@floegence/flowersec-core 0.2.1 → 0.3.0

package/dist/client-connect/common.d.ts

@@ -9,7 +9,7 @@ export declare class WsFactoryRequiredError extends Error {
 }
 export declare function createWebSocket(url: string, origin: string, wsFactory: ((url: string, origin: string) => WebSocketLike) | undefined): WebSocketLike;
 export declare function classifyConnectError(err: unknown): "websocket_error" | "websocket_closed" | "timeout" | "canceled";
-export declare function classifyHandshakeError(err: unknown): "auth_tag_mismatch" | "handshake_failed" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "timeout" | "canceled";
+export declare function classifyHandshakeError(err: unknown): "auth_tag_mismatch" | "handshake_failed" | "invalid_suite" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "timeout" | "canceled";
 export declare function withAbortAndTimeout<T>(p: Promise<T>, opts: Readonly<{
     signal?: AbortSignal;
     timeoutMs?: number;

package/dist/client-connect/tunnelAttachCloseReason.d.ts

@@ -1,3 +1,3 @@
-export declare const tunnelAttachCloseReasons: readonly ["too_many_connections", "expected_attach", "invalid_attach", "invalid_token", "channel_mismatch", "role_mismatch", "token_replay", "replace_rate_limited", "attach_failed"];
+export declare const tunnelAttachCloseReasons: readonly ["too_many_connections", "expected_attach", "invalid_attach", "invalid_token", "channel_mismatch", "init_exp_mismatch", "idle_timeout_mismatch", "role_mismatch", "token_replay", "replace_rate_limited", "attach_failed"];
 export type TunnelAttachCloseReason = (typeof tunnelAttachCloseReasons)[number];
 export declare function isTunnelAttachCloseReason(v: string | undefined): v is TunnelAttachCloseReason;

package/dist/client-connect/tunnelAttachCloseReason.js

@@ -4,6 +4,8 @@ export const tunnelAttachCloseReasons = [
     "invalid_attach",
     "invalid_token",
     "channel_mismatch",
+    "init_exp_mismatch",
+    "idle_timeout_mismatch",
     "role_mismatch",
     "token_replay",
     "replace_rate_limited",

package/dist/e2ee/errors.d.ts

@@ -1,4 +1,4 @@
-export type E2EEHandshakeErrorCode = "auth_tag_mismatch" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew";
+export type E2EEHandshakeErrorCode = "auth_tag_mismatch" | "invalid_suite" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew";
 export declare class E2EEHandshakeError extends Error {
     readonly code: E2EEHandshakeErrorCode;
     constructor(code: E2EEHandshakeErrorCode, message: string);

package/dist/e2ee/handshake.d.ts

@@ -18,7 +18,7 @@ export type HandshakeClientOptions = Readonly<{
     maxBufferedBytes?: number;
     /** Optional AbortSignal to cancel the handshake. */
     signal?: AbortSignal;
-    /** Optional total handshake timeout in milliseconds (0 disables). */
+    /** Optional total handshake timeout in milliseconds (>= 0; 0 disables). */
     timeoutMs?: number;
 }>;
 export type HandshakeServerOptions = Readonly<{
@@ -42,7 +42,7 @@ export type HandshakeServerOptions = Readonly<{
     maxBufferedBytes?: number;
     /** Optional AbortSignal to cancel the handshake. */
     signal?: AbortSignal;
-    /** Optional total handshake timeout in milliseconds (0 disables). */
+    /** Optional total handshake timeout in milliseconds (>= 0; 0 disables). */
     timeoutMs?: number;
 }>;
 export declare function clientHandshake(transport: BinaryTransport, opts: HandshakeClientOptions): Promise<SecureChannel>;

package/dist/e2ee/handshake.js

@@ -13,7 +13,9 @@ import { TimeoutError, throwIfAborted } from "../utils/errors.js";
 const te = new TextEncoder();
 const td = new TextDecoder();
 function handshakeDeadlineMs(timeoutMs) {
-    const ms = Math.max(0, timeoutMs ?? 10_000);
+    const ms = timeoutMs ?? 10_000;
+    if (!Number.isFinite(ms) || ms < 0)
+        throw new Error("timeoutMs must be >= 0");
     if (ms <= 0)
         return null;
     return Date.now() + ms;
@@ -172,8 +174,15 @@ export class ServerHandshakeCache {
     // Maximum number of cached entries.
     maxEntries;
     constructor(opts = {}) {
-        this.ttlMs = Math.max(0, opts.ttlMs ?? 60_000);
-        this.maxEntries = Math.max(0, opts.maxEntries ?? 4096);
+        const ttlMs = opts.ttlMs ?? 60_000;
+        if (!Number.isFinite(ttlMs) || ttlMs < 0)
+            throw new Error("ttlMs must be >= 0");
+        const maxEntries = opts.maxEntries ?? 4096;
+        if (!Number.isFinite(maxEntries) || maxEntries < 0 || !Number.isInteger(maxEntries)) {
+            throw new Error("maxEntries must be an integer >= 0");
+        }
+        this.ttlMs = ttlMs;
+        this.maxEntries = maxEntries;
     }
     cleanup(nowMs) {
         if (this.ttlMs <= 0)
@@ -233,7 +242,7 @@ export async function serverHandshake(transport, cache, opts) {
         throw new Error("bad channel_id");
     const suite = init.suite;
     if (suite !== opts.suite)
-        throw new Error("bad suite");
+        throw new E2EEHandshakeError("invalid_suite", "bad suite");
     const clientPub = base64urlDecode(init.client_eph_pub_b64u);
     const nonceC = base64urlDecode(init.nonce_c_b64u);
     if (nonceC.length !== 32)

package/dist/observability/observer.d.ts

@@ -2,9 +2,9 @@ import type { ClientPath } from "../client.js";
 export type ConnectResult = "ok" | "fail";
 export type ConnectReason = "websocket_error" | "websocket_closed" | "timeout" | "canceled";
 export type AttachResult = "ok" | "fail";
-export type AttachReason = "send_failed" | "too_many_connections" | "expected_attach" | "invalid_attach" | "invalid_token" | "channel_mismatch" | "role_mismatch" | "token_replay" | "replace_rate_limited" | "attach_failed";
+export type AttachReason = "send_failed" | "too_many_connections" | "expected_attach" | "invalid_attach" | "invalid_token" | "channel_mismatch" | "role_mismatch" | "init_exp_mismatch" | "idle_timeout_mismatch" | "token_replay" | "replace_rate_limited" | "attach_failed";
 export type HandshakeResult = "ok" | "fail";
-export type HandshakeReason = "auth_tag_mismatch" | "handshake_failed" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "timeout" | "canceled";
+export type HandshakeReason = "auth_tag_mismatch" | "handshake_failed" | "invalid_suite" | "invalid_version" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "timeout" | "canceled";
 export type WsCloseKind = "local" | "peer_or_error";
 export type WsErrorReason = "error" | "recv_buffer_exceeded" | "unexpected_text_frame" | "unexpected_message_type";
 export type RpcCallResult = "ok" | "rpc_error" | "handler_not_found" | "transport_error" | "canceled";

package/dist/utils/errors.d.ts

@@ -6,7 +6,7 @@ export declare class AbortError extends Error {
 }
 export type FlowersecPath = "auto" | "tunnel" | "direct";
 export type FlowersecStage = "validate" | "connect" | "attach" | "handshake" | "secure" | "yamux" | "rpc" | "close";
-export type FlowersecErrorCode = "timeout" | "canceled" | "invalid_version" | "invalid_input" | "invalid_option" | "invalid_endpoint_instance_id" | "invalid_psk" | "invalid_suite" | "missing_grant" | "missing_connect_info" | "missing_conn" | "missing_handler" | "missing_stream_kind" | "role_mismatch" | "missing_tunnel_url" | "missing_ws_url" | "missing_origin" | "missing_channel_id" | "missing_token" | "missing_init_exp" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "auth_tag_mismatch" | "resolve_failed" | "random_failed" | "upgrade_failed" | "dial_failed" | "attach_failed" | "too_many_connections" | "expected_attach" | "invalid_attach" | "invalid_token" | "channel_mismatch" | "token_replay" | "replace_rate_limited" | "handshake_failed" | "ping_failed" | "mux_failed" | "accept_stream_failed" | "open_stream_failed" | "stream_hello_failed" | "not_connected";
+export type FlowersecErrorCode = "timeout" | "canceled" | "invalid_version" | "invalid_input" | "invalid_option" | "invalid_endpoint_instance_id" | "invalid_psk" | "invalid_suite" | "missing_grant" | "missing_connect_info" | "missing_conn" | "missing_handler" | "missing_stream_kind" | "role_mismatch" | "missing_tunnel_url" | "missing_ws_url" | "missing_origin" | "missing_channel_id" | "missing_token" | "missing_init_exp" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "auth_tag_mismatch" | "resolve_failed" | "random_failed" | "upgrade_failed" | "dial_failed" | "attach_failed" | "too_many_connections" | "expected_attach" | "invalid_attach" | "invalid_token" | "channel_mismatch" | "init_exp_mismatch" | "idle_timeout_mismatch" | "token_replay" | "replace_rate_limited" | "handshake_failed" | "ping_failed" | "mux_failed" | "accept_stream_failed" | "open_stream_failed" | "stream_hello_failed" | "not_connected";
 export declare class FlowersecError extends Error {
     readonly code: FlowersecErrorCode;
     readonly stage: FlowersecStage;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Flowersec core TypeScript library (browser-friendly E2EE + multiplexing over WebSocket).",
   "license": "MIT",
   "repository": {