@floegence/flowersec-core 0.24.0 → 0.25.0

package/dist/proxy/server.js

@@ -7,6 +7,7 @@ import { DEFAULT_MAX_BODY_BYTES, DEFAULT_MAX_CHUNK_BYTES, DEFAULT_MAX_WS_FRAME_B
 import { filterRequestHeaders, filterResponseHeaders, filterWsOpenHeaders, isSafeHeaderValue, isValidHeaderName, normalizeHeaderName } from "./headerPolicy.js";
 export async function serveProxySession(session, options, signal) {
     const compiled = compileOptions(options);
+    const requestBodyBudget = createRequestBodyBudget(compiled.maxBufferedRequestBodyBytes);
     const active = new Set();
     try {
         while (!signal?.aborted) {
@@ -30,7 +31,7 @@ export async function serveProxySession(session, options, signal) {
                 await accepted.stream.reset(new Error("proxy stream concurrency exhausted"));
                 continue;
             }
-            const task = serveProxyStreamCompiled(accepted.kind, accepted.stream, compiled, signal)
+            const task = serveProxyStreamCompiled(accepted.kind, accepted.stream, compiled, requestBodyBudget, signal)
                 .catch(() => { })
                 .finally(() => active.delete(task));
             active.add(task);
@@ -50,12 +51,13 @@ async function serveRPCStream(stream, router, options, signal) {
     await server.serve(signal);
 }
 export function serveProxyStream(kind, stream, options, signal) {
-    return serveProxyStreamCompiled(kind, stream, compileOptions(options), signal);
+    const compiled = compileOptions(options);
+    return serveProxyStreamCompiled(kind, stream, compiled, createRequestBodyBudget(compiled.maxBufferedRequestBodyBytes), signal);
 }
-async function serveProxyStreamCompiled(kind, stream, options, signal) {
+async function serveProxyStreamCompiled(kind, stream, options, requestBodyBudget, signal) {
     try {
         if (kind === PROXY_KIND_HTTP1)
-            await serveHTTP(stream, options, signal);
+            await serveHTTP(stream, options, requestBodyBudget, signal);
         else
             await serveWebSocket(stream, options, signal);
     }
@@ -66,79 +68,102 @@ async function serveProxyStreamCompiled(kind, stream, options, signal) {
         catch { /* The peer may already have reset the stream. */ }
     }
 }
-async function serveHTTP(stream, options, signal) {
+async function serveHTTP(stream, options, requestBodyBudget, signal) {
     const reader = createByteReader(stream, signal === undefined ? {} : { signal });
     let requestId = "unknown";
     try {
         const meta = assertHTTPRequestMeta(await readJsonFrame(reader, options.maxJsonFrameBytes));
         requestId = meta.request_id;
         const path = parsePath(meta.path);
-        const body = await readBody(reader, options.maxChunkBytes, options.maxBodyBytes);
-        const headers = requestHeaders(meta.headers, options);
-        applyExternalOrigin(headers, meta.external_origin);
-        const target = new URL(options.upstream);
-        target.pathname = path.pathname;
-        target.search = path.search;
-        target.hash = "";
-        const timeoutMs = resolveTimeout(meta.timeout_ms, options);
-        const controller = new AbortController();
-        const onAbort = () => controller.abort(signal?.reason);
-        signal?.addEventListener("abort", onAbort, { once: true });
-        const timer = timeoutMs > 0 ? setTimeout(() => controller.abort(new Error("upstream request timeout")), timeoutMs) : undefined;
+        const bufferedBody = await readBody(reader, options.maxChunkBytes, options.maxBodyBytes, requestBodyBudget);
         try {
-            const method = meta.method.trim().toUpperCase();
-            const response = await options.fetch(target, {
-                method,
-                headers,
-                redirect: "manual",
-                signal: controller.signal,
-                ...((method === "GET" || method === "HEAD") ? {} : { body: body.slice().buffer }),
-            });
-            const responseHeaders = collectResponseHeaders(response.headers, options);
-            const responseMeta = {
-                v: PROXY_PROTOCOL_VERSION,
-                request_id: requestId,
-                ok: true,
-                status: response.status,
-                headers: responseHeaders,
-            };
-            await writeJsonFrame(stream, responseMeta);
-            if (response.body == null) {
+            if (signal?.aborted)
+                throw new ProxyServerError("canceled", "proxy request canceled");
+            const headers = requestHeaders(meta.headers, options);
+            applyExternalOrigin(headers, meta.external_origin);
+            const target = new URL(options.upstream);
+            target.pathname = path.pathname;
+            target.search = path.search;
+            target.hash = "";
+            const timeoutMs = resolveTimeout(meta.timeout_ms, options);
+            const controller = new AbortController();
+            const onAbort = () => controller.abort(new ProxyServerError("canceled", "proxy request canceled"));
+            signal?.addEventListener("abort", onAbort, { once: true });
+            if (signal?.aborted)
+                onAbort();
+            const timer = timeoutMs > 0
+                ? setTimeout(() => controller.abort(new ProxyServerError("timeout", "upstream request timeout")), timeoutMs)
+                : undefined;
+            try {
+                const method = meta.method.trim().toUpperCase();
+                let response;
+                try {
+                    if (controller.signal.aborted)
+                        throw controller.signal.reason;
+                    response = await options.fetch(target, {
+                        method,
+                        headers,
+                        redirect: "manual",
+                        signal: controller.signal,
+                        ...((method === "GET" || method === "HEAD")
+                            ? {}
+                            : { body: bufferedBody.bytes.buffer }),
+                    });
+                }
+                finally {
+                    bufferedBody.release();
+                }
+                const responseHeaders = collectResponseHeaders(response.headers, options);
+                const responseMeta = {
+                    v: PROXY_PROTOCOL_VERSION,
+                    request_id: requestId,
+                    ok: true,
+                    status: response.status,
+                    headers: responseHeaders,
+                };
+                await writeJsonFrame(stream, responseMeta);
+                if (response.body == null) {
+                    await stream.write(u32be(0));
+                    return;
+                }
+                const bodyReader = response.body.getReader();
+                let total = 0;
+                while (true) {
+                    const next = await bodyReader.read();
+                    if (next.done)
+                        break;
+                    const bytes = next.value;
+                    total += bytes.length;
+                    if (total > options.maxBodyBytes)
+                        throw new ProxyServerError("response_body_too_large", "response body too large");
+                    for (let offset = 0; offset < bytes.length; offset += options.maxChunkBytes) {
+                        const chunk = bytes.subarray(offset, Math.min(bytes.length, offset + options.maxChunkBytes));
+                        await stream.write(u32be(chunk.length));
+                        await stream.write(chunk);
+                    }
+                }
                 await stream.write(u32be(0));
-                return;
             }
-            const bodyReader = response.body.getReader();
-            let total = 0;
-            while (true) {
-                const next = await bodyReader.read();
-                if (next.done)
-                    break;
-                const bytes = next.value;
-                total += bytes.length;
-                if (total > options.maxBodyBytes)
-                    throw new ProxyServerError("response_body_too_large", "response body too large");
-                for (let offset = 0; offset < bytes.length; offset += options.maxChunkBytes) {
-                    const chunk = bytes.subarray(offset, Math.min(bytes.length, offset + options.maxChunkBytes));
-                    await stream.write(u32be(chunk.length));
-                    await stream.write(chunk);
-                }
+            finally {
+                if (timer != null)
+                    clearTimeout(timer);
+                signal?.removeEventListener("abort", onAbort);
             }
-            await stream.write(u32be(0));
         }
         finally {
-            if (timer != null)
-                clearTimeout(timer);
-            signal?.removeEventListener("abort", onAbort);
+            bufferedBody.release();
         }
     }
     catch (error) {
-        await writeHTTPError(stream, requestId, classifyHTTPError(error), error);
+        await writeHTTPError(stream, requestId, classifyHTTPError(error));
     }
 }
 async function serveWebSocket(stream, options, signal) {
     const reader = createByteReader(stream, signal === undefined ? {} : { signal });
     let connId = "unknown";
     let raw;
+    let upstreamOpened = false;
+    let removePostOpenAbortListener;
     try {
         const meta = assertWSOpenMeta(await readJsonFrame(reader, options.maxJsonFrameBytes));
         connId = meta.conn_id;
@@ -164,55 +189,137 @@ async function serveWebSocket(stream, options, signal) {
             headers,
             maxPayload: options.maxWsFrameBytes,
             perMessageDeflate: false,
-            handshakeTimeout: Math.min(options.defaultTimeoutMs, options.maxTimeoutMs),
+            handshakeTimeout: resolveTimeout(undefined, options),
         });
-        await waitForUpstreamOpen(raw, signal);
-        const response = {
-            v: PROXY_PROTOCOL_VERSION,
-            conn_id: connId,
-            ok: true,
-            protocol: String(raw.protocol ?? ""),
-        };
-        await writeJsonFrame(stream, response);
         let writeChain = Promise.resolve();
+        let queuedWriteBytes = 0;
+        let terminalSettled = false;
+        let terminalError;
         let terminalResolve;
         const terminal = new Promise((resolve) => { terminalResolve = resolve; });
-        const writeFrame = (op, payload) => {
-            const write = writeChain.then(() => writeWSFrame(stream, op, payload, options.maxWsFrameBytes));
-            writeChain = write.catch(() => { });
-            void write.catch((error) => terminalResolve(asError(error)));
+        const settleTerminal = (error) => {
+            if (terminalSettled)
+                return;
+            terminalSettled = true;
+            terminalError = error;
+            terminalResolve(error);
+        };
+        const queueFrame = (op, payload, allowCloseFrame = false) => {
+            if (terminalSettled)
+                return Promise.reject(new Error("proxy WebSocket is closed"));
+            const frameBytes = payload.byteLength + 5;
+            const nextQueuedWriteBytes = queuedWriteBytes + frameBytes;
+            if (!Number.isSafeInteger(nextQueuedWriteBytes)
+                || (!allowCloseFrame && nextQueuedWriteBytes > options.maxWsQueuedBytes)) {
+                const error = new ProxyServerError("resource_exhausted", "proxy WebSocket write queue exhausted");
+                settleTerminal(error);
+                try {
+                    raw.close(1011, "proxy buffer limit exceeded");
+                }
+                catch { /* Best effort. */ }
+                return Promise.reject(error);
+            }
+            queuedWriteBytes = nextQueuedWriteBytes;
+            const write = writeChain
+                .then(() => {
+                if (terminalSettled)
+                    throw terminalError ?? new Error("proxy WebSocket is closed");
+                return writeWSFrame(stream, op, payload, options.maxWsFrameBytes);
+            })
+                .finally(() => {
+                queuedWriteBytes = Math.max(0, queuedWriteBytes - frameBytes);
+            });
+            writeChain = write;
+            void write.catch((error) => settleTerminal(asError(error)));
+            return write;
+        };
+        const queueEventFrame = (op, payload) => {
+            void queueFrame(op, payload).catch(() => { });
         };
-        raw.on("message", (data, isBinary) => writeFrame(isBinary ? 2 : 1, toBytes(data)));
-        raw.on("ping", (data) => writeFrame(9, toBytes(data)));
-        raw.on("pong", (data) => writeFrame(10, toBytes(data)));
         raw.on("close", (code, reason) => {
+            if (terminalSettled)
+                return;
+            if (!upstreamOpened) {
+                settleTerminal(new Error("upstream WebSocket closed before open"));
+                return;
+            }
             const reasonBytes = toBytes(reason);
             const payload = new Uint8Array(2 + reasonBytes.length);
             payload[0] = (code >>> 8) & 0xff;
             payload[1] = code & 0xff;
             payload.set(reasonBytes, 2);
-            writeFrame(8, payload);
-            terminalResolve();
+            void queueFrame(8, payload, true).then(() => settleTerminal(), (error) => settleTerminal(asError(error)));
         });
-        raw.on("error", (error) => terminalResolve(error));
+        raw.on("error", (error) => settleTerminal(error));
+        await waitForUpstreamOpen(raw, signal);
+        upstreamOpened = true;
+        const response = {
+            v: PROXY_PROTOCOL_VERSION,
+            conn_id: connId,
+            ok: true,
+            protocol: String(raw.protocol ?? ""),
+        };
+        const openResponseWrite = writeJsonFrame(stream, response);
+        writeChain = openResponseWrite;
+        void openResponseWrite.catch((error) => settleTerminal(asError(error)));
+        raw.on("message", (data, isBinary) => queueEventFrame(isBinary ? 2 : 1, toBytes(data)));
+        raw.on("ping", (data) => queueEventFrame(9, toBytes(data)));
+        raw.on("pong", (data) => queueEventFrame(10, toBytes(data)));
+        const onPostOpenAbort = () => {
+            const error = asError(signal?.reason ?? new Error("proxy WebSocket aborted"));
+            settleTerminal(error);
+            try {
+                if (typeof raw.terminate === "function")
+                    raw.terminate();
+                else
+                    raw.close();
+            }
+            catch {
+                // The terminal error is already authoritative.
+            }
+        };
+        if (signal != null) {
+            signal.addEventListener("abort", onPostOpenAbort, { once: true });
+            removePostOpenAbortListener = () => signal.removeEventListener("abort", onPostOpenAbort);
+            if (signal.aborted)
+                onPostOpenAbort();
+        }
+        const openResponseResult = await Promise.race([
+            openResponseWrite.then(() => undefined),
+            terminal,
+        ]);
+        if (openResponseResult != null)
+            throw openResponseResult;
+        try {
+            if (!terminalSettled && typeof raw.resume === "function")
+                raw.resume();
+        }
+        catch (error) {
+            settleTerminal(asError(error));
+            throw error;
+        }
         const inbound = (async () => {
             while (true) {
                 const frame = await readWSFrame(reader, options.maxWsFrameBytes);
                 switch (frame.op) {
                     case 1:
-                        raw.send(frame.payload, { binary: false });
+                        await sendUpstreamFrame(raw, 1, frame.payload);
                         break;
                     case 2:
-                        raw.send(frame.payload, { binary: true });
+                        await sendUpstreamFrame(raw, 2, frame.payload);
                         break;
-                    case 8:
+                    case 8: {
                         raw.close(frame.payload.length >= 2 ? (frame.payload[0] << 8) | frame.payload[1] : 1000, new TextDecoder().decode(frame.payload.subarray(2)));
+                        const closeError = await terminal;
+                        if (closeError != null)
+                            throw closeError;
                         return;
+                    }
                     case 9:
-                        raw.ping(frame.payload);
+                        await sendUpstreamFrame(raw, 9, frame.payload);
                         break;
                     case 10:
-                        raw.pong(frame.payload);
+                        await sendUpstreamFrame(raw, 10, frame.payload);
                         break;
                     default: throw new Error("invalid websocket frame operation");
                 }
@@ -224,10 +331,11 @@ async function serveWebSocket(stream, options, signal) {
         await writeChain;
     }
     catch (error) {
-        if (raw == null || raw.readyState !== 1)
-            await writeWSOpenError(stream, connId, classifyWSError(error), error);
+        if (!upstreamOpened)
+            await writeWSOpenError(stream, connId, classifyWSError(error));
     }
     finally {
+        removePostOpenAbortListener?.();
         try {
             raw?.close();
         }
@@ -246,7 +354,14 @@ function compileOptions(input) {
     const maxJsonFrameBytes = positive(input.maxJsonFrameBytes, DEFAULT_MAX_JSON_FRAME_BYTES, "maxJsonFrameBytes");
     const maxChunkBytes = positive(input.maxChunkBytes, DEFAULT_MAX_CHUNK_BYTES, "maxChunkBytes");
     const maxBodyBytes = positive(input.maxBodyBytes, DEFAULT_MAX_BODY_BYTES, "maxBodyBytes");
+    const maxBufferedRequestBodyBytes = positive(input.maxBufferedRequestBodyBytes, maxBodyBytes, "maxBufferedRequestBodyBytes");
     const maxWsFrameBytes = positive(input.maxWsFrameBytes, DEFAULT_MAX_WS_FRAME_BYTES, "maxWsFrameBytes");
+    const defaultMaxWsQueuedBytes = maxWsFrameBytes <= Number.MAX_SAFE_INTEGER - 5
+        ? maxWsFrameBytes + 5
+        : maxWsFrameBytes;
+    const maxWsQueuedBytes = positive(input.maxWsQueuedBytes, defaultMaxWsQueuedBytes, "maxWsQueuedBytes");
+    if (maxWsQueuedBytes < 5)
+        throw new Error("maxWsQueuedBytes must be at least 5");
     const defaultTimeoutMs = nonNegative(input.defaultTimeoutMs, 30_000, "defaultTimeoutMs");
     const maxTimeoutMs = nonNegative(input.maxTimeoutMs, 300_000, "maxTimeoutMs");
     if (maxTimeoutMs > 0 && defaultTimeoutMs > maxTimeoutMs)
@@ -257,7 +372,9 @@ function compileOptions(input) {
         maxJsonFrameBytes,
         maxChunkBytes,
         maxBodyBytes,
+        maxBufferedRequestBodyBytes,
         maxWsFrameBytes,
+        maxWsQueuedBytes,
         defaultTimeoutMs,
         maxTimeoutMs,
         maxConcurrentStreams: positive(input.maxConcurrentStreams, 64, "maxConcurrentStreams"),
@@ -349,30 +466,70 @@ function applyExternalOrigin(headers, input) {
     headers.set("x-forwarded-proto", new URL(external).protocol.slice(0, -1));
     headers.set("host", new URL(external).host);
 }
-async function readBody(reader, maxChunkBytes, maxBodyBytes) {
+function createRequestBodyBudget(maxBytes) {
+    let usedBytes = 0;
+    return {
+        reserve: (bytes) => {
+            const next = usedBytes + bytes;
+            if (!Number.isSafeInteger(next) || next > maxBytes) {
+                throw new ProxyServerError("resource_exhausted", "proxy request body buffer exhausted");
+            }
+            usedBytes = next;
+        },
+        release: (bytes) => {
+            usedBytes = Math.max(0, usedBytes - bytes);
+        },
+    };
+}
+async function readBody(reader, maxChunkBytes, maxBodyBytes, budget) {
     const chunks = [];
     let total = 0;
-    while (true) {
-        const length = readU32be(await reader.readExactly(4), 0);
-        if (length === 0)
-            break;
-        if (length > maxChunkBytes)
-            throw new ProxyServerError("request_body_too_large", "request chunk too large");
-        total += length;
-        if (total > maxBodyBytes)
-            throw new ProxyServerError("request_body_too_large", "request body too large");
-        chunks.push(await reader.readExactly(length));
+    let handedOff = false;
+    try {
+        while (true) {
+            const length = readU32be(await reader.readExactly(4), 0);
+            if (length === 0)
+                break;
+            if (length > maxChunkBytes)
+                throw new ProxyServerError("request_body_too_large", "request chunk too large");
+            const next = total + length;
+            if (!Number.isSafeInteger(next) || next > maxBodyBytes) {
+                throw new ProxyServerError("request_body_too_large", "request body too large");
+            }
+            budget.reserve(length);
+            total = next;
+            chunks.push(await reader.readExactly(length));
+        }
+        const body = new Uint8Array(total);
+        let offset = 0;
+        for (const chunk of chunks) {
+            body.set(chunk, offset);
+            offset += chunk.length;
+        }
+        let released = false;
+        handedOff = true;
+        return {
+            bytes: body,
+            release: () => {
+                if (released)
+                    return;
+                released = true;
+                budget.release(total);
+            },
+        };
     }
-    const body = new Uint8Array(total);
-    let offset = 0;
-    for (const chunk of chunks) {
-        body.set(chunk, offset);
-        offset += chunk.length;
+    finally {
+        if (!handedOff)
+            budget.release(total);
     }
-    return body;
 }
-async function writeHTTPError(stream, requestId, code, error) {
-    const meta = { v: PROXY_PROTOCOL_VERSION, request_id: requestId.trim() || "unknown", ok: false, error: { code, message: asError(error).message } };
+async function writeHTTPError(stream, requestId, code) {
+    const meta = {
+        v: PROXY_PROTOCOL_VERSION,
+        request_id: requestId.trim() || "unknown",
+        ok: false,
+        error: { code, message: publicHTTPErrorMessage(code) },
+    };
     try {
         await writeJsonFrame(stream, meta);
         await stream.write(u32be(0));
@@ -396,8 +553,13 @@ async function writeWSFrame(stream, op, payload, maxBytes) {
     if (payload.length > 0)
         await stream.write(payload);
 }
-async function writeWSOpenError(stream, connId, code, error) {
-    const response = { v: PROXY_PROTOCOL_VERSION, conn_id: connId.trim() || "unknown", ok: false, error: { code, message: asError(error).message } };
+async function writeWSOpenError(stream, connId, code) {
+    const response = {
+        v: PROXY_PROTOCOL_VERSION,
+        conn_id: connId.trim() || "unknown",
+        ok: false,
+        error: { code, message: publicWSErrorMessage(code) },
+    };
     try {
         await writeJsonFrame(stream, response);
     }
@@ -405,13 +567,65 @@ async function writeWSOpenError(stream, connId, code, error) {
 }
 function waitForUpstreamOpen(websocket, signal) {
     return new Promise((resolve, reject) => {
-        const cleanup = () => { websocket.off("open", onOpen); websocket.off("error", onError); signal?.removeEventListener("abort", onAbort); };
-        const onOpen = () => { cleanup(); resolve(); };
+        const cleanup = () => {
+            websocket.off("open", onOpen);
+            websocket.off("error", onError);
+            websocket.off("close", onClose);
+            signal?.removeEventListener("abort", onAbort);
+        };
+        const onOpen = () => {
+            try {
+                if (typeof websocket.pause === "function")
+                    websocket.pause();
+            }
+            catch (error) {
+                cleanup();
+                reject(asError(error));
+                return;
+            }
+            cleanup();
+            resolve();
+        };
         const onError = (error) => { cleanup(); reject(error); };
+        const onClose = () => { cleanup(); reject(new Error("upstream WebSocket closed before open")); };
         const onAbort = () => { cleanup(); reject(signal?.reason ?? new Error("aborted")); };
         websocket.once("open", onOpen);
         websocket.once("error", onError);
+        websocket.once("close", onClose);
         signal?.addEventListener("abort", onAbort, { once: true });
+        if (signal?.aborted)
+            onAbort();
+    });
+}
+function sendUpstreamFrame(websocket, op, payload) {
+    return new Promise((resolve, reject) => {
+        const finish = (error) => {
+            if (error == null)
+                resolve();
+            else
+                reject(asError(error));
+        };
+        try {
+            switch (op) {
+                case 1:
+                    websocket.send(payload, { binary: false }, finish);
+                    return;
+                case 2:
+                    websocket.send(payload, { binary: true }, finish);
+                    return;
+                case 9:
+                    websocket.ping(payload, undefined, finish);
+                    return;
+                case 10:
+                    websocket.pong(payload, undefined, finish);
+                    return;
+                default:
+                    reject(new Error("invalid upstream WebSocket operation"));
+            }
+        }
+        catch (error) {
+            reject(asError(error));
+        }
     });
 }
 function resolveTimeout(input, options) {
@@ -458,6 +672,33 @@ function classifyWSError(error) {
         return error.code;
     return "upstream_ws_dial_failed";
 }
+function publicHTTPErrorMessage(code) {
+    switch (code) {
+        case "invalid_request_meta":
+            return "invalid proxy request";
+        case "request_body_too_large":
+        case "response_body_too_large":
+            return "proxy body limit exceeded";
+        case "resource_exhausted":
+            return "proxy resource limit exceeded";
+        case "timeout":
+            return "upstream request timed out";
+        case "canceled":
+            return "proxy request canceled";
+        default:
+            return "upstream request failed";
+    }
+}
+function publicWSErrorMessage(code) {
+    switch (code) {
+        case "invalid_ws_open_meta":
+            return "invalid proxy WebSocket request";
+        case "resource_exhausted":
+            return "proxy WebSocket resource limit exceeded";
+        default:
+            return "upstream WebSocket connection failed";
+    }
+}
 function toBytes(input) {
     if (input instanceof Uint8Array)
         return input;

package/dist/proxy/windowBridgeProtocol.d.ts

@@ -3,7 +3,7 @@ export declare const PROXY_WINDOW_FETCH_FORWARD_MSG_TYPE = "flowersec-proxy:wind
 export declare const PROXY_WINDOW_FETCH_MSG_TYPE = "flowersec-proxy:fetch";
 export declare const PROXY_WINDOW_WS_OPEN_MSG_TYPE = "flowersec-proxy:ws_open";
 export declare const PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE = "flowersec-proxy:ws_open_ack";
-export declare const PROXY_WINDOW_WS_WRITE_ACK_CAPABILITY = "stream_write_ack_v1";
+export declare const PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY = "stream_bidirectional_ack_v2";
 export declare const PROXY_WINDOW_WS_ERROR_MSG_TYPE = "flowersec-proxy:ws_error";
 export declare const PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE = "flowersec-proxy:stream_chunk";
 export declare const PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE = "flowersec-proxy:stream_write_ack";
@@ -32,12 +32,13 @@ export type ProxyWindowWsOpenMsg = Readonly<{
     type: typeof PROXY_WINDOW_WS_OPEN_MSG_TYPE;
     path: string;
     protocols?: readonly string[];
+    capabilities: readonly string[];
     capabilityNonce?: string;
 }>;
 export type ProxyWindowWsOpenAckMsg = Readonly<{
     type: typeof PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE;
     protocol: string;
-    capabilities?: readonly string[];
+    capabilities: readonly string[];
 }>;
 export type ProxyWindowWsErrorMsg = Readonly<{
     type: typeof PROXY_WINDOW_WS_ERROR_MSG_TYPE;
@@ -46,7 +47,7 @@ export type ProxyWindowWsErrorMsg = Readonly<{
 export type ProxyWindowStreamChunkMsg = Readonly<{
     type: typeof PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE;
     data: ArrayBuffer;
-    writeId?: number;
+    writeId: number;
 }>;
 export type ProxyWindowStreamWriteAckMsg = Readonly<{
     type: typeof PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE;

package/dist/proxy/windowBridgeProtocol.js

@@ -2,7 +2,7 @@ export const PROXY_WINDOW_FETCH_FORWARD_MSG_TYPE = "flowersec-proxy:window_fetch
 export const PROXY_WINDOW_FETCH_MSG_TYPE = "flowersec-proxy:fetch";
 export const PROXY_WINDOW_WS_OPEN_MSG_TYPE = "flowersec-proxy:ws_open";
 export const PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE = "flowersec-proxy:ws_open_ack";
-export const PROXY_WINDOW_WS_WRITE_ACK_CAPABILITY = "stream_write_ack_v1";
+export const PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY = "stream_bidirectional_ack_v2";
 export const PROXY_WINDOW_WS_ERROR_MSG_TYPE = "flowersec-proxy:ws_error";
 export const PROXY_WINDOW_STREAM_CHUNK_MSG_TYPE = "flowersec-proxy:stream_chunk";
 export const PROXY_WINDOW_STREAM_WRITE_ACK_MSG_TYPE = "flowersec-proxy:stream_write_ack";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Flowersec core TypeScript library (browser-friendly E2EE + multiplexing over WebSocket).",
   "license": "MIT",
   "repository": {