@floegence/flowersec-core 3.2.1 → 5.0.0

package/dist/node/nativeTransportAddon.js

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
-import { CarrierError, } from "../v2/carrier.js";
-export const NATIVE_TRANSPORT_CONTRACT_VERSION = 2;
+import { CarrierError } from "../v3/carrier.js";
+export const NATIVE_TRANSPORT_CONTRACT_VERSION = 3;
 const NATIVE_PACKAGE = "@floegence/flowersec-node-native";
 const SERVER_PARITY_NATIVE_ADDON = "FLOWERSEC_SERVER_PARITY_NATIVE_ADDON";
 export class NativeTransportUnavailableError extends Error {
@@ -45,31 +45,13 @@ export function createNativeRawQuicDriver(addon = loadNativeTransportAddon()) {
     return Object.freeze({
         async connectRawQuic(options, operation = {}) {
             const native = await settle(addon.connectRawQuic(options), operation.signal);
-            return wrapSession(native, 2);
+            return wrapSession(native);
         },
         async bindRawQuic(options) {
             const native = await addon.bindRawQuic(options);
             return Object.freeze({
                 address: () => native.address(),
-                accept: async (operation = {}) => wrapSession(await settle(native.accept(), operation.signal), 2),
-                async close() {
-                    await native.close();
-                },
-            });
-        },
-    });
-}
-export function createNativeRawQuicDriverV3(addon = loadNativeTransportAddon()) {
-    return Object.freeze({
-        async connectRawQuic(options, operation = {}) {
-            const native = await settle(addon.connectRawQuicV3(options), operation.signal);
-            return wrapSession(native, 3);
-        },
-        async bindRawQuic(options) {
-            const native = await addon.bindRawQuicV3(options);
-            return Object.freeze({
-                address: () => native.address(),
-                accept: async (operation = {}) => wrapSession(await settle(native.accept(), operation.signal), 3),
+                accept: async (operation = {}) => wrapSession(await settle(native.accept(), operation.signal)),
                 async close() {
                     await native.close();
                 },
@@ -92,12 +74,10 @@ function isNativeTransportAddon(value) {
     }
     return contractVersion === NATIVE_TRANSPORT_CONTRACT_VERSION &&
         typeof candidate.connectRawQuic === "function" &&
-        typeof candidate.bindRawQuic === "function" &&
-        typeof candidate.connectRawQuicV3 === "function" &&
-        typeof candidate.bindRawQuicV3 === "function";
+        typeof candidate.bindRawQuic === "function";
 }
-function wrapSession(native, expectedWireVersion) {
-    if (native.wireVersion !== expectedWireVersion) {
+function wrapSession(native) {
+    if (native.wireVersion !== 3) {
         native.abort();
         throw new NativeTransportUnavailableError();
     }

package/dist/node/proxyServer.d.ts

@@ -1,6 +1,6 @@
 import { StreamHandlers } from "../public/streamHandlers.js";
-import { SessionHandlers } from "./acceptor.js";
-export type StreamHandlerRegistrar = StreamHandlers | SessionHandlers;
+import { SessionHandlersV3 } from "./acceptor.js";
+export type StreamHandlerRegistrar = StreamHandlers | SessionHandlersV3;
 export type ProxyServerOptions = Readonly<{
     upstream: string;
     upstreamOrigin: string;

package/dist/node/proxyServer.js

@@ -3,7 +3,7 @@ import { SessionError } from "../public/contract.js";
 import { writeJsonFrame } from "../framing/jsonframe.js";
 import { ProxyByteReader, writeAll } from "../proxy/stream.js";
 import { StreamHandlers, registerStreamHandlersAtomically, } from "../public/streamHandlers.js";
-import { SessionHandlers, registerSessionStreamHandlersAtomically, } from "./acceptor.js";
+import { SessionHandlersV3, registerSessionStreamHandlersAtomically, } from "./acceptor.js";
 const HTTP_KIND = "flowersec-proxy/http1";
 const WS_KIND = "flowersec-proxy/ws";
 const WIRE_VERSION = 1;
@@ -47,7 +47,7 @@ export class ProxyServer {
             if (handlers instanceof StreamHandlers) {
                 registerStreamHandlersAtomically(handlers, registrations);
             }
-            else if (handlers instanceof SessionHandlers) {
+            else if (handlers instanceof SessionHandlersV3) {
                 registerSessionStreamHandlersAtomically(handlers, registrations);
             }
             else {

package/dist/node/rawQuicAdapterV3.d.ts

@@ -1,8 +1,8 @@
 import type { ArtifactV3, CanonicalArtifactCandidateV3 } from "../v3/artifact.js";
 import type { NativeCarrierSessionV3 } from "../v3/carrier.js";
-import type { NativeRawQuicDriverV3 } from "./nativeTransportAddon.js";
+import type { NativeRawQuicDriver } from "./nativeTransportAddon.js";
 type NodeTLSRootsV3 = string | Uint8Array | readonly (string | Uint8Array)[];
-export declare function createNodeRawQuicClientV3(driver: NativeRawQuicDriverV3, candidate: CanonicalArtifactCandidateV3, artifact: ArtifactV3, attemptNowUnixSeconds: number, options?: Readonly<{
+export declare function createNodeRawQuicClientV3(driver: NativeRawQuicDriver, candidate: CanonicalArtifactCandidateV3, artifact: ArtifactV3, attemptNowUnixSeconds: number, options?: Readonly<{
     roots?: NodeTLSRootsV3;
     signal?: AbortSignal;
     handshakeTimeoutMs?: number;

package/dist/node/rawQuicAdapterV3.js

@@ -1,6 +1,6 @@
 import { rootCertificates } from "node:tls";
 import { snapshotTransportSecurityPolicyV3, TransportFailureV3, } from "../v3/security.js";
-import { normalizeCertificateChain } from "./rawQuicAdapter.js";
+import { normalizeCertificateChain } from "./rawQuicTls.js";
 import { alpnForPathV3 } from "../v3/transportConstants.js";
 const DEFAULT_HANDSHAKE_TIMEOUT_MS = 10_000;
 export async function createNodeRawQuicClientV3(driver, candidate, artifact, attemptNowUnixSeconds, options = {}) {

package/dist/node/rawQuicServerV3.d.ts

@@ -1,6 +1,6 @@
 import { type CarrierSessionV3 } from "../v3/carrier.js";
 import type { PathKind } from "../v3/contract.js";
-import type { NativeRawQuicDriverV3 } from "./nativeTransportAddon.js";
+import type { NativeRawQuicDriver } from "./nativeTransportAddon.js";
 export type NodeRawQuicListenerOptionsV3 = Readonly<{
     host: string;
     port: number;
@@ -21,4 +21,4 @@ export type NodeRawQuicListenerV3 = Readonly<{
     }>): Promise<CarrierSessionV3>;
     close(): Promise<void>;
 }>;
-export declare function startNodeRawQuicListenerV3(driver: NativeRawQuicDriverV3, options: NodeRawQuicListenerOptionsV3): Promise<NodeRawQuicListenerV3>;
+export declare function startNodeRawQuicListenerV3(driver: NativeRawQuicDriver, options: NodeRawQuicListenerOptionsV3): Promise<NodeRawQuicListenerV3>;

package/dist/node/rawQuicServerV3.js

@@ -1,5 +1,5 @@
 import { adaptNativeCarrierSessionV3 } from "../v3/carrier.js";
-import { normalizeCertificateChain, normalizePrivateKey } from "./rawQuicAdapter.js";
+import { normalizeCertificateChain, normalizePrivateKey } from "./rawQuicTls.js";
 export async function startNodeRawQuicListenerV3(driver, options) {
     validateOptions(options);
     let listener;

package/dist/node/rawQuicTls.d.ts

@@ -0,0 +1,2 @@
+export declare function normalizeCertificateChain(input: string | Uint8Array | readonly (string | Uint8Array)[]): readonly Uint8Array[];
+export declare function normalizePrivateKey(input: string | Uint8Array): Uint8Array;

package/dist/node/{rawQuicAdapter.js → rawQuicTls.js}

@@ -1,25 +1,8 @@
 import { X509Certificate, createPrivateKey } from "node:crypto";
-const DEFAULT_HANDSHAKE_TIMEOUT_MS = 10_000;
 const CERTIFICATE_PEM_BEGIN = "-----BEGIN CERTIFICATE-----";
 const CERTIFICATE_PEM_END = "-----END CERTIFICATE-----";
 const MAX_CERTIFICATE_PEM_BYTES = 256 * 1024;
 const MAX_CERTIFICATE_CHAIN_LENGTH = 32;
-export async function createNodeRawQuicClientV2(driver, candidate, artifact, tls, signal, handshakeTimeoutMs = DEFAULT_HANDSHAKE_TIMEOUT_MS) {
-    const url = new URL(candidate.normalized_url);
-    if (candidate.carrier !== "raw_quic" || url.protocol !== "quic:" || url.port === "") {
-        throw new TypeError("invalid raw QUIC candidate");
-    }
-    const options = {
-        host: unbracket(url.hostname),
-        port: Number(url.port),
-        serverName: unbracket(url.hostname),
-        path: artifact.path.kind,
-        trustRootsDer: normalizeCertificateChain(tls.ca),
-        inboundBidirectionalStreamCapacity: artifact.session.max_inbound_streams + 2,
-        handshakeTimeoutMs,
-    };
-    return await driver.connectRawQuic(options, { signal });
-}
 export function normalizeCertificateChain(input) {
     const values = Array.isArray(input) ? input : [input];
     const certificates = [];
@@ -28,32 +11,46 @@ export function normalizeCertificateChain(input) {
         if (typeof value !== "string" && !(value instanceof Uint8Array)) {
             throw new TypeError("invalid raw QUIC certificate");
         }
-        totalInputBytes += typeof value === "string" ? Buffer.byteLength(value, "utf8") : value.byteLength;
-        if (totalInputBytes > MAX_CERTIFICATE_PEM_BYTES)
+        totalInputBytes += typeof value === "string"
+            ? Buffer.byteLength(value, "utf8")
+            : value.byteLength;
+        if (totalInputBytes > MAX_CERTIFICATE_PEM_BYTES) {
             throw new TypeError("invalid raw QUIC certificate");
+        }
         if (typeof value === "string") {
             const blocks = splitCertificatePEM(value);
-            if (blocks.length === 0)
-                throw new TypeError("invalid raw QUIC certificate");
-            if (certificates.length + blocks.length > MAX_CERTIFICATE_CHAIN_LENGTH) {
+            if (blocks.length === 0 || certificates.length + blocks.length > MAX_CERTIFICATE_CHAIN_LENGTH) {
                 throw new TypeError("invalid raw QUIC certificate");
             }
             for (const block of blocks)
                 certificates.push(parseCertificate(block));
         }
-        else if (value instanceof Uint8Array && value.length > 0) {
-            if (certificates.length >= MAX_CERTIFICATE_CHAIN_LENGTH)
+        else if (value.length > 0) {
+            if (certificates.length >= MAX_CERTIFICATE_CHAIN_LENGTH) {
                 throw new TypeError("invalid raw QUIC certificate");
+            }
             certificates.push(parseCertificate(value));
         }
         else {
             throw new TypeError("invalid raw QUIC certificate");
         }
     }
-    if (certificates.length === 0)
+    if (certificates.length === 0) {
         throw new TypeError("raw QUIC requires explicit trust roots");
+    }
     return certificates;
 }
+export function normalizePrivateKey(input) {
+    if (input.length === 0)
+        throw new TypeError("invalid raw QUIC private key");
+    try {
+        const key = createPrivateKey(input);
+        return new Uint8Array(key.export({ format: "der", type: "pkcs8" }));
+    }
+    catch {
+        throw new TypeError("invalid raw QUIC private key");
+    }
+}
 function splitCertificatePEM(value) {
     if (Buffer.byteLength(value, "utf8") > MAX_CERTIFICATE_PEM_BYTES) {
         throw new TypeError("invalid raw QUIC certificate");
@@ -63,37 +60,28 @@ function splitCertificatePEM(value) {
     while (cursor < value.length) {
         const begin = value.indexOf(CERTIFICATE_PEM_BEGIN, cursor);
         if (begin < 0) {
-            if (value.slice(cursor).trim().length !== 0)
+            if (value.slice(cursor).trim().length !== 0) {
                 throw new TypeError("invalid raw QUIC certificate");
+            }
             break;
         }
-        if (value.slice(cursor, begin).trim().length !== 0)
+        if (value.slice(cursor, begin).trim().length !== 0) {
             throw new TypeError("invalid raw QUIC certificate");
+        }
         const contentStart = begin + CERTIFICATE_PEM_BEGIN.length;
         const end = value.indexOf(CERTIFICATE_PEM_END, contentStart);
-        if (end < 0 || value.indexOf(CERTIFICATE_PEM_BEGIN, contentStart) >= 0 && value.indexOf(CERTIFICATE_PEM_BEGIN, contentStart) < end) {
+        const nested = value.indexOf(CERTIFICATE_PEM_BEGIN, contentStart);
+        if (end < 0 || nested >= 0 && nested < end) {
             throw new TypeError("invalid raw QUIC certificate");
         }
         blocks.push(value.slice(begin, end + CERTIFICATE_PEM_END.length));
-        if (blocks.length > MAX_CERTIFICATE_CHAIN_LENGTH)
+        if (blocks.length > MAX_CERTIFICATE_CHAIN_LENGTH) {
             throw new TypeError("invalid raw QUIC certificate");
+        }
         cursor = end + CERTIFICATE_PEM_END.length;
     }
     return blocks;
 }
-export function normalizePrivateKey(input) {
-    if ((typeof input === "string" && input.length === 0) ||
-        (input instanceof Uint8Array && input.length === 0)) {
-        throw new TypeError("invalid raw QUIC private key");
-    }
-    try {
-        const key = createPrivateKey(input);
-        return new Uint8Array(key.export({ format: "der", type: "pkcs8" }));
-    }
-    catch {
-        throw new TypeError("invalid raw QUIC private key");
-    }
-}
 function parseCertificate(input) {
     try {
         return new Uint8Array(new X509Certificate(input).raw);
@@ -102,6 +90,3 @@ function parseCertificate(input) {
         throw new TypeError("invalid raw QUIC certificate");
     }
 }
-function unbracket(host) {
-    return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-}

package/dist/node/tunnelRuntimeV3.js

@@ -2,7 +2,7 @@ import { createAdmissionReasonRegistryV3, receiveSessionAdmissionV3, rejectSessi
 import { configureServerWebSocketCarrierRoleV3 } from "../v3/webSocketCarrier.js";
 import { AdmissionStatusV3, encodeFSA3ResponseV3, } from "../v3/artifact.js";
 import { startNodeWebSocketListenerV3 } from "./webSocketServerV3.js";
-import { createNativeRawQuicDriverV3 } from "./nativeTransportAddon.js";
+import { createNativeRawQuicDriver } from "./nativeTransportAddon.js";
 import { startNodeRawQuicListenerV3 } from "./rawQuicServerV3.js";
 import { consumeTunnelAuthorizationGrantV3, inspectTunnelAuthorizationGrantV3, retireTunnelAuthorizationGrantV3, runtimeAuthorizationRequestV3FromDecoded, validateTunnelAuthorizationGrantV3, } from "./runtimeAuthorizationV3.js";
 const DEFAULT_PAIR_TIMEOUT_MS = 10_000;
@@ -107,7 +107,7 @@ async function startTunnelRuntimeV3(state) {
                             pendingSessionTimeoutMs: state.limits.admissionTimeoutMs,
                             cleanupTimeoutMs: state.limits.cleanupTimeoutMs,
                         })
-                        : await startNodeRawQuicListenerV3(rawQuicDriver ??= createNativeRawQuicDriverV3(), {
+                        : await startNodeRawQuicListenerV3(rawQuicDriver ??= createNativeRawQuicDriver(), {
                             ...listener,
                             path: "tunnel",
                             inboundBidirectionalStreamCapacity: state.options.maxInboundStreams + 2,

package/dist/proxy/index.d.ts

@@ -7,7 +7,7 @@ export { registerServiceWorkerAndEnsureControl } from "./registerServiceWorker.j
 export type { RegisterServiceWorkerOptions } from "./registerServiceWorker.js";
 export { createServiceWorkerControllerGuard } from "./controllerGuard.js";
 export type { ServiceWorkerControllerGuardConflictPolicy, ServiceWorkerControllerGuardHandle, ServiceWorkerControllerGuardMismatchContext, ServiceWorkerControllerGuardMonitorOptions, ServiceWorkerControllerGuardOptions, ServiceWorkerControllerGuardRepairOptions, } from "./controllerGuard.js";
-export { registerProxyAppWindow, registerProxyAppWindowWithServiceWorkerControl, registerProxyControllerWindow, } from "./windowBridge.js";
+export { registerProxyAppWindow, registerProxyAppWindowWithServiceWorkerControl, registerProxyAppWindowWithServiceWorkerRuntime, registerProxyControllerWindow, } from "./windowBridge.js";
 export type { ProxyAppServiceWorkerControlOptions, ProxyAppWindowHandle, ProxyControllerWindowHandle, RegisterProxyAppWindowOptions, RegisterProxyAppWindowWithServiceWorkerControlOptions, RegisterProxyControllerWindowOptions, } from "./windowBridge.js";
 export { installWebSocketPatch } from "./wsPatch.js";
 export type { WebSocketPatchOptions } from "./wsPatch.js";

package/dist/proxy/index.js

@@ -3,7 +3,7 @@ export { createProxyRuntime, ensureServiceWorkerRuntimeRegistered } from "./runt
 export { createProxyServiceWorkerScript } from "./serviceWorker.js";
 export { registerServiceWorkerAndEnsureControl } from "./registerServiceWorker.js";
 export { createServiceWorkerControllerGuard } from "./controllerGuard.js";
-export { registerProxyAppWindow, registerProxyAppWindowWithServiceWorkerControl, registerProxyControllerWindow, } from "./windowBridge.js";
+export { registerProxyAppWindow, registerProxyAppWindowWithServiceWorkerControl, registerProxyAppWindowWithServiceWorkerRuntime, registerProxyControllerWindow, } from "./windowBridge.js";
 export { installWebSocketPatch } from "./wsPatch.js";
 export { disableUpstreamServiceWorkerRegister } from "./disableUpstreamServiceWorkerRegister.js";
 export { connectProxyBrowser, connectProxyControllerBrowser, } from "./integration.js";

package/dist/proxy/integration.d.ts

@@ -1,10 +1,10 @@
-import { type SessionOptions } from "../browser/connectSession.js";
-import type { ArtifactLease } from "../public/artifactLease.js";
+import { type SessionOptionsV3 } from "../browser/connectSessionV3.js";
+import type { ArtifactLeaseV3 } from "../v3/artifactLease.js";
 import type { Session } from "../public/contract.js";
 import type { ProxyRuntime, ProxyRuntimeOptions } from "./types.js";
 import { type ProxyControllerWindowHandle, type RegisterProxyControllerWindowOptions } from "./windowBridge.js";
 export type ProxyBrowserConnectOptions = Readonly<{
-    connect?: SessionOptions;
+    connect?: SessionOptionsV3;
     runtime?: Omit<ProxyRuntimeOptions, "session">;
     serviceWorker?: Readonly<{
         scriptUrl: string;
@@ -19,11 +19,11 @@ export type ProxyBrowserHandle = Readonly<{
     runtime: ProxyRuntime;
     dispose(): Promise<void>;
 }>;
-export declare function connectProxyBrowser(lease: ArtifactLease, options?: ProxyBrowserConnectOptions): Promise<ProxyBrowserHandle>;
+export declare function connectProxyBrowser(lease: ArtifactLeaseV3, options?: ProxyBrowserConnectOptions): Promise<ProxyBrowserHandle>;
 export type ProxyControllerBrowserConnectOptions = ProxyBrowserConnectOptions & Readonly<{
     controller: Omit<RegisterProxyControllerWindowOptions, "runtime">;
 }>;
 export type ProxyControllerBrowserHandle = ProxyBrowserHandle & Readonly<{
     controller: ProxyControllerWindowHandle;
 }>;
-export declare function connectProxyControllerBrowser(lease: ArtifactLease, options: ProxyControllerBrowserConnectOptions): Promise<ProxyControllerBrowserHandle>;
+export declare function connectProxyControllerBrowser(lease: ArtifactLeaseV3, options: ProxyControllerBrowserConnectOptions): Promise<ProxyControllerBrowserHandle>;

package/dist/proxy/integration.js

@@ -1,9 +1,9 @@
-import { connect } from "../browser/connectSession.js";
+import { connectV3 } from "../browser/connectSessionV3.js";
 import { createProxyRuntime } from "./runtime.js";
 import { registerServiceWorkerAndEnsureControl } from "./registerServiceWorker.js";
 import { registerProxyControllerWindow, } from "./windowBridge.js";
 export async function connectProxyBrowser(lease, options = {}) {
-    const session = await connect(lease, options.connect);
+    const session = await connectV3(lease, options.connect);
     let runtime;
     try {
         if (options.serviceWorker !== undefined)

package/dist/proxy/runtime.js

@@ -5,6 +5,7 @@ import { readU32be, u32be } from "../utils/bin.js";
 import { SessionError } from "../public/contract.js";
 import { createStreamMetadata } from "../public/streamMetadata.js";
 import { ProxyByteReader, writeAll } from "./stream.js";
+import { registerProxyRuntimeServiceWorkerBridge, usesServiceWorkerResponseFlowControl, } from "./serviceWorkerRuntime.js";
 const PROXY_HTTP_STREAM_KIND = "flowersec-proxy/http1";
 const PROXY_WEBSOCKET_STREAM_KIND = "flowersec-proxy/ws";
 const PROXY_WIRE_VERSION = 1;
@@ -160,19 +161,6 @@ function filterHeaders(input, base, extra) {
     }
     return result;
 }
-function parseRuntimeRequest(raw) {
-    const headers = Array.isArray(raw.headers) ? raw.headers.filter((entry) => typeof entry === "object" && entry !== null && typeof entry.name === "string" && typeof entry.value === "string") : [];
-    const body = raw.body instanceof ArrayBuffer ? raw.body : undefined;
-    return {
-        id: typeof raw.id === "string" ? raw.id : "",
-        method: typeof raw.method === "string" ? raw.method : "GET",
-        path: typeof raw.path === "string" ? raw.path : "",
-        headers,
-        ...(typeof raw.external_origin === "string" ? { externalOrigin: raw.external_origin } : {}),
-        ...(raw.response_flow_control === "chunk_credit_v2" ? { responseFlowControl: "chunk_credit_v2" } : {}),
-        ...(body === undefined ? {} : { body }),
-    };
-}
 class StreamAdmission {
     concurrent;
     queued;
@@ -317,22 +305,15 @@ export function createProxyRuntime(options) {
         ...(runtimeRegistrationToken === undefined ? {} : { runtimeRegistrationToken }),
     }).catch(() => undefined);
     const serviceWorker = globalThis.navigator?.serviceWorker;
-    const onMessage = (event) => {
-        if (event.data === null || typeof event.data !== "object" || event.data.type !== "flowersec-proxy:fetch")
-            return;
-        const port = event.ports?.[0];
-        if (port === undefined)
-            return;
-        dispatchFetch(parseRuntimeRequest(event.data.req), port);
-    };
-    serviceWorker?.addEventListener("message", onMessage);
     serviceWorker?.addEventListener("controllerchange", register);
     register();
+    let serviceWorkerBridge;
     function dispatchFetch(request, port) {
         const controller = new AbortController();
         let stream;
         let release;
-        let credit = request.responseFlowControl !== "chunk_credit_v2";
+        const flowControlled = usesServiceWorkerResponseFlowControl(request);
+        let credit = !flowControlled;
         let creditWake;
         port.onmessage = (event) => {
             if (event.data?.type === "flowersec-proxy:abort") {
@@ -351,7 +332,7 @@ export function createProxyRuntime(options) {
                 await new Promise((resolve) => { creditWake = resolve; });
                 creditWake = undefined;
             }
-            credit = request.responseFlowControl !== "chunk_credit_v2";
+            credit = !flowControlled;
         };
         void (async () => {
             try {
@@ -439,7 +420,7 @@ export function createProxyRuntime(options) {
             throw error instanceof SessionError ? error : new SessionError("operation_failed");
         }
     }
-    return Object.freeze({
+    const runtime = Object.freeze({
         limits: Object.freeze({
             maxJsonFrameBytes,
             maxChunkBytes,
@@ -457,10 +438,14 @@ export function createProxyRuntime(options) {
                 return;
             disposed = true;
             admission.close();
-            serviceWorker?.removeEventListener("message", onMessage);
             serviceWorker?.removeEventListener("controllerchange", register);
+            serviceWorkerBridge?.dispose();
         },
     });
+    if (serviceWorker !== undefined) {
+        serviceWorkerBridge = registerProxyRuntimeServiceWorkerBridge(runtime, serviceWorker);
+    }
+    return runtime;
 }
 export async function ensureServiceWorkerRuntimeRegistered(options = {}) {
     const controller = globalThis.navigator?.serviceWorker?.controller;

package/dist/proxy/serviceWorkerRuntime.d.ts

@@ -0,0 +1,7 @@
+import type { ProxyFetchRequest, ProxyRuntime } from "./types.js";
+type ProxyRuntimeServiceWorkerBridgeHandle = Readonly<{
+    dispose(): void;
+}>;
+export declare function usesServiceWorkerResponseFlowControl(request: ProxyFetchRequest): boolean;
+export declare function registerProxyRuntimeServiceWorkerBridge(runtime: ProxyRuntime, serviceWorker: ServiceWorkerContainer): ProxyRuntimeServiceWorkerBridgeHandle;
+export {};

package/dist/proxy/serviceWorkerRuntime.js

@@ -0,0 +1,75 @@
+const responseFlowControl = new WeakSet();
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function parseRuntimeRequest(value) {
+    const raw = record(value);
+    if (raw === undefined || typeof raw.id !== "string" || typeof raw.method !== "string" ||
+        typeof raw.path !== "string" || !Array.isArray(raw.headers)) {
+        throw new TypeError("invalid proxy service worker request");
+    }
+    const headers = raw.headers.map((value) => {
+        const header = record(value);
+        if (header === undefined || typeof header.name !== "string" || typeof header.value !== "string") {
+            throw new TypeError("invalid proxy service worker request headers");
+        }
+        return Object.freeze({ name: header.name, value: header.value });
+    });
+    if (raw.body !== undefined && !(raw.body instanceof ArrayBuffer)) {
+        throw new TypeError("invalid proxy service worker request body");
+    }
+    if (raw.external_origin !== undefined && typeof raw.external_origin !== "string") {
+        throw new TypeError("invalid proxy service worker request origin");
+    }
+    if (raw.response_flow_control !== undefined && raw.response_flow_control !== "chunk_credit_v2") {
+        throw new TypeError("invalid proxy service worker response flow control");
+    }
+    const request = Object.freeze({
+        id: raw.id,
+        method: raw.method,
+        path: raw.path,
+        headers: Object.freeze(headers),
+        ...(typeof raw.external_origin === "string" ? { externalOrigin: raw.external_origin } : {}),
+        ...(raw.body instanceof ArrayBuffer ? { body: raw.body } : {}),
+    });
+    if (raw.response_flow_control === "chunk_credit_v2")
+        responseFlowControl.add(request);
+    return request;
+}
+export function usesServiceWorkerResponseFlowControl(request) {
+    return responseFlowControl.has(request);
+}
+export function registerProxyRuntimeServiceWorkerBridge(runtime, serviceWorker) {
+    let disposed = false;
+    const onMessage = (event) => {
+        const message = record(event.data);
+        if (message?.type !== "flowersec-proxy:fetch")
+            return;
+        const port = event.ports?.[0];
+        if (port === undefined)
+            return;
+        try {
+            runtime.dispatchFetch(parseRuntimeRequest(message.req), port);
+        }
+        catch {
+            port.postMessage({
+                type: "flowersec-proxy:response_error",
+                status: 400,
+                code: "invalid_request",
+                message: "invalid proxy request",
+            });
+            port.close();
+        }
+    };
+    serviceWorker.addEventListener("message", onMessage);
+    return Object.freeze({
+        dispose: () => {
+            if (disposed)
+                return;
+            disposed = true;
+            serviceWorker.removeEventListener("message", onMessage);
+        },
+    });
+}

package/dist/proxy/types.d.ts

@@ -43,7 +43,6 @@ export type ProxyFetchRequest = Readonly<{
     path: string;
     headers: readonly ProxyHeader[];
     externalOrigin?: string;
-    responseFlowControl?: "chunk_credit_v2";
     body?: ArrayBuffer;
 }>;
 export type ProxyRuntime = Readonly<{

package/dist/proxy/windowBridge.d.ts

@@ -38,6 +38,7 @@ export type ProxyAppWindowHandle = Readonly<{
     dispose(): void;
 }>;
 export declare function registerProxyAppWindow(options: RegisterProxyAppWindowOptions): ProxyAppWindowHandle;
+export declare function registerProxyAppWindowWithServiceWorkerRuntime(options: RegisterProxyAppWindowOptions): ProxyAppWindowHandle;
 export type RegisterProxyControllerWindowOptions = Readonly<{
     runtime: ProxyRuntime;
     allowedOrigins: readonly string[];
@@ -56,6 +57,7 @@ export type ProxyAppServiceWorkerControlOptions = Readonly<{
     repair?: ServiceWorkerControllerGuardRepairOptions;
     monitor?: ServiceWorkerControllerGuardMonitorOptions;
     conflicts?: ServiceWorkerControllerGuardConflictPolicy;
+    runtimeRegistrationToken?: string;
 }>;
 export type RegisterProxyAppWindowWithServiceWorkerControlOptions = RegisterProxyAppWindowOptions & Readonly<{
     serviceWorker: ProxyAppServiceWorkerControlOptions;

package/dist/proxy/windowBridge.js

@@ -2,6 +2,8 @@ import { SDK_DEFAULTS } from "../defaults.js";
 import { SessionError } from "../public/contract.js";
 import { createServiceWorkerControllerGuard, } from "./controllerGuard.js";
 import { registerServiceWorkerAndEnsureControl } from "./registerServiceWorker.js";
+import { ensureServiceWorkerRuntimeRegistered } from "./runtime.js";
+import { registerProxyRuntimeServiceWorkerBridge } from "./serviceWorkerRuntime.js";
 const FETCH_MESSAGE = "flowersec-proxy:window_fetch_v2";
 const WEBSOCKET_OPEN_MESSAGE = "flowersec-proxy:window_ws_open_v2";
 const WEBSOCKET_ACK_MESSAGE = "flowersec-proxy:window_ws_open_ack_v2";
@@ -292,6 +294,31 @@ export function registerProxyAppWindow(options) {
         dispose: () => { disposed = true; },
     });
 }
+export function registerProxyAppWindowWithServiceWorkerRuntime(options) {
+    const target = options.targetWindow ?? globalThis.window;
+    const serviceWorker = target.navigator?.serviceWorker;
+    if (serviceWorker === undefined)
+        throw new Error("proxy service worker is unavailable");
+    const app = registerProxyAppWindow(options);
+    try {
+        const serviceWorkerBridge = registerProxyRuntimeServiceWorkerBridge(app.runtime, serviceWorker);
+        let disposed = false;
+        return Object.freeze({
+            runtime: app.runtime,
+            dispose: () => {
+                if (disposed)
+                    return;
+                disposed = true;
+                serviceWorkerBridge.dispose();
+                app.dispose();
+            },
+        });
+    }
+    catch (error) {
+        app.dispose();
+        throw error;
+    }
+}
 async function bridgeStreams(runtimeStream, port, signal) {
     const bridge = new MessagePortByteStream(port);
     const controller = new AbortController();
@@ -436,10 +463,30 @@ export async function registerProxyAppWindowWithServiceWorkerControl(options) {
         ...(options.serviceWorker.monitor === undefined ? {} : { monitor: options.serviceWorker.monitor }),
         ...(options.serviceWorker.conflicts === undefined ? {} : { conflicts: options.serviceWorker.conflicts }),
     });
-    await guard.ensure();
-    const app = registerProxyAppWindow(options);
-    return Object.freeze({
-        runtime: app.runtime,
-        dispose: () => { app.dispose(); guard.dispose(); },
-    });
+    let app;
+    try {
+        await guard.ensure();
+        app = registerProxyAppWindowWithServiceWorkerRuntime(options);
+        await ensureServiceWorkerRuntimeRegistered({
+            ...(options.serviceWorker.runtimeRegistrationToken === undefined
+                ? {}
+                : { runtimeRegistrationToken: options.serviceWorker.runtimeRegistrationToken }),
+        });
+        let disposed = false;
+        return Object.freeze({
+            runtime: app.runtime,
+            dispose: () => {
+                if (disposed)
+                    return;
+                disposed = true;
+                app?.dispose();
+                guard.dispose();
+            },
+        });
+    }
+    catch (error) {
+        app?.dispose();
+        guard.dispose();
+        throw error;
+    }
 }

package/dist/public/contract.d.ts

@@ -26,9 +26,7 @@ export declare class UnreliableMessageError extends Error {
 export type StreamOpenOptions = OperationOptions & Readonly<{
     metadata?: StreamMetadata;
 }>;
-/** @deprecated Unreliable-message operations use UnreliableMessageErrorCode. */
-export type LegacyUnreliableSessionErrorCode = "unreliable_unavailable" | "unreliable_too_large" | "unreliable_dropped";
-export type SessionErrorCode = "canceled" | "timeout" | "closed" | "going_away" | "resource_exhausted" | "stream_rejected" | "stream_reset" | "rekey_failed" | "liveness_failed" | LegacyUnreliableSessionErrorCode | "operation_failed";
+export type SessionErrorCode = "canceled" | "timeout" | "closed" | "going_away" | "resource_exhausted" | "stream_rejected" | "stream_reset" | "rekey_failed" | "liveness_failed" | "operation_failed";
 /** A closed, carrier-neutral session failure with no internal cause or peer detail. */
 export declare class SessionError extends Error {
     readonly code: SessionErrorCode;

package/dist/public/streamHandlers.d.ts

@@ -18,6 +18,3 @@ export declare class StreamHandlers {
     handleStream(kind: string, handler: StreamHandler): void;
     serve(session: Session, options?: OperationOptions): Promise<void>;
 }
-/** Explicit-compatibility application-stream handlers. */
-export declare class LegacyStreamHandlers extends StreamHandlers {
-}