Function New

internal/carrier/client.go:340–449

New constructs a Client. The HTTP client is preconfigured for domain fronting per cfg.Fronting.

(cfg Config)

// New constructs a Client. The HTTP client is preconfigured for domain
// fronting per cfg.Fronting.
func New(cfg Config) (*Client, error) {
	aead, err := frame.NewCryptoFromHexKey(cfg.AESKeyHex)
	if err != nil {
		return nil, err
	}

	endpoints := make([]relayEndpoint, 0, len(cfg.ScriptURLs))
	seen := make(map[string]struct{}, len(cfg.ScriptURLs))
	for i, raw := range cfg.ScriptURLs {
		url := strings.TrimSpace(raw)
		if url == "" {
			continue
		}
		if _, ok := seen[url]; ok {
			continue
		}
		seen[url] = struct{}{}
		account := ""
		if i < len(cfg.ScriptAccounts) {
			account = strings.TrimSpace(cfg.ScriptAccounts[i])
		}
		ep := relayEndpoint{url: url, account: account}
		if account != "" {
			ep.bucket = "acct:" + account
		} else {
			ep.bucket = "url:" + url
		}
		endpoints = append(endpoints, ep)
	}
	if len(endpoints) == 0 {
		return nil, fmt.Errorf("at least one script URL is required")
	}

	// Each Google account is one in-flight bucket. Endpoints without an
	// account label each get their own bucket (Apps Script throttles per
	// account; we can't tell unlabeled deployments apart, so we conservatively
	// assume they're all distinct — which matches v1.5 behavior where each
	// endpoint was independently rate-managed). The in-flight semaphore on
	// each bucket caps concurrent polls hitting that account, preserving the
	// per-account anti-abuse protection that motivated v1.6's bucketing
	// (issue #56) without partitioning the worker pool itself.
	bucketSeen := make(map[string]struct{}, len(endpoints))
	labeled := 0
	for _, ep := range endpoints {
		bucketSeen[ep.bucket] = struct{}{}
		if ep.account != "" {
			labeled++
		}
	}
	bucketCount := len(bucketSeen)

	var clientID [frame.ClientIDLen]byte
	if _, err := rand.Read(clientID[:]); err != nil {
		// crypto/rand failure is unrecoverable; fail fast rather than emitting
		// an all-zero ID that would collide with every other unupgraded client.
		return nil, fmt.Errorf("crypto/rand: %w", err)
	}