@floegence/flowersec-core 2.3.8 → 2.3.10

package/README.md

@@ -41,6 +41,8 @@ The controller has one scheduler and one in-flight attempt. Its states are `idle
 
 Node `SessionHandlers` accept application stream kinds whose UTF-8 encoding is 1 through 255 bytes and reserve `flowersec.rpc.v2` for Flowersec RPC. `AcceptedSession.serve(...)` half-closes successfully handled streams. A rejected handler Promise resets only that stream; the accept loop and unrelated streams continue.
 
+Reliable streams apply bounded per-stream receive backpressure instead of buffering application data without limit. A slow consumer pauses carrier progress until reads release capacity; records retain carrier order, so a rekey behind backpressured DATA completes after the consumer resumes. `closeWrite()` sends the graceful FIN and keeps reads available. `reset()` and `close()` abort both directions. If a write is canceled or fails after its wire commit may have started, only that stream becomes terminal and cannot be reused.
+
 Source failures return a structured `terminal`, `retryable`, or `retry_after` disposition. Thrown or malformed source failures are terminal. Retry delay is deterministic exponential backoff from 250 ms, doubling to a 30-second maximum with no jitter; `retry_after` is never attempted before its specified Unix-millisecond boundary. Attempts are unlimited unless `maximumAttempts` is explicitly set.
 
 A newly established session replaces `currentSession` atomically. The controller never migrates or replays streams, RPC calls, or writes from a terminated session; callers start new application operations on the new session.

package/dist/interop/serverParityPeer.js

@@ -1,7 +1,8 @@
 import { createInterface } from "node:readline";
+import { createPrivateKey, createPublicKey, X509Certificate } from "node:crypto";
 import { createAcceptor, createArtifactLease, createEndpointSet, createStreamMetadata, createTunnelRuntime, connect, Issuer, parseArtifact, SessionError, SessionHandlers, } from "../node/index.js";
 const RUNTIME = "node-typescript";
-const ORIGIN = "https://client.example";
+const ORIGIN = process.env.FLOWERSEC_PARITY_ORIGIN ?? "https://client.example";
 const ECHO_RPC = 7001;
 const NOTIFY_RPC = 7002;
 const COMPLETE_RPC = 7003;
@@ -10,8 +11,10 @@ const ECHO_KIND = "parity.echo";
 const RESET_KIND = "parity.reset";
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
-const TEST_CERT_DER_B64 = "MIIBjzCCAUGgAwIBAgIUW8hQEpQsUJN9a6qqF2g6hsNpSm8wBQYDK2VwMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0yNjA3MjAxOTAxMjFaFw0zNjA3MTcxOTAxMjFaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDAqMAUGAytlcAMhAAihki/Jec+1EaC6E6PsSxjMYFAazrgkNiUIlbj/+A/0o4GkMIGhMB0GA1UdDgQWBBQCuKxQmMQkAAy9KkfuD+WOmrrMbTAfBgNVHSMEGDAWgBQCuKxQmMQkAAy9KkfuD+WOmrrMbTAsBgNVHREEJTAjgglsb2NhbGhvc3SHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwBQYDK2VwA0EArZng3XitiH2E1pW/NTxQvEOBXJYpYE8coQmLV4yTjfI43CWHMG6lIrwk/so67oe6Z2R4iHGjUm3Tuy50Fl8hBw==";
-const TEST_KEY_DER_B64 = "MC4CAQAwBQYDK2VwBCIEICxYUWHqGoh0CBBohsaNg/NThm1n3UeWCzYuq6jS+Qi6";
+// Static test-only P-256 material keeps browser parity hermetic and is never
+// exposed by a production package entrypoint.
+const TEST_CERT_DER_B64 = "MIIB0DCCAXWgAwIBAgIUN1vflbzlJfrU4ZKED+4S+7sCtiYwCgYIKoZIzj0EAwIwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDgxNDAyNDM0MloXDTM2MDgxMTAyNDM0MlowFDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEajwb7qy6VxUFH+WjP/RG8LabjthsjlqZweN2NAkwClGhWdp5XI5HEsP7p5pOpYjjD4kLsvjnBISRRf0CJIW2GKOBpDCBoTAdBgNVHQ4EFgQUe4BGlwqmqkqzEKuW7ACsFr6Dk4YwHwYDVR0jBBgwFoAUe4BGlwqmqkqzEKuW7ACsFr6Dk4YwLAYDVR0RBCUwI4IJbG9jYWxob3N0hwR/AAABhxAAAAAAAAAAAAAAAAAAAAABMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAoGCCqGSM49BAMCA0kAMEYCIQCYzxx1Zev7TI4aHaXKrj7uV4F8wkJ2kEJtogyGlMJOFwIhAOAEs50N+UKa+0B9JK6xRACX82a6bFBZCY+H9nUKikV9";
+const TEST_KEY_DER_B64 = "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgGw0KRCu5rtYpQtqfTVTSz97sUToj2S3UhuA/cxsDa5KhRANCAARqPBvurLpXFQUf5aM/9EbwtpuO2GyOWpnB43Y0CTAKUaFZ2nlcjkcSw/unmk6liOMPiQuy+OcEhJFF/QIkhbYY";
 class SignalQueue {
     #values = [];
     #waiters = [];
@@ -271,16 +274,41 @@ async function exchangeDatagram(session, carrier, initiator) {
 }
 function fixture() {
     const certificate = pem("CERTIFICATE", TEST_CERT_DER_B64);
+    const privateKey = pem("PRIVATE KEY", TEST_KEY_DER_B64);
+    validateTestTLSFixture(certificate, privateKey);
     return {
         tls: {
             certificate_chain_pem: certificate,
-            private_key_pem: pem("PRIVATE KEY", TEST_KEY_DER_B64),
+            private_key_pem: privateKey,
             root_certificate_pem: certificate,
             root_certificate_der_base64: TEST_CERT_DER_B64,
             leaf_certificate_der_base64: TEST_CERT_DER_B64,
         },
     };
 }
+function validateTestTLSFixture(certificatePEM, privateKeyPEM) {
+    const certificate = new X509Certificate(certificatePEM);
+    const validFrom = Date.parse(certificate.validFrom);
+    const validTo = Date.parse(certificate.validTo);
+    const maximumValidityMs = 11 * 366 * 24 * 60 * 60 * 1_000;
+    const certificatePublicKey = certificate.publicKey.export({ type: "spki", format: "der" });
+    const privateKeyPublicKey = createPublicKey(createPrivateKey(privateKeyPEM)).export({ type: "spki", format: "der" });
+    if (certificate.ca ||
+        certificate.publicKey.asymmetricKeyType !== "ec" ||
+        certificate.publicKey.asymmetricKeyDetails?.namedCurve !== "prime256v1" ||
+        certificate.checkHost("localhost") !== "localhost" ||
+        certificate.checkIP("127.0.0.1") !== "127.0.0.1" ||
+        certificate.checkIP("::1") !== "::1" ||
+        !certificate.keyUsage.includes("1.3.6.1.5.5.7.3.1") ||
+        !Number.isFinite(validFrom) ||
+        !Number.isFinite(validTo) ||
+        Date.now() < validFrom ||
+        Date.now() >= validTo ||
+        validTo - validFrom > maximumValidityMs ||
+        !certificatePublicKey.equals(privateKeyPublicKey)) {
+        throw new Error("browser parity TLS fixture is invalid");
+    }
+}
 function pem(label, encoded) {
     const lines = encoded.match(/.{1,64}/g);
     if (lines === null)
@@ -334,7 +362,12 @@ async function runServer(tls, carrier) {
         const accepted = await accepting;
         state.executed.record("admission");
         const serving = accepted.serve().catch((error) => error);
-        await exerciseServer(accepted.session, state, "direct", true, carrier);
+        if (process.env.FLOWERSEC_PARITY_CLIENT_PROFILE !== undefined) {
+            await externalServer(accepted.session, state);
+        }
+        else {
+            await exerciseServer(accepted.session, state, "direct", true, carrier);
+        }
         await serving;
         await accepted.close().catch(() => undefined);
         if (state.activeStreams.value !== 0)
@@ -481,7 +514,12 @@ async function runTunnelEndpointB(input, carrier) {
     const state = createHandlers("tunnel");
     const session = await connectArtifact(secondJSON, relay, state.handlers);
     state.executed.record("admission");
-    await exerciseServer(session, state, "tunnel", false, carrier);
+    if (process.env.FLOWERSEC_PARITY_CLIENT_PROFILE !== undefined) {
+        await externalServer(session, state);
+    }
+    else {
+        await exerciseServer(session, state, "tunnel", false, carrier);
+    }
     await session.close().catch(() => undefined);
     state.executed.record("close");
     if (state.activeStreams.value !== 0)
@@ -489,6 +527,10 @@ async function runTunnelEndpointB(input, carrier) {
     state.executed.record("cleanup");
     writeJSON(result("endpoint-b-result", "tunnel", state.executed.snapshot(), carrier));
 }
+async function externalServer(session, state) {
+    await session.waitTermination();
+    state.executed.record("close");
+}
 async function runTunnelEndpointA(input, carrier) {
     const envelope = await input.next();
     validateTunnelDimensions(envelope.topology, envelope.endpoint_b.relay, "endpoint_a", carrier);

package/dist/node/nativeTransportAddon.d.ts

@@ -45,6 +45,7 @@ type NativeRawQuicStreamBinding = Readonly<{
     closeWrite(): Promise<void>;
     stopSending(): Promise<void>;
     reset(): Promise<void>;
+    cancelPending?(): void;
     abort(): void;
 }>;
 type NativeRawQuicSessionBinding = Readonly<{

package/dist/node/nativeTransportAddon.js

@@ -2,6 +2,7 @@ import { createRequire } from "node:module";
 import { CarrierError, } from "../v2/carrier.js";
 export const NATIVE_TRANSPORT_CONTRACT_VERSION = 1;
 const NATIVE_PACKAGE = "@floegence/flowersec-node-native";
+const SERVER_PARITY_NATIVE_ADDON = "FLOWERSEC_SERVER_PARITY_NATIVE_ADDON";
 export class NativeTransportUnavailableError extends Error {
     code = "native_transport_unavailable";
     constructor() {
@@ -12,7 +13,7 @@ export class NativeTransportUnavailableError extends Error {
 export function loadNativeTransportAddon(requireFunction = createRequire(import.meta.url)) {
     let candidate;
     try {
-        candidate = requireFunction(NATIVE_PACKAGE);
+        candidate = requireFunction(nativePackageSpecifier());
     }
     catch {
         throw new NativeTransportUnavailableError();
@@ -22,6 +23,14 @@ export function loadNativeTransportAddon(requireFunction = createRequire(import.
     }
     return candidate;
 }
+function nativePackageSpecifier() {
+    if (process.env.FLOWERSEC_SERVER_PARITY_PEER === "1") {
+        const override = process.env[SERVER_PARITY_NATIVE_ADDON];
+        if (override !== undefined && override !== "")
+            return override;
+    }
+    return NATIVE_PACKAGE;
+}
 export function tryLoadNativeTransportAddon(requireFunction = createRequire(import.meta.url)) {
     try {
         return loadNativeTransportAddon(requireFunction);
@@ -117,21 +126,54 @@ function wrapSession(native) {
 }
 function wrapStream(native) {
     return Object.freeze({
-        read: async () => await native.read(),
-        write: async (data) => await native.write(data),
-        closeWrite: async () => await native.closeWrite(),
-        stopSending: async () => await native.stopSending(),
-        reset: async () => await native.reset(),
+        read: async () => await nativeStreamCall(native.read()),
+        write: async (data) => await nativeStreamCall(native.write(data)),
+        closeWrite: async () => await nativeStreamCall(native.closeWrite()),
+        stopSending: async () => await nativeStreamCall(native.stopSending()),
+        reset: async () => await nativeStreamCall(native.reset()),
+        cancelPending: () => native.cancelPending?.(),
         abort: () => native.abort(),
     });
 }
+async function nativeStreamCall(operation) {
+    try {
+        return await operation;
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : "";
+        switch (reason) {
+            case "reset": throw new CarrierError("reset", "raw QUIC stream reset", error);
+            case "canceled": throw new CarrierError("aborted", "raw QUIC stream operation canceled", error);
+            case "closed": throw new CarrierError("closed", "raw QUIC stream closed", error);
+            case "stream_failed": throw new CarrierError("closed", "raw QUIC stream operation closed", error);
+            default: throw error;
+        }
+    }
+}
+function nativeOperationError(error) {
+    const reason = error instanceof Error ? error.message : "";
+    switch (reason) {
+        case "canceled": return new CarrierError("aborted", "native transport operation canceled", error);
+        case "closed":
+        case "listener_closed":
+        case "stream_failed":
+            return new CarrierError("closed", "native transport operation closed", error);
+        default: return error;
+    }
+}
 async function settle(operation, signal) {
     if (signal?.aborted === true) {
         operation.cancel();
         throw new CarrierError("aborted", "native transport operation aborted");
     }
-    if (signal === undefined)
-        return await operation.result();
+    if (signal === undefined) {
+        try {
+            return await operation.result();
+        }
+        catch (error) {
+            throw nativeOperationError(error);
+        }
+    }
     return await new Promise((resolve, reject) => {
         let settled = false;
         const cleanup = () => signal.removeEventListener("abort", abort);
@@ -155,7 +197,7 @@ async function settle(operation, signal) {
                 return;
             settled = true;
             cleanup();
-            reject(error);
+            reject(nativeOperationError(error));
         });
     });
 }

package/dist/node/tunnelRuntime.js

@@ -301,9 +301,11 @@ async function bridgeStreams(source, target, slots, signal, start) {
         }
         catch (error) {
             release();
-            incoming.abort(asError(error));
-            if (signal.aborted)
+            if (signal.aborted) {
+                incoming.abort(asError(error));
                 throw error;
+            }
+            await incoming.reset().catch(() => undefined);
             continue;
         }
         start(spliceStreams(incoming, outgoing, signal, false).finally(release), false);
@@ -321,8 +323,13 @@ async function spliceStreams(left, right, signal, closePair) {
             throw new Error("Flowersec tunnel control stream closed");
     }
     catch (error) {
-        left.abort(asError(error));
-        right.abort(asError(error));
+        if (closePair || signal.aborted) {
+            left.abort(asError(error));
+            right.abort(asError(error));
+        }
+        else {
+            await Promise.allSettled([left.reset(), right.reset()]);
+        }
         throw error;
     }
     finally {

package/dist/proxy/runtime.js

@@ -352,8 +352,13 @@ export function createProxyRuntime(options) {
                 }
                 const headersOut = filterHeaders(response.headers ?? [], BASE_RESPONSE_HEADERS, responseExtra);
                 port.postMessage({ type: "flowersec-proxy:response_meta", status: response.status, headers: headersOut });
-                for await (const chunk of readChunks(reader, maxChunkBytes, maxBodyBytes)) {
+                const chunks = readChunks(reader, maxChunkBytes, maxBodyBytes)[Symbol.asyncIterator]();
+                for (;;) {
                     await waitForCredit();
+                    const next = await chunks.next();
+                    if (next.done)
+                        break;
+                    const chunk = next.value;
                     const data = chunk.slice().buffer;
                     port.postMessage({ type: "flowersec-proxy:response_chunk", data }, [data]);
                 }

package/dist/proxy/serviceWorker.js

@@ -121,8 +121,11 @@ function serviceWorkerMain(config) {
             const target = config.windowTarget === "request_client"
                 ? source
                 : runtimeClientId === "" ? null : await worker.clients.get(runtimeClientId);
-            if (target === null)
+            if (target === null) {
+                if (config.windowTarget === "registered_runtime")
+                    runtimeClientId = "";
                 return new Response("proxy runtime unavailable", { status: 503 });
+            }
             let body;
             if (request.method !== "GET" && request.method !== "HEAD") {
                 const requestBody = await request.clone().arrayBuffer();
@@ -188,17 +191,25 @@ function serviceWorkerMain(config) {
                 };
                 channel.port1.onmessageerror = () => finishError(502, "proxy request failed");
                 const headers = Array.from(request.headers.entries()).map(([name, value]) => ({ name, value }));
-                target.postMessage({
-                    type: config.windowClientMessageType,
-                    req: {
-                        id: `${Date.now()}-${Math.random().toString(16).slice(2)}`,
-                        method: request.method,
-                        path,
-                        headers,
-                        response_flow_control: "chunk_credit_v2",
-                        ...(body === undefined ? {} : { body }),
-                    },
-                }, [channel.port2, ...(body === undefined ? [] : [body])]);
+                try {
+                    target.postMessage({
+                        type: config.windowClientMessageType,
+                        req: {
+                            id: `${Date.now()}-${Math.random().toString(16).slice(2)}`,
+                            method: request.method,
+                            path,
+                            headers,
+                            response_flow_control: "chunk_credit_v2",
+                            ...(body === undefined ? {} : { body }),
+                        },
+                    }, [channel.port2, ...(body === undefined ? [] : [body])]);
+                }
+                catch {
+                    if (config.windowTarget === "registered_runtime")
+                        runtimeClientId = "";
+                    channel.port1.close();
+                    resolve(new Response("proxy runtime unavailable", { status: 503 }));
+                }
             });
             const injection = config.injectHTML;
             if (injection === null || pathMatches(url.pathname, injection.excludePathPrefixes ?? []))

package/dist/transport/webTransportAdapter.js

@@ -490,9 +490,9 @@ async function raceAbort(promise, signal) {
     if (signal === undefined)
         return await promise;
     if (signal.aborted)
-        throw signal.reason;
+        throw abortedCarrierError(signal.reason);
     return await new Promise((resolve, reject) => {
-        const abort = () => reject(signal.reason);
+        const abort = () => reject(abortedCarrierError(signal.reason));
         signal.addEventListener("abort", abort, { once: true });
         void promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
     });

package/dist/v2/carrier.d.ts

@@ -52,6 +52,8 @@ export type NativeCarrierStreamV2 = Readonly<{
     closeWrite(): Promise<void>;
     stopSending(): Promise<void>;
     reset(): Promise<void>;
+    /** Cancels pending local primitives without initiating peer-visible teardown. */
+    cancelPending?(): void;
     /** See {@link CarrierStreamV2.abort}. */
     abort(error?: Error): void;
 }>;

package/dist/v2/carrier.js

@@ -353,11 +353,11 @@ class NativeCarrierStreamAdapter {
         this.native = native;
     }
     async read(options = {}) {
-        return await abortable(this.native.read(), options.signal, () => this.native.abort());
+        return await abortable(this.native.read(), options.signal, () => this.cancelPending());
     }
     async write(data, options = {}) {
         throwIfAborted(options.signal);
-        return await abortable(this.native.write(data), options.signal, () => this.native.abort());
+        return await abortable(this.native.write(data), options.signal, () => this.cancelPending());
     }
     async closeWrite() {
         await this.native.closeWrite();
@@ -371,6 +371,12 @@ class NativeCarrierStreamAdapter {
     abort(error) {
         this.native.abort(error);
     }
+    cancelPending() {
+        if (this.native.cancelPending !== undefined)
+            this.native.cancelPending();
+        else
+            this.native.abort();
+    }
 }
 async function abortable(promise, signal, onAbort) {
     if (signal === undefined)

package/dist/v2/session.d.ts

@@ -104,12 +104,15 @@ export declare class SessionV2 implements SessionV2Contract {
     private sessionCloseCommitted;
     private readonly peerSessionClose;
     private readonly streams;
+    private readonly releasedStreams;
+    private readonly releasedStreamCleanup;
     private readonly peerLedger;
     private readonly outboundLedger;
     private readonly incoming;
     private readonly outboundPermits;
     private readonly inboundPermits;
     private readonly pings;
+    private readonly backgroundTasks;
     private nextPing;
     private readonly rpcActivation;
     private rpcStreamPromise;
@@ -153,6 +156,7 @@ export declare class SessionV2 implements SessionV2Contract {
     }>>;
     localReset(stream: EncryptedStreamV2, error: Error): Promise<void>;
     releaseStream(stream: EncryptedStreamV2): void;
+    private confirmControlDelivery;
     private openLogicalStream;
     private ensureRPCStream;
     private acceptCarrierLoop;
@@ -184,6 +188,7 @@ export declare class SessionV2 implements SessionV2Contract {
     private validGoAwayBoundary;
     private sendGoAway;
     private receiveGoAway;
+    private trackBackground;
     private localOpeningAllowedAfterGoAway;
     private acceptsPeerStreamAfterGoAway;
     private cleanupEpochRoots;
@@ -224,6 +229,7 @@ declare class EncryptedStreamV2 implements ByteStreamV2 {
     private remoteFIN;
     private pumpStarted;
     private permitReleased;
+    private closeWriteTask;
     private pendingSendRekey;
     private lastSendRekeyACK;
     private receiveRekey;
@@ -235,6 +241,7 @@ declare class EncryptedStreamV2 implements ByteStreamV2 {
     close(): Promise<void>;
     send(type: InnerTypeV2, payload: Uint8Array, signal?: AbortSignal): Promise<void>;
     canRekeySend(): boolean;
+    hasRemoteFIN(): boolean;
     startSendRekey(transition: bigint, epoch: number): Readonly<{
         armed: Deferred<void>;
         done: Deferred<void>;
@@ -245,6 +252,7 @@ declare class EncryptedStreamV2 implements ByteStreamV2 {
     markOpen(): void;
     markTerminal(error: Error): boolean;
     peerReset(error: Error): void;
+    carrierReset(): void;
     abort(error?: Error): void;
     releasePermit(): void;
     private pump;
@@ -274,12 +282,15 @@ declare class ByteQueue {
     private closed;
     private error;
     private readonly waiters;
+    private readonly capacityWaiters;
     constructor(limit: number);
     push(chunk: Uint8Array): void;
     close(): void;
     fail(error: Error): void;
+    waitForCapacity(required: number): Promise<void>;
     read(signal?: AbortSignal): Promise<Uint8Array | null>;
     private wake;
+    private wakeCapacity;
 }
 type Deferred<T> = Readonly<{
     promise: Promise<T>;

package/dist/v2/session.js

@@ -12,6 +12,7 @@ const MAX_BUFFERED_STREAM_BYTES = 4 * 1024 * 1024;
 const RESERVED_RPC_KIND = "flowersec.rpc.v2";
 const DEFAULT_IDLE_TIMEOUT_MS = 60_000;
 const DEFAULT_CLOSE_TIMEOUT_MS = 2_000;
+const DEFAULT_CONTROL_CONFIRM_TIMEOUT_MS = 2_000;
 export class SessionV2Error extends Error {
     code;
     constructor(code, message) {
@@ -108,12 +109,15 @@ export class SessionV2 {
     sessionCloseCommitted = false;
     peerSessionClose = deferred();
     streams = new Map();
+    releasedStreams = new Map();
+    releasedStreamCleanup = releasedStreamCleanup(this.releasedStreams);
     peerLedger;
     outboundLedger;
     incoming = new AsyncQueue();
     outboundPermits;
     inboundPermits;
     pings = new Map();
+    backgroundTasks = new Set();
     nextPing = 1n;
     rpcActivation = deferred();
     rpcStreamPromise;
@@ -305,23 +309,51 @@ export class SessionV2 {
     async localReset(stream, error) {
         if (!stream.markTerminal(error))
             return;
+        this.releaseStream(stream);
+        let controlConfirmed = false;
         try {
             await this.sendControl(InnerTypeV2.StreamReset, idReason(stream.id, 6));
             this.commitLocalReset(stream.id);
+            if (stream.hasRemoteFIN())
+                controlConfirmed = await this.confirmControlDelivery();
         }
         catch (cause) {
             this.fail(asError(cause));
         }
-        await stream.carrier.reset().catch(() => undefined);
-        this.releaseStream(stream);
+        if (controlConfirmed) {
+            await stream.carrier.closeWrite().catch(async () => await stream.carrier.reset().catch(() => undefined));
+        }
+        else {
+            await stream.carrier.reset().catch(() => undefined);
+        }
     }
     releaseStream(stream) {
+        if (stream.terminalError !== undefined) {
+            this.releasedStreams.delete(stream.id);
+            this.releasedStreamCleanup.unregister(stream);
+        }
         if (this.streams.get(stream.id) !== stream)
             return;
         this.streams.delete(stream.id);
+        if (stream.terminalError === undefined) {
+            this.releasedStreams.set(stream.id, new WeakRef(stream));
+            this.releasedStreamCleanup.register(stream, stream.id, stream);
+        }
         stream.releasePermit();
         this.cleanupEpochRoots();
     }
+    async confirmControlDelivery() {
+        const nonce = this.nextPing++;
+        const pending = deferred();
+        this.pings.set(nonce, pending);
+        try {
+            await this.sendControl(InnerTypeV2.Ping, u64(nonce));
+            return await resolveWithin(pending.promise, DEFAULT_CONTROL_CONFIRM_TIMEOUT_MS);
+        }
+        finally {
+            this.pings.delete(nonce);
+        }
+    }
     async openLogicalStream(kind, options, internal) {
         this.assertOpen();
         throwIfAborted(options.signal);
@@ -599,7 +631,21 @@ export class SessionV2 {
                         const { id, reason } = parseIDReason(record.payload);
                         if (id === 0n || reason === 0)
                             throw protocolError("invalid STREAM_RESET");
-                        this.streams.get(id)?.peerReset(new SessionV2Error("stream_reset", "logical stream reset by peer"));
+                        const stream = this.streams.get(id);
+                        if (stream !== undefined) {
+                            stream.peerReset(new SessionV2Error("stream_reset", "logical stream reset by peer"));
+                        }
+                        else {
+                            const released = this.releasedStreams.get(id);
+                            if (released !== undefined) {
+                                this.releasedStreams.delete(id);
+                                const releasedStream = released.deref();
+                                if (releasedStream !== undefined) {
+                                    this.releasedStreamCleanup.unregister(releasedStream);
+                                    releasedStream.markTerminal(new SessionV2Error("stream_reset", "logical stream reset by peer"));
+                                }
+                            }
+                        }
                         if (this.isLocalLogicalID(id)) {
                             this.outboundLedger.peerReset(id);
                             this.notifyOutboundFrontierChanged();
@@ -907,9 +953,16 @@ export class SessionV2 {
         this.receivedGoAwayLastAccepted = lastAccepted;
         this.receivedGoAwayReason = reason;
         const excluded = [...this.streams.values()].filter((stream) => this.isLocalLogicalID(stream.id) && stream.id > lastAccepted);
-        await Promise.allSettled(excluded.map(async (stream) => {
-            await this.localReset(stream, new SessionV2Error("going_away", "logical stream exceeds peer GOAWAY boundary"));
-        }));
+        for (const stream of excluded) {
+            this.trackBackground(this.localReset(stream, new SessionV2Error("going_away", "logical stream exceeds peer GOAWAY boundary")));
+        }
+    }
+    trackBackground(task) {
+        this.backgroundTasks.add(task);
+        void task.catch((error) => {
+            if (this.lifecycle !== "closed")
+                this.fail(asError(error));
+        }).finally(() => this.backgroundTasks.delete(task));
     }
     localOpeningAllowedAfterGoAway(id) {
         return !this.receivedGoAway || id <= this.receivedGoAwayLastAccepted;
@@ -995,6 +1048,12 @@ export class SessionV2 {
         this.rpc.close();
         for (const stream of [...this.streams.values()])
             stream.peerReset(error);
+        for (const released of this.releasedStreams.values()) {
+            const stream = released.deref();
+            if (stream !== undefined)
+                this.releasedStreamCleanup.unregister(stream);
+        }
+        this.releasedStreams.clear();
         this.wipeAllRoots();
         this.h3.fill(0);
         if (abortCarrier && !normalPeerCarrierClose)
@@ -1032,6 +1091,7 @@ class EncryptedStreamV2 {
     remoteFIN = false;
     pumpStarted = false;
     permitReleased = false;
+    closeWriteTask;
     pendingSendRekey;
     lastSendRekeyACK;
     receiveRekey;
@@ -1064,9 +1124,16 @@ class EncryptedStreamV2 {
             throw this.terminalError;
         const copy = payload.slice();
         await this.enqueueSend(async () => {
-            for (let offset = 0; offset < copy.length; offset += MAX_DATA_BYTES) {
-                throwIfAborted(options.signal);
-                await this.session.sendStreamRecord(this, InnerTypeV2.Data, copy.subarray(offset, Math.min(copy.length, offset + MAX_DATA_BYTES)));
+            try {
+                for (let offset = 0; offset < copy.length; offset += MAX_DATA_BYTES) {
+                    throwIfAborted(options.signal);
+                    await this.session.sendStreamRecord(this, InnerTypeV2.Data, copy.subarray(offset, Math.min(copy.length, offset + MAX_DATA_BYTES)), options.signal);
+                }
+            }
+            catch (error) {
+                const normalized = asError(error);
+                void this.session.localReset(this, normalized);
+                throw normalized;
             }
         });
         return copy.length;
@@ -1074,16 +1141,26 @@ class EncryptedStreamV2 {
     async closeWrite() {
         await this.opened.promise;
         await this.waitSendRekey();
-        if (this.localFIN || this.terminalError !== undefined)
+        if (this.localFIN)
             return;
-        await this.enqueueSend(async () => {
-            if (this.localFIN)
-                return;
-            this.localFIN = true;
-            await this.session.sendStreamRecord(this, InnerTypeV2.FIN, new Uint8Array());
-            await this.carrier.closeWrite();
-            this.releaseIfClean();
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
+        this.closeWriteTask ??= this.enqueueSend(async () => {
+            try {
+                if (this.localFIN)
+                    return;
+                await this.session.sendStreamRecord(this, InnerTypeV2.FIN, new Uint8Array());
+                await this.carrier.closeWrite();
+                this.localFIN = true;
+                this.releaseIfClean();
+            }
+            catch (error) {
+                const normalized = asError(error);
+                void this.session.localReset(this, normalized);
+                throw normalized;
+            }
         });
+        await this.closeWriteTask;
     }
     async reset() {
         await this.session.localReset(this, new SessionV2Error("stream_reset", "logical stream reset"));
@@ -1097,6 +1174,9 @@ class EncryptedStreamV2 {
     canRekeySend() {
         return this.terminalError === undefined && this.opened.settled && !this.localFIN;
     }
+    hasRemoteFIN() {
+        return this.remoteFIN;
+    }
     startSendRekey(transition, epoch) {
         if (this.pendingSendRekey !== undefined)
             throw protocolError("overlapping stream rekey");
@@ -1157,6 +1237,11 @@ class EncryptedStreamV2 {
         this.carrier.abort(error);
         this.session.releaseStream(this);
     }
+    carrierReset() {
+        if (!this.markTerminal(new SessionV2Error("stream_reset", "logical stream reset by peer")))
+            return;
+        this.session.releaseStream(this);
+    }
     abort(error = new SessionV2Error("closed", "logical stream aborted")) {
         this.peerReset(error);
     }
@@ -1196,6 +1281,7 @@ class EncryptedStreamV2 {
                     case InnerTypeV2.Data:
                         if (this.remoteFIN)
                             throw protocolError("DATA after FIN");
+                        await this.data.waitForCapacity(record.payload.length);
                         this.data.push(record.payload);
                         break;
                     case InnerTypeV2.FIN:
@@ -1218,6 +1304,10 @@ class EncryptedStreamV2 {
         }
         catch (error) {
             const normalized = asError(error);
+            if (normalized instanceof CarrierError && normalized.code === "reset") {
+                this.carrierReset();
+                return;
+            }
             if (this.remoteFIN && /closed|EOF/i.test(normalized.message)) {
                 this.releaseIfClean();
                 return;
@@ -1461,6 +1551,7 @@ class ByteQueue {
     closed = false;
     error;
     waiters = new Set();
+    capacityWaiters = new Set();
     constructor(limit) {
         this.limit = limit;
     }
@@ -1485,6 +1576,26 @@ class ByteQueue {
         this.head = 0;
         this.bytes = 0;
         this.wake(error);
+        this.wakeCapacity(error);
+    }
+    async waitForCapacity(required) {
+        if (!Number.isInteger(required) || required < 0 || required > this.limit) {
+            throw new RangeError("invalid stream receive capacity request");
+        }
+        while (this.bytes + required > this.limit) {
+            if (this.error !== undefined)
+                throw this.error;
+            if (this.closed)
+                return;
+            const waiter = deferred();
+            this.capacityWaiters.add(waiter);
+            try {
+                await waiter.promise;
+            }
+            finally {
+                this.capacityWaiters.delete(waiter);
+            }
+        }
     }
     async read(signal) {
         while (true) {
@@ -1493,6 +1604,7 @@ class ByteQueue {
             if (this.head < this.chunks.length) {
                 const chunk = this.chunks[this.head++];
                 this.bytes -= chunk.length;
+                this.wakeCapacity();
                 if (this.head > 1_024 && this.head * 2 > this.chunks.length) {
                     this.chunks.splice(0, this.head);
                     this.head = 0;
@@ -1516,6 +1628,11 @@ class ByteQueue {
             error === undefined ? waiter.resolve() : waiter.reject(error);
         this.waiters.clear();
     }
+    wakeCapacity(error) {
+        for (const waiter of [...this.capacityWaiters])
+            error === undefined ? waiter.resolve() : waiter.reject(error);
+        this.capacityWaiters.clear();
+    }
 }
 class AsyncSemaphore {
     available;
@@ -1742,6 +1859,12 @@ async function settleWithin(promise, timeoutMs) {
         void promise.then(() => { clearTimeout(timer); resolve(true); }, () => { clearTimeout(timer); resolve(true); });
     });
 }
+async function resolveWithin(promise, timeoutMs) {
+    return await new Promise((resolve) => {
+        const timer = setTimeout(() => resolve(false), timeoutMs);
+        void promise.then(() => { clearTimeout(timer); resolve(true); }, () => { clearTimeout(timer); resolve(false); });
+    });
+}
 function sessionIdleTimeoutMs(config) {
     const timeoutMs = config.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 0) {
@@ -1845,6 +1968,13 @@ function abortedError() {
 function abortReason(signal) {
     return signal.reason instanceof Error ? signal.reason : abortedError();
 }
+function releasedStreamCleanup(streams) {
+    return new FinalizationRegistry((id) => {
+        const stream = streams.get(id);
+        if (stream !== undefined && stream.deref() === undefined)
+            streams.delete(id);
+    });
+}
 function createSessionDeadline(config, phase) {
     const deadlines = config.deadlines;
     const timeoutMs = phase === "establish"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "2.3.8",
+  "version": "2.3.10",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {
@@ -77,7 +77,7 @@
     "ws": "^8.21.2"
   },
   "optionalDependencies": {
-    "@floegence/flowersec-node-native": "2.3.8"
+    "@floegence/flowersec-node-native": "2.3.10"
   },
   "devDependencies": {
     "@playwright/test": "1.62.1",
@@ -95,5 +95,5 @@
     "vite": "^8.2.1",
     "vitest": "4.1.10"
   },
-  "flowersecSourceCommit": "42ecb756ca3b1d0201628534f0304f9d95b09915"
+  "flowersecSourceCommit": "67e5ff521e77982e4f57e8ba5eb858df3e48c886"
 }

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e995e70c-2186-53ce-8d53-420ef784523c",
+  "serialNumber": "urn:uuid:2ff806a3-4e32-5ae7-867b-3dc94826ed55",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "2.3.8",
-      "purl": "pkg:npm/%40floegence/flowersec-core@2.3.8",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.3.8"
+      "version": "2.3.10",
+      "purl": "pkg:npm/%40floegence/flowersec-core@2.3.10",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.3.10"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "61acdda38c1b589f90670adc84ce2cfd838f91aaae3f7881bfc17397951c98ca"
+        "value": "36475d4f06355a764285462713f086777546ed34fe2ea5911961d9bb9a3037f1"
       }
     ]
   },
@@ -190,7 +190,7 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@2.3.8",
+      "ref": "pkg:npm/%40floegence/flowersec-core@2.3.10",
       "dependsOn": [
         "pkg:npm/%40noble/ciphers@2.3.0",
         "pkg:npm/%40noble/curves@2.3.0",

package/sbom/spdx.json

@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "flowersec-ts",
-  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/61acdda38c1b589f90670adc84ce2cfd838f91aaae3f7881bfc17397951c98ca",
+  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/36475d4f06355a764285462713f086777546ed34fe2ea5911961d9bb9a3037f1",
   "creationInfo": {
     "created": "1970-01-01T00:00:00Z",
     "creators": [
@@ -13,19 +13,19 @@
   "packages": [
     {
       "name": "@floegence/flowersec-core",
-      "SPDXID": "SPDXRef-Package-4908e4f26e4e95fbc182",
-      "versionInfo": "2.3.8",
+      "SPDXID": "SPDXRef-Package-bd5ff7d2005890830d32",
+      "versionInfo": "2.3.10",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "NOASSERTION",
       "copyrightText": "NOASSERTION",
-      "comment": "Flowersec source inventory SHA-256: 61acdda38c1b589f90670adc84ce2cfd838f91aaae3f7881bfc17397951c98ca",
+      "comment": "Flowersec source inventory SHA-256: 36475d4f06355a764285462713f086777546ed34fe2ea5911961d9bb9a3037f1",
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@2.3.8"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@2.3.10"
         }
       ]
     },
@@ -136,30 +136,30 @@
     {
       "spdxElementId": "SPDXRef-DOCUMENT",
       "relationshipType": "DESCRIBES",
-      "relatedSpdxElement": "SPDXRef-Package-4908e4f26e4e95fbc182"
+      "relatedSpdxElement": "SPDXRef-Package-bd5ff7d2005890830d32"
     },
     {
-      "spdxElementId": "SPDXRef-Package-4908e4f26e4e95fbc182",
+      "spdxElementId": "SPDXRef-Package-bd5ff7d2005890830d32",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-5ce913a03239b02770fb"
     },
     {
-      "spdxElementId": "SPDXRef-Package-4908e4f26e4e95fbc182",
+      "spdxElementId": "SPDXRef-Package-bd5ff7d2005890830d32",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-01009adf60db02c13634"
     },
     {
-      "spdxElementId": "SPDXRef-Package-4908e4f26e4e95fbc182",
+      "spdxElementId": "SPDXRef-Package-bd5ff7d2005890830d32",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-8815b117c8a1d5f7eeb0"
     },
     {
-      "spdxElementId": "SPDXRef-Package-4908e4f26e4e95fbc182",
+      "spdxElementId": "SPDXRef-Package-bd5ff7d2005890830d32",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-f8b45a289df643042b94"
     },
     {
-      "spdxElementId": "SPDXRef-Package-4908e4f26e4e95fbc182",
+      "spdxElementId": "SPDXRef-Package-bd5ff7d2005890830d32",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-b779412f685822663496"
     },