@floegence/flowersec-core 0.20.2 → 0.21.1

package/dist/client-connect/connectCore.d.ts

@@ -31,7 +31,7 @@ export type ConnectOptionsBase = Readonly<{
     outboundRecordChunkBytes?: number;
     /** WebSocket inbound and outbound queue limits. */
     webSocketLimits?: Partial<WebSocketLimits>;
-    /** Yamux stream, frame, and receive-memory limits. */
+    /** Yamux stream, frame, receive-memory, and per-stream write-queue limits. */
     yamuxLimits?: Partial<YamuxLimits>;
     /** Optional factory for creating the WebSocket instance. */
     wsFactory?: (url: string, origin: string) => WebSocketLike;

package/dist/proxy/controllerWindow.js

@@ -39,6 +39,23 @@ function hasExpectedCapability(data, capabilityNonce) {
         return false;
     return data.capabilityNonce === capabilityNonce;
 }
+function withTrustedExternalOrigin(req, rawOrigin) {
+    let externalOrigin;
+    try {
+        const url = new URL(rawOrigin);
+        if (url.protocol === "http:" || url.protocol === "https:") {
+            externalOrigin = url.origin;
+        }
+    }
+    catch {
+        // Opaque and invalid origins must not become upstream authority metadata.
+    }
+    const sanitized = { ...req };
+    delete sanitized.external_origin;
+    return externalOrigin === undefined
+        ? sanitized
+        : { ...sanitized, external_origin: externalOrigin };
+}
 function bridgeWebSocket(runtime, msg, port) {
     const ac = new AbortController();
     let terminal = false;
@@ -191,7 +208,8 @@ export function registerProxyControllerWindow(opts) {
         throw new Error("targetWindow is not available");
     }
     const onMessage = (ev) => {
-        if (!allowedOrigins.includes(String(ev.origin ?? "").trim()))
+        const eventOrigin = String(ev.origin ?? "").trim();
+        if (!allowedOrigins.includes(eventOrigin))
             return;
         if (opts.expectedSource != null && ev.source !== opts.expectedSource)
             return;
@@ -205,9 +223,11 @@ export function registerProxyControllerWindow(opts) {
         if (!port)
             return;
         switch (type) {
-            case PROXY_WINDOW_FETCH_MSG_TYPE:
-                opts.runtime.dispatchFetch(data.req, port);
+            case PROXY_WINDOW_FETCH_MSG_TYPE: {
+                const msg = data;
+                opts.runtime.dispatchFetch(withTrustedExternalOrigin(msg.req, eventOrigin), port);
                 return;
+            }
             case PROXY_WINDOW_WS_OPEN_MSG_TYPE:
                 bridgeWebSocket(opts.runtime, data, port);
                 return;

package/dist/proxy/preset.d.ts

@@ -24,7 +24,6 @@ export type ResolvedProxyPreset = Readonly<{
     }>;
 }>;
 export declare const DEFAULT_PROXY_PRESET_MANIFEST: ProxyPresetManifest;
-export declare const CODESERVER_PROXY_PRESET_MANIFEST: ProxyPresetManifest;
 export type ProxyPresetInput = ProxyPresetManifest | Partial<ProxyPresetLimits>;
 export declare function assertProxyPresetManifest(value: unknown): ProxyPresetManifest;
 export declare function resolveNamedProxyPreset(name: string): ProxyPresetManifest;

package/dist/proxy/preset.js

@@ -17,17 +17,6 @@ export const DEFAULT_PROXY_PRESET_MANIFEST = Object.freeze({
         max_ws_frame_bytes: DEFAULT_MAX_WS_FRAME_BYTES,
     },
 });
-export const CODESERVER_PROXY_PRESET_MANIFEST = Object.freeze({
-    v: 1,
-    preset_id: "codeserver",
-    deprecated: true,
-    limits: {
-        max_json_frame_bytes: DEFAULT_MAX_JSON_FRAME_BYTES,
-        max_chunk_bytes: DEFAULT_MAX_CHUNK_BYTES,
-        max_body_bytes: DEFAULT_MAX_BODY_BYTES,
-        max_ws_frame_bytes: 32 * 1024 * 1024,
-    },
-});
 function isRecord(v) {
     return typeof v === "object" && v != null && !Array.isArray(v);
 }
@@ -91,8 +80,6 @@ export function resolveNamedProxyPreset(name) {
         case "":
         case "default":
             return DEFAULT_PROXY_PRESET_MANIFEST;
-        case "codeserver":
-            return CODESERVER_PROXY_PRESET_MANIFEST;
         default:
             throw new Error(`unknown proxy preset: ${name}`);
     }

package/dist/proxy/profiles.d.ts

@@ -6,7 +6,7 @@ export type ProxyProfile = Readonly<{
     maxWsFrameBytes: number;
     timeoutMs: number;
 }>;
-export type ProxyProfileName = "default" | "codeserver";
+export type ProxyProfileName = "default";
 export declare const PROXY_PROFILE_DEFAULT: Readonly<{
     maxJsonFrameBytes: number;
     maxChunkBytes: number;
@@ -14,12 +14,5 @@ export declare const PROXY_PROFILE_DEFAULT: Readonly<{
     maxWsFrameBytes: number;
     timeoutMs: number;
 }>;
-export declare const PROXY_PROFILE_CODESERVER: Readonly<{
-    maxJsonFrameBytes: number;
-    maxChunkBytes: number;
-    maxBodyBytes: number;
-    maxWsFrameBytes: number;
-    timeoutMs: number;
-}>;
 export declare function resolveProxyProfile(profile?: ProxyProfileName | Partial<ProxyProfile>): ProxyProfile;
 export declare function profileToPresetManifest(profile?: ProxyProfileName | Partial<ProxyProfile>): ProxyPresetManifest;

package/dist/proxy/profiles.js

@@ -1,4 +1,4 @@
-import { CODESERVER_PROXY_PRESET_MANIFEST, DEFAULT_PROXY_PRESET_MANIFEST, resolveProxyPreset, } from "./preset.js";
+import { DEFAULT_PROXY_PRESET_MANIFEST, resolveProxyPreset, } from "./preset.js";
 function toLegacyProfile(manifest) {
     const resolved = resolveProxyPreset(manifest);
     return Object.freeze({
@@ -10,9 +10,7 @@ function toLegacyProfile(manifest) {
     });
 }
 const DEFAULT_PROFILE = toLegacyProfile(DEFAULT_PROXY_PRESET_MANIFEST);
-const CODESERVER_PROFILE = toLegacyProfile(CODESERVER_PROXY_PRESET_MANIFEST);
 export const PROXY_PROFILE_DEFAULT = DEFAULT_PROFILE;
-export const PROXY_PROFILE_CODESERVER = CODESERVER_PROFILE;
 function normalizeSafeInt(name, value) {
     if (!Number.isFinite(value))
         throw new Error(`${name} must be a finite number`);
@@ -27,8 +25,6 @@ function resolveNamedProfile(name) {
     switch (name) {
         case "default":
             return DEFAULT_PROFILE;
-        case "codeserver":
-            return CODESERVER_PROFILE;
         default:
             throw new Error(`unknown proxy profile: ${name}`);
     }
@@ -55,8 +51,6 @@ export function profileToPresetManifest(profile) {
         switch (profile) {
             case "default":
                 return DEFAULT_PROXY_PRESET_MANIFEST;
-            case "codeserver":
-                return CODESERVER_PROXY_PRESET_MANIFEST;
             default:
                 throw new Error(`unknown proxy profile: ${profile}`);
         }

package/dist/proxy/runtime.d.ts

@@ -8,6 +8,7 @@ type ProxyFetchReq = Readonly<{
     path: string;
     headers: readonly Header[];
     external_origin?: string;
+    response_flow_control?: "chunk_credit_v1";
     body?: ArrayBuffer;
 }>;
 export type ProxyRuntimeLimits = Readonly<{

package/dist/proxy/runtime.js

@@ -345,11 +345,44 @@ export function createProxyRuntime(opts) {
         const ac = new AbortController();
         let stream = null;
         let releaseAdmission = null;
+        const usesResponseCredits = req.response_flow_control === "chunk_credit_v1";
+        let responseCreditAvailable = false;
+        let responseCreditResolve = null;
+        const wakeResponseCreditWaiter = () => {
+            const resolve = responseCreditResolve;
+            responseCreditResolve = null;
+            resolve?.();
+        };
         port.onmessage = (ev) => {
             const m = ev.data;
-            if (m && typeof m === "object" && m.type === "flowersec-proxy:abort") {
+            if (!m || typeof m !== "object")
+                return;
+            if (m.type === "flowersec-proxy:abort") {
+                responseCreditAvailable = false;
                 ac.abort("aborted");
+                wakeResponseCreditWaiter();
+                return;
+            }
+            if (usesResponseCredits && m.type === "flowersec-proxy:response_credit") {
+                responseCreditAvailable = true;
+                wakeResponseCreditWaiter();
+            }
+        };
+        const waitForResponseCredit = async () => {
+            if (!usesResponseCredits)
+                return;
+            if (ac.signal.aborted)
+                throw new AbortError("aborted");
+            while (!responseCreditAvailable) {
+                if (ac.signal.aborted)
+                    throw new AbortError("aborted");
+                await new Promise((resolve) => {
+                    responseCreditResolve = resolve;
+                });
             }
+            if (ac.signal.aborted)
+                throw new AbortError("aborted");
+            responseCreditAvailable = false;
         };
         void (async () => {
             try {
@@ -400,6 +433,9 @@ export function createProxyRuntime(opts) {
                 port.postMessage({ type: "flowersec-proxy:response_meta", status, headers: passthrough });
                 const chunks = await readChunkFrames(reader, maxChunkBytes, maxBodyBytes);
                 for await (const chunk of chunks) {
+                    await waitForResponseCredit();
+                    if (ac.signal.aborted)
+                        throw new AbortError("aborted");
                     // Always transfer an ArrayBuffer (SharedArrayBuffer is not transferable).
                     const ab = chunk.slice().buffer;
                     port.postMessage({ type: "flowersec-proxy:response_chunk", data: ab }, [ab]);
@@ -429,6 +465,7 @@ export function createProxyRuntime(opts) {
                 }
             }
             finally {
+                wakeResponseCreditWaiter();
                 releaseAdmission?.();
                 try {
                     port.close();

package/dist/proxy/serviceWorker.js

@@ -472,12 +472,25 @@ async function handleFetch(event) {
     const donePromise = new Promise((resolve, reject) => { doneResolve = resolve; doneReject = reject; });
 
     let controller = null;
+    let responseCreditOutstanding = false;
+
+    function requestResponseCredit() {
+      if (responseCreditOutstanding) return;
+      responseCreditOutstanding = true;
+      try { port.postMessage({ type: "flowersec-proxy:response_credit" }); } catch {}
+    }
+
+    function abortRuntimeResponse() {
+      responseCreditOutstanding = false;
+      try { port.postMessage({ type: "flowersec-proxy:abort" }); } catch {}
+      try { port.close(); } catch {}
+    }
 
     const stream = new ReadableStream({
       start(c) { controller = c; },
+      pull() { requestResponseCredit(); },
       cancel() {
-        try { port.postMessage({ type: "flowersec-proxy:abort" }); } catch {}
-        try { port.close(); } catch {}
+        abortRuntimeResponse();
       }
     });
 
@@ -490,7 +503,7 @@ async function handleFetch(event) {
         metaReject(err);
         doneReject(err);
         controller?.error(err);
-        try { port.close(); } catch {}
+        abortRuntimeResponse();
         return false;
       }
       htmlChunks.push(b);
@@ -516,27 +529,30 @@ async function handleFetch(event) {
               metaReject(err);
               doneReject(err);
               controller?.error(err);
-              try { port.close(); } catch {}
+              abortRuntimeResponse();
               return;
             }
           }
         }
         metaResolve(m);
+        if (shouldInjectHTML) requestResponseCredit();
         if (controller && !shouldInjectHTML) for (const q of queued) controller.enqueue(q);
         if (shouldInjectHTML) for (const q of queued) if (!pushInjectChunk(q)) return;
         queued.length = 0;
         return;
       }
       if (m.type === "flowersec-proxy:response_chunk") {
+        responseCreditOutstanding = false;
         const b = new Uint8Array(m.data);
         if (shouldInjectHTML) {
-          pushInjectChunk(b);
+          if (pushInjectChunk(b)) requestResponseCredit();
           return;
         }
         if (controller) controller.enqueue(b); else queued.push(b);
         return;
       }
       if (m.type === "flowersec-proxy:response_end") {
+        responseCreditOutstanding = false;
         if (shouldInjectHTML) {
           doneResolve(htmlChunks);
           return;
@@ -545,6 +561,7 @@ async function handleFetch(event) {
         return;
       }
       if (m.type === "flowersec-proxy:response_error") {
+        responseCreditOutstanding = false;
         const status = typeof m.status === "number" && Number.isFinite(m.status) ? Math.floor(m.status) : 502;
         lastErrorStatus = status > 0 ? status : 502;
         lastErrorMessage = String(m.message || "proxy error");
@@ -572,6 +589,7 @@ async function handleFetch(event) {
         path,
         headers: headersToPairs(req.headers),
         ...(externalOrigin ? { external_origin: externalOrigin } : {}),
+        response_flow_control: "chunk_credit_v1",
         body
       }
     }, [port2]);

package/dist/proxy/windowBridgeProtocol.d.ts

@@ -16,6 +16,7 @@ export type ProxyWindowFetchRequest = Readonly<{
     path: string;
     headers: readonly Header[];
     external_origin?: string;
+    response_flow_control?: "chunk_credit_v1";
     body?: ArrayBuffer;
 }>;
 export type ProxyWindowFetchForwardMsg = Readonly<{

package/dist/reconnect/index.js

@@ -138,8 +138,9 @@ export function createReconnectManager() {
         }
         token += 1;
         const nextToken = token;
+        const reconnectPromise = startConnectLoop(nextToken, cfg);
         setState({ status: "connecting", error, client: null });
-        void connectWithRetry(nextToken, cfg).catch(() => {
+        void reconnectPromise.catch(() => {
             // connectWithRetry updates state; keep errors observable via state().
         });
     };
@@ -262,6 +263,22 @@ export function createReconnectManager() {
             }
         }
     };
+    const startConnectLoop = (t, cfg) => {
+        let resolveLoop;
+        let rejectLoop;
+        const loop = new Promise((resolve, reject) => {
+            resolveLoop = resolve;
+            rejectLoop = reject;
+        });
+        let promise;
+        promise = loop.finally(() => {
+            if (activeConnectPromise === promise)
+                activeConnectPromise = null;
+        });
+        activeConnectPromise = promise;
+        void connectWithRetry(t, cfg).then(resolveLoop, rejectLoop);
+        return promise;
+    };
     const connect = async (cfg) => {
         cancelRetrySleep();
         abortActiveAttempt();
@@ -277,25 +294,18 @@ export function createReconnectManager() {
                 // ignore
             }
         }
+        const connectPromise = startConnectLoop(t, cfg);
         setState({ status: "connecting", error: null, client: null });
-        const p = connectWithRetry(t, cfg);
-        activeConnectPromise = p;
-        try {
-            await p;
-        }
-        finally {
-            if (activeConnectPromise === p)
-                activeConnectPromise = null;
-        }
+        await connectPromise;
     };
     const connectIfNeeded = async (cfg) => {
         if (isSameConfig(active, cfg)) {
-            if (s.status === "connected" && s.client)
-                return;
-            if (s.status === "connecting" && activeConnectPromise) {
+            if (activeConnectPromise) {
                 await activeConnectPromise;
                 return;
             }
+            if (s.status === "connected" && s.client)
+                return;
         }
         await connect(cfg);
     };

package/dist/yamux/session.d.ts

@@ -12,8 +12,11 @@ export type YamuxLimits = Readonly<{
     preferredOutboundFrameBytes: number;
     maxStreamReceiveBytes: number;
     maxSessionReceiveBytes: number;
+    /** Maximum bytes retained by pending write calls on one stream. */
+    maxStreamWriteQueueBytes?: number;
 }>;
-export declare const DEFAULT_YAMUX_LIMITS: YamuxLimits;
+type ResolvedYamuxLimits = Readonly<Required<YamuxLimits>>;
+export declare const DEFAULT_YAMUX_LIMITS: ResolvedYamuxLimits;
 export type ByteDuplex = {
     /** Reads the next chunk from the underlying connection. */
     read(): Promise<Uint8Array>;
@@ -60,6 +63,7 @@ export declare class YamuxSession {
     getStream(id: number): YamuxStream | undefined;
     writeRaw(chunk: Uint8Array): Promise<void>;
     outboundFrameBytes(): number;
+    streamWriteQueueBytes(): number;
     releaseReceiveBytes(bytes: number): void;
     probeLiveness(timeoutMs?: number): Promise<number>;
     private startLivenessProbe;
@@ -79,3 +83,4 @@ export declare class YamuxSession {
     private isInboundStreamIdValid;
     private diagnostic;
 }
+export {};

package/dist/yamux/session.js

@@ -10,6 +10,7 @@ export const DEFAULT_YAMUX_LIMITS = Object.freeze({
     preferredOutboundFrameBytes: 64 * 1024,
     maxStreamReceiveBytes: 256 * 1024,
     maxSessionReceiveBytes: 16 * (1 << 20),
+    maxStreamWriteQueueBytes: 4 * (1 << 20),
 });
 // YamuxSession multiplexes multiple streams over a single byte stream.
 export class YamuxSession {
@@ -92,6 +93,9 @@ export class YamuxSession {
     outboundFrameBytes() {
         return this.limits.preferredOutboundFrameBytes;
     }
+    streamWriteQueueBytes() {
+        return this.limits.maxStreamWriteQueueBytes;
+    }
     releaseReceiveBytes(bytes) {
         this.sessionReceiveBytes = Math.max(0, this.sessionReceiveBytes - Math.max(0, bytes));
     }
@@ -436,6 +440,7 @@ function normalizeYamuxLimits(input) {
         preferredOutboundFrameBytes: input?.preferredOutboundFrameBytes ?? Math.min(DEFAULT_YAMUX_LIMITS.preferredOutboundFrameBytes, maxFrameBytes),
         maxStreamReceiveBytes: input?.maxStreamReceiveBytes ?? DEFAULT_YAMUX_LIMITS.maxStreamReceiveBytes,
         maxSessionReceiveBytes: input?.maxSessionReceiveBytes ?? DEFAULT_YAMUX_LIMITS.maxSessionReceiveBytes,
+        maxStreamWriteQueueBytes: input?.maxStreamWriteQueueBytes ?? DEFAULT_YAMUX_LIMITS.maxStreamWriteQueueBytes,
     };
     for (const [name, value] of Object.entries(limits)) {
         if (!Number.isSafeInteger(value) || value <= 0)

package/dist/yamux/stream.d.ts

@@ -13,6 +13,7 @@ export declare class YamuxStream {
     private error;
     private resetTask;
     private writeChain;
+    private writeQueueBytes;
     private finalized;
     constructor(session: YamuxSession, id: number, state: StreamState);
     open(): Promise<void>;

package/dist/yamux/stream.js

@@ -1,6 +1,7 @@
 import { concatBytes } from "../utils/bin.js";
 import { encodeHeader } from "./header.js";
 import { DEFAULT_MAX_STREAM_WINDOW, FLAG_ACK, FLAG_FIN, FLAG_RST, FLAG_SYN, TYPE_DATA, TYPE_WINDOW_UPDATE } from "./constants.js";
+import { YamuxResourceExhaustedError } from "./errors.js";
 // YamuxStream manages per-stream flow control and state transitions.
 export class YamuxStream {
     // Stream identifier within the session.
@@ -24,6 +25,7 @@ export class YamuxStream {
     error = null;
     resetTask;
     writeChain = Promise.resolve();
+    writeQueueBytes = 0;
     finalized = false;
     constructor(session, id, state) {
         this.session = session;
@@ -87,10 +89,23 @@ export class YamuxStream {
     }
     // write sends DATA frames, respecting the send window.
     async write(data) {
-        const payload = data.slice();
-        const write = this.writeChain.then(() => this.writeSerial(payload));
-        this.writeChain = write.catch(() => { });
-        await write;
+        this.ensureWritable();
+        const byteCount = data.byteLength;
+        const nextQueueBytes = this.writeQueueBytes + byteCount;
+        const limit = this.session.streamWriteQueueBytes();
+        if (!Number.isSafeInteger(nextQueueBytes) || nextQueueBytes > limit) {
+            throw new YamuxResourceExhaustedError("stream_write_queue_bytes", nextQueueBytes, limit);
+        }
+        this.writeQueueBytes = nextQueueBytes;
+        try {
+            const payload = data.slice();
+            const write = this.writeChain.then(() => this.writeSerial(payload));
+            this.writeChain = write.catch(() => { });
+            await write;
+        }
+        finally {
+            this.writeQueueBytes = Math.max(0, this.writeQueueBytes - byteCount);
+        }
     }
     async writeSerial(data) {
         this.ensureWritable();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "0.20.2",
+  "version": "0.21.1",
   "description": "Flowersec core TypeScript library (browser-friendly E2EE + multiplexing over WebSocket).",
   "license": "MIT",
   "repository": {