@floegence/flowersec-core 0.26.0 → 2.0.0

package/dist/ws-client/binaryTransport.d.ts

@@ -1,4 +1,3 @@
-import { type ClientObserverLike } from "../observability/observer.js";
 export declare class WsCloseError extends Error {
     readonly code: number | undefined;
     readonly reason: string | undefined;
@@ -24,11 +23,9 @@ export type WebSocketLimits = Readonly<{
 export declare const DEFAULT_WEB_SOCKET_LIMITS: WebSocketLimits;
 export type WebSocketBinaryTransportOptions = Readonly<{
     webSocketLimits?: Partial<WebSocketLimits>;
-    observer?: ClientObserverLike;
 }>;
 export declare class WebSocketBinaryTransport {
     private readonly ws;
-    private readonly observer;
     private readonly queue;
     private queueHead;
     private queueBytes;

package/dist/ws-client/binaryTransport.js

@@ -1,4 +1,3 @@
-import { emitObserverDiagnostic, normalizeObserver } from "../observability/observer.js";
 import { AbortError, TimeoutError, throwIfAborted } from "../utils/errors.js";
 export class WsCloseError extends Error {
     code;
@@ -28,8 +27,6 @@ export const DEFAULT_WEB_SOCKET_LIMITS = Object.freeze({
 export class WebSocketBinaryTransport {
     // Underlying WebSocket instance (browser or polyfill).
     ws;
-    // Observer for websocket-level errors.
-    observer;
     // Buffered inbound frames when no reader is waiting.
     queue = [];
     // Read cursor for queue to avoid Array.shift() O(n).
@@ -55,7 +52,6 @@ export class WebSocketBinaryTransport {
     pendingOutboundBytes = 0;
     constructor(ws, opts = {}) {
         this.ws = ws;
-        this.observer = normalizeObserver(opts.observer);
         this.limits = normalizeWebSocketLimits(opts.webSocketLimits);
         this.ws.binaryType = "arraybuffer";
         this.ws.addEventListener("message", this.onMessage);
@@ -129,7 +125,7 @@ export class WebSocketBinaryTransport {
         if (frame.byteLength > this.limits.outboundHardLimitBytes ||
             this.pendingOutboundBytes + this.ws.bufferedAmount + frame.byteLength > this.limits.outboundHardLimitBytes) {
             const err = new Error("ws send queue exceeds hard limit");
-            this.failAndClose(err, "send_buffer_exceeded");
+            this.failAndClose(err);
             throw err;
         }
         this.pendingOutboundBytes += frame.byteLength;
@@ -151,8 +147,6 @@ export class WebSocketBinaryTransport {
     close() {
         if (!this.localCloseRequested) {
             this.localCloseRequested = true;
-            if (this.error == null)
-                this.observer.onWsClose("local");
         }
         this.fail(new Error("websocket closed"));
         this.ws.removeEventListener("message", this.onMessage);
@@ -168,7 +162,7 @@ export class WebSocketBinaryTransport {
         if (this.error != null)
             return;
         if (typeof data === "string") {
-            this.fail(new Error("unexpected text frame"), "unexpected_text_frame");
+            this.fail(new Error("unexpected text frame"));
             return;
         }
         if (data instanceof Uint8Array) {
@@ -177,9 +171,8 @@ export class WebSocketBinaryTransport {
         }
         if (data instanceof ArrayBuffer) {
             if (this.queueBytes + data.byteLength > this.limits.maxInboundQueuedBytes) {
-                this.fail(new Error("ws recv buffer exceeded"), "recv_buffer_exceeded");
+                this.fail(new Error("ws recv buffer exceeded"));
                 this.localCloseRequested = true;
-                this.observer.onWsClose("local");
                 this.ws.close();
                 return;
             }
@@ -189,9 +182,8 @@ export class WebSocketBinaryTransport {
         if (ArrayBuffer.isView(data)) {
             const view = data;
             if (this.queueBytes + view.byteLength > this.limits.maxInboundQueuedBytes) {
-                this.fail(new Error("ws recv buffer exceeded"), "recv_buffer_exceeded");
+                this.fail(new Error("ws recv buffer exceeded"));
                 this.localCloseRequested = true;
-                this.observer.onWsClose("local");
                 this.ws.close();
                 return;
             }
@@ -200,9 +192,8 @@ export class WebSocketBinaryTransport {
         }
         if (typeof Blob !== "undefined" && data instanceof Blob) {
             if (this.queueBytes + data.size > this.limits.maxInboundQueuedBytes) {
-                this.fail(new Error("ws recv buffer exceeded"), "recv_buffer_exceeded");
+                this.fail(new Error("ws recv buffer exceeded"));
                 this.localCloseRequested = true;
-                this.observer.onWsClose("local");
                 this.ws.close();
                 return;
             }
@@ -212,23 +203,22 @@ export class WebSocketBinaryTransport {
             this.push(new Uint8Array(ab));
             return;
         }
-        this.fail(new Error("unexpected message type"), "unexpected_message_type");
+        this.fail(new Error("unexpected message type"));
     }
     onMessage = (ev) => {
         const data = ev.data;
         this.messageChain = this.messageChain.then(() => this.handleMessage(data)).catch((err) => {
             const e = err instanceof Error ? err : new Error(String(err));
-            this.fail(e, "error");
+            this.fail(e);
         });
     };
     onError = () => {
-        this.fail(new Error("websocket error"), "error");
+        this.fail(new Error("websocket error"));
     };
     onClose = (ev) => {
         if (!this.localCloseRequested) {
             const code = typeof ev?.code === "number" ? ev.code : undefined;
             const reason = typeof ev?.reason === "string" ? ev.reason : undefined;
-            this.observer.onWsClose("peer_or_error", code);
             this.fail(new WsCloseError(code, reason));
             return;
         }
@@ -246,9 +236,8 @@ export class WebSocketBinaryTransport {
             return;
         }
         if (this.queueBytes + b.length > this.limits.maxInboundQueuedBytes) {
-            this.fail(new Error("ws recv buffer exceeded"), "recv_buffer_exceeded");
+            this.fail(new Error("ws recv buffer exceeded"));
             this.localCloseRequested = true;
-            this.observer.onWsClose("local");
             this.ws.close();
             return;
         }
@@ -261,7 +250,7 @@ export class WebSocketBinaryTransport {
             throw this.error;
         if (frame.byteLength > this.limits.outboundHardLimitBytes) {
             const err = new Error("ws send frame exceeds hard limit");
-            this.failAndClose(err, "send_buffer_exceeded");
+            this.failAndClose(err);
             throw err;
         }
         const startedAt = Date.now();
@@ -273,7 +262,7 @@ export class WebSocketBinaryTransport {
                 throw this.error;
             if (Date.now() - startedAt >= this.limits.outboundDrainTimeoutMs) {
                 const err = new TimeoutError("ws send buffer drain timeout");
-                this.failAndClose(err, "send_buffer_timeout");
+                this.failAndClose(err);
                 throw err;
             }
             await new Promise((resolve) => setTimeout(resolve, 10));
@@ -286,24 +275,14 @@ export class WebSocketBinaryTransport {
         onHandedToWebSocket();
         if (this.ws.bufferedAmount > this.limits.outboundHardLimitBytes) {
             const err = new Error("ws send buffer exceeded");
-            this.failAndClose(err, "send_buffer_exceeded");
+            this.failAndClose(err);
             throw err;
         }
     }
-    failAndClose(err, reason) {
-        emitObserverDiagnostic(this.observer, {
-            stage: "transport",
-            code_domain: "event",
-            code: reason === "send_buffer_timeout" ? "queue_pressure" : "resource_limit_reached",
-            result: "fail",
-            resource: "websocket_outbound_bytes",
-            current: this.ws.bufferedAmount + this.pendingOutboundBytes,
-            limit: this.limits.outboundHardLimitBytes,
-        });
-        this.fail(err, reason);
+    failAndClose(err) {
+        this.fail(err);
         if (!this.localCloseRequested) {
             this.localCloseRequested = true;
-            this.observer.onWsClose("local");
             this.ws.close();
         }
     }
@@ -359,13 +338,10 @@ export class WebSocketBinaryTransport {
         this.waitersSettled = 0;
     }
     // fail transitions the transport into a permanent error state.
-    fail(err, reason) {
+    fail(err) {
         if (this.error != null)
             return;
         this.error = err;
-        if (reason != null) {
-            this.observer.onWsError(reason);
-        }
         const ws = this.waiters;
         const start = this.waitersHead;
         this.waiters = [];

package/dist/yamux/errors.d.ts

@@ -13,7 +13,3 @@ export declare class YamuxResourceExhaustedError extends Error {
     constructor(resource: string, current: number, limit: number);
 }
 export declare function isYamuxResourceExhaustedError(error: unknown): error is YamuxResourceExhaustedError;
-export declare class YamuxPingTimeoutError extends Error {
-    constructor();
-}
-export declare function isYamuxPingTimeoutError(error: unknown): error is YamuxPingTimeoutError;

package/dist/yamux/errors.js

@@ -32,12 +32,3 @@ export class YamuxResourceExhaustedError extends Error {
 export function isYamuxResourceExhaustedError(error) {
     return error instanceof YamuxResourceExhaustedError;
 }
-export class YamuxPingTimeoutError extends Error {
-    constructor() {
-        super("yamux ping timeout");
-        this.name = "YamuxPingTimeoutError";
-    }
-}
-export function isYamuxPingTimeoutError(error) {
-    return error instanceof YamuxPingTimeoutError;
-}

package/dist/yamux/session.d.ts

@@ -53,9 +53,6 @@ export declare class YamuxSession {
     private readonly sendWindowWaiters;
     private readonly inboundStreams;
     private sessionReceiveBytes;
-    private nextPingId;
-    private readonly pingWaiters;
-    private activeProbe;
     constructor(conn: ByteDuplex, opts: YamuxSessionOptions);
     openStream(opts?: Readonly<{
         signal?: AbortSignal;
@@ -65,8 +62,6 @@ export declare class YamuxSession {
     outboundFrameBytes(): number;
     streamWriteQueueBytes(): number;
     releaseReceiveBytes(bytes: number): void;
-    probeLiveness(timeoutMs?: number): Promise<number>;
-    private startLivenessProbe;
     sendRst(id: number): Promise<void>;
     notifySendWindow(streamId: number): void;
     waitForSendWindow(streamId: number): Promise<void>;

package/dist/yamux/session.js

@@ -2,7 +2,7 @@ import { ByteReader } from "./byteReader.js";
 import { decodeHeader, encodeHeader, HEADER_LEN } from "./header.js";
 import { FLAG_ACK, FLAG_RST, FLAG_SYN, TYPE_DATA, TYPE_GO_AWAY, TYPE_PING, TYPE_WINDOW_UPDATE, YAMUX_VERSION } from "./constants.js";
 import { YamuxStream } from "./stream.js";
-import { YamuxPingTimeoutError, YamuxResourceExhaustedError } from "./errors.js";
+import { YamuxResourceExhaustedError } from "./errors.js";
 import { SDK_DEFAULTS } from "../defaults.js";
 export const DEFAULT_YAMUX_LIMITS = Object.freeze({
     maxActiveStreams: SDK_DEFAULTS.yamux.maxActiveStreams,
@@ -37,9 +37,6 @@ export class YamuxSession {
     sendWindowWaiters = new Map();
     inboundStreams = new Set();
     sessionReceiveBytes = 0;
-    nextPingId = 1;
-    pingWaiters = new Map();
-    activeProbe;
     constructor(conn, opts) {
         this.conn = conn;
         this.reader = new ByteReader(() => this.conn.read());
@@ -100,53 +97,6 @@ export class YamuxSession {
     releaseReceiveBytes(bytes) {
         this.sessionReceiveBytes = Math.max(0, this.sessionReceiveBytes - Math.max(0, bytes));
     }
-    // probeLiveness performs a correlated yamux PING SYN/ACK round trip.
-    async probeLiveness(timeoutMs = 10_000) {
-        if (this.activeProbe != null)
-            return await this.activeProbe;
-        const probe = this.startLivenessProbe(timeoutMs);
-        this.activeProbe = probe;
-        try {
-            return await probe;
-        }
-        finally {
-            if (this.activeProbe === probe)
-                this.activeProbe = undefined;
-        }
-    }
-    async startLivenessProbe(timeoutMs) {
-        if (this.closed)
-            throw new Error("session closed");
-        if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
-            throw new RangeError("timeoutMs must be positive");
-        let opaque = this.nextPingId >>> 0;
-        do {
-            opaque = this.nextPingId++ >>> 0;
-            if (this.nextPingId > 0xffffffff)
-                this.nextPingId = 1;
-        } while (opaque === 0 || this.pingWaiters.has(opaque));
-        const startedAt = monotonicMilliseconds();
-        return await new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                this.pingWaiters.delete(opaque);
-                const error = new YamuxPingTimeoutError();
-                reject(error);
-                this.fail(error);
-            }, timeoutMs);
-            timer?.unref?.();
-            this.pingWaiters.set(opaque, { startedAt, resolve, reject, timer });
-            const hdr = encodeHeader({ type: TYPE_PING, flags: FLAG_SYN, streamId: 0, length: opaque });
-            void this.writeRaw(hdr).catch((err) => {
-                const waiter = this.pingWaiters.get(opaque);
-                if (waiter == null)
-                    return;
-                this.pingWaiters.delete(opaque);
-                clearTimeout(waiter.timer);
-                reject(err);
-                this.fail(err);
-            });
-        });
-    }
     // sendRst sends a reset frame and removes the stream.
     async sendRst(id) {
         const hdr = encodeHeader({ type: TYPE_WINDOW_UPDATE, flags: FLAG_RST, streamId: id, length: 0 });
@@ -222,17 +172,10 @@ export class YamuxSession {
         this.closed = true;
         this.conn.close();
         this.wakeSendWindowWaiters();
-        for (const waiter of this.pingWaiters.values()) {
-            clearTimeout(waiter.timer);
-            waiter.reject(new Error("session closed"));
-        }
-        this.pingWaiters.clear();
         const streams = Array.from(this.streams.values());
         this.streams.clear();
         for (const s of streams) {
-            void Promise.resolve(s.reset(new Error("session closed"))).catch(() => {
-                // Session shutdown has already made the stream terminal.
-            });
+            s.abort(new Error("session closed"));
         }
     }
     wakeSendWindowWaiters() {
@@ -321,14 +264,8 @@ export class YamuxSession {
             await this.writeRaw(hdr);
             return;
         }
-        if ((flags & FLAG_ACK) !== 0) {
-            const waiter = this.pingWaiters.get(opaque >>> 0);
-            if (waiter == null)
-                return;
-            this.pingWaiters.delete(opaque >>> 0);
-            clearTimeout(waiter.timer);
-            waiter.resolve(Math.max(0, monotonicMilliseconds() - waiter.startedAt));
-        }
+        // Yamux PING ACKs are accepted for protocol interoperability. Active
+        // liveness belongs to the established Flowersec session protocol.
     }
     async handleDataFrame(streamId, flags, data) {
         if (streamId === 0) {
@@ -462,6 +399,3 @@ function normalizeYamuxLimits(input) {
         throw new RangeError("maxStreamReceiveBytes must not exceed maxSessionReceiveBytes");
     return Object.freeze(limits);
 }
-function monotonicMilliseconds() {
-    return typeof performance !== "undefined" ? performance.now() : Date.now();
-}

package/dist/yamux/stream.d.ts

@@ -24,6 +24,7 @@ export declare class YamuxStream {
     private writeSerial;
     close(): Promise<void>;
     reset(err?: Error): Promise<void>;
+    abort(err?: Error): void;
     private fail;
     bufferedReceiveBytes(): number;
     releaseBufferedReceiveBytes(): number;

package/dist/yamux/stream.js

@@ -160,6 +160,10 @@ export class YamuxStream {
         this.resetTask = this.session.sendRst(this.id);
         return this.resetTask;
     }
+    abort(err = new Error("stream aborted")) {
+        if (this.fail(err))
+            this.session.onStreamClosed(this.id);
+    }
     fail(err) {
         if (this.state === "reset")
             return false;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "0.26.0",
-  "description": "Flowersec core TypeScript library (browser-friendly E2EE + multiplexing over WebSocket).",
+  "version": "2.0.0",
+  "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -14,11 +14,15 @@
   "type": "module",
   "main": "./dist/facade.js",
   "types": "./dist/facade.d.ts",
+  "bin": {
+    "flowersec-ts-cli": "./dist/cli.js"
+  },
   "files": [
     "dist/**",
     "README.md",
     "LICENSE",
-    "YAMUX_ALIGNMENT.md"
+    "THIRD_PARTY_NOTICES.md",
+    "sbom/**"
   ],
   "publishConfig": {
     "access": "public"
@@ -36,93 +40,29 @@
       "types": "./dist/browser/index.d.ts",
       "default": "./dist/browser/index.js"
     },
-    "./controlplane": {
-      "types": "./dist/controlplane/index.d.ts",
-      "default": "./dist/controlplane/index.js"
-    },
-    "./endpoint": {
-      "types": "./dist/endpoint/index.d.ts",
-      "default": "./dist/endpoint/index.js"
-    },
-    "./framing": {
-      "types": "./dist/framing/index.d.ts",
-      "default": "./dist/framing/index.js"
-    },
-    "./streamio": {
-      "types": "./dist/streamio/index.d.ts",
-      "default": "./dist/streamio/index.js"
-    },
     "./proxy": {
       "types": "./dist/proxy/index.d.ts",
       "default": "./dist/proxy/index.js"
-    },
-    "./reconnect": {
-      "types": "./dist/reconnect/index.d.ts",
-      "default": "./dist/reconnect/index.js"
-    },
-    "./rpc": {
-      "types": "./dist/rpc/index.d.ts",
-      "default": "./dist/rpc/index.js"
-    },
-    "./yamux": {
-      "types": "./dist/yamux/index.d.ts",
-      "default": "./dist/yamux/index.js"
-    },
-    "./e2ee": {
-      "types": "./dist/e2ee/index.d.ts",
-      "default": "./dist/e2ee/index.js"
-    },
-    "./ws": {
-      "types": "./dist/ws/index.d.ts",
-      "default": "./dist/ws/index.js"
-    },
-    "./observability": {
-      "types": "./dist/observability/index.d.ts",
-      "default": "./dist/observability/index.js"
-    },
-    "./streamhello": {
-      "types": "./dist/streamhello/index.d.ts",
-      "default": "./dist/streamhello/index.js"
-    },
-    "./gen/flowersec/controlplane/*": {
-      "types": "./dist/gen/flowersec/controlplane/*.d.ts",
-      "default": "./dist/gen/flowersec/controlplane/*.js"
-    },
-    "./gen/flowersec/direct/*": {
-      "types": "./dist/gen/flowersec/direct/*.d.ts",
-      "default": "./dist/gen/flowersec/direct/*.js"
-    },
-    "./gen/flowersec/e2ee/*": {
-      "types": "./dist/gen/flowersec/e2ee/*.d.ts",
-      "default": "./dist/gen/flowersec/e2ee/*.js"
-    },
-    "./gen/flowersec/rpc/*": {
-      "types": "./dist/gen/flowersec/rpc/*.d.ts",
-      "default": "./dist/gen/flowersec/rpc/*.js"
-    },
-    "./gen/flowersec/tunnel/*": {
-      "types": "./dist/gen/flowersec/tunnel/*.d.ts",
-      "default": "./dist/gen/flowersec/tunnel/*.js"
-    },
-    "./internal": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
     }
   },
   "engines": {
-    "node": ">=24.0.0"
+    "node": ">=20.0.0"
   },
   "overrides": {
-    "brace-expansion@^1.1.7": "^1.1.13",
-    "brace-expansion@^2.0.1": "^2.0.3",
-    "postcss": "^8.5.12"
+    "js-yaml": "^4.3.0",
+    "postcss": "^8.5.23"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "node ./scripts/clean-dist.mjs && tsc -p tsconfig.build.json && node ./scripts/build-browser-vendor.mjs",
     "bench": "vitest bench --run",
-    "test": "npm run build && vitest run",
-    "test:browser": "npm run build && playwright test",
-    "ensure:browser": "node ./scripts/ensure-playwright-chromium.mjs",
+    "test": "npm run build && vitest run --exclude 'src/**/*.integration.test.ts'",
+    "test:browser": "npm run test:browser:chromium",
+    "test:browser:chromium": "npm run ensure:browser && npm run build && playwright test --project=chromium",
+    "test:browser:firefox": "npm run ensure:browser:firefox && npm run build && playwright test --project=firefox-compat",
+    "test:browser:webkit": "npm run ensure:browser:webkit && npm run build && playwright test --project=webkit-smoke",
+    "ensure:browser": "node ./scripts/ensure-playwright-browsers.mjs chromium",
+    "ensure:browser:firefox": "node ./scripts/ensure-playwright-browsers.mjs firefox",
+    "ensure:browser:webkit": "node ./scripts/ensure-playwright-browsers.mjs webkit",
     "test:coverage": "npm run build && vitest run --coverage",
     "lint": "eslint .",
     "verify:package": "node ./scripts/verify-package-exports.mjs",
@@ -130,19 +70,25 @@
     "prepublishOnly": "npm run build && npm run verify:package"
   },
   "dependencies": {
+    "@fails-components/webtransport": "1.6.7",
+    "@fails-components/webtransport-transport-http3-quiche": "1.6.7",
     "@noble/ciphers": "^0.6.0",
     "@noble/curves": "^1.9.0",
     "@noble/hashes": "^1.8.0",
+    "tr46": "5.0.0",
     "ws": "^8.21.0"
   },
   "devDependencies": {
+    "@playwright/test": "1.62.0",
     "@types/node": "^24.0.0",
     "@types/ws": "^8.5.12",
-    "@playwright/test": "1.58.2",
-    "@typescript-eslint/eslint-plugin": "^8.18.0",
-    "@typescript-eslint/parser": "^8.18.0",
+    "@typescript-eslint/eslint-plugin": "^8.65.0",
+    "@typescript-eslint/parser": "^8.65.0",
     "@vitest/coverage-v8": "4.1.0",
-    "eslint": "^9.17.0",
+    "ajv": "8.20.0",
+    "ajv-formats": "3.0.1",
+    "ajv-formats-draft2019": "1.6.1",
+    "eslint": "^10.8.0",
     "typescript": "^5.7.2",
     "vite": "^8.0.16",
     "vitest": "4.1.0"