamCapacity: artifact.session.max_inbound_streams + 2,
+            signal,
+            ...(options.tls?.serverCertificateHash === undefined
+                ? {}
+                : { serverCertificateHash: options.tls.serverCertificateHash }),
+        })),
+    }), {
+        capability: NODE_RUNTIME_CAPABILITY_V2,
+        runtime: nodeSessionRuntimeV2,
+        ...(options.connectTimeoutMs === undefined ? {} : { connectTimeoutMs: options.connectTimeoutMs }),
+    });
+    const result = await connector.connect(options.signal === undefined ? {} : { signal: options.signal });
+    return projectSessionV2(result.session);
+}
+function normalizeOrigin(input) {
+    let parsed;
+    try {
+        parsed = new URL(input);
+    }
+    catch {
+        throw new TypeError("origin must be an absolute HTTP(S) origin");
+    }
+    if ((parsed.protocol !== "https:" && parsed.protocol !== "http:") || parsed.origin !== input || parsed.username !== "" || parsed.password !== "") {
+        throw new TypeError("origin must be an absolute HTTP(S) origin without path, query, or credentials");
+    }
+    return parsed.origin;
+}

package/dist/node/index.d.ts

@@ -1,11 +1,3 @@
-export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
-export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, NetworkPlaintextPolicyOptions, } from "../client-connect/transportSecurity.js";
-export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
-export type { DirectNodeReconnectConfig, NodeReconnectConfig, TunnelNodeReconnectConfig, } from "./reconnectConfig.js";
-export { createDirectNodeReconnectConfig, createNodeReconnectConfig, createTunnelNodeReconnectConfig, } from "./reconnectConfig.js";
-export * from "../endpoint/index.js";
-export * from "../endpoint/node.js";
-export * from "../proxy/server.js";
-export type { ConnectArtifact, CorrelationContext, CorrelationKV, DirectClientConnectArtifact, ScopeMetadataEntry, TunnelClientConnectArtifact, } from "../connect/artifact.js";
-export { assertConnectArtifact } from "../connect/artifact.js";
+export { connect, createConnectionController } from "./connectSession.js";
+export type { ConnectionControllerOptions, SessionOptions, SessionTLSOptions, } from "./connectSession.js";
+export * from "../facade.js";

package/dist/node/index.js

@@ -1,8 +1,2 @@
-export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
-export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
-export { createDirectNodeReconnectConfig, createNodeReconnectConfig, createTunnelNodeReconnectConfig, } from "./reconnectConfig.js";
-export * from "../endpoint/index.js";
-export * from "../endpoint/node.js";
-export * from "../proxy/server.js";
-export { assertConnectArtifact } from "../connect/artifact.js";
+export { connect, createConnectionController } from "./connectSession.js";
+export * from "../facade.js";

package/dist/node/runtimeCapability.d.ts

@@ -0,0 +1,7 @@
+export declare const NODE_RUNTIME_CAPABILITY_V2: Readonly<{
+    language: string;
+    runtime: string;
+    schemaVersion: 2;
+    tuples: readonly import("../v2/capability.js").RuntimeCapabilityTupleV2[];
+    unsupported: readonly import("../v2/capability.js").UnsupportedRuntimeCarrierV2[];
+}>;

package/dist/node/runtimeCapability.js

@@ -0,0 +1,10 @@
+import { defineRuntimeCapabilityDescriptorV2 } from "../v2/capability.js";
+export const NODE_RUNTIME_CAPABILITY_V2 = defineRuntimeCapabilityDescriptorV2("node", [
+    { carrier: "websocket", datagrams: false, migration: false, networkMode: "dial", path: "direct", reliableStreams: true, sessionRole: "client" },
+    { carrier: "websocket", datagrams: false, migration: false, networkMode: "dial", path: "tunnel", reliableStreams: true, sessionRole: "client" },
+    { carrier: "websocket", datagrams: false, migration: false, networkMode: "dial", path: "tunnel", reliableStreams: true, sessionRole: "server" },
+    { carrier: "webtransport", datagrams: true, migration: false, networkMode: "dial", path: "direct", reliableStreams: true, sessionRole: "client" },
+    { carrier: "webtransport", datagrams: true, migration: false, networkMode: "dial", path: "tunnel", reliableStreams: true, sessionRole: "client" },
+    { carrier: "webtransport", datagrams: true, migration: false, networkMode: "dial", path: "tunnel", reliableStreams: true, sessionRole: "server" },
+    { carrier: "webtransport", datagrams: true, migration: false, networkMode: "listen", path: "direct", reliableStreams: true, sessionRole: "server" },
+], [{ carrier: "raw_quic", reason: "raw_quic_adapter_not_implemented" }]);

package/dist/node/sessionRuntime.d.ts

@@ -0,0 +1,2 @@
+import type { SessionProtocolRuntimeV2 } from "../v2/session.js";
+export declare const nodeSessionRuntimeV2: SessionProtocolRuntimeV2;

package/dist/node/sessionRuntime.js

@@ -0,0 +1,13 @@
+import { randomBytes } from "node:crypto";
+import { performance } from "node:perf_hooks";
+export const nodeSessionRuntimeV2 = Object.freeze({
+    entropy(length) {
+        if (!Number.isSafeInteger(length) || length < 1 || length > 65_536) {
+            throw new RangeError("entropy length must be an integer from 1 to 65536");
+        }
+        return Uint8Array.from(randomBytes(length));
+    },
+    monotonicMilliseconds() {
+        return performance.now();
+    },
+});

package/dist/node/webTransportClient.d.ts

@@ -0,0 +1,9 @@
+import type { NativeCarrierSessionV2 } from "../v2/carrier.js";
+import type { PathKind } from "../v2/contract.js";
+export type NodeWebTransportClientOptionsV2 = Readonly<{
+    path: PathKind;
+    inboundBidirectionalStreamCapacity: number;
+    signal?: AbortSignal;
+    serverCertificateHash?: Uint8Array;
+}>;
+export declare function createNodeWebTransportClientV2(url: string, options: NodeWebTransportClientOptionsV2): Promise<NativeCarrierSessionV2>;

package/dist/node/webTransportClient.js

@@ -0,0 +1,56 @@
+import { adaptWebTransportCarrierSessionV2 } from "../transport/webTransportAdapter.js";
+import { RuntimeError } from "../runtime/errors.js";
+export async function createNodeWebTransportClientV2(url, options) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch (error) {
+        throw new RuntimeError("runtime_start_failed", "Node WebTransport URL is invalid", error);
+    }
+    if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") {
+        throw new RuntimeError("runtime_start_failed", "Node WebTransport requires an HTTPS URL without credentials");
+    }
+    if (options.signal?.aborted === true)
+        throw options.signal.reason;
+    let transport;
+    try {
+        const runtime = await loadNodeWebTransportRuntime();
+        await raceAbort(runtime.quicheLoaded, options.signal);
+        transport = new runtime.WebTransport(parsed.href, {
+            requireUnreliable: true,
+            ...(options.serverCertificateHash === undefined
+                ? {}
+                : { serverCertificateHashes: [{ algorithm: "sha-256", value: options.serverCertificateHash.slice() }] }),
+        });
+        await raceAbort(transport.ready, options.signal);
+        return adaptWebTransportCarrierSessionV2(transport, {
+            path: options.path,
+            inboundBidirectionalStreamCapacity: options.inboundBidirectionalStreamCapacity,
+            datagramMaxSize: 1_200,
+        });
+    }
+    catch (error) {
+        transport?.close({ closeCode: 6, reason: "Node WebTransport start failed" });
+        if (error instanceof RuntimeError)
+            throw error;
+        throw new RuntimeError("runtime_start_failed", "Node WebTransport failed to start", error);
+    }
+}
+const NODE_WEBTRANSPORT_MODULE = "@fails-components/webtransport";
+let runtimePromise;
+function loadNodeWebTransportRuntime() {
+    runtimePromise ??= import(NODE_WEBTRANSPORT_MODULE).then((value) => value);
+    return runtimePromise;
+}
+async function raceAbort(promise, signal) {
+    if (signal === undefined)
+        return await promise;
+    if (signal.aborted)
+        throw signal.reason;
+    return await new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        void promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}

package/dist/node/webTransportServer.d.ts

@@ -0,0 +1,22 @@
+import type { NativeCarrierSessionV2 } from "../v2/carrier.js";
+import type { PathKind } from "../v2/contract.js";
+export type NodeWebTransportServerOptionsV2 = Readonly<{
+    host: string;
+    port: number;
+    path: string;
+    certificate: string;
+    privateKey: string;
+    carrierPath: PathKind;
+    inboundBidirectionalStreamCapacity: number;
+}>;
+export type NodeWebTransportServerV2 = Readonly<{
+    address(): Readonly<{
+        host: string;
+        port: number;
+    }>;
+    accept(options?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<NativeCarrierSessionV2>;
+    close(): Promise<void>;
+}>;
+export declare function startNodeWebTransportServerV2(options: NodeWebTransportServerOptionsV2): Promise<NodeWebTransportServerV2>;

package/dist/node/webTransportServer.js

@@ -0,0 +1,100 @@
+import { randomBytes } from "node:crypto";
+import { adaptWebTransportCarrierSessionV2 } from "../transport/webTransportAdapter.js";
+import { RuntimeError } from "../runtime/errors.js";
+export async function startNodeWebTransportServerV2(options) {
+    if (!options.path.startsWith("/") || options.path.includes("?") || options.path.includes("#")) {
+        throw new TypeError("Node WebTransport server path must be an absolute path");
+    }
+    if (!Number.isInteger(options.port) || options.port < 0 || options.port > 65_535) {
+        throw new RangeError("Node WebTransport server port is invalid");
+    }
+    let runtime;
+    try {
+        runtime = await loadNodeWebTransportRuntime();
+        await runtime.quicheLoaded;
+    }
+    catch (error) {
+        throw new RuntimeError("runtime_start_failed", "Node WebTransport runtime failed to load", error);
+    }
+    let server;
+    try {
+        server = new runtime.Http3Server({
+            host: options.host,
+            port: options.port,
+            secret: randomBytes(32).toString("hex"),
+            cert: options.certificate,
+            privKey: options.privateKey,
+        });
+    }
+    catch (error) {
+        throw new RuntimeError("runtime_start_failed", "Node WebTransport server could not be created", error);
+    }
+    const sessions = server.sessionStream(options.path).getReader();
+    server.startServer();
+    try {
+        await server.ready;
+    }
+    catch (error) {
+        server.stopServer();
+        throw new RuntimeError("runtime_start_failed", "Node WebTransport server failed to start", error);
+    }
+    let closed = false;
+    return {
+        address() {
+            const address = server.address();
+            if (address === null)
+                throw new Error("Node WebTransport server is not listening");
+            return Object.freeze({ host: address.host, port: address.port });
+        },
+        async accept(acceptOptions = {}) {
+            if (closed)
+                throw new Error("Node WebTransport server is closed");
+            try {
+                const result = await raceAbort(sessions.read(), acceptOptions.signal);
+                if (result.done || result.value === undefined) {
+                    throw new RuntimeError("runtime_crashed", "Node WebTransport server session stream closed");
+                }
+                await raceAbort(result.value.ready, acceptOptions.signal);
+                return adaptWebTransportCarrierSessionV2(result.value, {
+                    path: options.carrierPath,
+                    inboundBidirectionalStreamCapacity: options.inboundBidirectionalStreamCapacity,
+                    datagramMaxSize: 1_200,
+                });
+            }
+            catch (error) {
+                if (error instanceof RuntimeError)
+                    throw error;
+                throw new RuntimeError("runtime_crashed", "Node WebTransport server failed while accepting a session", error);
+            }
+        },
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            server.stopServer();
+            try {
+                await server.closed;
+            }
+            catch (error) {
+                throw new RuntimeError("runtime_crashed", "Node WebTransport server failed while closing", error);
+            }
+        },
+    };
+}
+const NODE_WEBTRANSPORT_MODULE = "@fails-components/webtransport";
+let runtimePromise;
+function loadNodeWebTransportRuntime() {
+    runtimePromise ??= import(NODE_WEBTRANSPORT_MODULE).then((value) => value);
+    return runtimePromise;
+}
+async function raceAbort(promise, signal) {
+    if (signal === undefined)
+        return await promise;
+    if (signal.aborted)
+        throw signal.reason;
+    return await new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        void promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}

package/dist/node/wsFactory.d.ts

@@ -2,5 +2,7 @@ import type { WebSocketLike } from "../ws-client/binaryTransport.js";
 export type NodeWsFactoryOptions = Readonly<{
     maxPayload?: number;
     perMessageDeflate?: boolean;
+    /** Additional trusted CA certificate(s) for private WSS deployments. */
+    ca?: string | Uint8Array;
 }>;
-export declare function createNodeWsFactory(opts?: NodeWsFactoryOptions): (url: string, origin: string) => WebSocketLike;
+export declare function createNodeWsFactory(opts?: NodeWsFactoryOptions): (url: string, origin: string, subprotocol?: string) => WebSocketLike;

package/dist/node/wsFactory.js

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import { defaultWsMaxPayload } from "./wsDefaults.js";
-// createNodeWsFactory returns a wsFactory compatible with connectTunnel/connectDirect in Node.js.
+// createNodeWsFactory adapts the Node WebSocket runtime for candidate dialing.
 //
 // It uses the "ws" package to set the Origin header explicitly (browsers set Origin automatically).
 export function createNodeWsFactory(opts = {}) {
@@ -13,11 +13,12 @@ export function createNodeWsFactory(opts = {}) {
     }
     const maxPayload = maxPayloadRaw;
     const perMessageDeflate = opts.perMessageDeflate ?? false;
-    return (url, origin) => {
-        const raw = new WebSocketCtor(url, {
+    return (url, origin, subprotocol) => {
+        const raw = new WebSocketCtor(url, subprotocol === undefined ? undefined : [subprotocol], {
             headers: { Origin: origin },
             maxPayload,
             perMessageDeflate,
+            ...(opts.ca === undefined ? {} : { ca: opts.ca }),
         });
         // Map (type -> user listener -> wrapped listener) so removeEventListener works.
         const listeners = new Map();

package/dist/proxy/controllerGuard.d.ts

@@ -24,10 +24,10 @@ export type ServiceWorkerControllerGuardOptions = Readonly<{
     repair?: ServiceWorkerControllerGuardRepairOptions;
     monitor?: ServiceWorkerControllerGuardMonitorOptions;
     conflicts?: ServiceWorkerControllerGuardConflictPolicy;
-    onControllerMismatch?: (ctx: ServiceWorkerControllerGuardMismatchContext) => "repair" | "ignore" | void;
+    onControllerMismatch?: (context: ServiceWorkerControllerGuardMismatchContext) => "repair" | "ignore" | void;
 }>;
 export type ServiceWorkerControllerGuardHandle = Readonly<{
-    ensure: () => Promise<void>;
-    dispose: () => void;
+    ensure(): Promise<void>;
+    dispose(): void;
 }>;
-export declare function createServiceWorkerControllerGuard(opts: ServiceWorkerControllerGuardOptions): ServiceWorkerControllerGuardHandle;
+export declare function createServiceWorkerControllerGuard(options: ServiceWorkerControllerGuardOptions): ServiceWorkerControllerGuardHandle;