@floegence/flowersec-core 3.2.0 → 4.0.0

package/dist/node/nativeTransportAddon.js

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
-import { CarrierError, } from "../v2/carrier.js";
-export const NATIVE_TRANSPORT_CONTRACT_VERSION = 2;
+import { CarrierError } from "../v3/carrier.js";
+export const NATIVE_TRANSPORT_CONTRACT_VERSION = 3;
 const NATIVE_PACKAGE = "@floegence/flowersec-node-native";
 const SERVER_PARITY_NATIVE_ADDON = "FLOWERSEC_SERVER_PARITY_NATIVE_ADDON";
 export class NativeTransportUnavailableError extends Error {
@@ -45,31 +45,13 @@ export function createNativeRawQuicDriver(addon = loadNativeTransportAddon()) {
     return Object.freeze({
         async connectRawQuic(options, operation = {}) {
             const native = await settle(addon.connectRawQuic(options), operation.signal);
-            return wrapSession(native, 2);
+            return wrapSession(native);
         },
         async bindRawQuic(options) {
             const native = await addon.bindRawQuic(options);
             return Object.freeze({
                 address: () => native.address(),
-                accept: async (operation = {}) => wrapSession(await settle(native.accept(), operation.signal), 2),
-                async close() {
-                    await native.close();
-                },
-            });
-        },
-    });
-}
-export function createNativeRawQuicDriverV3(addon = loadNativeTransportAddon()) {
-    return Object.freeze({
-        async connectRawQuic(options, operation = {}) {
-            const native = await settle(addon.connectRawQuicV3(options), operation.signal);
-            return wrapSession(native, 3);
-        },
-        async bindRawQuic(options) {
-            const native = await addon.bindRawQuicV3(options);
-            return Object.freeze({
-                address: () => native.address(),
-                accept: async (operation = {}) => wrapSession(await settle(native.accept(), operation.signal), 3),
+                accept: async (operation = {}) => wrapSession(await settle(native.accept(), operation.signal)),
                 async close() {
                     await native.close();
                 },
@@ -92,12 +74,10 @@ function isNativeTransportAddon(value) {
     }
     return contractVersion === NATIVE_TRANSPORT_CONTRACT_VERSION &&
         typeof candidate.connectRawQuic === "function" &&
-        typeof candidate.bindRawQuic === "function" &&
-        typeof candidate.connectRawQuicV3 === "function" &&
-        typeof candidate.bindRawQuicV3 === "function";
+        typeof candidate.bindRawQuic === "function";
 }
-function wrapSession(native, expectedWireVersion) {
-    if (native.wireVersion !== expectedWireVersion) {
+function wrapSession(native) {
+    if (native.wireVersion !== 3) {
         native.abort();
         throw new NativeTransportUnavailableError();
     }

package/dist/node/proxyServer.d.ts

@@ -1,6 +1,6 @@
 import { StreamHandlers } from "../public/streamHandlers.js";
-import { SessionHandlers } from "./acceptor.js";
-export type StreamHandlerRegistrar = StreamHandlers | SessionHandlers;
+import { SessionHandlersV3 } from "./acceptor.js";
+export type StreamHandlerRegistrar = StreamHandlers | SessionHandlersV3;
 export type ProxyServerOptions = Readonly<{
     upstream: string;
     upstreamOrigin: string;

package/dist/node/proxyServer.js

@@ -3,7 +3,7 @@ import { SessionError } from "../public/contract.js";
 import { writeJsonFrame } from "../framing/jsonframe.js";
 import { ProxyByteReader, writeAll } from "../proxy/stream.js";
 import { StreamHandlers, registerStreamHandlersAtomically, } from "../public/streamHandlers.js";
-import { SessionHandlers, registerSessionStreamHandlersAtomically, } from "./acceptor.js";
+import { SessionHandlersV3, registerSessionStreamHandlersAtomically, } from "./acceptor.js";
 const HTTP_KIND = "flowersec-proxy/http1";
 const WS_KIND = "flowersec-proxy/ws";
 const WIRE_VERSION = 1;
@@ -47,7 +47,7 @@ export class ProxyServer {
             if (handlers instanceof StreamHandlers) {
                 registerStreamHandlersAtomically(handlers, registrations);
             }
-            else if (handlers instanceof SessionHandlers) {
+            else if (handlers instanceof SessionHandlersV3) {
                 registerSessionStreamHandlersAtomically(handlers, registrations);
             }
             else {

package/dist/node/rawQuicAdapterV3.d.ts

@@ -1,8 +1,8 @@
 import type { ArtifactV3, CanonicalArtifactCandidateV3 } from "../v3/artifact.js";
 import type { NativeCarrierSessionV3 } from "../v3/carrier.js";
-import type { NativeRawQuicDriverV3 } from "./nativeTransportAddon.js";
+import type { NativeRawQuicDriver } from "./nativeTransportAddon.js";
 type NodeTLSRootsV3 = string | Uint8Array | readonly (string | Uint8Array)[];
-export declare function createNodeRawQuicClientV3(driver: NativeRawQuicDriverV3, candidate: CanonicalArtifactCandidateV3, artifact: ArtifactV3, attemptNowUnixSeconds: number, options?: Readonly<{
+export declare function createNodeRawQuicClientV3(driver: NativeRawQuicDriver, candidate: CanonicalArtifactCandidateV3, artifact: ArtifactV3, attemptNowUnixSeconds: number, options?: Readonly<{
     roots?: NodeTLSRootsV3;
     signal?: AbortSignal;
     handshakeTimeoutMs?: number;

package/dist/node/rawQuicAdapterV3.js

@@ -1,6 +1,6 @@
 import { rootCertificates } from "node:tls";
 import { snapshotTransportSecurityPolicyV3, TransportFailureV3, } from "../v3/security.js";
-import { normalizeCertificateChain } from "./rawQuicAdapter.js";
+import { normalizeCertificateChain } from "./rawQuicTls.js";
 import { alpnForPathV3 } from "../v3/transportConstants.js";
 const DEFAULT_HANDSHAKE_TIMEOUT_MS = 10_000;
 export async function createNodeRawQuicClientV3(driver, candidate, artifact, attemptNowUnixSeconds, options = {}) {

package/dist/node/rawQuicServerV3.d.ts

@@ -1,6 +1,6 @@
 import { type CarrierSessionV3 } from "../v3/carrier.js";
 import type { PathKind } from "../v3/contract.js";
-import type { NativeRawQuicDriverV3 } from "./nativeTransportAddon.js";
+import type { NativeRawQuicDriver } from "./nativeTransportAddon.js";
 export type NodeRawQuicListenerOptionsV3 = Readonly<{
     host: string;
     port: number;
@@ -21,4 +21,4 @@ export type NodeRawQuicListenerV3 = Readonly<{
     }>): Promise<CarrierSessionV3>;
     close(): Promise<void>;
 }>;
-export declare function startNodeRawQuicListenerV3(driver: NativeRawQuicDriverV3, options: NodeRawQuicListenerOptionsV3): Promise<NodeRawQuicListenerV3>;
+export declare function startNodeRawQuicListenerV3(driver: NativeRawQuicDriver, options: NodeRawQuicListenerOptionsV3): Promise<NodeRawQuicListenerV3>;

package/dist/node/rawQuicServerV3.js

@@ -1,5 +1,5 @@
 import { adaptNativeCarrierSessionV3 } from "../v3/carrier.js";
-import { normalizeCertificateChain, normalizePrivateKey } from "./rawQuicAdapter.js";
+import { normalizeCertificateChain, normalizePrivateKey } from "./rawQuicTls.js";
 export async function startNodeRawQuicListenerV3(driver, options) {
     validateOptions(options);
     let listener;

package/dist/node/rawQuicTls.d.ts

@@ -0,0 +1,2 @@
+export declare function normalizeCertificateChain(input: string | Uint8Array | readonly (string | Uint8Array)[]): readonly Uint8Array[];
+export declare function normalizePrivateKey(input: string | Uint8Array): Uint8Array;

package/dist/node/{rawQuicAdapter.js → rawQuicTls.js}

@@ -1,25 +1,8 @@
 import { X509Certificate, createPrivateKey } from "node:crypto";
-const DEFAULT_HANDSHAKE_TIMEOUT_MS = 10_000;
 const CERTIFICATE_PEM_BEGIN = "-----BEGIN CERTIFICATE-----";
 const CERTIFICATE_PEM_END = "-----END CERTIFICATE-----";
 const MAX_CERTIFICATE_PEM_BYTES = 256 * 1024;
 const MAX_CERTIFICATE_CHAIN_LENGTH = 32;
-export async function createNodeRawQuicClientV2(driver, candidate, artifact, tls, signal, handshakeTimeoutMs = DEFAULT_HANDSHAKE_TIMEOUT_MS) {
-    const url = new URL(candidate.normalized_url);
-    if (candidate.carrier !== "raw_quic" || url.protocol !== "quic:" || url.port === "") {
-        throw new TypeError("invalid raw QUIC candidate");
-    }
-    const options = {
-        host: unbracket(url.hostname),
-        port: Number(url.port),
-        serverName: unbracket(url.hostname),
-        path: artifact.path.kind,
-        trustRootsDer: normalizeCertificateChain(tls.ca),
-        inboundBidirectionalStreamCapacity: artifact.session.max_inbound_streams + 2,
-        handshakeTimeoutMs,
-    };
-    return await driver.connectRawQuic(options, { signal });
-}
 export function normalizeCertificateChain(input) {
     const values = Array.isArray(input) ? input : [input];
     const certificates = [];
@@ -28,32 +11,46 @@ export function normalizeCertificateChain(input) {
         if (typeof value !== "string" && !(value instanceof Uint8Array)) {
             throw new TypeError("invalid raw QUIC certificate");
         }
-        totalInputBytes += typeof value === "string" ? Buffer.byteLength(value, "utf8") : value.byteLength;
-        if (totalInputBytes > MAX_CERTIFICATE_PEM_BYTES)
+        totalInputBytes += typeof value === "string"
+            ? Buffer.byteLength(value, "utf8")
+            : value.byteLength;
+        if (totalInputBytes > MAX_CERTIFICATE_PEM_BYTES) {
             throw new TypeError("invalid raw QUIC certificate");
+        }
         if (typeof value === "string") {
             const blocks = splitCertificatePEM(value);
-            if (blocks.length === 0)
-                throw new TypeError("invalid raw QUIC certificate");
-            if (certificates.length + blocks.length > MAX_CERTIFICATE_CHAIN_LENGTH) {
+            if (blocks.length === 0 || certificates.length + blocks.length > MAX_CERTIFICATE_CHAIN_LENGTH) {
                 throw new TypeError("invalid raw QUIC certificate");
             }
             for (const block of blocks)
                 certificates.push(parseCertificate(block));
         }
-        else if (value instanceof Uint8Array && value.length > 0) {
-            if (certificates.length >= MAX_CERTIFICATE_CHAIN_LENGTH)
+        else if (value.length > 0) {
+            if (certificates.length >= MAX_CERTIFICATE_CHAIN_LENGTH) {
                 throw new TypeError("invalid raw QUIC certificate");
+            }
             certificates.push(parseCertificate(value));
         }
         else {
             throw new TypeError("invalid raw QUIC certificate");
         }
     }
-    if (certificates.length === 0)
+    if (certificates.length === 0) {
         throw new TypeError("raw QUIC requires explicit trust roots");
+    }
     return certificates;
 }
+export function normalizePrivateKey(input) {
+    if (input.length === 0)
+        throw new TypeError("invalid raw QUIC private key");
+    try {
+        const key = createPrivateKey(input);
+        return new Uint8Array(key.export({ format: "der", type: "pkcs8" }));
+    }
+    catch {
+        throw new TypeError("invalid raw QUIC private key");
+    }
+}
 function splitCertificatePEM(value) {
     if (Buffer.byteLength(value, "utf8") > MAX_CERTIFICATE_PEM_BYTES) {
         throw new TypeError("invalid raw QUIC certificate");
@@ -63,37 +60,28 @@ function splitCertificatePEM(value) {
     while (cursor < value.length) {
         const begin = value.indexOf(CERTIFICATE_PEM_BEGIN, cursor);
         if (begin < 0) {
-            if (value.slice(cursor).trim().length !== 0)
+            if (value.slice(cursor).trim().length !== 0) {
                 throw new TypeError("invalid raw QUIC certificate");
+            }
             break;
         }
-        if (value.slice(cursor, begin).trim().length !== 0)
+        if (value.slice(cursor, begin).trim().length !== 0) {
             throw new TypeError("invalid raw QUIC certificate");
+        }
         const contentStart = begin + CERTIFICATE_PEM_BEGIN.length;
         const end = value.indexOf(CERTIFICATE_PEM_END, contentStart);
-        if (end < 0 || value.indexOf(CERTIFICATE_PEM_BEGIN, contentStart) >= 0 && value.indexOf(CERTIFICATE_PEM_BEGIN, contentStart) < end) {
+        const nested = value.indexOf(CERTIFICATE_PEM_BEGIN, contentStart);
+        if (end < 0 || nested >= 0 && nested < end) {
             throw new TypeError("invalid raw QUIC certificate");
         }
         blocks.push(value.slice(begin, end + CERTIFICATE_PEM_END.length));
-        if (blocks.length > MAX_CERTIFICATE_CHAIN_LENGTH)
+        if (blocks.length > MAX_CERTIFICATE_CHAIN_LENGTH) {
             throw new TypeError("invalid raw QUIC certificate");
+        }
         cursor = end + CERTIFICATE_PEM_END.length;
     }
     return blocks;
 }
-export function normalizePrivateKey(input) {
-    if ((typeof input === "string" && input.length === 0) ||
-        (input instanceof Uint8Array && input.length === 0)) {
-        throw new TypeError("invalid raw QUIC private key");
-    }
-    try {
-        const key = createPrivateKey(input);
-        return new Uint8Array(key.export({ format: "der", type: "pkcs8" }));
-    }
-    catch {
-        throw new TypeError("invalid raw QUIC private key");
-    }
-}
 function parseCertificate(input) {
     try {
         return new Uint8Array(new X509Certificate(input).raw);
@@ -102,6 +90,3 @@ function parseCertificate(input) {
         throw new TypeError("invalid raw QUIC certificate");
     }
 }
-function unbracket(host) {
-    return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-}

package/dist/node/tunnelRuntimeV3.js

@@ -2,7 +2,7 @@ import { createAdmissionReasonRegistryV3, receiveSessionAdmissionV3, rejectSessi
 import { configureServerWebSocketCarrierRoleV3 } from "../v3/webSocketCarrier.js";
 import { AdmissionStatusV3, encodeFSA3ResponseV3, } from "../v3/artifact.js";
 import { startNodeWebSocketListenerV3 } from "./webSocketServerV3.js";
-import { createNativeRawQuicDriverV3 } from "./nativeTransportAddon.js";
+import { createNativeRawQuicDriver } from "./nativeTransportAddon.js";
 import { startNodeRawQuicListenerV3 } from "./rawQuicServerV3.js";
 import { consumeTunnelAuthorizationGrantV3, inspectTunnelAuthorizationGrantV3, retireTunnelAuthorizationGrantV3, runtimeAuthorizationRequestV3FromDecoded, validateTunnelAuthorizationGrantV3, } from "./runtimeAuthorizationV3.js";
 const DEFAULT_PAIR_TIMEOUT_MS = 10_000;
@@ -107,7 +107,7 @@ async function startTunnelRuntimeV3(state) {
                             pendingSessionTimeoutMs: state.limits.admissionTimeoutMs,
                             cleanupTimeoutMs: state.limits.cleanupTimeoutMs,
                         })
-                        : await startNodeRawQuicListenerV3(rawQuicDriver ??= createNativeRawQuicDriverV3(), {
+                        : await startNodeRawQuicListenerV3(rawQuicDriver ??= createNativeRawQuicDriver(), {
                             ...listener,
                             path: "tunnel",
                             inboundBidirectionalStreamCapacity: state.options.maxInboundStreams + 2,

package/dist/proxy/integration.d.ts

@@ -1,10 +1,10 @@
-import { type SessionOptions } from "../browser/connectSession.js";
-import type { ArtifactLease } from "../public/artifactLease.js";
+import { type SessionOptionsV3 } from "../browser/connectSessionV3.js";
+import type { ArtifactLeaseV3 } from "../v3/artifactLease.js";
 import type { Session } from "../public/contract.js";
 import type { ProxyRuntime, ProxyRuntimeOptions } from "./types.js";
 import { type ProxyControllerWindowHandle, type RegisterProxyControllerWindowOptions } from "./windowBridge.js";
 export type ProxyBrowserConnectOptions = Readonly<{
-    connect?: SessionOptions;
+    connect?: SessionOptionsV3;
     runtime?: Omit<ProxyRuntimeOptions, "session">;
     serviceWorker?: Readonly<{
         scriptUrl: string;
@@ -19,11 +19,11 @@ export type ProxyBrowserHandle = Readonly<{
     runtime: ProxyRuntime;
     dispose(): Promise<void>;
 }>;
-export declare function connectProxyBrowser(lease: ArtifactLease, options?: ProxyBrowserConnectOptions): Promise<ProxyBrowserHandle>;
+export declare function connectProxyBrowser(lease: ArtifactLeaseV3, options?: ProxyBrowserConnectOptions): Promise<ProxyBrowserHandle>;
 export type ProxyControllerBrowserConnectOptions = ProxyBrowserConnectOptions & Readonly<{
     controller: Omit<RegisterProxyControllerWindowOptions, "runtime">;
 }>;
 export type ProxyControllerBrowserHandle = ProxyBrowserHandle & Readonly<{
     controller: ProxyControllerWindowHandle;
 }>;
-export declare function connectProxyControllerBrowser(lease: ArtifactLease, options: ProxyControllerBrowserConnectOptions): Promise<ProxyControllerBrowserHandle>;
+export declare function connectProxyControllerBrowser(lease: ArtifactLeaseV3, options: ProxyControllerBrowserConnectOptions): Promise<ProxyControllerBrowserHandle>;

package/dist/proxy/integration.js

@@ -1,9 +1,9 @@
-import { connect } from "../browser/connectSession.js";
+import { connectV3 } from "../browser/connectSessionV3.js";
 import { createProxyRuntime } from "./runtime.js";
 import { registerServiceWorkerAndEnsureControl } from "./registerServiceWorker.js";
 import { registerProxyControllerWindow, } from "./windowBridge.js";
 export async function connectProxyBrowser(lease, options = {}) {
-    const session = await connect(lease, options.connect);
+    const session = await connectV3(lease, options.connect);
     let runtime;
     try {
         if (options.serviceWorker !== undefined)

package/dist/public/streamHandlers.d.ts

@@ -18,6 +18,3 @@ export declare class StreamHandlers {
     handleStream(kind: string, handler: StreamHandler): void;
     serve(session: Session, options?: OperationOptions): Promise<void>;
 }
-/** Explicit-compatibility application-stream handlers. */
-export declare class LegacyStreamHandlers extends StreamHandlers {
-}

package/dist/public/streamHandlers.js

@@ -1,5 +1,5 @@
 import { SessionError, } from "./contract.js";
-import { validApplicationStreamKind } from "../v2/protocol.js";
+import { validApplicationStreamKind } from "../v3/protocol.js";
 const DEFAULT_MAX_CONCURRENT_STREAMS = 64;
 const MAX_CONCURRENT_STREAMS = 128;
 export class HandlerRegistrationError extends Error {
@@ -11,6 +11,7 @@ export class HandlerRegistrationError extends Error {
     }
 }
 const streamHandlerStates = new WeakMap();
+// The v2 identifier is denied so it cannot be repurposed as an application stream.
 const RESERVED_RPC_KINDS = new Set(["flowersec.rpc.v2", "flowersec.rpc.v3"]);
 /** Carrier-neutral application-stream handlers for any established Session. */
 export class StreamHandlers {
@@ -38,9 +39,6 @@ export class StreamHandlers {
         await serveFrozenStreamHandlers(freezeStreamHandlers(this), session, options, async () => await session.close());
     }
 }
-/** Explicit-compatibility application-stream handlers. */
-export class LegacyStreamHandlers extends StreamHandlers {
-}
 function mutableStreamHandlerState(handlers) {
     const state = streamHandlerStates.get(handlers);
     if (state === undefined)

package/dist/public/streamMetadata.js

@@ -1,4 +1,4 @@
-import { canonicalStreamMetadataJSONV2Internal } from "../v2/protocol.js";
+import { canonicalStreamMetadataJSONV3Internal } from "../v3/protocol.js";
 export class StreamMetadataError extends Error {
     constructor() {
         super("invalid Flowersec stream metadata");
@@ -18,7 +18,7 @@ export class StreamMetadata {
 }
 export function createStreamMetadata(values) {
     try {
-        const canonical = canonicalStreamMetadataJSONV2Internal(values);
+        const canonical = canonicalStreamMetadataJSONV3Internal(values);
         return StreamMetadata.fromCanonicalValues(deepFreeze(JSON.parse(canonical)));
     }
     catch {

package/dist/runtime/errors.d.ts

@@ -1,6 +1,6 @@
 export type RuntimeErrorCode = "runtime_unsupported" | "runtime_start_failed" | "runtime_crashed";
 export declare class RuntimeError extends Error {
     readonly code: RuntimeErrorCode;
-    readonly cause?: unknown | undefined;
-    constructor(code: RuntimeErrorCode, message: string, cause?: unknown | undefined);
+    readonly cause?: unknown;
+    constructor(code: RuntimeErrorCode, message: string, cause?: unknown);
 }

package/dist/testSupport/tlsFixture.d.ts

@@ -0,0 +1,2 @@
+export declare const testCertificatePEM: string;
+export declare const testPrivateKeyPEM: string;

package/dist/testSupport/tlsFixture.js

@@ -0,0 +1,8 @@
+const certificateDER = Buffer.from("MIIBjzCCAUGgAwIBAgIUW8hQEpQsUJN9a6qqF2g6hsNpSm8wBQYDK2VwMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0yNjA3MjAxOTAxMjFaFw0zNjA3MTcxOTAxMjFaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDAqMAUGAytlcAMhAAihki/Jec+1EaC6E6PsSxjMYFAazrgkNiUIlbj/+A/0o4GkMIGhMB0GA1UdDgQWBBQCuKxQmMQkAAy9KkfuD+WOmrrMbTAfBgNVHSMEGDAWgBQCuKxQmMQkAAy9KkfuD+WOmrrMbTAsBgNVHREEJTAjgglsb2NhbGhvc3SHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwBQYDK2VwA0EArZng3XitiH2E1pW/NTxQvEOBXJYpYE8coQmLV4yTjfI43CWHMG6lIrwk/so67oe6Z2R4iHGjUm3Tuy50Fl8hBw==", "base64");
+const privateKeyDER = Buffer.from("MC4CAQAwBQYDK2VwBCIEICxYUWHqGoh0CBBohsaNg/NThm1n3UeWCzYuq6jS+Qi6", "base64");
+export const testCertificatePEM = pem("CERTIFICATE", certificateDER);
+export const testPrivateKeyPEM = pem("PRIVATE KEY", privateKeyDER);
+function pem(label, der) {
+    const lines = Buffer.from(der).toString("base64").match(/.{1,64}/gu) ?? [];
+    return `-----BEGIN ${label}-----\n${lines.join("\n")}\n-----END ${label}-----\n`;
+}

package/dist/utils/errors.d.ts

@@ -4,5 +4,3 @@ export declare class TimeoutError extends Error {
 export declare class AbortError extends Error {
     constructor(message?: string);
 }
-export type ConnectErrorPath = "auto" | "tunnel" | "direct";
-export type ConnectErrorStage = "validate" | "connect" | "session" | "rpc" | "close";

package/dist/utils/errors.js

@@ -1,4 +1,3 @@
-import { ConnectError } from "../public/connectError.js";
 export class TimeoutError extends Error {
     constructor(message = "timeout") {
         super(message);
@@ -11,87 +10,8 @@ export class AbortError extends Error {
         this.name = "AbortError";
     }
 }
-const internalDetails = new WeakMap();
-/** @internal */
-export function createConnectErrorInternal(args) {
-    const error = new ConnectError(publicCode(args.code));
-    internalDetails.set(error, Object.freeze({
-        code: args.code,
-        stage: args.stage,
-        ...(args.cause === undefined ? {} : { cause: args.cause }),
-        diagnostics: Object.freeze((args.diagnostics ?? []).map((diagnostic) => Object.freeze({ ...diagnostic }))),
-    }));
-    return error;
-}
-/** @internal */
-export function connectErrorDetailsInternal(error) {
-    return internalDetails.get(error) ?? Object.freeze({
-        code: internalCode(error.code),
-        stage: "connect",
-        diagnostics: Object.freeze([]),
-    });
-}
-/** @internal */
-export function isTimeoutError(e) {
-    return e instanceof TimeoutError;
-}
-/** @internal */
-export function isAbortError(e) {
-    return e instanceof AbortError;
-}
-/** @internal */
-export function isConnectError(e) {
-    return e instanceof ConnectError;
-}
 /** @internal */
 export function throwIfAborted(signal, message) {
     if (signal?.aborted)
         throw new AbortError(message);
 }
-function publicCode(code) {
-    switch (code) {
-        case "timeout": return "timeout";
-        case "canceled": return "canceled";
-        case "resolve_failed": return "resolve_failed";
-        case "credential_commit_failed": return "credential_spend_failed";
-        case "handshake_failed": return "handshake_failed";
-        case "rpc_failed": return "rpc_failed";
-        case "resource_exhausted": return "resource_exhausted";
-        case "not_connected": return "not_connected";
-        case "invalid_option": return "invalid_options";
-        case "timestamp_after_init_exp": return "expired_artifact";
-        case "dial_failed":
-        case "upgrade_failed":
-        case "attach_failed":
-        case "unsupported_capability":
-        case "too_many_connections":
-        case "policy_denied":
-        case "policy_error":
-        case "replace_rate_limited":
-        case "ping_failed":
-        case "rekey_failed":
-        case "mux_failed":
-        case "accept_stream_failed":
-        case "open_stream_failed":
-        case "stream_hello_failed":
-            return "connection_failed";
-        default:
-            return "invalid_input";
-    }
-}
-function internalCode(code) {
-    switch (code) {
-        case "invalid_input": return "invalid_input";
-        case "invalid_options": return "invalid_option";
-        case "expired_artifact": return "timestamp_after_init_exp";
-        case "resolve_failed": return "resolve_failed";
-        case "credential_spend_failed": return "credential_commit_failed";
-        case "connection_failed": return "dial_failed";
-        case "timeout": return "timeout";
-        case "canceled": return "canceled";
-        case "handshake_failed": return "handshake_failed";
-        case "rpc_failed": return "rpc_failed";
-        case "resource_exhausted": return "resource_exhausted";
-        case "not_connected": return "not_connected";
-    }
-}

package/dist/v3/artifact.js

@@ -1,7 +1,8 @@
 import { sha256 } from "@noble/hashes/sha2.js";
 import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
 import { concatBytes, readU32be, u32be } from "../utils/bin.js";
-import { toASCII } from "../vendor/tr46.js";
+import { unicode151Assigned } from "../generated/unicode151.js";
+import { toASCII, toUnicode } from "../vendor/tr46.js";
 import { canonicalizeJCSV3 } from "./jcs.js";
 import { preflightJSONV3 } from "./jsonPreflight.js";
 import { FLOWERSEC_V3_CRYPTO_LABELS, FLOWERSEC_V3_PROFILE, wireProfileForPathV3, } from "./transportConstants.js";
@@ -671,14 +672,20 @@ function normalizeDNSOrIPv4(host) {
         }
         return parts.map((part) => String(Number(part))).join(".");
     }
-    const ascii = toASCII(host, {
+    const options = {
         checkHyphens: true,
         checkBidi: true,
         checkJoiners: true,
         useSTD3ASCIIRules: true,
         verifyDNSLength: true,
         transitionalProcessing: false,
-    });
+    };
+    if (!hasOnlyUnicode151Scalars(host))
+        throw invalidCandidate("DNS label");
+    const decoded = toUnicode(host, options);
+    if (decoded.error || !hasOnlyUnicode151Scalars(decoded.domain))
+        throw invalidCandidate("DNS label");
+    const ascii = toASCII(host, options);
     if (ascii === null || ascii.endsWith("."))
         throw invalidCandidate("DNS label");
     const normalized = ascii.toLowerCase();
@@ -688,6 +695,13 @@ function normalizeDNSOrIPv4(host) {
     }
     return normalized;
 }
+function hasOnlyUnicode151Scalars(value) {
+    for (const scalar of value) {
+        if (!unicode151Assigned(scalar.codePointAt(0)))
+            return false;
+    }
+    return true;
+}
 function requestFromValidatedArtifact(artifact, candidateSet, chosenCandidateID) {
     const common = {
         profile: PROFILE,

package/dist/v3/carrier.d.ts

@@ -2,8 +2,8 @@ import type { CarrierKind, OperationOptionsV3, PathKind } from "./contract.js";
 export type CarrierErrorCode = "aborted" | "closed" | "reset" | "stop_sending" | "stop_sending_unavailable" | "write_closed" | "datagram_unavailable";
 export declare class CarrierError extends Error {
     readonly code: CarrierErrorCode;
-    readonly cause?: unknown | undefined;
-    constructor(code: CarrierErrorCode, message: string, cause?: unknown | undefined);
+    readonly cause?: unknown;
+    constructor(code: CarrierErrorCode, message: string, cause?: unknown);
 }
 export interface CarrierStreamV3 {
     read(options?: OperationOptionsV3): Promise<Uint8Array | null>;