@floegence/flowersec-core 0.22.0 → 0.23.0

package/README.md

@@ -60,7 +60,9 @@ const reconnectConfig = createNodeReconnectConfig({
 Browser `requestConnectArtifact(...)`, `requestEntryConnectArtifact(...)`, and `ControlplaneRequestError` remain available from `@floegence/flowersec-core/browser` as stable aliases.
 
 High-level connects use `RequireTLS` by default. `AllowPlaintextForLoopback` permits only literal loopback
-targets without DNS resolution; `AllowPlaintext` is an explicit acceptance of pre-E2EE metadata exposure.
+targets without DNS resolution. Deliberate non-loopback `ws://` connections must use
+`createNetworkPlaintextPolicy(...)` with exact canonical IP literals and
+`PlaintextRiskAcceptance.acceptPreE2ECredentialExposure`. The unrestricted `AllowPlaintext` preset is deprecated.
 
 ## Node endpoint and controlplane
 

package/YAMUX_ALIGNMENT.md

@@ -77,19 +77,19 @@ Source: `flowersec-ts/src/yamux/constants.ts`, `flowersec-ts/src/yamux/header.ts
 The TS Yamux implementation is exercised in real interop scenarios:
 
 - **TS client ↔ Go server (minimal Yamux over TCP)**:
-  - Test: `flowersec-ts/src/e2e/yamux_interop.test.ts` (minimal tcp mode)
-  - Go harness: `flowersec-go/internal/cmd/flowersec-yamux-harness/main.go`
+  - Test: `flowersec-go/internal/cmd/flowersec-interop` with the TypeScript JSONL harness
+  - Go reference: production `client`, `endpoint`, and Yamux-backed session APIs
   - Covers: window update race, RST handling, concurrent open/close, session close.
   - Notes: opt-in via `YAMUX_INTEROP=1` (runs Go harnesses).
   - Notes: sizes scale via `YAMUX_INTEROP_SCALE` (e.g. `2` => 20 streams / 1 MiB per stream).
   - Notes: client-initiated RST scenarios run when `YAMUX_INTEROP_CLIENT_RST=1`.
   - Notes: window-update and concurrent-open/close stress runs when `YAMUX_INTEROP_STRESS=1`.
 - **TS client ↔ Go server (full chain: E2EE + tunnel + Yamux)**:
-  - Test: `flowersec-ts/src/e2e/yamux_interop.test.ts` (full chain mode)
+  - Test: the Direct/Tunnel variants in `stability/interop_matrix.json`
   - Go harness: `flowersec-go/internal/cmd/flowersec-e2e-harness/main.go` with `-scenario`
   - Notes: reduced stream counts/payload sizes to keep end-to-end runtime bounded.
 - **Layered close/reset probes (memory + WS + full chain)**:
-  - Test: `flowersec-ts/src/e2e/yamux_interop_layers.test.ts`
+  - Test: the Go-reference smoke and stress profiles in `testdata/interop/v1/profiles.json`
   - Covers: session-close wakeup, FIN/RST delivery across SecureChannel + WebSocketBinaryTransport,
     and a full-chain FIN/RST probe on `rst_mid_write_go`.
   - Notes: gated by `YAMUX_INTEROP=1`; the full-chain probe additionally requires

package/dist/browser/index.d.ts

@@ -1,7 +1,7 @@
 export type { ConnectBrowserOptions, DirectConnectBrowserOptions, TunnelConnectBrowserOptions } from "./connect.js";
 export { connectBrowser, connectDirectBrowser, connectTunnelBrowser } from "./connect.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, RequireTLS, } from "../client-connect/transportSecurity.js";
-export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, NetworkPlaintextPolicyOptions, } from "../client-connect/transportSecurity.js";
 export type { ConnectArtifact, CorrelationContext, CorrelationKV, DirectClientConnectArtifact, ScopeMetadataEntry, TunnelClientConnectArtifact, } from "../connect/artifact.js";
 export { assertConnectArtifact } from "../connect/artifact.js";
 export type { ConnectArtifactRequestConfig, ControlplaneConfig, EntryConnectArtifactRequestConfig, EntryControlplaneConfig, } from "./controlplane.js";

package/dist/browser/index.js

@@ -1,5 +1,5 @@
 export { connectBrowser, connectDirectBrowser, connectTunnelBrowser } from "./connect.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export { assertConnectArtifact } from "../connect/artifact.js";
 export { ControlplaneRequestError, requestChannelGrant, requestConnectArtifact, requestEntryChannelGrant, requestEntryConnectArtifact, } from "./controlplane.js";
 export { createBrowserReconnectConfig, createDirectBrowserReconnectConfig, createTunnelBrowserReconnectConfig, } from "./reconnectConfig.js";

package/dist/client-connect/connectCore.js

@@ -14,7 +14,7 @@ import { prepareChannelId } from "./contract.js";
 import { isTunnelAttachCloseReason } from "./tunnelAttachCloseReason.js";
 import { enforceTransportSecurity } from "./transportSecurity.js";
 import { maxPlaintextBytes } from "../e2ee/record.js";
-import { isYamuxResourceExhaustedError } from "../yamux/errors.js";
+import { isYamuxPingTimeoutError, isYamuxResourceExhaustedError } from "../yamux/errors.js";
 import { registerClientTermination } from "./termination.js";
 export async function connectCore(args) {
     const observer = normalizeObserver(args.opts.observer, { path: args.path });
@@ -143,12 +143,6 @@ export async function connectCore(args) {
         catch (err) {
             const reason = classifyConnectError(err);
             observer.onConnect(args.path, "fail", reason, nowSeconds() - connectStart);
-            try {
-                transport.close();
-            }
-            catch {
-                // ignore
-            }
             const code = reason === "timeout" ? "timeout" : reason === "canceled" ? "canceled" : "dial_failed";
             throw new FlowersecError({
                 path: args.path,
@@ -167,12 +161,6 @@ export async function connectCore(args) {
             catch (err) {
                 observer.onAttach("fail", "send_failed");
                 attachState = "failed";
-                try {
-                    transport.close();
-                }
-                catch {
-                    // ignore
-                }
                 throw new FlowersecError({ path: args.path, stage: "attach", code: "attach_failed", message: "attach failed", cause: err });
             }
         }
@@ -202,7 +190,6 @@ export async function connectCore(args) {
         catch (err) {
             const handshakeElapsedSeconds = nowSeconds() - handshakeStart;
             const handshakeCode = classifyHandshakeError(err);
-            transport.close();
             if (args.path === "tunnel" && err instanceof WsCloseError) {
                 const reason = err.reason;
                 if (isTunnelAttachCloseReason(reason)) {
@@ -233,17 +220,20 @@ export async function connectCore(args) {
         });
         let terminationReported = false;
         let closeAll = () => {
-            try {
-                secure.close();
-            }
-            catch { /* ignore */ }
+            runSyncCleanups([() => secure.close()]);
         };
         const reportTermination = (error) => {
             if (terminationReported)
                 return;
             terminationReported = true;
-            closeAll();
-            resolveTermination({ error });
+            let terminalError = error;
+            try {
+                closeAll();
+            }
+            catch (cleanupError) {
+                terminalError = errorWithCleanup(error, cleanupError, "session termination cleanup failed");
+            }
+            resolveTermination({ error: terminalError });
         };
         const mux = new YamuxSession(conn, {
             client: true,
@@ -261,23 +251,21 @@ export async function connectCore(args) {
             }),
         });
         closeAll = () => {
-            try {
-                mux.close();
-            }
-            catch { /* ignore */ }
-            try {
-                secure.close();
-            }
-            catch { /* ignore */ }
+            runSyncCleanups([() => mux.close(), () => secure.close()]);
         };
         let rpcStream;
         try {
             rpcStream = await mux.openStream(signal === undefined ? {} : { signal });
         }
         catch (e) {
-            mux.close();
-            secure.close();
-            throw new FlowersecError({ path: args.path, stage: "yamux", code: "open_stream_failed", message: "open rpc stream failed", cause: e });
+            const cleanupError = captureSyncCleanup(() => runSyncCleanups([() => mux.close(), () => secure.close()]));
+            throw new FlowersecError({
+                path: args.path,
+                stage: "yamux",
+                code: "open_stream_failed",
+                message: "open rpc stream failed",
+                cause: causeWithCleanup(e, cleanupError, "RPC stream setup cleanup failed"),
+            });
         }
         const reader = new ByteReader(() => rpcStream.read());
         const readExactly = (n) => reader.readExactly(n);
@@ -286,20 +274,19 @@ export async function connectCore(args) {
             await writeStreamHello(write, "rpc");
         }
         catch (e) {
-            try {
-                await rpcStream.close();
-            }
-            catch {
-                // ignore
-            }
-            mux.close();
-            secure.close();
+            const cleanupError = await captureAsyncCleanup(async () => {
+                const streamCloseError = await captureAsyncCleanup(() => rpcStream.close());
+                const stackCloseError = captureSyncCleanup(() => runSyncCleanups([() => mux.close(), () => secure.close()]));
+                const combined = errorsFrom([streamCloseError, stackCloseError]);
+                if (combined != null)
+                    throw combined;
+            });
             throw new FlowersecError({
                 path: args.path,
                 stage: "rpc",
                 code: "stream_hello_failed",
                 message: "rpc stream hello failed",
-                cause: e,
+                cause: causeWithCleanup(e, cleanupError, "RPC bootstrap cleanup failed"),
             });
         }
         const rpc = new RpcClient(readExactly, write, { observer, onTerminal: reportTermination });
@@ -316,22 +303,12 @@ export async function connectCore(args) {
                 return await mux.probeLiveness(liveness.timeoutMs);
             }
             catch (e) {
-                if (String(e?.message).includes("ping timeout")) {
+                if (isYamuxPingTimeoutError(e)) {
                     emitObserverDiagnostic(args.opts.observer, { path: args.path, stage: "yamux", code_domain: "event", code: "liveness_timeout", result: "fail" });
                 }
-                try {
-                    rpc.close();
-                }
-                catch { /* ignore */ }
-                try {
-                    mux.close();
-                }
-                catch { /* ignore */ }
-                try {
-                    secure.close();
-                }
-                catch { /* ignore */ }
-                throw new FlowersecError({ path: args.path, stage: "yamux", code: "ping_failed", message: "liveness probe failed", cause: e });
+                const error = new FlowersecError({ path: args.path, stage: "yamux", code: "ping_failed", message: "liveness probe failed", cause: e });
+                reportTermination(error);
+                throw error;
             }
         };
         let livenessTimer;
@@ -344,24 +321,7 @@ export async function connectCore(args) {
         };
         closeAll = () => {
             stopLiveness();
-            try {
-                rpc.close();
-            }
-            catch {
-                // ignore
-            }
-            try {
-                mux.close();
-            }
-            catch {
-                // ignore
-            }
-            try {
-                secure.close();
-            }
-            catch {
-                // ignore
-            }
+            runSyncCleanups([() => rpc.close(), () => mux.close(), () => secure.close()]);
         };
         if (liveness.intervalMs > 0) {
             livenessTimer = setInterval(() => {
@@ -385,6 +345,14 @@ export async function connectCore(args) {
             mux,
             rpc,
             ping,
+            rekey: async () => {
+                try {
+                    await secure.rekeyNow();
+                }
+                catch (error) {
+                    throw new FlowersecError({ path: args.path, stage: "secure", code: "rekey_failed", message: "rekey failed", cause: error });
+                }
+            },
             probeLiveness,
             openStream: async (kind, opts = {}) => {
                 if (kind == null || kind === "")
@@ -408,6 +376,7 @@ export async function connectCore(args) {
                 };
                 const signal = opts.signal;
                 let abortListener;
+                let abortReset;
                 let s;
                 try {
                     s = await mux.openStream(signal === undefined ? {} : { signal });
@@ -421,12 +390,7 @@ export async function connectCore(args) {
                 }
                 if (signal != null) {
                     abortListener = () => {
-                        try {
-                            s.reset(abortReason(signal));
-                        }
-                        catch {
-                            // ignore
-                        }
+                        abortReset ??= captureAsyncCleanup(() => Promise.resolve(s.reset(abortReason(signal))));
                     };
                     signal.addEventListener("abort", abortListener, { once: true });
                     if (signal.aborted)
@@ -435,18 +399,19 @@ export async function connectCore(args) {
                 if (signal?.aborted) {
                     if (abortListener != null)
                         signal.removeEventListener("abort", abortListener);
-                    try {
-                        await s.close();
-                    }
-                    catch {
-                        // ignore
-                    }
+                    const cleanupError = await captureAsyncCleanup(async () => {
+                        const resetError = abortReset == null ? undefined : await abortReset;
+                        const closeError = await captureAsyncCleanup(() => s.close());
+                        const combined = errorsFrom([resetError, closeError]);
+                        if (combined != null)
+                            throw combined;
+                    });
                     throw new FlowersecError({
                         path: args.path,
                         stage: "yamux",
                         code: "canceled",
                         message: "open stream aborted",
-                        cause: signal.reason,
+                        cause: causeWithCleanup(signal.reason, cleanupError, "aborted stream cleanup failed"),
                     });
                 }
                 try {
@@ -456,34 +421,30 @@ export async function connectCore(args) {
                     if (signal?.aborted) {
                         if (abortListener != null)
                             signal.removeEventListener("abort", abortListener);
-                        try {
-                            await s.close();
-                        }
-                        catch {
-                            // ignore
-                        }
+                        const cleanupError = await captureAsyncCleanup(async () => {
+                            const resetError = abortReset == null ? undefined : await abortReset;
+                            const closeError = await captureAsyncCleanup(() => s.close());
+                            const combined = errorsFrom([resetError, closeError]);
+                            if (combined != null)
+                                throw combined;
+                        });
                         throw new FlowersecError({
                             path: args.path,
                             stage: "yamux",
                             code: "canceled",
                             message: "open stream aborted",
-                            cause: signal.reason,
+                            cause: causeWithCleanup(signal.reason, cleanupError, "aborted stream cleanup failed"),
                         });
                     }
                     if (signal != null && abortListener != null)
                         signal.removeEventListener("abort", abortListener);
-                    try {
-                        await s.close();
-                    }
-                    catch {
-                        // ignore
-                    }
+                    const cleanupError = await captureAsyncCleanup(() => s.close());
                     throw new FlowersecError({
                         path: args.path,
                         stage: "rpc",
                         code: "stream_hello_failed",
                         message: "stream hello failed",
-                        cause: err,
+                        cause: causeWithCleanup(err, cleanupError, "stream hello cleanup failed"),
                     });
                 }
                 if (signal != null && abortListener != null) {
@@ -499,14 +460,65 @@ export async function connectCore(args) {
         return client;
     }
     catch (e) {
+        const cleanupError = captureSyncCleanup(() => transport.close());
+        throw cleanupError == null ? e : errorWithCleanup(e, cleanupError, "transport cleanup failed");
+    }
+}
+function runSyncCleanups(actions) {
+    const failures = [];
+    for (const action of actions) {
         try {
-            transport.close();
+            action();
         }
-        catch {
-            // ignore
+        catch (error) {
+            failures.push(errorValue(error));
         }
-        throw e;
     }
+    if (failures.length > 0)
+        throw new AggregateError(failures, "Flowersec cleanup failed");
+}
+function captureSyncCleanup(action) {
+    try {
+        action();
+        return undefined;
+    }
+    catch (error) {
+        return error;
+    }
+}
+async function captureAsyncCleanup(action) {
+    try {
+        await action();
+        return undefined;
+    }
+    catch (error) {
+        return error;
+    }
+}
+function causeWithCleanup(primary, cleanup, message) {
+    if (cleanup === undefined)
+        return primary;
+    return new AggregateError([errorValue(primary), errorValue(cleanup)], message);
+}
+function errorWithCleanup(primary, cleanup, message) {
+    const cause = causeWithCleanup(primary, cleanup, message);
+    if (primary instanceof FlowersecError) {
+        return new FlowersecError({
+            path: primary.path,
+            stage: primary.stage,
+            code: primary.code,
+            message,
+            cause,
+        });
+    }
+    return new AggregateError([errorValue(primary), errorValue(cleanup)], message);
+}
+function errorsFrom(values) {
+    const failures = values.filter((value) => value !== undefined).map(errorValue);
+    return failures.length === 0 ? undefined : new AggregateError(failures, "Flowersec cleanup failed");
+}
+function errorValue(error) {
+    return error instanceof Error ? error : new Error(String(error));
 }
 function validateLimitObject(input, name, invalid) {
     if (input === undefined)

package/dist/client-connect/transportSecurity.d.ts

@@ -2,7 +2,16 @@ import type { ClientPath } from "../client.js";
 import { type ClientObserverLike } from "../observability/observer.js";
 export declare const RequireTLS: "require_tls";
 export declare const AllowPlaintextForLoopback: "allow_plaintext_for_loopback";
+/** @deprecated Use RequireTLS, AllowPlaintextForLoopback, or createNetworkPlaintextPolicy. */
 export declare const AllowPlaintext: "allow_plaintext";
+export declare const PlaintextRiskAcceptance: {
+    readonly acceptPreE2ECredentialExposure: "accept_pre_e2ee_credential_exposure";
+};
+export type PlaintextRiskAcceptance = typeof PlaintextRiskAcceptance[keyof typeof PlaintextRiskAcceptance];
+export type NetworkPlaintextPolicyOptions = Readonly<{
+    allowedHosts: readonly string[];
+    riskAcceptance: PlaintextRiskAcceptance;
+}>;
 export type TransportSecurityPolicyInput = Readonly<{
     path: ClientPath;
     scheme: "ws" | "wss";
@@ -11,6 +20,7 @@ export type TransportSecurityPolicyInput = Readonly<{
 }>;
 export type TransportSecurityPolicyPreset = typeof RequireTLS | typeof AllowPlaintextForLoopback | typeof AllowPlaintext;
 export type TransportSecurityPolicy = TransportSecurityPolicyPreset | ((input: TransportSecurityPolicyInput) => boolean | Promise<boolean>);
+export declare function createNetworkPlaintextPolicy(options: NetworkPlaintextPolicyOptions): TransportSecurityPolicy;
 export declare function enforceTransportSecurity(args: Readonly<{
     rawUrl: string;
     path: ClientPath;

package/dist/client-connect/transportSecurity.js

@@ -2,7 +2,21 @@ import { FlowersecError } from "../utils/errors.js";
 import { emitObserverDiagnostic } from "../observability/observer.js";
 export const RequireTLS = "require_tls";
 export const AllowPlaintextForLoopback = "allow_plaintext_for_loopback";
+/** @deprecated Use RequireTLS, AllowPlaintextForLoopback, or createNetworkPlaintextPolicy. */
 export const AllowPlaintext = "allow_plaintext";
+export const PlaintextRiskAcceptance = {
+    acceptPreE2ECredentialExposure: "accept_pre_e2ee_credential_exposure",
+};
+export function createNetworkPlaintextPolicy(options) {
+    if (options?.riskAcceptance !== PlaintextRiskAcceptance.acceptPreE2ECredentialExposure) {
+        throw new Error("network plaintext policy requires explicit pre-E2EE credential exposure acceptance");
+    }
+    if (!Array.isArray(options.allowedHosts) || options.allowedHosts.length === 0) {
+        throw new Error("network plaintext policy requires at least one allowed host");
+    }
+    const allowedHosts = new Set(options.allowedHosts.map(canonicalNetworkPlaintextHost));
+    return (input) => input.scheme === "wss" || (input.scheme === "ws" && allowedHosts.has(input.host));
+}
 export async function enforceTransportSecurity(args) {
     let target;
     try {
@@ -105,6 +119,81 @@ function isLiteralLoopbackHost(host) {
     }
     return octets[0] === 127;
 }
+function canonicalNetworkPlaintextHost(rawHost) {
+    const host = String(rawHost ?? "").trim();
+    if (host === "" || host !== host.toLowerCase() || /[@/?#%\[\]]/.test(host)) {
+        throw new Error(`invalid network plaintext allowed host ${JSON.stringify(rawHost)}`);
+    }
+    if (host.includes(":")) {
+        return canonicalNetworkIPv6Host(host);
+    }
+    const octets = canonicalIPv4Octets(host);
+    const firstOctet = octets[0];
+    const secondOctet = octets[1];
+    if (firstOctet == null || secondOctet == null) {
+        throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(rawHost)}`);
+    }
+    if (firstOctet === 127 || (firstOctet === 169 && secondOctet === 254) || firstOctet >= 224 || octets.every((value) => value === 0)) {
+        throw new Error(`network plaintext allowed host must be a non-loopback unicast IP literal: ${JSON.stringify(rawHost)}`);
+    }
+    return host;
+}
+function canonicalIPv4Octets(host) {
+    const parts = host.split(".");
+    if (parts.length !== 4) {
+        throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(host)}`);
+    }
+    const octets = parts.map((part) => {
+        if (!/^(0|[1-9]\d{0,2})$/.test(part)) {
+            throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(host)}`);
+        }
+        const value = Number(part);
+        if (value > 255) {
+            throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(host)}`);
+        }
+        return value;
+    });
+    return octets;
+}
+function canonicalNetworkIPv6Host(host) {
+    let parsed;
+    try {
+        parsed = new URL(`http://[${host}]/`);
+    }
+    catch {
+        throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(host)}`);
+    }
+    const canonical = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    if (canonical !== host) {
+        throw new Error(`network plaintext allowed host must be a canonical IP literal: ${JSON.stringify(host)}`);
+    }
+    const words = expandIPv6Words(canonical);
+    const unspecified = words.every((word) => word === 0);
+    const loopback = words.slice(0, 7).every((word) => word === 0) && words[7] === 1;
+    const mappedIPv4 = words.slice(0, 5).every((word) => word === 0) && words[5] === 0xffff;
+    const multicast = (words[0] & 0xff00) === 0xff00;
+    const linkLocal = (words[0] & 0xffc0) === 0xfe80;
+    if (unspecified || loopback || mappedIPv4 || multicast || linkLocal) {
+        throw new Error(`network plaintext allowed host must be a non-loopback unicast IP literal: ${JSON.stringify(host)}`);
+    }
+    return canonical;
+}
+function expandIPv6Words(host) {
+    const halves = host.split("::");
+    if (halves.length > 2)
+        throw new Error("invalid IPv6 host");
+    const left = halves[0] === "" ? [] : halves[0].split(":");
+    const right = halves.length === 1 || halves[1] === "" ? [] : halves[1].split(":");
+    const missing = 8 - left.length - right.length;
+    if ((halves.length === 1 && missing !== 0) || (halves.length === 2 && missing < 1)) {
+        throw new Error("invalid IPv6 host");
+    }
+    const words = [...left, ...Array.from({ length: missing }, () => "0"), ...right].map((part) => Number.parseInt(part, 16));
+    if (words.length !== 8 || words.some((word) => !Number.isInteger(word) || word < 0 || word > 0xffff)) {
+        throw new Error("invalid IPv6 host");
+    }
+    return words;
+}
 function detectRuntime() {
     if (typeof window !== "undefined" && typeof window.document !== "undefined")
         return "browser";

package/dist/client.d.ts

@@ -11,6 +11,8 @@ export type Client = Readonly<{
         signal?: AbortSignal;
     }>) => Promise<YamuxStream>;
     ping: () => Promise<void>;
+    /** Emits an authenticated rekey record and advances the E2EE send key. */
+    rekey: () => Promise<void>;
     /** Performs an acknowledged Yamux round trip and returns RTT in milliseconds. */
     probeLiveness: () => Promise<number>;
     close: () => void;

package/dist/controlplane/request.js

@@ -77,7 +77,9 @@ async function readControlplaneText(response, maxBytes) {
             try {
                 await reader.cancel();
             }
-            catch { }
+            catch {
+                // The size violation is authoritative; cancellation is secondary cleanup.
+            }
             throw new ControlplaneResponseTooLargeError(maxBytes);
         }
         text += decoder.decode(chunk.value, { stream: true });

package/dist/endpoint/index.d.ts

@@ -70,6 +70,7 @@ export declare class Session {
         signal?: AbortSignal;
     }>): Promise<void>;
     probeLiveness(timeoutMs?: 10000): Promise<number>;
+    rekey(): Promise<void>;
     close(): void;
     private pushStream;
     private acceptRawStream;

package/dist/endpoint/index.js

@@ -85,6 +85,14 @@ export class Session {
     probeLiveness(timeoutMs = SDK_DEFAULTS.transport.handshakeTimeoutMs) {
         return this.mux.probeLiveness(timeoutMs);
     }
+    async rekey() {
+        try {
+            await this.secure.rekeyNow();
+        }
+        catch (error) {
+            throw new FlowersecError({ path: this.path, stage: "secure", code: "rekey_failed", message: "endpoint rekey failed", cause: error });
+        }
+    }
     close() {
         this.fail(new Error("endpoint session closed"));
         this.mux.close();

package/dist/facade.d.ts

@@ -17,8 +17,8 @@ export type { WebSocketLimits } from "./ws-client/binaryTransport.js";
 export type { YamuxLimits } from "./yamux/session.js";
 export type { FlowersecErrorCode, FlowersecPath, FlowersecStage } from "./utils/errors.js";
 export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, RequireTLS, } from "./client-connect/transportSecurity.js";
-export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, } from "./client-connect/transportSecurity.js";
+export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
+export type { NetworkPlaintextPolicyOptions, TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, } from "./client-connect/transportSecurity.js";
 export type { TunnelConnectOptions } from "./tunnel-client/connect.js";
 export type { DirectConnectOptions } from "./direct-client/connect.js";
 export type ConnectOptions = TunnelConnectOptions | DirectConnectOptions;

package/dist/facade.js

@@ -6,7 +6,7 @@ export { assertChannelInitGrant } from "./gen/flowersec/controlplane/v1.gen.js";
 export { assertDirectConnectInfo } from "./gen/flowersec/direct/v1.gen.js";
 export { assertConnectArtifact } from "./connect/artifact.js";
 export { FlowersecError } from "./utils/errors.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, RequireTLS, } from "./client-connect/transportSecurity.js";
+export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "./client-connect/transportSecurity.js";
 export async function connectTunnel(grant, opts) {
     return await connectTunnelInternal(grant, opts);
 }

package/dist/node/index.d.ts

@@ -1,6 +1,6 @@
 export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, RequireTLS, } from "../client-connect/transportSecurity.js";
-export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
+export type { TransportSecurityPolicy, TransportSecurityPolicyInput, TransportSecurityPolicyPreset, NetworkPlaintextPolicyOptions, } from "../client-connect/transportSecurity.js";
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export type { DirectNodeReconnectConfig, NodeReconnectConfig, TunnelNodeReconnectConfig, } from "./reconnectConfig.js";
 export { createDirectNodeReconnectConfig, createNodeReconnectConfig, createTunnelNodeReconnectConfig, } from "./reconnectConfig.js";

package/dist/node/index.js

@@ -1,5 +1,5 @@
 export { createNodeWsFactory } from "./wsFactory.js";
-export { AllowPlaintext, AllowPlaintextForLoopback, RequireTLS, } from "../client-connect/transportSecurity.js";
+export { AllowPlaintext, AllowPlaintextForLoopback, createNetworkPlaintextPolicy, PlaintextRiskAcceptance, RequireTLS, } from "../client-connect/transportSecurity.js";
 export { connectDirectNode, connectNode, connectTunnelNode } from "./connect.js";
 export { createDirectNodeReconnectConfig, createNodeReconnectConfig, createTunnelNodeReconnectConfig, } from "./reconnectConfig.js";
 export * from "../endpoint/index.js";

package/dist/proxy/controllerWindow.js

@@ -78,11 +78,10 @@ function bridgeWebSocket(runtime, msg, port) {
         terminal = true;
         acceptingWrites = false;
         const err = error instanceof Error ? error : new Error(String(error));
-        try {
-            stream?.reset(err);
-        }
-        catch {
-            // Best-effort.
+        if (stream != null) {
+            void Promise.resolve(stream.reset(err)).catch(() => {
+                // The bridge error is already delivered through the terminal response.
+            });
         }
         try {
             ac.abort(err.message);

package/dist/proxy/runtime.js

@@ -416,13 +416,13 @@ export function createProxyRuntime(opts) {
                 }
                 if (!respMeta.ok) {
                     const msg = respMeta.error?.message ?? "upstream error";
-                    port.postMessage({ type: "flowersec-proxy:response_error", status: 502, message: msg });
-                    try {
-                        stream.reset(new Error(msg));
-                    }
-                    catch {
-                        // Best-effort.
-                    }
+                    port.postMessage({
+                        type: "flowersec-proxy:response_error",
+                        status: 502,
+                        ...(respMeta.error?.code === undefined ? {} : { code: respMeta.error.code }),
+                        message: msg,
+                    });
+                    await stream.reset(new Error(msg));
                     stream = null;
                     return;
                 }
@@ -455,14 +455,10 @@ export function createProxyRuntime(opts) {
                 port.postMessage({
                     type: "flowersec-proxy:response_error",
                     status,
+                    ...(code === undefined ? {} : { code }),
                     message: msg,
                 });
-                try {
-                    stream?.reset(new Error(msg));
-                }
-                catch {
-                    // Best-effort.
-                }
+                await stream?.reset(new Error(msg));
             }
             finally {
                 wakeResponseCreditWaiter();
@@ -494,12 +490,7 @@ export function createProxyRuntime(opts) {
         const resp = (await readJsonFrame(reader, maxJsonFrameBytes));
         if (resp.v !== PROXY_PROTOCOL_VERSION || resp.ok !== true) {
             const msg = resp.error?.message ?? "upstream ws open failed";
-            try {
-                stream.reset(new Error(msg));
-            }
-            catch {
-                // Best-effort.
-            }
+            await stream.reset(new Error(msg));
             throw new Error(msg);
         }
         return { stream, protocol: resp.protocol ?? "" };

package/dist/reconnect/index.js

@@ -3,24 +3,30 @@ import { emitObserverDiagnostic, withObserverContext } from "../observability/ob
 import { SDK_DEFAULTS } from "../defaults.js";
 export { createArtifactResolver, createControlplaneArtifactSource } from "./artifactControlplane.js";
 function normalizeAutoReconnect(cfg) {
-    if (!cfg?.enabled) {
-        return {
-            enabled: false,
-            maxAttempts: 1,
-            initialDelayMs: SDK_DEFAULTS.reconnect.initialDelayMs,
-            maxDelayMs: SDK_DEFAULTS.reconnect.maxDelayMs,
-            factor: SDK_DEFAULTS.reconnect.factor,
-            jitterRatio: SDK_DEFAULTS.reconnect.jitterRatio,
-        };
-    }
-    return {
-        enabled: true,
-        maxAttempts: Math.max(1, cfg.maxAttempts ?? SDK_DEFAULTS.reconnect.maxAttempts),
-        initialDelayMs: Math.max(0, cfg.initialDelayMs ?? SDK_DEFAULTS.reconnect.initialDelayMs),
-        maxDelayMs: Math.max(0, cfg.maxDelayMs ?? SDK_DEFAULTS.reconnect.maxDelayMs),
-        factor: Math.max(1, cfg.factor ?? SDK_DEFAULTS.reconnect.factor),
-        jitterRatio: Math.max(0, cfg.jitterRatio ?? SDK_DEFAULTS.reconnect.jitterRatio),
+    const settings = {
+        enabled: cfg?.enabled === true,
+        maxAttempts: cfg?.enabled === true ? (cfg.maxAttempts ?? SDK_DEFAULTS.reconnect.maxAttempts) : 1,
+        initialDelayMs: cfg?.initialDelayMs ?? SDK_DEFAULTS.reconnect.initialDelayMs,
+        maxDelayMs: cfg?.maxDelayMs ?? SDK_DEFAULTS.reconnect.maxDelayMs,
+        factor: cfg?.factor ?? SDK_DEFAULTS.reconnect.factor,
+        jitterRatio: cfg?.jitterRatio ?? SDK_DEFAULTS.reconnect.jitterRatio,
     };
+    if (!Number.isSafeInteger(settings.maxAttempts) || settings.maxAttempts < 1) {
+        throw new TypeError("autoReconnect.maxAttempts must be a positive integer");
+    }
+    if (!Number.isFinite(settings.initialDelayMs) || settings.initialDelayMs < 0) {
+        throw new TypeError("autoReconnect.initialDelayMs must be a non-negative finite number");
+    }
+    if (!Number.isFinite(settings.maxDelayMs) || settings.maxDelayMs < 0) {
+        throw new TypeError("autoReconnect.maxDelayMs must be a non-negative finite number");
+    }
+    if (!Number.isFinite(settings.factor) || settings.factor < 1) {
+        throw new TypeError("autoReconnect.factor must be a finite number greater than or equal to one");
+    }
+    if (!Number.isFinite(settings.jitterRatio) || settings.jitterRatio < 0 || settings.jitterRatio > 1) {
+        throw new TypeError("autoReconnect.jitterRatio must be a finite number between zero and one");
+    }
+    return settings;
 }
 function backoffDelayMs(attemptIndex, cfg) {
     const base = Math.min(cfg.maxDelayMs, cfg.initialDelayMs * Math.pow(cfg.factor, attemptIndex));
@@ -73,13 +79,19 @@ export function createReconnectManager() {
         retryResolve = null;
     };
     const abortActiveAttempt = () => {
+        attemptAbort?.abort("canceled");
+        attemptAbort = null;
+    };
+    const closeClient = (value) => {
+        if (value == null)
+            return null;
         try {
-            attemptAbort?.abort("canceled");
+            value.close();
+            return null;
         }
-        catch {
-            // ignore
+        catch (error) {
+            return asError(error);
         }
-        attemptAbort = null;
     };
     const sleep = (ms) => new Promise((resolve) => {
         retryResolve = resolve;
@@ -96,13 +108,10 @@ export function createReconnectManager() {
         activeConnectPromise = null;
         token += 1;
         attemptSeq = 0;
-        if (s.client) {
-            try {
-                s.client.close();
-            }
-            catch {
-                // ignore
-            }
+        const closeError = closeClient(s.client);
+        if (closeError != null) {
+            setState({ status: "error", error: closeError, client: null });
+            throw closeError;
         }
         setState({ status: "disconnected", error: null, client: null });
     };
@@ -115,27 +124,24 @@ export function createReconnectManager() {
             return;
         const ar = normalizeAutoReconnect(cfg.autoReconnect);
         if (!ar.enabled) {
-            if (s.client) {
-                try {
-                    s.client.close();
-                }
-                catch {
-                    // ignore
-                }
-            }
-            setState({ status: "error", error, client: null });
+            const closeError = closeClient(s.client);
+            const finalError = closeError == null
+                ? error
+                : new AggregateError([error, closeError], "reconnect termination and client close failed");
+            setState({ status: "error", error: finalError, client: null });
             return;
         }
         // Restart the connection loop in the background.
         cancelRetrySleep();
         abortActiveAttempt();
-        if (s.client) {
-            try {
-                s.client.close();
-            }
-            catch {
-                // ignore
-            }
+        const closeError = closeClient(s.client);
+        if (closeError != null) {
+            setState({
+                status: "error",
+                error: new AggregateError([error, closeError], "reconnect termination and client close failed"),
+                client: null,
+            });
+            return;
         }
         token += 1;
         const nextToken = token;
@@ -198,21 +204,15 @@ export function createReconnectManager() {
             try {
                 const client = await connectOnce(t, cfg, attemptSeq);
                 if (t !== token) {
-                    try {
-                        client.close();
-                    }
-                    catch {
-                        // ignore
-                    }
+                    const closeError = closeClient(client);
+                    if (closeError != null)
+                        throw new ReconnectCleanupError(closeError);
                     return;
                 }
                 if (active !== cfg) {
-                    try {
-                        client.close();
-                    }
-                    catch {
-                        // ignore
-                    }
+                    const closeError = closeClient(client);
+                    if (closeError != null)
+                        throw new ReconnectCleanupError(closeError);
                     return;
                 }
                 setState({ status: "connected", client, error: null });
@@ -222,6 +222,10 @@ export function createReconnectManager() {
                         if (s.client !== client)
                             return;
                         startReconnect(t, cfg, error);
+                    }, (error) => {
+                        if (s.client !== client)
+                            return;
+                        startReconnect(t, cfg, asError(error));
                     });
                 }
                 emitObserverDiagnostic(withObserverContext(cfg.observer, { attemptSeq }), {
@@ -234,6 +238,8 @@ export function createReconnectManager() {
                 return;
             }
             catch (err) {
+                if (err instanceof ReconnectCleanupError)
+                    throw err.cleanupError;
                 const e = err instanceof Error ? err : new Error(String(err));
                 if (t !== token)
                     return;
@@ -281,19 +287,18 @@ export function createReconnectManager() {
         return promise;
     };
     const connect = async (cfg) => {
+        normalizeAutoReconnect(cfg.autoReconnect);
         cancelRetrySleep();
         abortActiveAttempt();
         token += 1;
         const t = token;
         active = cfg;
         attemptSeq = 0;
-        if (s.client) {
-            try {
-                s.client.close();
-            }
-            catch {
-                // ignore
-            }
+        const closeError = closeClient(s.client);
+        if (closeError != null) {
+            active = null;
+            setState({ status: "error", error: closeError, client: null });
+            throw closeError;
         }
         const connectPromise = startConnectLoop(t, cfg);
         setState({ status: "connecting", error: null, client: null });
@@ -333,3 +338,14 @@ export function createReconnectManager() {
         disconnect,
     };
 }
+class ReconnectCleanupError extends Error {
+    cleanupError;
+    constructor(cleanupError) {
+        super("reconnect cleanup failed", { cause: cleanupError });
+        this.cleanupError = cleanupError;
+        this.name = "ReconnectCleanupError";
+    }
+}
+function asError(value) {
+    return value instanceof Error ? value : new Error(String(value));
+}

package/dist/rpc/server.d.ts

@@ -32,6 +32,7 @@ export declare class RpcServer {
     private readonly terminalSignal;
     private signalTerminal;
     private transportClosed;
+    private admittedRequests;
     constructor(transport: RpcServerTransport, options?: RpcServerOptions, router?: RpcRouter);
     register(typeId: number, h: RpcHandler): void;
     notify(typeId: number, payload: unknown): Promise<void>;

package/dist/rpc/server.js

@@ -31,6 +31,7 @@ export class RpcServer {
     terminalSignal;
     signalTerminal;
     transportClosed = false;
+    admittedRequests = 0;
     constructor(transport, options = {}, router = new RpcRouter()) {
         this.transport = transport;
         this.router = router;
@@ -57,11 +58,15 @@ export class RpcServer {
     }
     // serve handles request/response frames until closed or aborted.
     async serve(signal) {
-        const supervise = (worker) => worker.catch((err) => {
-            this.fail(err);
-        });
-        const workers = Array.from({ length: this.options.maxConcurrentRequests }, () => supervise(this.requestWorker()));
-        workers.push(supervise(this.notificationWorker()));
+        const workers = Array.from({ length: this.options.maxConcurrentRequests }, () => this.requestWorker());
+        workers.push(this.notificationWorker());
+        const workerFailure = Promise.race(workers.map(async (worker) => {
+            await worker;
+            if (!this.closed)
+                throw new Error("rpc worker ended before server shutdown");
+            return await new Promise(() => undefined);
+        }));
+        let failure;
         try {
             while (!this.closed) {
                 if (signal?.aborted)
@@ -69,6 +74,7 @@ export class RpcServer {
                 const next = await Promise.race([
                     readJsonFrame(this.transport.readExactly, DEFAULT_MAX_JSON_FRAME_BYTES),
                     this.terminalSignal.then((error) => { throw error; }),
+                    workerFailure,
                 ]);
                 const v = assertRpcEnvelope(next);
                 if (v.response_to !== 0)
@@ -81,23 +87,38 @@ export class RpcServer {
                     this.wakeOne(this.notificationWaiters);
                     continue;
                 }
-                if (this.requests.length >= this.options.maxQueuedRequests) {
+                if (this.admittedRequests >= this.options.maxConcurrentRequests + this.options.maxQueuedRequests) {
                     await this.writeResponse(v, { payload: null, error: { code: 429, message: "server overloaded" } });
                     continue;
                 }
+                this.admittedRequests += 1;
                 this.requests.push({ envelope: v });
                 this.wakeOne(this.requestWaiters);
             }
         }
         catch (err) {
+            failure = err;
             this.terminalError = err;
-            this.close(err);
-            throw err;
         }
-        finally {
-            this.close(this.terminalError ?? new Error("rpc server closed"));
-            void Promise.allSettled(workers);
+        let closeError;
+        try {
+            this.close(failure ?? this.terminalError ?? new Error("rpc server closed"));
+        }
+        catch (error) {
+            closeError = error;
         }
+        const settled = await Promise.allSettled(workers);
+        const workerErrors = settled
+            .filter((result) => result.status === "rejected")
+            .map((result) => result.reason)
+            .filter((error) => error !== failure);
+        const errors = [failure, closeError, ...workerErrors].filter((error) => error !== undefined);
+        if (errors.length === 1)
+            throw errors[0];
+        if (errors.length > 1)
+            throw new AggregateError(errors, "rpc server and cleanup failed");
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
     }
     // close stops the serve loop and closes the underlying RPC stream.
     close(error = new Error("rpc server closed")) {
@@ -138,9 +159,14 @@ export class RpcServer {
                     out = { payload: null, error: { code: 500, message: "internal error" } };
                 }
             }
-            if (this.closed)
-                return;
-            await this.writeResponse(v, out);
+            try {
+                if (this.closed)
+                    return;
+                await this.writeResponse(v, out);
+            }
+            finally {
+                this.admittedRequests = Math.max(0, this.admittedRequests - 1);
+            }
         }
     }
     async notificationWorker() {
@@ -152,10 +178,7 @@ export class RpcServer {
             const h = this.router.handler(v.type_id);
             if (h == null)
                 continue;
-            try {
-                await h(v.payload);
-            }
-            catch { /* Notification failures are isolated. */ }
+            await h(v.payload);
         }
     }
     async nextWork(queue, waiters) {
@@ -182,8 +205,14 @@ export class RpcServer {
     }
     async writeEnvelope(envelope) {
         const write = this.writeChain.then(() => writeJsonFrame(this.transport.write, envelope));
-        this.writeChain = write.catch(() => { });
-        await write;
+        this.writeChain = write;
+        try {
+            await write;
+        }
+        catch (error) {
+            this.fail(error);
+            throw error;
+        }
     }
 }
 function positiveInteger(value, name) {

package/dist/streamio/index.js

@@ -11,12 +11,9 @@ function abortReasonToError(signal) {
 }
 function bindAbortToStream(stream, signal) {
     const onAbort = () => {
-        try {
-            stream.reset(abortReasonToError(signal));
-        }
-        catch {
-            // Best-effort cancel.
-        }
+        void Promise.resolve(stream.reset(abortReasonToError(signal))).catch(() => {
+            // The read/write operation reports the authoritative abort to its caller.
+        });
     };
     if (signal.aborted) {
         onAbort();

package/dist/utils/errors.d.ts

@@ -6,7 +6,7 @@ export declare class AbortError extends Error {
 }
 export type FlowersecPath = "auto" | "tunnel" | "direct";
 export type FlowersecStage = "validate" | "connect" | "attach" | "handshake" | "secure" | "yamux" | "rpc" | "close";
-export type FlowersecErrorCode = "timeout" | "canceled" | "invalid_version" | "invalid_input" | "invalid_option" | "invalid_endpoint_instance_id" | "invalid_psk" | "invalid_suite" | "missing_grant" | "missing_connect_info" | "missing_conn" | "missing_handler" | "missing_stream_kind" | "role_mismatch" | "missing_tunnel_url" | "missing_ws_url" | "missing_origin" | "missing_channel_id" | "missing_token" | "missing_init_exp" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "auth_tag_mismatch" | "resolve_failed" | "transport_policy_denied" | "credential_commit_failed" | "random_failed" | "upgrade_failed" | "dial_failed" | "attach_failed" | "too_many_connections" | "expected_attach" | "invalid_attach" | "invalid_token" | "channel_mismatch" | "init_exp_mismatch" | "idle_timeout_mismatch" | "token_replay" | "tenant_mismatch" | "policy_denied" | "policy_error" | "replace_rate_limited" | "handshake_failed" | "ping_failed" | "mux_failed" | "accept_stream_failed" | "open_stream_failed" | "stream_hello_failed" | "rpc_failed" | "resource_exhausted" | "not_connected";
+export type FlowersecErrorCode = "timeout" | "canceled" | "invalid_version" | "invalid_input" | "invalid_option" | "invalid_endpoint_instance_id" | "invalid_psk" | "invalid_suite" | "missing_grant" | "missing_connect_info" | "missing_conn" | "missing_handler" | "missing_stream_kind" | "role_mismatch" | "missing_tunnel_url" | "missing_ws_url" | "missing_origin" | "missing_channel_id" | "missing_token" | "missing_init_exp" | "timestamp_after_init_exp" | "timestamp_out_of_skew" | "auth_tag_mismatch" | "resolve_failed" | "transport_policy_denied" | "credential_commit_failed" | "random_failed" | "upgrade_failed" | "dial_failed" | "attach_failed" | "too_many_connections" | "expected_attach" | "invalid_attach" | "invalid_token" | "channel_mismatch" | "init_exp_mismatch" | "idle_timeout_mismatch" | "token_replay" | "tenant_mismatch" | "policy_denied" | "policy_error" | "replace_rate_limited" | "handshake_failed" | "ping_failed" | "rekey_failed" | "mux_failed" | "accept_stream_failed" | "open_stream_failed" | "stream_hello_failed" | "rpc_failed" | "resource_exhausted" | "not_connected";
 export declare class FlowersecError extends Error {
     readonly code: FlowersecErrorCode;
     readonly stage: FlowersecStage;

package/dist/yamux/errors.d.ts

@@ -2,6 +2,10 @@ export declare class StreamEOFError extends Error {
     constructor(message?: string);
 }
 export declare function isStreamEOFError(e: unknown): e is StreamEOFError;
+export declare class YamuxStreamResetError extends Error {
+    constructor();
+}
+export declare function isYamuxStreamResetError(error: unknown): error is YamuxStreamResetError;
 export declare class YamuxResourceExhaustedError extends Error {
     readonly resource: string;
     readonly current: number;
@@ -9,3 +13,7 @@ export declare class YamuxResourceExhaustedError extends Error {
     constructor(resource: string, current: number, limit: number);
 }
 export declare function isYamuxResourceExhaustedError(error: unknown): error is YamuxResourceExhaustedError;
+export declare class YamuxPingTimeoutError extends Error {
+    constructor();
+}
+export declare function isYamuxPingTimeoutError(error: unknown): error is YamuxPingTimeoutError;

package/dist/yamux/errors.js

@@ -8,6 +8,15 @@ export class StreamEOFError extends Error {
 export function isStreamEOFError(e) {
     return e instanceof StreamEOFError;
 }
+export class YamuxStreamResetError extends Error {
+    constructor() {
+        super("yamux stream reset");
+        this.name = "YamuxStreamResetError";
+    }
+}
+export function isYamuxStreamResetError(error) {
+    return error instanceof YamuxStreamResetError;
+}
 export class YamuxResourceExhaustedError extends Error {
     resource;
     current;
@@ -23,3 +32,12 @@ export class YamuxResourceExhaustedError extends Error {
 export function isYamuxResourceExhaustedError(error) {
     return error instanceof YamuxResourceExhaustedError;
 }
+export class YamuxPingTimeoutError extends Error {
+    constructor() {
+        super("yamux ping timeout");
+        this.name = "YamuxPingTimeoutError";
+    }
+}
+export function isYamuxPingTimeoutError(error) {
+    return error instanceof YamuxPingTimeoutError;
+}

package/dist/yamux/session.js

@@ -2,7 +2,7 @@ import { ByteReader } from "./byteReader.js";
 import { decodeHeader, encodeHeader, HEADER_LEN } from "./header.js";
 import { FLAG_ACK, FLAG_RST, FLAG_SYN, TYPE_DATA, TYPE_GO_AWAY, TYPE_PING, TYPE_WINDOW_UPDATE, YAMUX_VERSION } from "./constants.js";
 import { YamuxStream } from "./stream.js";
-import { YamuxResourceExhaustedError } from "./errors.js";
+import { YamuxPingTimeoutError, YamuxResourceExhaustedError } from "./errors.js";
 import { SDK_DEFAULTS } from "../defaults.js";
 export const DEFAULT_YAMUX_LIMITS = Object.freeze({
     maxActiveStreams: SDK_DEFAULTS.yamux.maxActiveStreams,
@@ -129,7 +129,7 @@ export class YamuxSession {
         return await new Promise((resolve, reject) => {
             const timer = setTimeout(() => {
                 this.pingWaiters.delete(opaque);
-                const error = new Error("yamux ping timeout");
+                const error = new YamuxPingTimeoutError();
                 reject(error);
                 this.fail(error);
             }, timeoutMs);
@@ -229,8 +229,11 @@ export class YamuxSession {
         this.pingWaiters.clear();
         const streams = Array.from(this.streams.values());
         this.streams.clear();
-        for (const s of streams)
-            s.reset(new Error("session closed"));
+        for (const s of streams) {
+            void Promise.resolve(s.reset(new Error("session closed"))).catch(() => {
+                // Session shutdown has already made the stream terminal.
+            });
+        }
     }
     wakeSendWindowWaiters() {
         for (const [streamId, ws] of this.sendWindowWaiters) {

package/dist/yamux/stream.d.ts

@@ -23,7 +23,7 @@ export declare class YamuxStream {
     write(data: Uint8Array): Promise<void>;
     private writeSerial;
     close(): Promise<void>;
-    reset(err: Error): Promise<void>;
+    reset(err?: Error): Promise<void>;
     private fail;
     bufferedReceiveBytes(): number;
     releaseBufferedReceiveBytes(): number;

package/dist/yamux/stream.js

@@ -1,7 +1,7 @@
 import { concatBytes } from "../utils/bin.js";
 import { encodeHeader } from "./header.js";
 import { DEFAULT_MAX_STREAM_WINDOW, FLAG_ACK, FLAG_FIN, FLAG_RST, FLAG_SYN, TYPE_DATA, TYPE_WINDOW_UPDATE } from "./constants.js";
-import { YamuxResourceExhaustedError } from "./errors.js";
+import { YamuxResourceExhaustedError, YamuxStreamResetError } from "./errors.js";
 // YamuxStream manages per-stream flow control and state transitions.
 export class YamuxStream {
     // Stream identifier within the session.
@@ -152,7 +152,7 @@ export class YamuxStream {
         }
     }
     // reset tears down the stream and notifies the peer.
-    reset(err) {
+    reset(err = new Error("stream reset")) {
         if (this.resetTask != null)
             return this.resetTask;
         if (!this.fail(err))
@@ -206,7 +206,7 @@ export class YamuxStream {
                 w();
         }
         if ((flags & FLAG_RST) !== 0) {
-            if (this.fail(new Error("rst")))
+            if (this.fail(new YamuxStreamResetError()))
                 this.session.onStreamClosed(this.id);
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Flowersec core TypeScript library (browser-friendly E2EE + multiplexing over WebSocket).",
   "license": "MIT",
   "repository": {
@@ -120,8 +120,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "bench": "vitest bench --run",
-    "test": "vitest run",
-    "test:coverage": "vitest run --coverage",
+    "test": "npm run build && vitest run",
+    "test:coverage": "npm run build && vitest run --coverage",
     "lint": "eslint .",
     "verify:package": "node ./scripts/verify-package-exports.mjs",
     "prepack": "npm run build",