@floegence/flowersec-core 2.3.5 → 2.3.7

package/dist/node/webSocketServer.js

@@ -0,0 +1,135 @@
+import { createServer as createHTTPServer } from "node:http";
+import { createServer as createHTTPSServer } from "node:https";
+import { createRequire } from "node:module";
+import { isIP } from "node:net";
+import { createServerWebSocketCarrierSessionV2 } from "../transport/webSocketAdapter.js";
+import { WebSocketBinaryTransport } from "../ws-client/binaryTransport.js";
+import { defaultWsMaxPayload } from "./wsDefaults.js";
+export async function startNodeWebSocketServer(options) {
+    validateOptions(options);
+    const protocol = options.path === "direct" ? "flowersec.direct.v2" : "flowersec.tunnel.v2";
+    const endpoint = "/flowersec/v2/" + options.path;
+    const require = createRequire(import.meta.url);
+    const wsModule = require("ws");
+    const WebSocketServer = wsModule.WebSocketServer;
+    const server = options.tls === undefined
+        ? createHTTPServer()
+        : createHTTPSServer({ key: options.tls.privateKey, cert: options.tls.certificate, minVersion: "TLSv1.3", maxVersion: "TLSv1.3" });
+    const sessions = new SessionQueue();
+    const sockets = new Set();
+    const wss = new WebSocketServer({
+        noServer: true,
+        perMessageDeflate: false,
+        maxPayload: defaultWsMaxPayload({}),
+        handleProtocols(protocols) { return protocols.has(protocol) ? protocol : false; },
+    });
+    server.on("upgrade", (request, socket, head) => {
+        const origin = request.headers.origin;
+        const requested = request.headers["sec-websocket-protocol"];
+        const remote = request.socket.remoteAddress;
+        const local = request.socket.localAddress;
+        const plaintextAllowed = options.tls === undefined && options.path === "direct" && isLoopback(remote) && isLoopback(local);
+        if (request.url !== endpoint || typeof origin !== "string" || !options.allowedOrigins.includes(origin) || requested !== protocol || (options.tls === undefined && !plaintextAllowed)) {
+            socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+            socket.destroy();
+            return;
+        }
+        wss.handleUpgrade(request, socket, head, (webSocket) => wss.emit("connection", webSocket));
+    });
+    wss.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.once("close", () => sockets.delete(socket));
+        const transport = new WebSocketBinaryTransport(socket);
+        sessions.push(createServerWebSocketCarrierSessionV2(transport, {
+            path: options.path,
+            inboundBidirectionalStreamCapacity: options.inboundBidirectionalStreamCapacity,
+        }));
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port, options.host, resolve);
+    });
+    let closed = false;
+    return {
+        address() {
+            const address = server.address();
+            if (address === null || typeof address === "string")
+                throw new Error("Node WebSocket server is not listening");
+            return Object.freeze({ host: address.address, port: address.port });
+        },
+        async accept(acceptOptions = {}) { return await sessions.shift(acceptOptions.signal); },
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            sessions.close();
+            for (const socket of sockets)
+                socket.close();
+            wss.close();
+            await new Promise((resolve, reject) => server.close((error) => error === undefined ? resolve() : reject(error)));
+        },
+    };
+}
+function validateOptions(options) {
+    if (!Number.isInteger(options.port) || options.port < 0 || options.port > 65_535 || options.allowedOrigins.length === 0) {
+        throw new TypeError("invalid Node WebSocket listener options");
+    }
+    if (options.tls === undefined && (options.path !== "direct" || !isLoopback(options.host))) {
+        throw new TypeError("plaintext WebSocket is restricted to direct loopback listeners");
+    }
+}
+function isLoopback(address) {
+    if (address === undefined)
+        return false;
+    if (address === "::1")
+        return true;
+    if (isIP(address) === 4)
+        return address.startsWith("127.");
+    return address.toLowerCase().startsWith("::ffff:127.");
+}
+class SessionQueue {
+    values = [];
+    waiters = new Set();
+    closed = false;
+    push(value) {
+        if (this.closed) {
+            void value.close();
+            return;
+        }
+        const waiter = this.waiters.values().next().value;
+        if (waiter === undefined)
+            this.values.push(value);
+        else {
+            this.waiters.delete(waiter);
+            waiter.resolve(value);
+        }
+    }
+    async shift(signal) {
+        if (signal?.aborted === true)
+            throw new Error("accept canceled");
+        const value = this.values.shift();
+        if (value !== undefined)
+            return value;
+        if (this.closed)
+            throw new Error("WebSocket listener is closed");
+        return await new Promise((resolve, reject) => {
+            const waiter = { resolve: (session) => { cleanup(); resolve(session); }, reject };
+            const abort = () => { this.waiters.delete(waiter); reject(new Error("accept canceled")); };
+            const cleanup = () => signal?.removeEventListener("abort", abort);
+            this.waiters.add(waiter);
+            signal?.addEventListener("abort", abort, { once: true });
+        });
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        const error = new Error("WebSocket listener is closed");
+        for (const waiter of this.waiters)
+            waiter.reject(error);
+        this.waiters.clear();
+        for (const value of this.values)
+            void value.close();
+        this.values.length = 0;
+    }
+}

package/dist/public/contract.d.ts

@@ -14,7 +14,7 @@ export type UnreliableMessageSendOptions = OperationOptions & Readonly<{
 }>;
 export type UnreliableMessageSendResult = "accepted" | "dropped_budget" | "dropped_expired" | "dropped_carrier";
 export interface UnreliableMessageChannel {
-    readonly maxMessageSize: 976;
+    readonly maxMessageSize: number;
     send(message: Uint8Array, options: UnreliableMessageSendOptions): Promise<UnreliableMessageSendResult>;
     receive(options?: OperationOptions): Promise<Uint8Array>;
 }
@@ -42,8 +42,8 @@ export type RpcResult<Response = unknown> = Readonly<{
     }>;
 }>;
 export interface RpcPeer {
-    call<Request = unknown, Response = unknown>(typeId: number, payload: Request, decodeResponse: (payload: JsonValue) => Response, signal?: AbortSignal): Promise<RpcResult<Response>>;
-    notify<Payload = unknown>(typeId: number, payload: Payload): Promise<void>;
+    call<Request = unknown, Response = unknown>(typeId: number, payload: Request, decodeResponse: (payload: JsonValue) => Response, options?: OperationOptions): Promise<RpcResult<Response>>;
+    notify<Payload = unknown>(typeId: number, payload: Payload, options?: OperationOptions): Promise<void>;
     onNotify<Payload = unknown>(typeId: number, handler: (payload: Payload) => void): () => void;
 }
 export interface ByteStream {
@@ -71,6 +71,7 @@ export interface Session {
     rekey(options?: OperationOptions): Promise<void>;
     probeLiveness(options?: OperationOptions): Promise<number>;
     waitTermination(): Promise<SessionTermination>;
+    waitTermination(options: OperationOptions): Promise<SessionTermination>;
     close(): Promise<void>;
 }
 export type RetryDisposition = Readonly<{

package/dist/transport/webSocketAdapter.d.ts

@@ -6,6 +6,7 @@ export type WebSocketBinaryTransportV2 = Readonly<{
         timeoutMs?: number;
     }>): Promise<Uint8Array>;
     writeBinary(data: Uint8Array, options?: OperationOptionsV2): Promise<void>;
+    flush(options?: OperationOptionsV2): Promise<void>;
     close(): void;
 }>;
 export type WebSocketResourcePolicyV2 = Readonly<{
@@ -22,3 +23,9 @@ export declare function createWebSocketCarrierSessionV2(transport: WebSocketBina
     inboundBidirectionalStreamCapacity: number;
     resourcePolicy?: WebSocketResourcePolicyV2;
 }>): CarrierSessionV2;
+export declare function createServerWebSocketCarrierSessionV2(transport: WebSocketBinaryTransportV2, options: Readonly<{
+    path: PathKind;
+    inboundBidirectionalStreamCapacity: number;
+    resourcePolicy?: WebSocketResourcePolicyV2;
+}>): CarrierSessionV2;
+export declare function configureServerWebSocketCarrierRoleV2(carrier: CarrierSessionV2, client: boolean): void;

package/dist/transport/webSocketAdapter.js

@@ -3,7 +3,139 @@ import { CarrierError } from "../v2/carrier.js";
 export function createWebSocketCarrierSessionV2(transport, options) {
     return new WebSocketYamuxCarrierSession(transport, options);
 }
+export function createServerWebSocketCarrierSessionV2(transport, options) {
+    requireCapacity(options.inboundBidirectionalStreamCapacity);
+    const carrier = new ServerWebSocketAdmissionCarrier(transport, options);
+    serverAdmissionCarriers.set(carrier, carrier);
+    return carrier;
+}
+const serverAdmissionCarriers = new WeakMap();
+export function configureServerWebSocketCarrierRoleV2(carrier, client) {
+    const server = serverAdmissionCarriers.get(carrier);
+    if (server === undefined)
+        throw new CarrierError("closed", "WebSocket carrier is not a server admission carrier");
+    server.configureRole(client);
+}
+class ServerWebSocketAdmissionCarrier {
+    transport;
+    options;
+    kind = "websocket";
+    path;
+    inboundBidirectionalStreamCapacity;
+    unreliableDatagrams = undefined;
+    admissionAvailable = true;
+    active;
+    closed = false;
+    client = false;
+    constructor(transport, options) {
+        this.transport = transport;
+        this.options = options;
+        this.path = options.path;
+        this.inboundBidirectionalStreamCapacity = options.inboundBidirectionalStreamCapacity;
+    }
+    async openStream(options = {}) {
+        return await this.activate().openStream(options);
+    }
+    async acceptStream(options = {}) {
+        throwIfAborted(options.signal);
+        if (this.closed)
+            throw new CarrierError("closed", "WebSocket carrier is closed");
+        if (this.admissionAvailable) {
+            this.admissionAvailable = false;
+            return new WebSocketAdmissionStream(this.transport);
+        }
+        return await this.activate().acceptStream(options);
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        if (this.active === undefined)
+            this.transport.close();
+        else
+            await this.active.close();
+    }
+    abort() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        if (this.active === undefined)
+            this.transport.close();
+        else
+            this.active.abort();
+    }
+    async waitTermination() {
+        if (this.closed && this.active === undefined)
+            return;
+        await this.activate().waitTermination();
+    }
+    configureRole(client) {
+        if (this.closed || this.active !== undefined)
+            throw new CarrierError("closed", "WebSocket carrier is already active");
+        this.client = client;
+    }
+    activate() {
+        if (this.closed)
+            throw new CarrierError("closed", "WebSocket carrier is closed");
+        if (this.admissionAvailable) {
+            throw new CarrierError("closed", "WebSocket admission has not completed");
+        }
+        this.active ??= createWebSocketCarrierSessionV2(this.transport, {
+            path: this.options.path,
+            client: this.client,
+            inboundBidirectionalStreamCapacity: this.options.inboundBidirectionalStreamCapacity,
+            ...(this.options.resourcePolicy === undefined ? {} : { resourcePolicy: this.options.resourcePolicy }),
+        });
+        return this.active;
+    }
+}
+class WebSocketAdmissionStream {
+    transport;
+    readComplete = false;
+    writeComplete = false;
+    outbound = [];
+    constructor(transport) {
+        this.transport = transport;
+    }
+    async read(options = {}) {
+        if (this.readComplete)
+            return null;
+        this.readComplete = true;
+        return await this.transport.readBinary(options);
+    }
+    async write(data, options = {}) {
+        throwIfAborted(options.signal);
+        if (this.writeComplete)
+            throw new CarrierError("write_closed", "admission response is closed");
+        this.outbound.push(data.slice());
+        return data.length;
+    }
+    async closeWrite() {
+        if (this.writeComplete)
+            return;
+        this.writeComplete = true;
+        const length = this.outbound.reduce((total, chunk) => total + chunk.length, 0);
+        const response = new Uint8Array(length);
+        let offset = 0;
+        for (const chunk of this.outbound) {
+            response.set(chunk, offset);
+            offset += chunk.length;
+        }
+        this.outbound.length = 0;
+        await this.transport.writeBinary(response);
+    }
+    async stopSending() {
+        this.transport.close();
+    }
+    async reset() {
+        this.transport.close();
+    }
+    abort() {
+        this.transport.close();
+    }
+}
 class WebSocketYamuxCarrierSession {
+    transport;
     kind = "websocket";
     path;
     inboundBidirectionalStreamCapacity;
@@ -14,6 +146,7 @@ class WebSocketYamuxCarrierSession {
     terminalError;
     closed = false;
     constructor(transport, options) {
+        this.transport = transport;
         requireCapacity(options.inboundBidirectionalStreamCapacity);
         this.path = options.path;
         this.inboundBidirectionalStreamCapacity = options.inboundBidirectionalStreamCapacity;
@@ -60,6 +193,9 @@ class WebSocketYamuxCarrierSession {
         return await this.incoming.shift(options.signal);
     }
     async close() {
+        if (this.closed)
+            return;
+        await this.transport.flush().catch(() => undefined);
         this.closeLocally();
     }
     abort() {

package/dist/v2/artifact.js

@@ -1,4 +1,4 @@
-import { sha256 } from "@noble/hashes/sha256";
+import { sha256 } from "@noble/hashes/sha2.js";
 import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
 import { concatBytes, readU32be, u32be } from "../utils/bin.js";
 import { toASCII } from "../vendor/tr46.js";

package/dist/v2/capability.js

@@ -1,4 +1,4 @@
-import { sha256 } from "@noble/hashes/sha256";
+import { sha256 } from "@noble/hashes/sha2.js";
 const encoder = new TextEncoder();
 const carriers = Object.freeze(["raw_quic", "websocket", "webtransport"]);
 const registryToken = /^[a-z][a-z0-9_]{0,127}$/;

package/dist/v2/carrier.d.ts

@@ -63,7 +63,10 @@ export type NativeCarrierSessionV2 = Readonly<{
     openStream(options?: OperationOptionsV2): Promise<NativeCarrierStreamV2>;
     acceptStream(options?: OperationOptionsV2): Promise<NativeCarrierStreamV2>;
     waitTermination(): Promise<void>;
-    close(): Promise<void>;
+    close(error?: Readonly<{
+        code: number;
+        reason: string;
+    }>): Promise<void>;
     /** See {@link CarrierSessionV2.abort}. */
     abort(error?: Readonly<{
         code: number;

package/dist/v2/carrier.js

@@ -335,8 +335,8 @@ class NativeCarrierSessionAdapter {
     async waitTermination() {
         await this.native.waitTermination();
     }
-    async close() {
-        await this.native.close();
+    async close(error) {
+        await this.native.close(error);
     }
     abort(error) {
         this.native.abort(error);

package/dist/v2/handshake.js

@@ -1,8 +1,8 @@
-import { x25519 } from "@noble/curves/ed25519";
-import { p256 } from "@noble/curves/p256";
-import { expand, extract } from "@noble/hashes/hkdf";
-import { hmac } from "@noble/hashes/hmac";
-import { sha256 } from "@noble/hashes/sha256";
+import { x25519 } from "@noble/curves/ed25519.js";
+import { p256 } from "@noble/curves/nist.js";
+import { expand, extract } from "@noble/hashes/hkdf.js";
+import { hmac } from "@noble/hashes/hmac.js";
+import { sha256 } from "@noble/hashes/sha2.js";
 import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
 import { concatBytes, readU32be, u32be } from "../utils/bin.js";
 import { CipherSuiteV2, ProtocolV2Error } from "./protocol.js";
@@ -187,7 +187,7 @@ export function generateEphemeralKeyV2(suite, entropy) {
     else if (suite === CipherSuiteV2.AES256GCM) {
         do
             privateKey = requireEntropy(entropy, 32);
-        while (!p256.utils.isValidPrivateKey(privateKey));
+        while (!p256.utils.isValidSecretKey(privateKey));
     }
     else {
         return invalidSuite();
@@ -353,7 +353,7 @@ function validateEphemeralPublic(suite, value) {
         if (suite === CipherSuiteV2.AES256GCM) {
             if (value.length !== 65 || value[0] !== 4)
                 throw new Error("invalid P-256 public key");
-            p256.ProjectivePoint.fromHex(value);
+            p256.Point.fromBytes(value);
             return;
         }
     }

package/dist/v2/protocol.js

@@ -1,8 +1,8 @@
-import { gcm } from "@noble/ciphers/aes";
-import { chacha20poly1305 } from "@noble/ciphers/chacha";
-import { expand } from "@noble/hashes/hkdf";
-import { hmac } from "@noble/hashes/hmac";
-import { sha256 } from "@noble/hashes/sha256";
+import { gcm } from "@noble/ciphers/aes.js";
+import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
+import { expand } from "@noble/hashes/hkdf.js";
+import { hmac } from "@noble/hashes/hmac.js";
+import { sha256 } from "@noble/hashes/sha2.js";
 const encoder = new TextEncoder();
 const MAX_UINT32 = 0xffffffff;
 const MAX_UINT64 = (1n << 64n) - 1n;

package/dist/v2/publicSession.js

@@ -48,9 +48,14 @@ export function projectSessionV2(session) {
                 throw redactSessionError(error);
             }
         },
-        async waitTermination() {
-            const { error } = await session.waitTermination();
-            return Object.freeze({ error: redactSessionError(error) });
+        async waitTermination(options) {
+            try {
+                const { error } = await raceWithSignal(session.waitTermination(), options?.signal);
+                return Object.freeze({ error: redactSessionError(error) });
+            }
+            catch (error) {
+                throw redactSessionError(error);
+            }
         },
         async close() {
             try {
@@ -112,9 +117,9 @@ function projectByteStreamV2(stream) {
 }
 function projectRpcPeerV2(peer) {
     return Object.freeze({
-        async call(typeId, payload, decodeResponse, signal) {
+        async call(typeId, payload, decodeResponse, options) {
             try {
-                const result = await peer.call(typeId, payload, signal);
+                const result = await peer.call(typeId, payload, options?.signal);
                 if (result.error !== undefined) {
                     return Object.freeze({ ok: false, error: Object.freeze({ ...result.error }) });
                 }
@@ -124,9 +129,11 @@ function projectRpcPeerV2(peer) {
                 throw redactSessionError(error);
             }
         },
-        async notify(typeId, payload) {
+        async notify(typeId, payload, options) {
             try {
-                await peer.notify(typeId, payload);
+                if (options?.signal?.aborted)
+                    throw options.signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+                await raceWithSignal(peer.notify(typeId, payload), options?.signal);
             }
             catch (error) {
                 throw redactSessionError(error);
@@ -137,6 +144,17 @@ function projectRpcPeerV2(peer) {
         },
     });
 }
+async function raceWithSignal(operation, signal) {
+    if (signal === undefined)
+        return await operation;
+    if (signal.aborted)
+        throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+    return await new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason ?? new DOMException("The operation was aborted", "AbortError"));
+        signal.addEventListener("abort", abort, { once: true });
+        void operation.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
 function redactSessionError(error) {
     if (error instanceof SessionError)
         return error;

package/dist/v2/retryDisposition.js

@@ -9,9 +9,9 @@ export function retryDispositionForConnectError(error) {
         case "rpc_failed":
         case "resource_exhausted":
         case "not_connected":
-            return { kind: "retryable" };
+            return Object.freeze({ kind: "retryable" });
         default:
-            return { kind: "terminal" };
+            return Object.freeze({ kind: "terminal" });
     }
 }
 export function retryDispositionForSessionError(error) {
@@ -23,8 +23,8 @@ export function retryDispositionForSessionError(error) {
         case "stream_reset":
         case "rekey_failed":
         case "liveness_failed":
-            return { kind: "retryable" };
+            return Object.freeze({ kind: "retryable" });
         default:
-            return { kind: "terminal" };
+            return Object.freeze({ kind: "terminal" });
     }
 }

package/dist/v2/session.d.ts

@@ -46,8 +46,8 @@ export type SessionProtocolRuntimeV2 = Readonly<{
     monotonicMilliseconds(): number;
 }>;
 export declare class SessionV2Error extends Error {
-    readonly code: "aborted" | "closed" | "going_away" | "handshake" | "open_rejected" | "protocol" | "resource_exhausted" | "timeout";
-    constructor(code: "aborted" | "closed" | "going_away" | "handshake" | "open_rejected" | "protocol" | "resource_exhausted" | "timeout", message: string);
+    readonly code: "aborted" | "closed" | "going_away" | "handshake" | "open_rejected" | "protocol" | "resource_exhausted" | "stream_reset" | "timeout";
+    constructor(code: "aborted" | "closed" | "going_away" | "handshake" | "open_rejected" | "protocol" | "resource_exhausted" | "stream_reset" | "timeout", message: string);
 }
 declare class SessionRpcPeerV2 implements InternalRpcPeerV2 {
     private readonly outbound;

package/dist/v2/session.js

@@ -305,7 +305,6 @@ export class SessionV2 {
     async localReset(stream, error) {
         if (!stream.markTerminal(error))
             return;
-        await stream.carrier.reset().catch(() => undefined);
         try {
             await this.sendControl(InnerTypeV2.StreamReset, idReason(stream.id, 6));
             this.commitLocalReset(stream.id);
@@ -313,6 +312,7 @@ export class SessionV2 {
         catch (cause) {
             this.fail(asError(cause));
         }
+        await stream.carrier.reset().catch(() => undefined);
         this.releaseStream(stream);
     }
     releaseStream(stream) {
@@ -599,7 +599,7 @@ export class SessionV2 {
                         const { id, reason } = parseIDReason(record.payload);
                         if (id === 0n || reason === 0)
                             throw protocolError("invalid STREAM_RESET");
-                        this.streams.get(id)?.peerReset(new SessionV2Error("closed", "logical stream reset by peer"));
+                        this.streams.get(id)?.peerReset(new SessionV2Error("stream_reset", "logical stream reset by peer"));
                         if (this.isLocalLogicalID(id)) {
                             this.outboundLedger.peerReset(id);
                             this.notifyOutboundFrontierChanged();
@@ -1086,7 +1086,7 @@ class EncryptedStreamV2 {
         });
     }
     async reset() {
-        await this.session.localReset(this, new SessionV2Error("closed", "logical stream reset"));
+        await this.session.localReset(this, new SessionV2Error("stream_reset", "logical stream reset"));
     }
     async close() {
         await this.reset();

package/dist/v2/unreliableMessage.js

@@ -1,7 +1,7 @@
-import { gcm } from "@noble/ciphers/aes";
-import { chacha20poly1305 } from "@noble/ciphers/chacha";
-import { expand } from "@noble/hashes/hkdf";
-import { sha256 } from "@noble/hashes/sha256";
+import { gcm } from "@noble/ciphers/aes.js";
+import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
+import { expand } from "@noble/hashes/hkdf.js";
+import { sha256 } from "@noble/hashes/sha2.js";
 import { CipherSuiteV2 } from "./protocol.js";
 import { UnreliableMessageError } from "../public/contract.js";
 export const UNRELIABLE_MESSAGES_FEATURE_V2 = 0x00000001;

package/dist/vendor/tr46.js

@@ -5,7 +5,14 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __esmMin = (fn, res, err) => () => {
+	if (err) throw err[0];
+	try {
+		return fn && (res = fn(fn = 0)), res;
+	} catch (e) {
+		throw err = [e], e;
+	}
+};
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __exportAll = (all, no_symbols) => {
 	let target = {};
@@ -26,7 +33,7 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
@@ -135,7 +142,7 @@ var init_punycode_es6 = __esmMin((() => {
 		"not-basic": "Illegal input >= 0x80 (not a basic code point)",
 		"invalid-input": "Invalid input"
 	};
-	baseMinusTMin = base - tMin;
+	baseMinusTMin = 35;
 	floor = Math.floor;
 	stringFromCharCode = String.fromCharCode;
 	ucs2encode = (codePoints) => String.fromCodePoint(...codePoints);
@@ -348,9 +355,7 @@ var import_tr46 = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((expor
 					if (transitionalProcessing) processed += mapping;
 					else processed += ch;
 					break;
-				case STATUS_MAPPING.valid:
-					processed += ch;
-					break;
+				case STATUS_MAPPING.valid: processed += ch;
 			}
 		}
 		return processed;

package/dist/ws-client/binaryTransport.d.ts

@@ -46,6 +46,9 @@ export declare class WebSocketBinaryTransport {
     writeBinary(frame: Uint8Array, opts?: Readonly<{
         signal?: AbortSignal;
     }>): Promise<void>;
+    flush(opts?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<void>;
     close(): void;
     private handleMessage;
     private readonly onMessage;

package/dist/ws-client/binaryTransport.js

@@ -143,6 +143,20 @@ export class WebSocketBinaryTransport {
         this.writeChain = write.catch(() => { });
         await write;
     }
+    async flush(opts = {}) {
+        throwIfAborted(opts.signal, "flush aborted");
+        await this.writeChain;
+        const startedAt = Date.now();
+        while (this.ws.bufferedAmount > 0) {
+            throwIfAborted(opts.signal, "flush aborted");
+            if (this.error != null)
+                throw this.error;
+            if (Date.now() - startedAt >= this.limits.outboundDrainTimeoutMs) {
+                throw new TimeoutError("ws send buffer drain timeout");
+            }
+            await new Promise((resolve) => setTimeout(resolve, 10));
+        }
+    }
     // close tears down listeners and rejects pending readers.
     close() {
         if (!this.localCloseRequested) {