@floegence/flowersec-core 0.20.0 → 0.20.2

package/dist/proxy/portStream.js

@@ -1,14 +1,16 @@
-import { PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE, PROXY_WINDOW_STREAM_CLOSE_MSG_TYPE, PROXY_WINDOW_STREAM_END_MSG_TYPE, PROXY_WINDOW_STREAM_RESET_MSG_TYPE, } from "./windowBridgeProtocol.js";
+import { PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE, PROXY_WINDOW_STREAM_CLOSE_MSG_TYPE, PROXY_WINDOW_STREAM_END_MSG_TYPE, PROXY_WINDOW_STREAM_RESET_MSG_TYPE, PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE, } from "./windowBridgeProtocol.js";
 function cloneChunk(chunk) {
     const out = new Uint8Array(chunk.byteLength);
     out.set(chunk);
     return out.buffer;
 }
-export function createMessagePortBackedStream(port) {
+export function createMessagePortBackedStream(port, opts = {}) {
     let closed = false;
     let error = null;
     const queue = [];
     const waiters = [];
+    const pendingWrites = new Map();
+    let nextWriteId = 1;
     const resolveWaiter = (value) => {
         const waiter = waiters.shift();
         if (waiter) {
@@ -29,6 +31,9 @@ export function createMessagePortBackedStream(port) {
         while (resolveWaiter(err)) {
             // Drain waiters.
         }
+        for (const pending of pendingWrites.values())
+            pending.reject(err);
+        pendingWrites.clear();
     };
     port.onmessage = (ev) => {
         const data = ev.data;
@@ -46,8 +51,22 @@ export function createMessagePortBackedStream(port) {
             case PROXY_WINDOW_STREAM_END_MSG_TYPE:
             case PROXY_WINDOW_STREAM_CLOSE_MSG_TYPE:
                 closed = true;
+                for (const pending of pendingWrites.values())
+                    pending.reject(new Error("stream is closed"));
+                pendingWrites.clear();
                 pushValue(null);
                 return;
+            case PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE: {
+                const writeId = data.writeId;
+                if (!Number.isSafeInteger(writeId) || writeId <= 0)
+                    return;
+                const pending = pendingWrites.get(writeId);
+                if (pending == null)
+                    return;
+                pendingWrites.delete(writeId);
+                pending.resolve();
+                return;
+            }
             case PROXY_WINDOW_STREAM_RESET_MSG_TYPE: {
                 closed = true;
                 const message = String(data.message ?? "stream reset");
@@ -87,12 +106,30 @@ export function createMessagePortBackedStream(port) {
             if (closed)
                 throw new Error("stream is closed");
             const ab = cloneChunk(chunk);
-            port.postMessage({ type: PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE, data: ab }, [ab]);
+            if (opts.writeAcknowledgements !== true) {
+                port.postMessage({ type: PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE, data: ab }, [ab]);
+                return;
+            }
+            const writeId = nextWriteId++;
+            await new Promise((resolve, reject) => {
+                pendingWrites.set(writeId, { resolve, reject });
+                try {
+                    port.postMessage({ type: PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE, data: ab, writeId }, [ab]);
+                }
+                catch (error) {
+                    pendingWrites.delete(writeId);
+                    reject(error instanceof Error ? error : new Error(String(error)));
+                }
+            });
         },
         async close() {
             if (closed)
                 return;
             closed = true;
+            const closeError = new Error("stream is closed");
+            for (const pending of pendingWrites.values())
+                pending.reject(closeError);
+            pendingWrites.clear();
             try {
                 port.postMessage({ type: PROXY_WINDOW_STREAM_CLOSE_MSG_TYPE });
             }

package/dist/proxy/runtime.d.ts

@@ -15,6 +15,10 @@ export type ProxyRuntimeLimits = Readonly<{
     maxChunkBytes: number;
     maxBodyBytes: number;
     maxWsFrameBytes: number;
+    maxWsBufferedAmountBytes: number;
+    maxConcurrentHttpStreams: number;
+    maxQueuedHttpRequests: number;
+    maxQueuedHttpBodyBytes: number;
 }>;
 export type ProxyRuntime = Readonly<{
     limits: ProxyRuntimeLimits;
@@ -40,6 +44,10 @@ export type ProxyRuntimeOptions = Readonly<{
     maxChunkBytes?: number;
     maxBodyBytes?: number;
     maxWsFrameBytes?: number;
+    maxWsBufferedAmountBytes?: number;
+    maxConcurrentHttpStreams?: number;
+    maxQueuedHttpRequests?: number;
+    maxQueuedHttpBodyBytes?: number;
     timeoutMs?: number;
     extraRequestHeaders?: readonly string[];
     extraResponseHeaders?: readonly string[];

package/dist/proxy/runtime.js

@@ -2,6 +2,7 @@ import { DEFAULT_MAX_JSON_FRAME_BYTES, readJsonFrame, writeJsonFrame } from "../
 import { createByteReader } from "../streamio/index.js";
 import { base64urlEncode } from "../utils/base64url.js";
 import { readU32be, u32be } from "../utils/bin.js";
+import { AbortError, FlowersecError, isFlowersecError } from "../utils/errors.js";
 import { CookieJar } from "./cookieJar.js";
 import { DEFAULT_MAX_BODY_BYTES, DEFAULT_MAX_CHUNK_BYTES, DEFAULT_MAX_WS_FRAME_BYTES, PROXY_KIND_HTTP1, PROXY_KIND_WS, PROXY_PROTOCOL_VERSION } from "./constants.js";
 import { filterRequestHeaders, filterResponseHeaders, filterWsOpenHeaders } from "./headerPolicy.js";
@@ -129,6 +130,141 @@ function normalizeMaxBytes(name, v, defaultValue) {
         return defaultValue;
     return n;
 }
+const DEFAULT_MAX_CONCURRENT_HTTP_STREAMS = 24;
+const DEFAULT_MAX_QUEUED_HTTP_REQUESTS = 128;
+const DEFAULT_MAX_QUEUED_HTTP_BODY_BYTES = 64 * (1 << 20);
+const DEFAULT_MAX_WS_BUFFERED_AMOUNT_BYTES = 4 * (1 << 20);
+function normalizePositiveLimit(name, value, defaultValue) {
+    if (value == null)
+        return defaultValue;
+    if (!Number.isFinite(value) || !Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`${name} must be a positive safe integer`);
+    }
+    return value;
+}
+function normalizeNonNegativeLimit(name, value, defaultValue) {
+    if (value == null)
+        return defaultValue;
+    if (!Number.isFinite(value) || !Number.isSafeInteger(value) || value < 0) {
+        throw new Error(`${name} must be a non-negative safe integer`);
+    }
+    return value;
+}
+class HttpStreamAdmission {
+    path;
+    maxConcurrent;
+    maxQueued;
+    maxQueuedBodyBytes;
+    active = 0;
+    pending = [];
+    pendingBodyBytes = 0;
+    closed = false;
+    constructor(path, maxConcurrent, maxQueued, maxQueuedBodyBytes) {
+        this.path = path;
+        this.maxConcurrent = maxConcurrent;
+        this.maxQueued = maxQueued;
+        this.maxQueuedBodyBytes = maxQueuedBodyBytes;
+    }
+    acquire(bodyBytes, signal) {
+        if (this.closed)
+            return Promise.reject(this.closedError());
+        if (signal?.aborted)
+            return Promise.reject(this.abortedError());
+        if (this.active < this.maxConcurrent && this.pending.length === 0) {
+            this.active++;
+            return Promise.resolve(this.createRelease());
+        }
+        if (this.pending.length >= this.maxQueued) {
+            return Promise.reject(new FlowersecError({
+                path: this.path,
+                stage: "yamux",
+                code: "resource_exhausted",
+                message: "proxy runtime HTTP request queue is full",
+            }));
+        }
+        if (this.pendingBodyBytes + bodyBytes > this.maxQueuedBodyBytes) {
+            return Promise.reject(new FlowersecError({
+                path: this.path,
+                stage: "yamux",
+                code: "resource_exhausted",
+                message: "proxy runtime HTTP request body queue is full",
+            }));
+        }
+        return new Promise((resolve, reject) => {
+            const waiter = {
+                bodyBytes,
+                resolve,
+                reject,
+                ...(signal === undefined ? {} : { signal }),
+            };
+            waiter.onAbort = () => {
+                const index = this.pending.indexOf(waiter);
+                if (index < 0)
+                    return;
+                this.pending.splice(index, 1);
+                this.pendingBodyBytes = Math.max(0, this.pendingBodyBytes - waiter.bodyBytes);
+                this.cleanupWaiter(waiter);
+                reject(this.abortedError());
+            };
+            signal?.addEventListener("abort", waiter.onAbort, { once: true });
+            this.pending.push(waiter);
+            this.pendingBodyBytes += bodyBytes;
+        });
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        for (const waiter of this.pending.splice(0)) {
+            this.pendingBodyBytes = Math.max(0, this.pendingBodyBytes - waiter.bodyBytes);
+            this.cleanupWaiter(waiter);
+            waiter.reject(this.closedError());
+        }
+    }
+    assertOpen() {
+        if (this.closed)
+            throw this.closedError();
+    }
+    createRelease() {
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            this.active = Math.max(0, this.active - 1);
+            this.drain();
+        };
+    }
+    drain() {
+        while (!this.closed && this.active < this.maxConcurrent && this.pending.length > 0) {
+            const waiter = this.pending.shift();
+            this.pendingBodyBytes = Math.max(0, this.pendingBodyBytes - waiter.bodyBytes);
+            this.cleanupWaiter(waiter);
+            if (waiter.signal?.aborted) {
+                waiter.reject(this.abortedError());
+                continue;
+            }
+            this.active++;
+            waiter.resolve(this.createRelease());
+        }
+    }
+    cleanupWaiter(waiter) {
+        if (waiter.onAbort != null) {
+            waiter.signal?.removeEventListener("abort", waiter.onAbort);
+        }
+    }
+    abortedError() {
+        return new AbortError("proxy HTTP request canceled while waiting for stream admission");
+    }
+    closedError() {
+        return new FlowersecError({
+            path: this.path,
+            stage: "close",
+            code: "not_connected",
+            message: "proxy runtime is disposed",
+        });
+    }
+}
 async function writeChunkFrames(stream, body, chunkSize, maxBodyBytes) {
     if (maxBodyBytes > 0 && body.length > maxBodyBytes)
         throw new Error("request body too large");
@@ -169,6 +305,11 @@ export function createProxyRuntime(opts) {
     const maxChunkBytes = normalizeMaxBytes("maxChunkBytes", opts.maxChunkBytes, DEFAULT_MAX_CHUNK_BYTES);
     const maxBodyBytes = normalizeMaxBytes("maxBodyBytes", opts.maxBodyBytes, DEFAULT_MAX_BODY_BYTES);
     const maxWsFrameBytes = normalizeMaxBytes("maxWsFrameBytes", opts.maxWsFrameBytes, DEFAULT_MAX_WS_FRAME_BYTES);
+    const maxWsBufferedAmountBytes = normalizeMaxBytes("maxWsBufferedAmountBytes", opts.maxWsBufferedAmountBytes, DEFAULT_MAX_WS_BUFFERED_AMOUNT_BYTES);
+    const maxConcurrentHttpStreams = normalizePositiveLimit("maxConcurrentHttpStreams", opts.maxConcurrentHttpStreams, DEFAULT_MAX_CONCURRENT_HTTP_STREAMS);
+    const maxQueuedHttpRequests = normalizeNonNegativeLimit("maxQueuedHttpRequests", opts.maxQueuedHttpRequests, DEFAULT_MAX_QUEUED_HTTP_REQUESTS);
+    const maxQueuedHttpBodyBytes = normalizeNonNegativeLimit("maxQueuedHttpBodyBytes", opts.maxQueuedHttpBodyBytes, DEFAULT_MAX_QUEUED_HTTP_BODY_BYTES);
+    const httpStreamAdmission = new HttpStreamAdmission(client.path, maxConcurrentHttpStreams, maxQueuedHttpRequests, maxQueuedHttpBodyBytes);
     const timeoutMs = normalizeTimeoutMs(opts.timeoutMs);
     const extraRequestHeaders = opts.extraRequestHeaders ?? [];
     const extraResponseHeaders = opts.extraResponseHeaders ?? [];
@@ -203,6 +344,7 @@ export function createProxyRuntime(opts) {
     const dispatchFetch = (req, port) => {
         const ac = new AbortController();
         let stream = null;
+        let releaseAdmission = null;
         port.onmessage = (ev) => {
             const m = ev.data;
             if (m && typeof m === "object" && m.type === "flowersec-proxy:abort") {
@@ -215,6 +357,11 @@ export function createProxyRuntime(opts) {
                 assertPathPolicyAllows("http", path, pathPolicy);
                 const requestID = req.id.trim() !== "" ? req.id : randomB64u(18);
                 const externalOrigin = externalOriginOverride ?? normalizeExternalOrigin(req.external_origin);
+                const body = req.body != null ? new Uint8Array(req.body) : new Uint8Array();
+                if (maxBodyBytes > 0 && body.length > maxBodyBytes)
+                    throw new Error("request body too large");
+                releaseAdmission = await httpStreamAdmission.acquire(body.byteLength, ac.signal);
+                httpStreamAdmission.assertOpen();
                 stream = await client.openStream(PROXY_KIND_HTTP1, { signal: ac.signal });
                 const reader = createByteReader(stream, { signal: ac.signal });
                 const filteredReqHeaders = filterRequestHeaders(req.headers, { extraAllowed: extraRequestHeaders });
@@ -229,7 +376,6 @@ export function createProxyRuntime(opts) {
                     ...(externalOrigin === undefined ? {} : { external_origin: externalOrigin }),
                     timeout_ms: timeoutMs
                 });
-                const body = req.body != null ? new Uint8Array(req.body) : new Uint8Array();
                 await writeChunkFrames(stream, body, Math.min(64 * 1024, maxChunkBytes), maxBodyBytes);
                 const respMeta = (await readJsonFrame(reader, maxJsonFrameBytes));
                 if (respMeta.v !== PROXY_PROTOCOL_VERSION || respMeta.request_id !== requestID) {
@@ -264,8 +410,17 @@ export function createProxyRuntime(opts) {
             }
             catch (e) {
                 const msg = e instanceof Error ? e.message : String(e);
-                const status = e instanceof ProxyRuntimePolicyError ? e.status : 502;
-                port.postMessage({ type: "flowersec-proxy:response_error", status, message: msg });
+                const code = isFlowersecError(e) ? e.code : undefined;
+                const status = e instanceof ProxyRuntimePolicyError
+                    ? e.status
+                    : code === "resource_exhausted" || code === "not_connected"
+                        ? 503
+                        : 502;
+                port.postMessage({
+                    type: "flowersec-proxy:response_error",
+                    status,
+                    message: msg,
+                });
                 try {
                     stream?.reset(new Error(msg));
                 }
@@ -274,6 +429,7 @@ export function createProxyRuntime(opts) {
                 }
             }
             finally {
+                releaseAdmission?.();
                 try {
                     port.close();
                 }
@@ -312,10 +468,20 @@ export function createProxyRuntime(opts) {
         return { stream, protocol: resp.protocol ?? "" };
     }
     return {
-        limits: { maxJsonFrameBytes, maxChunkBytes, maxBodyBytes, maxWsFrameBytes },
+        limits: {
+            maxJsonFrameBytes,
+            maxChunkBytes,
+            maxBodyBytes,
+            maxWsFrameBytes,
+            maxWsBufferedAmountBytes,
+            maxConcurrentHttpStreams,
+            maxQueuedHttpRequests,
+            maxQueuedHttpBodyBytes,
+        },
         dispatchFetch,
         openWebSocketStream,
         dispose: () => {
+            httpStreamAdmission.close();
             sw?.removeEventListener("message", onMessage);
             sw?.removeEventListener("controllerchange", registerRuntime);
         }

package/dist/proxy/runtimeScope.d.ts

@@ -36,12 +36,20 @@ export declare function resolveRuntimeLimitsFromScope(scope: ProxyRuntimeScopeV1
     maxChunkBytes?: number;
     maxBodyBytes?: number;
     maxWsFrameBytes?: number;
+    maxWsBufferedAmountBytes?: number;
+    maxConcurrentHttpStreams?: number;
+    maxQueuedHttpRequests?: number;
+    maxQueuedHttpBodyBytes?: number;
     timeoutMs?: number;
 }> | undefined): Readonly<{
     maxJsonFrameBytes?: number;
     maxChunkBytes?: number;
     maxBodyBytes?: number;
     maxWsFrameBytes?: number;
+    maxWsBufferedAmountBytes?: number;
+    maxConcurrentHttpStreams?: number;
+    maxQueuedHttpRequests?: number;
+    maxQueuedHttpBodyBytes?: number;
     timeoutMs?: number;
 }> | undefined;
 export declare function resolvePresetInputFromScope(scope: ProxyRuntimeScopeV1, presetOverride: ProxyPresetInput | undefined): ProxyPresetInput | undefined;

package/dist/proxy/windowBridgeProtocol.d.ts

@@ -3,8 +3,10 @@ export declare const PROXY_WINDOW_FETCH_FORWARD_MSG_TYPE = "flowersec-proxy:wind
 export declare const PROXY_WINDOW_FETCH_MSG_TYPE = "flowersec-proxy:fetch";
 export declare const PROXY_WINDOW_WS_OPEN_MSG_TYPE = "flowersec-proxy:ws_open";
 export declare const PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE = "flowersec-proxy:ws_open_ack";
+export declare const PROXY_WINDOW_WS_WRITE_ACK_CAPABILITY = "stream_write_ack_v1";
 export declare const PROXY_WINDOW_WS_ERROR_MSG_TYPE = "flowersec-proxy:ws_error";
 export declare const PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE = "flowersec-proxy:stream_chunk";
+export declare const PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE = "flowersec-proxy:stream_write_ack";
 export declare const PROXY_WINDOW_STREAM_END_MSG_TYPE = "flowersec-proxy:stream_end";
 export declare const PROXY_WINDOW_STREAM_RESET_MSG_TYPE = "flowersec-proxy:stream_reset";
 export declare const PROXY_WINDOW_STREAM_CLOSE_MSG_TYPE = "flowersec-proxy:stream_close";
@@ -34,6 +36,7 @@ export type ProxyWindowWsOpenMsg = Readonly<{
 export type ProxyWindowWsOpenAckMsg = Readonly<{
     type: typeof PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE;
     protocol: string;
+    capabilities?: readonly string[];
 }>;
 export type ProxyWindowWsErrorMsg = Readonly<{
     type: typeof PROXY_WINDOW_WS_ERROR_MSG_TYPE;
@@ -42,6 +45,11 @@ export type ProxyWindowWsErrorMsg = Readonly<{
 export type ProxyWindowStreamChunkMsg = Readonly<{
     type: typeof PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE;
     data: ArrayBuffer;
+    writeId?: number;
+}>;
+export type ProxyWindowStreamWriteAckMsg = Readonly<{
+    type: typeof PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE;
+    writeId: number;
 }>;
 export type ProxyWindowStreamEndMsg = Readonly<{
     type: typeof PROXY_WINDOW_STREAM_END_MSG_TYPE;

package/dist/proxy/windowBridgeProtocol.js

@@ -2,8 +2,10 @@ export const PROXY_WINDOW_FETCH_FORWARD_MSG_TYPE = "flowersec-proxy:window_fetch
 export const PROXY_WINDOW_FETCH_MSG_TYPE = "flowersec-proxy:fetch";
 export const PROXY_WINDOW_WS_OPEN_MSG_TYPE = "flowersec-proxy:ws_open";
 export const PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE = "flowersec-proxy:ws_open_ack";
+export const PROXY_WINDOW_WS_WRITE_ACK_CAPABILITY = "stream_write_ack_v1";
 export const PROXY_WINDOW_WS_ERROR_MSG_TYPE = "flowersec-proxy:ws_error";
 export const PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE = "flowersec-proxy:stream_chunk";
+export const PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE = "flowersec-proxy:stream_write_ack";
 export const PROXY_WINDOW_STREAM_END_MSG_TYPE = "flowersec-proxy:stream_end";
 export const PROXY_WINDOW_STREAM_RESET_MSG_TYPE = "flowersec-proxy:stream_reset";
 export const PROXY_WINDOW_STREAM_CLOSE_MSG_TYPE = "flowersec-proxy:stream_close";

package/dist/proxy/wsPatch.d.ts

@@ -13,6 +13,7 @@ export type WebSocketPatchOptions = Readonly<{
     }>;
     shouldProxy?: (url: URL) => boolean;
     maxWsFrameBytes?: number;
+    maxWsBufferedAmountBytes?: number;
 }>;
 export declare function installWebSocketPatch(opts: WebSocketPatchOptions): Readonly<{
     uninstall: () => void;

package/dist/proxy/wsPatch.js

@@ -85,6 +85,22 @@ export function installWebSocketPatch(opts) {
     if (maxWsFrameBytesFloor < 0)
         throw new Error("maxWsFrameBytes must be >= 0");
     const maxWsFrameBytes = maxWsFrameBytesFloor === 0 ? runtimeMaxWsFrameBytes : maxWsFrameBytesFloor;
+    const defaultMaxWsBufferedAmountBytes = 4 * (1 << 20);
+    const runtimeMaxWsBufferedAmountBytesRaw = runtime.limits?.maxWsBufferedAmountBytes;
+    if (runtimeMaxWsBufferedAmountBytesRaw !== undefined &&
+        (!Number.isSafeInteger(runtimeMaxWsBufferedAmountBytesRaw) || runtimeMaxWsBufferedAmountBytesRaw < 0)) {
+        throw new Error("runtime maxWsBufferedAmountBytes must be a non-negative safe integer");
+    }
+    const runtimeMaxWsBufferedAmountBytes = runtimeMaxWsBufferedAmountBytesRaw == null || runtimeMaxWsBufferedAmountBytesRaw === 0
+        ? defaultMaxWsBufferedAmountBytes
+        : runtimeMaxWsBufferedAmountBytesRaw;
+    const maxWsBufferedAmountBytesRaw = opts.maxWsBufferedAmountBytes ?? runtimeMaxWsBufferedAmountBytes;
+    if (!Number.isSafeInteger(maxWsBufferedAmountBytesRaw) || maxWsBufferedAmountBytesRaw < 0) {
+        throw new Error("maxWsBufferedAmountBytes must be a non-negative safe integer");
+    }
+    const maxWsBufferedAmountBytes = maxWsBufferedAmountBytesRaw === 0
+        ? runtimeMaxWsBufferedAmountBytes
+        : maxWsBufferedAmountBytesRaw;
     class PatchedWebSocket {
         static CONNECTING = 0;
         static OPEN = 1;
@@ -119,36 +135,60 @@ export function installWebSocketPatch(opts) {
         removeEventListener(type, listener) {
             this.listeners.off(type, listener);
         }
-        queueWriteFrame(stream, op, payload) {
+        queueWriteFrame(stream, op, payload, bufferedBytes = 0) {
             this.writeChain = this.writeChain
-                .then(() => writeWSFrame(stream, op, payload, maxWsFrameBytes))
-                .catch((e) => this.fail(e));
+                .then(async () => {
+                if (this.readyState === PatchedWebSocket.CLOSED)
+                    return;
+                const resolved = typeof payload === "function" ? await payload() : payload;
+                await writeWSFrame(stream, op, resolved, maxWsFrameBytes);
+            })
+                .catch((e) => this.fail(e))
+                .finally(() => {
+                this.bufferedAmount = Math.max(0, this.bufferedAmount - bufferedBytes);
+            });
+        }
+        reserveBufferedAmount(bytes) {
+            if (this.bufferedAmount + bytes > maxWsBufferedAmountBytes) {
+                this.fail(new Error("WebSocket bufferedAmount limit exceeded"));
+                return false;
+            }
+            this.bufferedAmount += bytes;
+            return true;
         }
         send(data) {
             if (this.readyState !== PatchedWebSocket.OPEN || this.stream == null) {
                 throw new Error("WebSocket is not open");
             }
             const s = this.stream;
-            const sendBytes = (op, payload) => {
-                this.queueWriteFrame(s, op, payload);
+            const sendBytes = (op, byteLength, copyPayload) => {
+                if (!this.reserveBufferedAmount(byteLength))
+                    return;
+                try {
+                    this.queueWriteFrame(s, op, copyPayload(), byteLength);
+                }
+                catch (error) {
+                    this.bufferedAmount = Math.max(0, this.bufferedAmount - byteLength);
+                    throw error;
+                }
             };
             if (typeof data === "string") {
-                sendBytes(1, te.encode(data));
+                const payload = te.encode(data);
+                sendBytes(1, payload.byteLength, () => payload);
                 return;
             }
             if (data instanceof ArrayBuffer) {
-                sendBytes(2, new Uint8Array(data));
+                sendBytes(2, data.byteLength, () => new Uint8Array(data).slice());
                 return;
             }
             if (ArrayBuffer.isView(data)) {
-                sendBytes(2, new Uint8Array(data.buffer, data.byteOffset, data.byteLength));
+                sendBytes(2, data.byteLength, () => new Uint8Array(data.buffer, data.byteOffset, data.byteLength).slice());
                 return;
             }
             if (typeof Blob !== "undefined" && data instanceof Blob) {
-                void data
-                    .arrayBuffer()
-                    .then((ab) => sendBytes(2, new Uint8Array(ab)))
-                    .catch((e) => this.fail(e));
+                if (!this.reserveBufferedAmount(data.size))
+                    return;
+                this.queueWriteFrame(s, 2, async () => new Uint8Array(await data.arrayBuffer()), data.size);
                 return;
             }
             throw new Error("unsupported WebSocket send payload");
@@ -260,10 +300,14 @@ export function installWebSocketPatch(opts) {
             }
         }
         fail(e) {
+            if (this.readyState === PatchedWebSocket.CLOSED)
+                return;
             this.readyState = PatchedWebSocket.CLOSED;
             const msg = e instanceof Error ? e.message : String(e);
+            this.bufferedAmount = 0;
             this.emit("error", { type: "error", message: msg });
             this.emit("close", { type: "close", code: 1006, reason: msg, wasClean: false });
+            this.stream = null;
             try {
                 this.ac.abort(msg);
             }

package/dist/reconnect/index.js

@@ -1,3 +1,4 @@
+import { getClientTermination } from "../client-connect/termination.js";
 import { emitObserverDiagnostic, withObserverContext } from "../observability/observer.js";
 export { createArtifactResolver, createControlplaneArtifactSource } from "./artifactControlplane.js";
 function normalizeAutoReconnect(cfg) {
@@ -213,6 +214,14 @@ export function createReconnectManager() {
                     return;
                 }
                 setState({ status: "connected", client, error: null });
+                const termination = getClientTermination(client);
+                if (termination != null) {
+                    void termination.then(({ error }) => {
+                        if (s.client !== client)
+                            return;
+                        startReconnect(t, cfg, error);
+                    });
+                }
                 emitObserverDiagnostic(withObserverContext(cfg.observer, { attemptSeq }), {
                     path: "auto",
                     stage: "reconnect",

package/dist/rpc/client.d.ts

@@ -8,8 +8,10 @@ export declare class RpcClient {
     private readonly notifyHandlers;
     private closed;
     private readonly observer;
+    private readonly onTerminal;
     constructor(readExactly: (n: number) => Promise<Uint8Array>, write: (b: Uint8Array) => Promise<void>, opts?: Readonly<{
         observer?: ClientObserverLike;
+        onTerminal?: (error: Error) => void;
     }>);
     call(typeId: number, payload: unknown, signal?: AbortSignal): Promise<{
         payload: unknown;

package/dist/rpc/client.js

@@ -17,10 +17,12 @@ export class RpcClient {
     closed = false;
     // Observer for RPC events.
     observer;
+    onTerminal;
     constructor(readExactly, write, opts = {}) {
         this.readExactly = readExactly;
         this.write = write;
         this.observer = normalizeObserver(opts.observer);
+        this.onTerminal = opts.onTerminal;
         void this.readLoop();
     }
     // call sends a request and awaits a response or abort.
@@ -136,10 +138,19 @@ export class RpcClient {
             }
         }
         catch (e) {
+            const unexpected = !this.closed;
             this.closed = true;
             for (const [, p] of this.pending)
                 p.reject(e);
             this.pending.clear();
+            if (unexpected) {
+                try {
+                    this.onTerminal?.(e instanceof Error ? e : new Error(String(e)));
+                }
+                catch {
+                    // Lifecycle callbacks must not escape the read loop.
+                }
+            }
         }
     }
 }

package/dist/yamux/session.d.ts

@@ -33,6 +33,8 @@ export type YamuxSessionOptions = Readonly<{
     limits?: Partial<YamuxLimits>;
     /** Optional generic resource diagnostic callback. */
     onDiagnostic?: (event: YamuxDiagnostic) => void;
+    /** Internal lifecycle callback for unexpected session termination. */
+    onTerminal?: (error: Error) => void;
 }>;
 export declare class YamuxSession {
     private readonly conn;
@@ -41,6 +43,7 @@ export declare class YamuxSession {
     private readonly onIncomingStream;
     private readonly limits;
     private readonly onDiagnostic;
+    private readonly onTerminal;
     private readonly client;
     private nextStreamId;
     private closed;
@@ -51,7 +54,9 @@ export declare class YamuxSession {
     private readonly pingWaiters;
     private activeProbe;
     constructor(conn: ByteDuplex, opts: YamuxSessionOptions);
-    openStream(): Promise<YamuxStream>;
+    openStream(opts?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<YamuxStream>;
     getStream(id: number): YamuxStream | undefined;
     writeRaw(chunk: Uint8Array): Promise<void>;
     outboundFrameBytes(): number;
@@ -64,6 +69,8 @@ export declare class YamuxSession {
     onStreamEstablished(_streamId: number): void;
     onStreamClosed(streamId: number): void;
     close(): void;
+    private fail;
+    private closeInternal;
     private wakeSendWindowWaiters;
     private readLoop;
     private handlePing;