@floegence/flowersec-core 2.3.3 → 2.3.5

package/README.md

@@ -2,12 +2,12 @@
 
 `@floegence/flowersec-core` is the ESM-only Flowersec v2 SDK for browsers and Node.js. Its public package surface is limited to the root, `/browser`, `/node`, and `/proxy` entrypoints.
 
-Flowersec 2.3.3 is the coordinated TypeScript SDK patch release.
+Flowersec 2.3.5 is the published TypeScript SDK release.
 
 ## Install
 
 ```bash
-npm install @floegence/flowersec-core@2.3.3
+npm install @floegence/flowersec-core@2.3.5
 ```
 
 ## Public API
@@ -28,7 +28,7 @@ The root type exports are:
 
 Retry ownership belongs to `ConnectionController`; applications do not classify error text or run a parallel retry scheduler. Public failures remain redacted and reveal no carrier, candidate, URL, credential, stage, key, or diagnostic details.
 
-`RpcResult<Response>` is a discriminated union. `RpcPeer.call(...)` requires a decoder for successful payloads, so the typed success value has passed application validation before it is returned. Check `result.ok` before reading either the typed success `payload` or bounded application `error`; a result cannot contain both. RPC call and notify are portable across SDKs, while `RpcPeer.onNotify(...)` is a TypeScript-specific subscription convenience.
+`RpcResult<Response>` is a discriminated union. `RpcPeer.call(...)` requires a decoder for successful payloads, so the typed success value has passed application validation before it is returned. Check `result.ok` before reading either the typed success `payload` or bounded application `error`; a result cannot contain both. RPC call and notify are portable across SDKs. TypeScript `RpcPeer.onNotify(...)` receives peer outbound notifications through the local Session's inbound reserved RPC stream.
 
 When connector options omit a connection timeout, browser and Node.js connectors use the shared ten-second default.
 
@@ -84,13 +84,13 @@ Raw QUIC and WebTransport preserve native FIN, RESET_STREAM, STOP_SENDING, flow
 
 WebSocket uses Yamux only inside its carrier adapter. Yamux has no independent STOP_SENDING primitive, so that operation is explicitly unavailable rather than emulated with a full stream reset.
 
-Browser applications receive a ready `Session` from `connect(...)`. The browser connector supports WSS and WebTransport production connections. WebTransport uses native HTTP/3 bidirectional streams and does not use Yamux.
+Browser applications receive a ready `Session` from `connect(...)`. The browser connector supports WSS, restricted plaintext loopback WebSocket direct connections, and WebTransport. WebTransport uses native HTTP/3 bidirectional streams and does not use Yamux.
 
 Chromium does not support a WebTransport pooling option; each carrier creates an independent native WebTransport connection.
 
 Cold-connection diagnostics require every independent carrier to meet the declared deadline. A `dial_failed` result remains a test failure and is not hidden by pooling, retry, or timeout relaxation.
 
-Node.js applications receive the same `Session` contract from `connect(...)`. The Node.js connector supports WSS and WebTransport production connections for direct and tunnel artifacts. It requires an absolute HTTP(S) `origin`; a custom certificate authority can be supplied through `tls.ca`. Invalid origin and TLS options fail as `ConnectError` with `invalid_options` and are terminal to the optional connection controller.
+Node.js applications receive the same `Session` contract from `connect(...)`. The Node.js connector supports WSS and WebTransport for direct and tunnel artifacts, plus restricted plaintext loopback WebSocket direct connections. It requires an absolute HTTP(S) `origin`; a custom certificate authority can be supplied through `tls.ca`. Invalid origin and TLS options fail as `ConnectError` with `invalid_options` and are terminal to the optional connection controller.
 
 The Node WebTransport direct listener/server is owned by the Node runtime and the `flowersec-ts-cli` server path. It uses the same native carrier acceptor and session engine as the client connector; it is not a second protocol implementation.
 

package/dist/rpc/server.d.ts

@@ -15,8 +15,11 @@ export type RpcServerTransport = Readonly<{
 }>;
 export declare class RpcRouter {
     private readonly handlers;
+    private readonly notifyHandlers;
     register(typeId: number, handler: RpcHandler): void;
     handler(typeId: number): RpcHandler | undefined;
+    onNotify(typeId: number, handler: (payload: unknown) => void): () => void;
+    dispatchNotification(typeId: number, payload: unknown): Promise<void>;
 }
 export declare class RpcServer {
     private readonly transport;

package/dist/rpc/server.js

@@ -8,12 +8,38 @@ const DEFAULT_RPC_SERVER_OPTIONS = Object.freeze({
 });
 export class RpcRouter {
     handlers = new Map();
+    notifyHandlers = new Map();
     register(typeId, handler) {
         this.handlers.set(typeId >>> 0, handler);
     }
     handler(typeId) {
         return this.handlers.get(typeId >>> 0);
     }
+    onNotify(typeId, handler) {
+        const normalized = typeId >>> 0;
+        const handlers = this.notifyHandlers.get(normalized) ?? new Set();
+        handlers.add(handler);
+        this.notifyHandlers.set(normalized, handlers);
+        return () => {
+            handlers.delete(handler);
+            if (handlers.size === 0)
+                this.notifyHandlers.delete(normalized);
+        };
+    }
+    async dispatchNotification(typeId, payload) {
+        const normalized = typeId >>> 0;
+        const requestHandler = this.handlers.get(normalized);
+        if (requestHandler !== undefined)
+            await requestHandler(payload);
+        for (const handler of [...(this.notifyHandlers.get(normalized) ?? [])]) {
+            try {
+                handler(payload);
+            }
+            catch {
+                // Application subscribers cannot stop RPC serving.
+            }
+        }
+    }
 }
 // RpcServer dispatches request envelopes to registered handlers.
 export class RpcServer {
@@ -175,10 +201,7 @@ export class RpcServer {
             if (work == null)
                 return;
             const v = work.envelope;
-            const h = this.router.handler(v.type_id);
-            if (h == null)
-                continue;
-            await h(v.payload);
+            await this.router.dispatchNotification(v.type_id, v.payload);
         }
     }
     async nextWork(queue, waiters) {

package/dist/v2/contract.d.ts

@@ -1,4 +1,4 @@
-import type { RpcClient } from "../rpc/client.js";
+import type { RpcError } from "../rpc/wire.js";
 export interface InternalByteStreamV2 {
     readonly id: bigint;
     readonly kind: string;
@@ -18,7 +18,7 @@ export interface InternalIncomingStreamV2 {
 export interface InternalSessionV2 {
     readonly path: PathKind;
     readonly endpointInstanceId: string | undefined;
-    readonly rpc: RpcClient;
+    readonly rpc: InternalRpcPeerV2;
     readonly termination: Promise<Readonly<{
         error: Error;
     }>>;
@@ -32,6 +32,15 @@ export interface InternalSessionV2 {
     }>>;
     close(): Promise<void>;
 }
+export interface InternalRpcPeerV2 {
+    call(typeId: number, payload: unknown, signal?: AbortSignal): Promise<{
+        payload: unknown;
+        error?: RpcError;
+    }>;
+    notify(typeId: number, payload: unknown): Promise<void>;
+    onNotify(typeId: number, handler: (payload: unknown) => void): () => void;
+    close(): void;
+}
 export type InternalStreamOpenOptionsV2 = OperationOptionsV2 & Readonly<{
     metadata?: JsonObjectV2;
 }>;

package/dist/v2/session.d.ts

@@ -1,6 +1,6 @@
 import { RpcClient } from "../rpc/client.js";
 import { RpcRouter, type RpcServerOptions } from "../rpc/server.js";
-import type { InternalByteStreamV2 as ByteStreamV2, InternalIncomingStreamV2 as IncomingStreamV2, InternalSessionV2 as SessionV2Contract, OperationOptionsV2, PathKind, InternalStreamOpenOptionsV2, UnreliableMessageChannelV2 } from "./contract.js";
+import type { InternalByteStreamV2 as ByteStreamV2, InternalIncomingStreamV2 as IncomingStreamV2, InternalRpcPeerV2, InternalSessionV2 as SessionV2Contract, OperationOptionsV2, PathKind, InternalStreamOpenOptionsV2, UnreliableMessageChannelV2 } from "./contract.js";
 import { type CarrierSessionV2, type CarrierStreamV2 } from "./carrier.js";
 import type { SessionContractV2 } from "./artifact.js";
 import { DirectionV2, InnerTypeV2, type EpochRootsV2, type RecordHeaderV2, type CipherSuiteV2 } from "./protocol.js";
@@ -49,6 +49,18 @@ export declare class SessionV2Error extends Error {
     readonly code: "aborted" | "closed" | "going_away" | "handshake" | "open_rejected" | "protocol" | "resource_exhausted" | "timeout";
     constructor(code: "aborted" | "closed" | "going_away" | "handshake" | "open_rejected" | "protocol" | "resource_exhausted" | "timeout", message: string);
 }
+declare class SessionRpcPeerV2 implements InternalRpcPeerV2 {
+    private readonly outbound;
+    private readonly inbound;
+    constructor(outbound: RpcClient, inbound: RpcRouter);
+    call(typeId: number, payload: unknown, signal?: AbortSignal): Promise<{
+        payload: unknown;
+        error?: import("../rpc/wire.js").RpcError;
+    }>;
+    notify(typeId: number, payload: unknown): Promise<void>;
+    onNotify(typeId: number, handler: (payload: unknown) => void): () => void;
+    close(): void;
+}
 type HandshakeMaterial = Readonly<{
     h3: Uint8Array;
     sessionPRK: Uint8Array;
@@ -62,7 +74,7 @@ export declare class SessionV2 implements SessionV2Contract {
     private readonly config;
     readonly path: PathKind;
     readonly endpointInstanceId: string | undefined;
-    readonly rpc: RpcClient;
+    readonly rpc: SessionRpcPeerV2;
     readonly termination: Promise<SessionTerminationV2>;
     readonly unreliableMessages: UnreliableMessageChannelV2 | undefined;
     terminalError: Error | undefined;
@@ -119,6 +131,7 @@ export declare class SessionV2 implements SessionV2Contract {
     private idleWatchdogStarted;
     private idleTimer;
     private readonly terminationState;
+    private readonly rpcRouter;
     constructor(carrier: CarrierSessionV2, control: CarrierStreamV2, controlReader: ExactReader, config: SessionConfigV2, material: HandshakeMaterial);
     openStream(kind: string, options?: InternalStreamOpenOptionsV2): Promise<ByteStreamV2>;
     acceptStream(options?: OperationOptionsV2): Promise<IncomingStreamV2>;

package/dist/v2/session.js

@@ -20,6 +20,26 @@ export class SessionV2Error extends Error {
         this.name = "SessionV2Error";
     }
 }
+class SessionRpcPeerV2 {
+    outbound;
+    inbound;
+    constructor(outbound, inbound) {
+        this.outbound = outbound;
+        this.inbound = inbound;
+    }
+    call(typeId, payload, signal) {
+        return this.outbound.call(typeId, payload, signal);
+    }
+    notify(typeId, payload) {
+        return this.outbound.notify(typeId, payload);
+    }
+    onNotify(typeId, handler) {
+        return this.inbound.onNotify(typeId, handler);
+    }
+    close() {
+        this.outbound.close();
+    }
+}
 export async function establishSessionV2(carrier, config, options = {}) {
     validateConfig(carrier, config);
     const establishDeadline = createSessionDeadline(config, "establish");
@@ -115,6 +135,7 @@ export class SessionV2 {
     idleWatchdogStarted = false;
     idleTimer;
     terminationState = deferred();
+    rpcRouter;
     constructor(carrier, control, controlReader, config, material) {
         this.carrier = carrier;
         this.control = control;
@@ -150,8 +171,9 @@ export class SessionV2 {
             : undefined;
         this.outboundPermits = new AsyncSemaphore(config.maxInboundStreams);
         this.inboundPermits = new AsyncSemaphore(config.maxInboundStreams);
+        this.rpcRouter = config.rpcRouter ?? new RpcRouter();
         const rpcReadState = { reader: undefined };
-        this.rpc = new RpcClient(async (length) => {
+        const rpcClient = new RpcClient(async (length) => {
             await this.rpcActivation.promise;
             const stream = await this.ensureRPCStream();
             rpcReadState.reader ??= new ExactReader(stream);
@@ -161,6 +183,7 @@ export class SessionV2 {
             const stream = await this.ensureRPCStream();
             await stream.write(payload);
         }, { onTerminal: (error) => this.fail(error) });
+        this.rpc = new SessionRpcPeerV2(rpcClient, this.rpcRouter);
     }
     async openStream(kind, options = {}) {
         if (kind === RESERVED_RPC_KIND)
@@ -495,7 +518,7 @@ export class SessionV2 {
                 readExactly: async (length) => await rpcReader.readExactly(length),
                 write: async (payload) => { await stream.write(payload); },
                 close: () => { void stream.reset(); },
-            }, this.config.rpcServerOptions, this.config.rpcRouter ?? new RpcRouter());
+            }, this.config.rpcServerOptions, this.rpcRouter);
             void server.serve().catch((error) => {
                 if (this.lifecycle !== "closed")
                     this.fail(asError(error));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "2.3.3",
+  "version": "2.3.5",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c94053cc-a443-5cf2-8417-f0399a407a0f",
+  "serialNumber": "urn:uuid:3400c69b-8cbe-5509-8b3e-e52a56f2135d",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "2.3.3",
-      "purl": "pkg:npm/%40floegence/flowersec-core@2.3.3",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.3.3"
+      "version": "2.3.5",
+      "purl": "pkg:npm/%40floegence/flowersec-core@2.3.5",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.3.5"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "fcd6271d40c202e8e93bf5d7f79a228360688ae574e876f9c0616d6efe5ef8ca"
+        "value": "0ab98241dfe33a677cf1e6726296a7db34a9f0a77e1eb4c9d21784b4581fccd1"
       }
     ]
   },
@@ -2290,7 +2290,7 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@2.3.3",
+      "ref": "pkg:npm/%40floegence/flowersec-core@2.3.5",
       "dependsOn": [
         "pkg:npm/%40fails-components/webtransport-transport-http3-quiche@1.6.7",
         "pkg:npm/%40fails-components/webtransport@1.6.7",

package/sbom/spdx.json

@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "flowersec-ts",
-  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/fcd6271d40c202e8e93bf5d7f79a228360688ae574e876f9c0616d6efe5ef8ca",
+  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/0ab98241dfe33a677cf1e6726296a7db34a9f0a77e1eb4c9d21784b4581fccd1",
   "creationInfo": {
     "created": "1970-01-01T00:00:00Z",
     "creators": [
@@ -13,19 +13,19 @@
   "packages": [
     {
       "name": "@floegence/flowersec-core",
-      "SPDXID": "SPDXRef-Package-17254d46a5f845d3133b",
-      "versionInfo": "2.3.3",
+      "SPDXID": "SPDXRef-Package-4c55f673934ca9f855ad",
+      "versionInfo": "2.3.5",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "NOASSERTION",
       "copyrightText": "NOASSERTION",
-      "comment": "Flowersec source inventory SHA-256: fcd6271d40c202e8e93bf5d7f79a228360688ae574e876f9c0616d6efe5ef8ca",
+      "comment": "Flowersec source inventory SHA-256: 0ab98241dfe33a677cf1e6726296a7db34a9f0a77e1eb4c9d21784b4581fccd1",
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@2.3.3"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@2.3.5"
         }
       ]
     },
@@ -1411,7 +1411,7 @@
     {
       "spdxElementId": "SPDXRef-DOCUMENT",
       "relationshipType": "DESCRIBES",
-      "relatedSpdxElement": "SPDXRef-Package-17254d46a5f845d3133b"
+      "relatedSpdxElement": "SPDXRef-Package-4c55f673934ca9f855ad"
     },
     {
       "spdxElementId": "SPDXRef-Package-789c0f508771e385c5e8",
@@ -1459,37 +1459,37 @@
       "relatedSpdxElement": "SPDXRef-Package-1a7f123f21a1eaf4fd69"
     },
     {
-      "spdxElementId": "SPDXRef-Package-17254d46a5f845d3133b",
+      "spdxElementId": "SPDXRef-Package-4c55f673934ca9f855ad",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-789c0f508771e385c5e8"
     },
     {
-      "spdxElementId": "SPDXRef-Package-17254d46a5f845d3133b",
+      "spdxElementId": "SPDXRef-Package-4c55f673934ca9f855ad",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-4b35e4821b43dc47a168"
     },
     {
-      "spdxElementId": "SPDXRef-Package-17254d46a5f845d3133b",
+      "spdxElementId": "SPDXRef-Package-4c55f673934ca9f855ad",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-24f128c8779cacb70e46"
     },
     {
-      "spdxElementId": "SPDXRef-Package-17254d46a5f845d3133b",
+      "spdxElementId": "SPDXRef-Package-4c55f673934ca9f855ad",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-6a42d288421aaee354ff"
     },
     {
-      "spdxElementId": "SPDXRef-Package-17254d46a5f845d3133b",
+      "spdxElementId": "SPDXRef-Package-4c55f673934ca9f855ad",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-d976986d5d79eddc7789"
     },
     {
-      "spdxElementId": "SPDXRef-Package-17254d46a5f845d3133b",
+      "spdxElementId": "SPDXRef-Package-4c55f673934ca9f855ad",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-f8b45a289df643042b94"
     },
     {
-      "spdxElementId": "SPDXRef-Package-17254d46a5f845d3133b",
+      "spdxElementId": "SPDXRef-Package-4c55f673934ca9f855ad",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-38fe7b92bdac2a86fb61"
     },