@floegence/flowersec-core 2.3.6 → 2.3.8

package/README.md

@@ -1,20 +1,21 @@
 # Flowersec for TypeScript
 
-`@floegence/flowersec-core` is the ESM-only Flowersec v2 SDK for browsers and Node.js. Its public package surface is limited to the root, `/browser`, `/node`, and `/proxy` entrypoints.
-
-Flowersec 2.3.6 is the published TypeScript SDK release.
+`@floegence/flowersec-core` is the ESM-only Flowersec SDK for browsers and
+Node.js. It gives both runtimes the same encrypted session, RPC, notification,
+and byte-stream API through the root, `/browser`, `/node`, and `/proxy`
+entrypoints.
 
 ## Install
 
 ```bash
-npm install @floegence/flowersec-core@2.3.6
+npm install @floegence/flowersec-core
 ```
 
 ## Public API
 
 - `@floegence/flowersec-core` exports the portable artifact, lease, session, stream, RPC, stream-metadata, and connection-controller API, plus profile-owned unreliable messages when negotiated.
 - `@floegence/flowersec-core/browser` adds `connect(...)`, `createConnectionController(...)`, and their options.
-- `@floegence/flowersec-core/node` adds `connect(...)`, `createConnectionController(...)`, `createAcceptor(...)`, `SessionHandlers`, and `AcceptedSession`.
+- `@floegence/flowersec-core/node` adds `connect(...)`, `createConnectionController(...)`, direct-only `createAcceptor(...)`, opaque `createTunnelRuntime(...)`, `SessionHandlers`, `AcceptedSession`, `Issuer`, authorization record/request/response types, `authorizeRuntime(...)`, `authorizeTunnelRuntime(...)`, and `ProxyServer`.
 - `@floegence/flowersec-core/proxy` adds the `Session`-based HTTP/WebSocket runtime, Service Worker and controller/app-window bridges, strict `proxy.runtime@2` validation, and `connectProxyBrowser(...)` composition.
 
 The root type exports are:
@@ -38,7 +39,7 @@ The Browser and Node `connect(...)` operations are one-shot and never reconnect.
 
 The controller has one scheduler and one in-flight attempt. Its states are `idle`, `connecting`, `connected`, `waiting`, `failed`, and `closed`; immutable snapshots expose `ConnectionSnapshot.retryDisposition` while the corresponding retry decision applies and clear it before a new attempt, after connection, and on close. Call `start()` once, observe snapshots with `subscribe(...)`, await an established session with `waitForSession(...)`, and use `retryNow()` only to wake a `waiting` controller. `close()` cancels acquisition, connection, and waiting before closing the current session.
 
-Node `SessionHandlers` accept application stream kinds whose UTF-8 encoding is 1 through 255 bytes and reserve `flowersec.rpc.v2` for Flowersec RPC. `AcceptedSession.serve(...)` closes successfully handled streams. A rejected handler Promise resets then closes only that stream; the accept loop and unrelated streams continue.
+Node `SessionHandlers` accept application stream kinds whose UTF-8 encoding is 1 through 255 bytes and reserve `flowersec.rpc.v2` for Flowersec RPC. `AcceptedSession.serve(...)` half-closes successfully handled streams. A rejected handler Promise resets only that stream; the accept loop and unrelated streams continue.
 
 Source failures return a structured `terminal`, `retryable`, or `retry_after` disposition. Thrown or malformed source failures are terminal. Retry delay is deterministic exponential backoff from 250 ms, doubling to a 30-second maximum with no jitter; `retry_after` is never attempted before its specified Unix-millisecond boundary. Attempts are unlimited unless `maximumAttempts` is explicitly set.
 
@@ -46,25 +47,22 @@ A newly established session replaces `currentSession` atomically. The controller
 
 A negotiated `Session.unreliableMessages` channel sends defensively copied `Uint8Array` values and returns `accepted`, `dropped_expired`, `dropped_budget`, or `dropped_carrier`. `receive(...)` also returns a fresh `Uint8Array`. Invalid payloads, unavailable channels, cancellation, closure, and internal failures remain redacted public operation errors.
 
-## Capability Layers
-
-The portable core is the same application model used by every Flowersec SDK:
-opaque artifact parsing, a durable single-use lease, one-shot connection,
-carrier-neutral sessions, RPC, reliable streams, redacted public errors, and
-the optional single-owner `ConnectionController`. Callers should not compare
-raw TypeScript error-code strings with other SDKs.
-
-Portable core, connection control, session/RPC/stream lifecycle, accepted-session
-workflows, and published consumer workflows align across every applicable SDK.
-Platform-limited profiles are unsupported only with an explicit alternative
-boundary and executable test ID in `stability/language_capabilities.json`.
-
-The TypeScript SDK profile is split by entrypoint: browsers own WebSocket and
-WebTransport dialing, while Node.js owns WebSocket and WebTransport dialing through
-the native `@fails-components/webtransport` adapter. Its language convenience
-includes static generic RPC result typing, notification subscriptions, and
-proxy composition. These conveniences do not expand the
-portable core required from Go, Swift, or Rust.
+## Supported Connections
+
+Browsers support WebSocket. Browser WebTransport is capability-dependent on
+the browser's WebTransport API and is an optional browser adapter, not a
+required native-server carrier. Through
+`/node`, Node.js supports WebSocket and raw QUIC client connections, direct
+server sessions, and opaque `TunnelRuntime` relay legs. Raw QUIC uses the
+Flowersec-owned optional native addon wrapper and one of its supported
+prebuilt platform packages; it never loads from the browser entrypoint. The
+wrapper selects the matching optional package for macOS arm64/x64 or Linux
+arm64/x64 glibc. Windows and musl packages are not published. The same Node entrypoint provides the
+control plane and `ProxyServer`, and the relay never terminates an E2EE
+Session. WebTransport is an optional adapter profile and the Node.js runtime
+does not currently expose a production adapter.
+The `/proxy` entrypoint adds browser bridges for applications that need to keep
+the session behind a Service Worker or another window.
 
 ## Opaque Boundaries
 
@@ -72,35 +70,31 @@ portable core required from Go, Swift, or Rust.
 
 `ConnectError` and `SessionError` expose only a closed `code`. They do not retain raw causes, credentials, URLs, candidate diagnostics, transport objects, peer details, or internal routing and handshake state.
 
-Candidate lists, runtime capability descriptors, transport factories, admission state, Yamux, wire messages, cryptographic state, keys, and spend-ledger internals are not package exports.
+Connection negotiation and cryptographic state are not package exports.
 
 Admission rejection reasons are server-authorized bounded protocol tokens. Clients validate their wire form without carrying a deployment-specific reason registry; the public error boundary remains closed and redacted.
 
-The proxy entrypoint accepts an opaque `ArtifactLease` or an already connected `Session`. Its public runtime never exposes the selected carrier, a Yamux stream, raw artifact fields, or proxy wire frames. Cross-window bridges require an exact allowed origin and may require a bounded capability nonce; runtime failures are mapped to closed status/code values before reaching Service Worker or Window messages.
-
-## Transport v2 Support
+The proxy entrypoint accepts an opaque `ArtifactLease` or an already connected `Session`. Cross-window bridges require an exact allowed origin and may require a bounded capability nonce; runtime failures are mapped to closed status/code values before reaching Service Worker or Window messages.
 
-WebSocket, raw QUIC, and WebTransport are equal carrier candidates. Browser and Node.js support below describes this SDK's profiles, not the portable API.
+## Connection Notes
 
-Raw QUIC and WebTransport preserve native FIN, RESET_STREAM, STOP_SENDING, flow control, and migration behavior. The TypeScript SDK support below is narrower than the protocol carrier set.
-
-WebSocket uses Yamux only inside its carrier adapter. Yamux has no independent STOP_SENDING primitive, so that operation is explicitly unavailable rather than emulated with a full stream reset.
-
-Browser applications receive a ready `Session` from `connect(...)`. The browser connector supports WSS, restricted plaintext loopback WebSocket direct connections, and WebTransport. WebTransport uses native HTTP/3 bidirectional streams and does not use Yamux.
+Browser applications receive a ready `Session` from `connect(...)`. The browser
+connector supports WSS, restricted plaintext loopback WebSocket direct
+connections, and WebTransport when the browser exposes that API. WebTransport
+uses browser-owned HTTP/3 streams and is not available in the Node entrypoint.
 
 Chromium does not support a WebTransport pooling option; each carrier creates an independent native WebTransport connection.
 
 Cold-connection diagnostics require every independent carrier to meet the declared deadline. A `dial_failed` result remains a test failure and is not hidden by pooling, retry, or timeout relaxation.
 
-Node.js applications receive the same `Session` contract from `connect(...)`. The Node.js connector supports WSS and WebTransport for direct and tunnel artifacts, plus restricted plaintext loopback WebSocket direct connections. It requires an absolute HTTP(S) `origin`; a custom certificate authority can be supplied through `tls.ca`. Invalid origin and TLS options fail as `ConnectError` with `invalid_options` and are terminal to the optional connection controller.
-
-The Node WebTransport direct listener/server is owned by the Node runtime and the `flowersec-ts-cli` server path. It uses the same native carrier acceptor and session engine as the client connector; it is not a second protocol implementation.
-
-The connectors select an eligible transport from the opaque artifact internally. They do not accept a public transport selector, capability manifest, candidate factory, or admission-reason override. Unsupported artifacts fail closed. The TypeScript package does not expose raw QUIC dialing.
-
-Transport v2 production carrier support: browsers support WebSocket and WebTransport; Node.js supports WebSocket and WebTransport dialing for direct clients and both tunnel roles. Node WebTransport uses the pinned native quiche adapter and is covered by a real admission/session integration test without Playwright.
+Node.js applications receive the same `Session` contract from `connect(...)`.
+The Node connector supports WSS, restricted plaintext loopback WebSocket
+direct connections, and raw QUIC through the optional native package. It
+requires an absolute HTTP(S) `origin`; custom certificate authorities can be
+supplied through `tls.ca`, and raw QUIC requires explicit trust roots.
 
-Flowersec disables application 0-RTT. Reliable streams never use QUIC DATAGRAM; runtimes with negotiated native DATAGRAM expose it only through carrier-neutral unreliable messages.
+The connectors choose an eligible connection path from the invitation. They do
+not expose transport selectors, candidate lists, or native carrier objects to application code.
 
 ## Verify
 

package/THIRD_PARTY_NOTICES.md

@@ -3,87 +3,12 @@
 This file is generated from the canonical Flowersec source dependency inventory for flowersec-ts.
 Do not edit it manually. License decisions are reviewed by the repository source license policy.
 
-- @fails-components/webtransport 1.6.7 (Declared: BSD-3-Clause; selected: BSD-3-Clause; source: https://registry.npmjs.org/@fails-components/webtransport/-/webtransport-1.6.7.tgz)
-- @fails-components/webtransport-transport-http3-quiche 1.6.7 (Declared: BSD-3-Clause; selected: BSD-3-Clause; source: https://registry.npmjs.org/@fails-components/webtransport-transport-http3-quiche/-/webtransport-transport-http3-quiche-1.6.7.tgz)
-- @isaacs/fs-minipass 4.0.1 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz)
-- @noble/ciphers 0.6.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/ciphers/-/ciphers-0.6.0.tgz)
-- @noble/curves 1.9.7 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/curves/-/curves-1.9.7.tgz)
-- @noble/hashes 1.8.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz)
-- @types/debug 4.1.13 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz)
-- @types/ms 2.1.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz)
-- ansi-regex 5.0.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz)
-- ansi-styles 4.3.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz)
-- base64-js 1.5.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz)
-- bindings 1.5.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz)
-- bl 4.1.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/bl/-/bl-4.1.0.tgz)
-- buffer 5.7.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz)
-- chownr 1.1.4 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz)
-- chownr 3.0.0 (Declared: BlueOak-1.0.0; selected: BlueOak-1.0.0; source: https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz)
-- cliui 8.0.1 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz)
-- cmake-js 8.0.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/cmake-js/-/cmake-js-8.0.0.tgz)
-- color-convert 2.0.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz)
-- color-name 1.1.4 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz)
-- debug 4.4.3 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/debug/-/debug-4.4.3.tgz)
-- decompress-response 6.0.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz)
-- deep-extend 0.6.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz)
-- detect-libc 2.1.2 (Declared: Apache-2.0; selected: Apache-2.0; source: https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz)
-- emoji-regex 8.0.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz)
-- end-of-stream 1.4.5 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz)
-- escalade 3.2.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz)
-- expand-template 2.0.3 (Declared: MIT OR WTFPL; selected: MIT; source: https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz)
-- file-uri-to-path 1.0.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz)
-- fs-constants 1.0.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz)
-- fs-extra 11.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/fs-extra/-/fs-extra-11.4.0.tgz)
-- get-caller-file 2.0.5 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz)
-- github-from-package 0.0.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz)
-- graceful-fs 4.2.11 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz)
-- ieee754 1.2.1 (Declared: BSD-3-Clause; selected: BSD-3-Clause; source: https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz)
-- inherits 2.0.4 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz)
-- ini 1.3.8 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/ini/-/ini-1.3.8.tgz)
-- is-fullwidth-code-point 3.0.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz)
-- isexe 4.0.0 (Declared: BlueOak-1.0.0; selected: BlueOak-1.0.0; source: https://registry.npmjs.org/isexe/-/isexe-4.0.0.tgz)
-- jsonfile 6.2.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz)
-- mimic-response 3.1.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz)
-- minimist 1.2.8 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz)
-- minipass 7.1.3 (Declared: BlueOak-1.0.0; selected: BlueOak-1.0.0; source: https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz)
-- minizlib 3.1.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz)
-- mkdirp-classic 0.5.3 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz)
-- ms 2.1.3 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/ms/-/ms-2.1.3.tgz)
-- napi-build-utils 2.0.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz)
-- node-abi 3.94.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/node-abi/-/node-abi-3.94.0.tgz)
-- node-addon-api 7.1.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz)
-- node-api-headers 1.9.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/node-api-headers/-/node-api-headers-1.9.0.tgz)
-- once 1.4.0 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/once/-/once-1.4.0.tgz)
-- prebuild-install 7.1.3 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz)
-- pump 3.0.4 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/pump/-/pump-3.0.4.tgz)
+- @noble/ciphers 2.3.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.3.0.tgz)
+- @noble/curves 2.3.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/curves/-/curves-2.3.0.tgz)
+- @noble/hashes 2.3.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/hashes/-/hashes-2.3.0.tgz)
 - punycode 2.3.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz)
-- rc 1.2.8 (Declared: BSD-2-Clause OR MIT OR Apache-2.0; selected: MIT; source: https://registry.npmjs.org/rc/-/rc-1.2.8.tgz)
-- readable-stream 3.6.2 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz)
-- require-directory 2.1.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz)
-- safe-buffer 5.2.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz)
-- semver 7.7.3 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/semver/-/semver-7.7.3.tgz)
-- simple-concat 1.0.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz)
-- simple-get 4.0.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz)
-- string_decoder 1.3.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz)
-- string-width 4.2.3 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz)
-- strip-ansi 6.0.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz)
-- strip-json-comments 2.0.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz)
-- tar 7.5.22 (Declared: BlueOak-1.0.0; selected: BlueOak-1.0.0; source: https://registry.npmjs.org/tar/-/tar-7.5.22.tgz)
-- tar-fs 2.1.5 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.5.tgz)
-- tar-stream 2.2.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz)
 - tr46 5.0.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/tr46/-/tr46-5.0.0.tgz)
-- tunnel-agent 0.6.0 (Declared: Apache-2.0; selected: Apache-2.0; source: https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz)
-- universalify 2.0.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz)
-- url-join 4.0.1 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/url-join/-/url-join-4.0.1.tgz)
-- util-deprecate 1.0.2 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz)
-- which 6.0.1 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/which/-/which-6.0.1.tgz)
-- wrap-ansi 7.0.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz)
-- wrappy 1.0.2 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz)
-- ws 8.21.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/ws/-/ws-8.21.0.tgz)
-- y18n 5.0.8 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz)
-- yallist 5.0.0 (Declared: BlueOak-1.0.0; selected: BlueOak-1.0.0; source: https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz)
-- yargs 17.7.3 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz)
-- yargs-parser 21.1.1 (Declared: ISC; selected: ISC; source: https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz)
+- ws 8.21.3 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/ws/-/ws-8.21.3.tgz)
 ## Distributed Dependency License Materials
 
 The following dependencies are incorporated into distributed Flowersec files or binaries.

package/dist/cli.js

@@ -1,32 +1,27 @@
 #!/usr/bin/env node
 import { readFileSync } from "node:fs";
+import { acceptNativeSessionV2 } from "./connector/sessionAcceptor.js";
+import { claimSpendMarker } from "./cliSpendMarker.js";
+import { connect } from "./node/connectSession.js";
+import { nodeSessionRuntimeV2 } from "./node/sessionRuntime.js";
+import { startNodeWebSocketServer } from "./node/webSocketServer.js";
 import { createArtifactLeaseV2 } from "./v2/artifactLease.js";
 import { buildFSB2RequestV2, encodeFSB2RequestV2 } from "./v2/artifact.js";
 import { parseArtifact, unwrapArtifact } from "./v2/opaqueArtifact.js";
-import { connect } from "./node/connectSession.js";
-import { startNodeWebTransportServerV2 } from "./node/webTransportServer.js";
-import { acceptNativeSessionV2 } from "./connector/sessionAcceptor.js";
-import { nodeSessionRuntimeV2 } from "./node/sessionRuntime.js";
-import { claimSpendMarker } from "./cliSpendMarker.js";
 const args = parseArguments(process.argv.slice(2));
 if (args.mode === "client")
     await runClient(args.values);
 else
     await runServer(args.values);
 async function runClient(values) {
-    const artifactPath = required(values, "artifact");
-    const origin = required(values, "origin");
-    const spendMarker = required(values, "spend-marker");
-    requireWebTransport(values);
-    const artifact = parseArtifact(readFileSync(artifactPath));
+    requireWebSocket(values);
+    const artifact = parseArtifact(readFileSync(required(values, "artifact")));
+    const lease = createArtifactLeaseV2(artifact, async () => claimSpendMarker(required(values, "spend-marker")));
     let session;
-    const lease = createArtifactLeaseV2(artifact, async () => claimSpendMarker(spendMarker));
     try {
         session = await connect(lease, {
-            origin,
-            ...(values["certificate-hash"] === undefined ? {} : {
-                tls: { serverCertificateHash: decodeHash(values["certificate-hash"]) },
-            }),
+            origin: required(values, "origin"),
+            ...(values.ca === undefined ? {} : { tls: { ca: readFileSync(values.ca, "utf8") } }),
         });
         const stream = await session.openStream("cli");
         await stream.write(new TextEncoder().encode("flowersec-ts-cli"));
@@ -42,16 +37,27 @@ async function runClient(values) {
     }
 }
 async function runServer(values) {
+    requireWebSocket(values);
     const artifact = unwrapArtifact(parseArtifact(readFileSync(required(values, "artifact"))));
-    requireWebTransport(values);
-    const server = await startNodeWebTransportServerV2({
+    if (artifact.path.kind !== "direct")
+        throw new Error("CLI server requires a direct artifact");
+    const certificatePath = values.certificate;
+    const privateKeyPath = values["private-key"];
+    if ((certificatePath === undefined) !== (privateKeyPath === undefined)) {
+        throw new Error("--certificate and --private-key must be provided together");
+    }
+    const server = await startNodeWebSocketServer({
         host: values.host ?? "127.0.0.1",
         port: Number.parseInt(required(values, "port"), 10),
-        path: values.path ?? "/flowersec/webtransport/v2/direct",
-        certificate: readFileSync(required(values, "certificate"), "utf8"),
-        privateKey: readFileSync(required(values, "private-key"), "utf8"),
-        carrierPath: artifact.path.kind,
+        path: "direct",
+        allowedOrigins: [required(values, "origin")],
         inboundBidirectionalStreamCapacity: artifact.session.max_inbound_streams + 2,
+        ...(certificatePath === undefined || privateKeyPath === undefined ? {} : {
+            tls: {
+                certificate: readFileSync(certificatePath, "utf8"),
+                privateKey: readFileSync(privateKeyPath, "utf8"),
+            },
+        }),
     });
     process.stdout.write(JSON.stringify(server.address()) + "\n");
     const abort = new AbortController();
@@ -61,7 +67,7 @@ async function runServer(values) {
     try {
         const session = await acceptNativeSessionV2(await server.accept({ signal: abort.signal }), async (request) => {
             const chosen = artifact.path.candidates.find(({ id }) => id === request.request.chosen_candidate_id);
-            if (request.request.pathKind !== artifact.path.kind || chosen?.carrier !== "webtransport") {
+            if (request.request.pathKind !== "direct" || chosen?.carrier !== "websocket") {
                 throw new Error("CLI server rejected an unexpected artifact candidate");
             }
             const expected = encodeFSB2RequestV2(buildFSB2RequestV2(artifact, request.request.chosen_candidate_id));
@@ -106,15 +112,9 @@ function required(values, name) {
         throw new Error(`missing --${name}`);
     return value;
 }
-function decodeHash(value) {
-    if (!/^[0-9a-fA-F]{64}$/.test(value))
-        throw new Error("--certificate-hash must be 32-byte SHA-256 hex");
-    return Uint8Array.from(Buffer.from(value, "hex"));
-}
-function requireWebTransport(values) {
-    if (values.transport !== "webtransport") {
-        throw new Error("--transport webtransport is required");
-    }
+function requireWebSocket(values) {
+    if (values.transport !== "websocket")
+        throw new Error("--transport websocket is required");
 }
 function bytesEqual(left, right) {
     if (left.length !== right.length)

package/dist/connector/adapters/rawQuicCandidate.d.ts

@@ -0,0 +1,5 @@
+import type { ArtifactV2, CanonicalArtifactCandidateV2 } from "../../v2/artifact.js";
+import { type NativeCarrierSessionV2 } from "../../v2/carrier.js";
+import type { CandidateAttemptFactoryV2 } from "../sessionConnector.js";
+export type RawQuicClientFactoryV2 = (candidate: CanonicalArtifactCandidateV2, artifact: ArtifactV2, signal: AbortSignal) => Promise<NativeCarrierSessionV2>;
+export declare function createRawQuicCandidateFactoryV2(factory: RawQuicClientFactoryV2): CandidateAttemptFactoryV2;

package/dist/connector/adapters/rawQuicCandidate.js

@@ -0,0 +1,71 @@
+import { adaptNativeCarrierSessionV2, } from "../../v2/carrier.js";
+export function createRawQuicCandidateFactoryV2(factory) {
+    return {
+        create(candidate, artifact) {
+            if (candidate.carrier !== "raw_quic") {
+                throw new Error(`unsupported raw QUIC carrier ${candidate.carrier}`);
+            }
+            return new RawQuicCandidateAttempt(candidate, artifact, factory);
+        },
+    };
+}
+class RawQuicCandidateAttempt {
+    candidate;
+    artifact;
+    factory;
+    controller = new AbortController();
+    carrier;
+    finalized = false;
+    constructor(candidate, artifact, factory) {
+        this.candidate = candidate;
+        this.artifact = artifact;
+        this.factory = factory;
+    }
+    async ready(signal) {
+        const unlink = linkAbort(signal, this.controller);
+        try {
+            const carrier = await this.factory(this.candidate, this.artifact, this.controller.signal);
+            this.carrier = carrier;
+            return {
+                candidate: this.candidate,
+                kind: carrier.kind,
+                path: carrier.path,
+                inboundBidirectionalStreamCapacity: carrier.inboundBidirectionalStreamCapacity,
+                openAdmissionChannel: async (channelSignal) => {
+                    const options = channelSignal === undefined ? {} : { signal: channelSignal };
+                    const stream = await carrier.openStream(options);
+                    return {
+                        framing: "stream",
+                        stream,
+                        abort: (error) => stream.abort(error),
+                    };
+                },
+                finalize: () => {
+                    if (this.finalized)
+                        throw new Error("raw QUIC candidate already finalized");
+                    this.finalized = true;
+                    return adaptNativeCarrierSessionV2(carrier);
+                },
+                close: async () => await carrier.close(),
+                abort: () => carrier.abort({ code: 6, reason: "candidate aborted" }),
+            };
+        }
+        finally {
+            unlink();
+        }
+    }
+    abort() {
+        this.controller.abort(new Error("raw QUIC candidate aborted"));
+        this.carrier?.abort({ code: 6, reason: "candidate aborted" });
+    }
+}
+function linkAbort(parent, child) {
+    if (parent === undefined)
+        return () => undefined;
+    const abort = () => child.abort(parent.reason);
+    if (parent.aborted)
+        abort();
+    else
+        parent.addEventListener("abort", abort, { once: true });
+    return () => parent.removeEventListener("abort", abort);
+}

package/dist/connector/sessionAcceptor.d.ts

@@ -1,5 +1,5 @@
 import { AdmissionStatusV2, type ArtifactV2, type DecodedFSB2RequestV2 } from "../v2/artifact.js";
-import { type NativeCarrierSessionV2 } from "../v2/carrier.js";
+import type { CarrierSessionV2, CarrierStreamV2 } from "../v2/carrier.js";
 import type { SessionProtocolRuntimeV2, SessionV2 as InternalSessionV2 } from "../v2/session.js";
 import type { RpcRouter } from "../rpc/server.js";
 export type AdmissionDecisionV2 = Readonly<{
@@ -11,7 +11,27 @@ export type AdmissionDecisionV2 = Readonly<{
     reason: string;
 }>;
 export type AdmissionAuthorizerV2 = (request: DecodedFSB2RequestV2, signal?: AbortSignal) => Promise<AdmissionDecisionV2>;
-export declare function acceptNativeSessionV2(carrier: NativeCarrierSessionV2, authorize: AdmissionAuthorizerV2, options: Readonly<{
+export type ReceivedSessionAdmissionV2 = Readonly<{
+    carrier: CarrierSessionV2;
+    stream: CarrierStreamV2;
+    rawFSB2: Uint8Array;
+    decoded: DecodedFSB2RequestV2;
+}>;
+export declare function receiveSessionAdmissionV2(carrier: CarrierSessionV2, signal?: AbortSignal): Promise<ReceivedSessionAdmissionV2>;
+export declare function rejectSessionAdmissionV2(received: ReceivedSessionAdmissionV2, decision: Extract<AdmissionDecisionV2, Readonly<{
+    accepted: false;
+}>>, signal?: AbortSignal): Promise<never>;
+export declare function acceptReceivedSessionV2(received: ReceivedSessionAdmissionV2, artifact: ArtifactV2, options: Readonly<{
+    runtime: SessionProtocolRuntimeV2;
+    rpcRouter?: RpcRouter;
+    signal?: AbortSignal;
+    role?: "client" | "server";
+    localAdmissionBinding?: Uint8Array;
+    peerAdmissionBinding?: Uint8Array;
+    localEndpointInstanceID?: string;
+    expectedPeerEndpointInstanceID?: string;
+}>): Promise<InternalSessionV2>;
+export declare function acceptNativeSessionV2(carrier: CarrierSessionV2, authorize: AdmissionAuthorizerV2, options: Readonly<{
     runtime: SessionProtocolRuntimeV2;
     rpcRouter?: RpcRouter;
     signal?: AbortSignal;

package/dist/connector/sessionAcceptor.js

@@ -1,38 +1,68 @@
 import { AdmissionStatusV2, buildFSB2RequestV2, decodeFSB2RequestV2, encodeFSB2RequestV2, encodeFSA2ResponseV2, } from "../v2/artifact.js";
-import { adaptNativeCarrierSessionV2 } from "../v2/carrier.js";
 import { establishSessionV2 } from "../v2/session.js";
 import { AdmissionSessionV2Error } from "../v2/admissionError.js";
 import { sessionConfigFromArtifactV2 } from "./sessionConfig.js";
+export async function receiveSessionAdmissionV2(carrier, signal) {
+    const stream = carrier.kind === "webtransport"
+        ? await carrier.openStream(signalOptions(signal))
+        : await carrier.acceptStream(signalOptions(signal));
+    try {
+        const rawFSB2 = await readFSB2(stream, signal);
+        return Object.freeze({ carrier, stream, rawFSB2, decoded: decodeFSB2RequestV2(rawFSB2) });
+    }
+    catch (error) {
+        stream.abort(asError(error));
+        carrier.abort({ code: 6, reason: "admission failed" });
+        throw error;
+    }
+}
+export async function rejectSessionAdmissionV2(received, decision, signal) {
+    await respondAdmission(received.stream, { status: decision.status, reason: decision.reason }, signal);
+    received.carrier.abort({ code: 6, reason: "admission rejected" });
+    throw new AdmissionSessionV2Error(decision.reason, `Flowersec v2 admission rejected: ${decision.reason}`);
+}
+export async function acceptReceivedSessionV2(received, artifact, options) {
+    try {
+        const expected = encodeFSB2RequestV2(buildFSB2RequestV2(artifact, received.decoded.request.chosen_candidate_id));
+        if (!equalBytes(expected, received.rawFSB2))
+            throw new Error("authorized artifact does not match admission");
+        await respondAdmission(received.stream, { status: AdmissionStatusV2.Success, reason: "" }, options.signal);
+        const base = sessionConfigFromArtifactV2(artifact, received.rawFSB2, options.runtime, undefined, options.role);
+        const config = {
+            ...base,
+            ...(options.rpcRouter === undefined ? {} : { rpcRouter: options.rpcRouter }),
+            ...(options.localAdmissionBinding === undefined ? {} : { localAdmissionBinding: options.localAdmissionBinding }),
+            ...(options.peerAdmissionBinding === undefined ? {} : { peerAdmissionBinding: options.peerAdmissionBinding }),
+            ...(options.localEndpointInstanceID === undefined ? {} : { localEndpointInstanceID: options.localEndpointInstanceID }),
+            ...(options.expectedPeerEndpointInstanceID === undefined ? {} : { expectedPeerEndpointInstanceID: options.expectedPeerEndpointInstanceID }),
+        };
+        return await establishSessionV2(received.carrier, config, signalOptions(options.signal));
+    }
+    catch (error) {
+        received.stream.abort(asError(error));
+        received.carrier.abort({ code: 6, reason: "admission failed" });
+        throw error;
+    }
+}
 export async function acceptNativeSessionV2(carrier, authorize, options) {
-    const admission = carrier.kind === "webtransport"
-        ? await carrier.openStream(signalOptions(options.signal))
-        : await carrier.acceptStream(signalOptions(options.signal));
+    const received = await receiveSessionAdmissionV2(carrier, options.signal);
     try {
-        const rawFSB2 = await readFSB2(admission, options.signal);
-        const decoded = decodeFSB2RequestV2(rawFSB2);
-        const decision = await authorize(decoded, options.signal);
-        if (decision.accepted) {
-            const expected = encodeFSB2RequestV2(buildFSB2RequestV2(decision.artifact, decoded.request.chosen_candidate_id));
-            if (!equalBytes(expected, rawFSB2))
-                throw new Error("authorized artifact does not match admission");
-        }
-        const response = decision.accepted
-            ? { status: AdmissionStatusV2.Success, reason: "" }
-            : { status: decision.status, reason: decision.reason };
-        await writeAll(admission, encodeFSA2ResponseV2(response), options.signal);
-        await raceAbort(admission.closeWrite(), options.signal);
+        const decision = await authorize(received.decoded, options.signal);
         if (!decision.accepted) {
-            throw new AdmissionSessionV2Error(decision.reason, `Flowersec v2 admission rejected: ${decision.reason}`);
+            return await rejectSessionAdmissionV2(received, decision, options.signal);
         }
-        const config = sessionConfigFromArtifactV2(decision.artifact, rawFSB2, options.runtime, undefined, "server");
-        return await establishSessionV2(adaptNativeCarrierSessionV2(carrier), options.rpcRouter === undefined ? config : { ...config, rpcRouter: options.rpcRouter }, signalOptions(options.signal));
+        return await acceptReceivedSessionV2(received, decision.artifact, { ...options, role: "server" });
     }
     catch (error) {
-        admission.abort(asError(error));
+        received.stream.abort(asError(error));
         carrier.abort({ code: 6, reason: "admission failed" });
         throw error;
     }
 }
+async function respondAdmission(stream, response, signal) {
+    await writeAll(stream, encodeFSA2ResponseV2(response), signal);
+    await raceAbort(stream.closeWrite(), signal);
+}
 function equalBytes(left, right) {
     if (left.length !== right.length)
         return false;

package/dist/connector/sessionConnector.d.ts

@@ -2,6 +2,7 @@ import { type ArtifactV2, type CanonicalArtifactCandidateV2 } from "../v2/artifa
 import { type SessionDeadlineFactoryV2, type SessionProtocolRuntimeV2, type SessionV2 as InternalSessionV2 } from "../v2/session.js";
 import type { ArtifactLeaseV2 } from "../v2/artifactLease.js";
 import { type RuntimeCapabilityDescriptorV2 } from "../v2/capability.js";
+import type { RpcRouter } from "../rpc/server.js";
 import { type ReadyAdmissionTransportV2 } from "./admissionCommit.js";
 export type SessionConnectorStateV2 = "attempt" | "ready" | "winner" | "admitted" | "established" | "terminated";
 export type ConnectorArtifactLeaseV2 = ArtifactLeaseV2;
@@ -20,6 +21,7 @@ export type SessionConnectorOptionsV2 = Readonly<{
 }>;
 type SessionConnectorInternalOptionsV2 = Readonly<{
     runtime: SessionProtocolRuntimeV2;
+    rpcRouter?: RpcRouter;
     connectTimeoutMs?: number;
     deadlineFactory?: SessionDeadlineFactoryV2;
     loserCloseTimeoutMs?: number;

package/dist/connector/sessionConnector.js

@@ -199,7 +199,10 @@ export class SessionConnectorV2 {
             let config;
             try {
                 rawFSB2 = encodeFSB2RequestV2(buildFSB2RequestV2(this.artifact, selected.attempt.candidate.id));
-                config = sessionConfigFromArtifactV2(this.artifact, rawFSB2, this.options.runtime, this.options.deadlineFactory);
+                const baseConfig = sessionConfigFromArtifactV2(this.artifact, rawFSB2, this.options.runtime, this.options.deadlineFactory);
+                config = this.options.rpcRouter === undefined
+                    ? baseConfig
+                    : { ...baseConfig, rpcRouter: this.options.rpcRouter };
             }
             catch (error) {
                 const closeFailure = await captureCandidateCleanupFailure(selected.attempt.candidate, "close selected candidate", () => selected.ready.close(), loserCloseTimeoutMs, operationSignal, abortSources, selected.ready.abort);

package/dist/interop/proxyServerPeer.d.ts

@@ -0,0 +1 @@
+export {};