@floegence/flowersec-core 2.5.2 → 2.5.4

package/dist/proxy/wsPatch.d.ts

@@ -4,6 +4,7 @@ export type WebSocketPatchOptions = Readonly<{
     shouldProxy?: (url: URL) => boolean;
     maxWsFrameBytes?: number;
     maxWsBufferedAmountBytes?: number;
+    closeHandshakeTimeoutMs?: number;
 }>;
 export declare function installWebSocketPatch(options: WebSocketPatchOptions): Readonly<{
     uninstall(): void;

package/dist/proxy/wsPatch.js

@@ -64,6 +64,7 @@ export function installWebSocketPatch(options) {
     const runtimeLimits = options.runtime.limits;
     const maxFrameBytes = limit("maxWsFrameBytes", options.maxWsFrameBytes, runtimeLimits.maxWsFrameBytes ?? 1024 * 1024);
     const maxBufferedBytes = limit("maxWsBufferedAmountBytes", options.maxWsBufferedAmountBytes, runtimeLimits.maxWsBufferedAmountBytes ?? 4 * 1024 * 1024);
+    const closeHandshakeTimeoutMs = limit("closeHandshakeTimeoutMs", options.closeHandshakeTimeoutMs, 5_000);
     const shouldProxy = options.shouldProxy ?? ((url) => {
         const location = globalThis.location;
         if (location?.hostname === undefined || location.hostname === "")
@@ -95,6 +96,7 @@ export function installWebSocketPatch(options) {
         abort = new AbortController();
         stream;
         writes = Promise.resolve();
+        closeTimer;
         constructor(input, protocols) {
             const url = new URL(String(input), globalThis.location?.href);
             if (!shouldProxy(url))
@@ -152,12 +154,17 @@ export function installWebSocketPatch(options) {
             const reasonBytes = encoder.encode(reason);
             if (reasonBytes.length > 123)
                 throw new DOMException("WebSocket close reason is too long", "SyntaxError");
+            if (this.readyState === ProxyWebSocket.CONNECTING || this.stream === undefined) {
+                this.fail();
+                return;
+            }
             this.readyState = ProxyWebSocket.CLOSING;
             const payload = code === undefined ? new Uint8Array() : new Uint8Array([...u16be(code), ...reasonBytes]);
-            this.writes = this.writes.then(async () => {
-                if (this.stream !== undefined)
-                    await writeFrame(this.stream, 8, payload, maxFrameBytes);
-            }).catch(() => undefined).finally(() => this.abort.abort());
+            const stream = this.stream;
+            this.closeTimer = setTimeout(() => this.fail(), closeHandshakeTimeoutMs);
+            this.writes = this.writes
+                .then(async () => await writeFrame(stream, 8, payload, maxFrameBytes))
+                .catch(() => this.fail());
         }
         async connect(url, protocols) {
             try {
@@ -183,10 +190,19 @@ export function installWebSocketPatch(options) {
                     this.writes = this.writes.then(async () => await writeFrame(stream, 10, frame.payload, maxFrameBytes)).catch(() => this.fail());
                 }
                 else if (frame.opcode === 8) {
+                    if (frame.payload.length === 1)
+                        throw new Error("invalid WebSocket close frame");
                     const code = frame.payload.length >= 2 ? readU16(frame.payload) : 1000;
                     const reason = frame.payload.length > 2 ? decoder.decode(frame.payload.subarray(2)) : "";
-                    this.readyState = ProxyWebSocket.CLOSED;
-                    this.emit("close", new CloseEvent("close", { code, reason, wasClean: true }));
+                    const peerInitiated = this.readyState === ProxyWebSocket.OPEN;
+                    this.readyState = ProxyWebSocket.CLOSING;
+                    if (this.closeTimer !== undefined)
+                        clearTimeout(this.closeTimer);
+                    if (peerInitiated) {
+                        this.writes = this.writes.then(async () => await writeFrame(stream, 8, frame.payload, maxFrameBytes));
+                    }
+                    await this.writes;
+                    this.completeClose(code, reason);
                     return;
                 }
                 else if (frame.opcode === 1) {
@@ -211,12 +227,29 @@ export function installWebSocketPatch(options) {
         fail() {
             if (this.readyState === ProxyWebSocket.CLOSED)
                 return;
+            if (this.closeTimer !== undefined)
+                clearTimeout(this.closeTimer);
             this.readyState = ProxyWebSocket.CLOSED;
             this.bufferedAmount = 0;
             this.emit("error", new Event("error"));
             this.emit("close", new CloseEvent("close", { code: 1006, reason: "proxy WebSocket failed", wasClean: false }));
+            const stream = this.stream;
+            this.stream = undefined;
+            this.abort.abort();
+            void stream?.reset().catch(() => undefined);
+        }
+        completeClose(code, reason) {
+            if (this.readyState === ProxyWebSocket.CLOSED)
+                return;
+            if (this.closeTimer !== undefined)
+                clearTimeout(this.closeTimer);
+            this.readyState = ProxyWebSocket.CLOSED;
+            this.bufferedAmount = 0;
+            this.emit("close", new CloseEvent("close", { code, reason, wasClean: true }));
+            const stream = this.stream;
             this.stream = undefined;
             this.abort.abort();
+            void stream?.close().catch(() => stream.reset().catch(() => undefined));
         }
     }
     globalThis.WebSocket = ProxyWebSocket;

package/dist/rpc/client.js

@@ -1,5 +1,5 @@
 import { DEFAULT_MAX_JSON_FRAME_BYTES, readJsonFrame, writeJsonFrame } from "../framing/jsonframe.js";
-import { assertRpcEnvelope } from "./validate.js";
+import { assertRpcEnvelope, assertRpcTypeId } from "./validate.js";
 // Guard against precision loss when encoding request IDs as numbers.
 const MAX_SAFE_REQUEST_ID = BigInt(Number.MAX_SAFE_INTEGER);
 // RpcClient sends request/response envelopes and dispatches notifications.
@@ -25,12 +25,13 @@ export class RpcClient {
     async call(typeId, payload, signal) {
         if (this.closed)
             throw new Error("rpc client closed");
+        const validatedTypeId = assertRpcTypeId(typeId);
         if (this.nextId > MAX_SAFE_REQUEST_ID)
             throw new Error("request id overflow");
         const requestId = this.nextId;
         this.nextId += 1n;
         const env = {
-            type_id: typeId >>> 0,
+            type_id: validatedTypeId,
             request_id: Number(requestId),
             response_to: 0,
             payload
@@ -39,7 +40,7 @@ export class RpcClient {
             this.pending.set(requestId, { resolve, reject });
         });
         try {
-            await writeJsonFrame(this.write, env);
+            await writeJsonFrame(this.write, env, DEFAULT_MAX_JSON_FRAME_BYTES);
         }
         catch (e) {
             this.pending.delete(requestId);
@@ -71,7 +72,7 @@ export class RpcClient {
     }
     // onNotify registers a handler for incoming notifications.
     onNotify(typeId, handler) {
-        const tid = typeId >>> 0;
+        const tid = assertRpcTypeId(typeId);
         const set = this.notifyHandlers.get(tid) ?? new Set();
         set.add(handler);
         this.notifyHandlers.set(tid, set);
@@ -86,13 +87,14 @@ export class RpcClient {
     async notify(typeId, payload) {
         if (this.closed)
             throw new Error("rpc client closed");
+        const validatedTypeId = assertRpcTypeId(typeId);
         const env = {
-            type_id: typeId >>> 0,
+            type_id: validatedTypeId,
             request_id: 0,
             response_to: 0,
             payload
         };
-        await writeJsonFrame(this.write, env);
+        await writeJsonFrame(this.write, env, DEFAULT_MAX_JSON_FRAME_BYTES);
     }
     async readLoop() {
         try {
@@ -101,7 +103,7 @@ export class RpcClient {
                 if (v.response_to === 0) {
                     // Notification: response_to=0 and request_id=0.
                     if (v.request_id === 0) {
-                        const set = this.notifyHandlers.get(v.type_id >>> 0);
+                        const set = this.notifyHandlers.get(v.type_id);
                         if (set != null) {
                             for (const h of set) {
                                 try {

package/dist/rpc/server.js

@@ -1,5 +1,5 @@
 import { DEFAULT_MAX_JSON_FRAME_BYTES, readJsonFrame, writeJsonFrame } from "../framing/jsonframe.js";
-import { assertRpcEnvelope, assertRpcError } from "./validate.js";
+import { assertRpcEnvelope, assertRpcError, assertRpcTypeId } from "./validate.js";
 import { SDK_DEFAULTS } from "../defaults.js";
 const DEFAULT_RPC_SERVER_OPTIONS = Object.freeze({
     maxConcurrentRequests: SDK_DEFAULTS.rpc.maxConcurrentRequests,
@@ -10,13 +10,13 @@ export class RpcRouter {
     handlers = new Map();
     notifyHandlers = new Map();
     register(typeId, handler) {
-        this.handlers.set(typeId >>> 0, handler);
+        this.handlers.set(assertRpcTypeId(typeId), handler);
     }
     handler(typeId) {
-        return this.handlers.get(typeId >>> 0);
+        return this.handlers.get(assertRpcTypeId(typeId));
     }
     onNotify(typeId, handler) {
-        const normalized = typeId >>> 0;
+        const normalized = assertRpcTypeId(typeId);
         const handlers = this.notifyHandlers.get(normalized) ?? new Set();
         handlers.add(handler);
         this.notifyHandlers.set(normalized, handlers);
@@ -27,7 +27,7 @@ export class RpcRouter {
         };
     }
     async dispatchNotification(typeId, payload) {
-        const normalized = typeId >>> 0;
+        const normalized = assertRpcTypeId(typeId);
         const requestHandler = this.handlers.get(normalized);
         if (requestHandler !== undefined)
             await requestHandler(payload);
@@ -76,7 +76,7 @@ export class RpcServer {
         if (this.closed)
             throw new Error("rpc server closed");
         await this.writeEnvelope({
-            type_id: typeId >>> 0,
+            type_id: assertRpcTypeId(typeId),
             request_id: 0,
             response_to: 0,
             payload,
@@ -93,6 +93,7 @@ export class RpcServer {
             return await new Promise(() => undefined);
         }));
         let failure;
+        const aborted = abortPromise(signal);
         try {
             while (!this.closed) {
                 if (signal?.aborted)
@@ -101,6 +102,7 @@ export class RpcServer {
                     readJsonFrame(this.transport.readExactly, DEFAULT_MAX_JSON_FRAME_BYTES),
                     this.terminalSignal.then((error) => { throw error; }),
                     workerFailure,
+                    ...(aborted === undefined ? [] : [aborted.promise]),
                 ]);
                 const v = assertRpcEnvelope(next);
                 if (v.response_to !== 0)
@@ -126,6 +128,9 @@ export class RpcServer {
             failure = err;
             this.terminalError = err;
         }
+        finally {
+            aborted?.cleanup();
+        }
         let closeError;
         try {
             this.close(failure ?? this.terminalError ?? new Error("rpc server closed"));
@@ -173,19 +178,23 @@ export class RpcServer {
             if (work == null)
                 return;
             const v = work.envelope;
-            const h = this.router.handler(v.type_id);
-            let out;
-            if (h == null)
-                out = { payload: null, error: { code: 404, message: "handler not found" } };
-            else {
-                try {
-                    out = await h(v.payload);
-                }
-                catch {
-                    out = { payload: null, error: { code: 500, message: "internal error" } };
-                }
-            }
             try {
+                const h = this.router.handler(v.type_id);
+                let out;
+                if (h == null)
+                    out = { payload: null, error: { code: 404, message: "handler not found" } };
+                else {
+                    const outcome = await Promise.race([
+                        Promise.resolve().then(() => h(v.payload)).then((value) => ({ kind: "completed", value }), () => ({
+                            kind: "completed",
+                            value: { payload: null, error: { code: 500, message: "internal error" } },
+                        })),
+                        this.terminalSignal.then(() => ({ kind: "terminated" })),
+                    ]);
+                    if (outcome.kind === "terminated")
+                        return;
+                    out = outcome.value;
+                }
                 if (this.closed)
                     return;
                 await this.writeResponse(v, out);
@@ -201,7 +210,12 @@ export class RpcServer {
             if (work == null)
                 return;
             const v = work.envelope;
-            await this.router.dispatchNotification(v.type_id, v.payload);
+            const completed = await Promise.race([
+                Promise.resolve().then(() => this.router.dispatchNotification(v.type_id, v.payload)).then(() => true),
+                this.terminalSignal.then(() => false),
+            ]);
+            if (!completed)
+                return;
         }
     }
     async nextWork(queue, waiters) {
@@ -236,7 +250,7 @@ export class RpcServer {
         await this.writeEnvelope(resp);
     }
     async writeEnvelope(envelope) {
-        const write = this.writeChain.then(() => writeJsonFrame(this.transport.write, envelope));
+        const write = this.writeChain.then(() => writeJsonFrame(this.transport.write, envelope, DEFAULT_MAX_JSON_FRAME_BYTES));
         this.writeChain = write;
         try {
             await write;
@@ -247,6 +261,16 @@ export class RpcServer {
         }
     }
 }
+function abortPromise(signal) {
+    if (signal === undefined || signal.aborted)
+        return undefined;
+    let onAbort;
+    const promise = new Promise((_resolve, reject) => {
+        onAbort = () => reject(signal.reason ?? new Error("aborted"));
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+    return { promise, cleanup: () => signal.removeEventListener("abort", onAbort) };
+}
 function positiveInteger(value, name) {
     if (!Number.isSafeInteger(value) || value <= 0)
         throw new RangeError(`${name} must be a positive integer`);

package/dist/rpc/validate.d.ts

@@ -1,3 +1,4 @@
 import type { RpcEnvelope, RpcError } from "./wire.js";
 export declare function assertRpcEnvelope(v: unknown): RpcEnvelope;
+export declare function assertRpcTypeId(value: unknown): number;
 export declare function assertRpcError(value: unknown): RpcError;

package/dist/rpc/validate.js

@@ -6,21 +6,33 @@ const strictDecoder = new TextDecoder("utf-8", { fatal: true });
 // The wire format is JSON, so JS numbers are used. For u64 we enforce the safe integer range
 // to avoid silent precision loss on request/response correlation.
 export function assertRpcEnvelope(v) {
-    if (typeof v !== "object" || v == null)
+    if (typeof v !== "object" || v == null || Array.isArray(v))
         throw new Error("bad rpc envelope");
     const o = v;
-    if (!isSafeU32Number(o.type_id))
-        throw new Error("bad rpc envelope: type_id");
+    const keys = Object.keys(o);
+    if (keys.some((key) => key !== "type_id" && key !== "request_id" && key !== "response_to" && key !== "payload" && key !== "error")) {
+        throw new Error("bad rpc envelope: shape");
+    }
+    if (!Object.prototype.hasOwnProperty.call(o, "payload"))
+        throw new Error("bad rpc envelope: payload");
+    assertRpcTypeId(o.type_id);
     if (!isSafeU64Number(o.request_id))
         throw new Error("bad rpc envelope: request_id");
     if (!isSafeU64Number(o.response_to))
         throw new Error("bad rpc envelope: response_to");
-    // payload: unknown (JSON)
-    if (o.error != null) {
+    if (o.request_id !== 0 && o.response_to !== 0)
+        throw new Error("bad rpc envelope: request/response shape");
+    if (o.error != null && o.response_to === 0)
+        throw new Error("bad rpc envelope: error shape");
+    if (o.error != null)
         assertRpcError(o.error);
-    }
     return o;
 }
+export function assertRpcTypeId(value) {
+    if (!isSafeU32Number(value) || value === 0)
+        throw new RangeError("RPC typeId must be a non-zero u32 integer");
+    return value;
+}
 export function assertRpcError(value) {
     if (typeof value !== "object" || value == null)
         throw new Error("bad rpc envelope: error");

package/dist/transport/webTransportAdapter.js

@@ -327,6 +327,7 @@ class WebTransportDatagramAdapter {
         this.terminalError = error;
         this.incoming.fail(error);
         void this.writable.abort(error).catch(() => undefined);
+        void this.readable.cancel(error).catch(() => undefined);
     }
     assertOpen() {
         if (this.terminalError !== undefined)
@@ -416,15 +417,26 @@ class IncomingWebTransportStreamQueue {
     }
 }
 class IncomingDatagramQueue {
+    static MAX_VALUES = 256;
+    static MAX_BYTES = 4 * 1024 * 1024;
     values = [];
+    bufferedBytes = 0;
     waiters = new Set();
     terminalError;
     push(value) {
         if (this.terminalError !== undefined)
             return;
         const waiter = this.waiters.values().next().value;
-        if (waiter === undefined)
+        if (waiter === undefined) {
+            // DATAGRAMs are lossy by contract. Drop an incoming value once the
+            // bounded queue budget is exhausted, while keeping the native reader
+            // drained so an unconsumed peer cannot grow memory without bound.
+            if (this.values.length >= IncomingDatagramQueue.MAX_VALUES ||
+                this.bufferedBytes + value.byteLength > IncomingDatagramQueue.MAX_BYTES)
+                return;
             this.values.push(value);
+            this.bufferedBytes += value.byteLength;
+        }
         else
             waiter.deliver(value);
     }
@@ -434,8 +446,10 @@ class IncomingDatagramQueue {
         if (this.terminalError !== undefined)
             return Promise.reject(this.terminalError);
         const value = this.values.shift();
-        if (value !== undefined)
+        if (value !== undefined) {
+            this.bufferedBytes -= value.byteLength;
             return Promise.resolve(value);
+        }
         return new Promise((resolve, reject) => {
             let settled = false;
             const cleanup = () => {
@@ -470,6 +484,7 @@ class IncomingDatagramQueue {
             return;
         this.terminalError = error;
         this.values.length = 0;
+        this.bufferedBytes = 0;
         for (const waiter of [...this.waiters])
             waiter.fail(error);
     }

package/dist/v2/publicSession.js

@@ -1,5 +1,6 @@
 import { SessionError } from "./contract.js";
 import { createStreamMetadataV2, streamMetadataValuesV2 } from "./streamMetadata.js";
+import { assertRpcTypeId } from "../rpc/validate.js";
 /** @internal */
 export function projectSessionV2(session) {
     const notificationOwner = {
@@ -132,6 +133,7 @@ function projectRpcPeerV2(peer, notificationOwner) {
     return Object.freeze({
         async call(typeId, payload, decodeResponse, options) {
             try {
+                assertRpcTypeId(typeId);
                 assertJsonValue(payload);
                 const result = await peer.call(typeId, payload, options?.signal);
                 if (result.error !== undefined) {
@@ -146,6 +148,7 @@ function projectRpcPeerV2(peer, notificationOwner) {
         },
         async notify(typeId, payload, options) {
             try {
+                assertRpcTypeId(typeId);
                 assertJsonValue(payload);
                 if (options?.signal?.aborted)
                     throw options.signal.reason ?? new DOMException("The operation was aborted", "AbortError");
@@ -156,6 +159,7 @@ function projectRpcPeerV2(peer, notificationOwner) {
             }
         },
         onNotify(typeId, decodePayload, handler) {
+            assertRpcTypeId(typeId);
             if (notificationOwner.closed)
                 return () => undefined;
             const unsubscribe = peer.onNotify(typeId, (payload) => {

package/dist/v2/session.d.ts

@@ -132,7 +132,7 @@ export declare class SessionV2 implements SessionV2Contract {
     private peerResponderFrozen;
     private responderChanged;
     private idleWatchdogStarted;
-    private idleTimer;
+    private idleTimerCancel;
     private readonly terminationState;
     private readonly rpcRouter;
     constructor(carrier: CarrierSessionV2, control: CarrierStreamV2, controlReader: ExactReader, config: SessionConfigV2, material: HandshakeMaterial);

package/dist/v2/session.js

@@ -137,7 +137,7 @@ export class SessionV2 {
     peerResponderFrozen = false;
     responderChanged = deferred();
     idleWatchdogStarted = false;
-    idleTimer;
+    idleTimerCancel;
     terminationState = deferred();
     rpcRouter;
     constructor(carrier, control, controlReader, config, material) {
@@ -1017,10 +1017,9 @@ export class SessionV2 {
         const timeoutMs = sessionIdleTimeoutMs(this.config);
         if (timeoutMs === 0)
             return;
-        if (this.idleTimer !== undefined)
-            clearTimeout(this.idleTimer);
-        this.idleTimer = setTimeout(() => {
-            this.idleTimer = undefined;
+        this.idleTimerCancel?.();
+        this.idleTimerCancel = scheduleLongTimeout(() => {
+            this.idleTimerCancel = undefined;
             this.fail(new SessionV2Error("timeout", "Flowersec v2 session idle timeout exceeded"));
         }, timeoutMs);
     }
@@ -1034,10 +1033,8 @@ export class SessionV2 {
         this.terminalError = error;
         this.lifecycle = "closed";
         this.terminationState.resolve({ error });
-        if (this.idleTimer !== undefined) {
-            clearTimeout(this.idleTimer);
-            this.idleTimer = undefined;
-        }
+        this.idleTimerCancel?.();
+        this.idleTimerCancel = undefined;
         this.incoming.fail(error);
         this.outboundPermits.fail(error);
         this.inboundPermits.fail(error);
@@ -1227,6 +1224,10 @@ class EncryptedStreamV2 {
         if (this.terminalError !== undefined)
             return false;
         this.terminalError = error;
+        const pendingSendRekey = this.pendingSendRekey;
+        this.pendingSendRekey = undefined;
+        pendingSendRekey?.armed.reject(error);
+        pendingSendRekey?.done.reject(error);
         this.opened.reject(error);
         this.data.fail(error);
         return true;
@@ -1988,12 +1989,38 @@ function createSessionDeadline(config, phase) {
 }
 function defaultDeadlineFactory(timeoutMs, phase) {
     const controller = new AbortController();
-    const timer = setTimeout(() => {
+    const cancelTimer = scheduleLongTimeout(() => {
         controller.abort(new SessionV2Error("timeout", `${phase} deadline exceeded`));
     }, timeoutMs);
     return {
         signal: controller.signal,
-        cancel: () => clearTimeout(timer),
+        cancel: cancelTimer,
+    };
+}
+const MAX_NATIVE_TIMEOUT_MS = 2_147_483_647;
+// Node and browsers clamp setTimeout delays above a signed 32-bit integer.
+// Keep the public timeout range intact by scheduling the remaining duration in
+// bounded segments against a monotonic wall-clock deadline.
+function scheduleLongTimeout(callback, timeoutMs) {
+    const clock = () => typeof performance !== "undefined" ? performance.now() : Date.now();
+    const deadline = clock() + timeoutMs;
+    let timer;
+    let canceled = false;
+    const schedule = () => {
+        if (canceled)
+            return;
+        const remaining = deadline - clock();
+        if (remaining <= 0) {
+            callback();
+            return;
+        }
+        timer = setTimeout(schedule, Math.min(remaining, MAX_NATIVE_TIMEOUT_MS));
+    };
+    schedule();
+    return () => {
+        canceled = true;
+        if (timer !== undefined)
+            clearTimeout(timer);
     };
 }
 function combineSignals(...signals) {

package/dist/yamux/stream.d.ts

@@ -12,6 +12,8 @@ export declare class YamuxStream {
     private readWaiters;
     private error;
     private resetTask;
+    private closeTask;
+    private closeRequested;
     private writeChain;
     private writeQueueBytes;
     private finalized;
@@ -23,6 +25,7 @@ export declare class YamuxStream {
     write(data: Uint8Array): Promise<void>;
     private writeSerial;
     close(): Promise<void>;
+    private closeSerial;
     reset(err?: Error): Promise<void>;
     abort(err?: Error): void;
     private fail;

package/dist/yamux/stream.js

@@ -24,6 +24,8 @@ export class YamuxStream {
     // Terminal error (reset/overflow) for the stream.
     error = null;
     resetTask;
+    closeTask;
+    closeRequested = false;
     writeChain = Promise.resolve();
     writeQueueBytes = 0;
     finalized = false;
@@ -89,6 +91,8 @@ export class YamuxStream {
     }
     // write sends DATA frames, respecting the send window.
     async write(data) {
+        if (this.closeRequested)
+            throw new Error("stream closed");
         this.ensureWritable();
         const byteCount = data.byteLength;
         const nextQueueBytes = this.writeQueueBytes + byteCount;
@@ -129,10 +133,19 @@ export class YamuxStream {
         }
     }
     // close sends FIN and transitions to local close.
-    async close() {
-        if (this.state === "closed")
-            return;
-        if (this.state === "reset")
+    close() {
+        if (this.closeTask !== undefined)
+            return this.closeTask;
+        if (this.state === "closed" || this.state === "reset" || this.state === "localClose")
+            return Promise.resolve();
+        this.closeRequested = true;
+        const task = this.writeChain.then(async () => await this.closeSerial());
+        this.writeChain = task.catch(() => undefined);
+        this.closeTask = task;
+        return task;
+    }
+    async closeSerial() {
+        if (this.state === "closed" || this.state === "reset" || this.state === "localClose")
             return;
         const wasRemoteClose = this.state === "remoteClose";
         const flags = this.sendFlags() | FLAG_FIN;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "2.5.2",
+  "version": "2.5.4",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {
@@ -77,7 +77,7 @@
     "ws": "^8.21.2"
   },
   "optionalDependencies": {
-    "@floegence/flowersec-node-native": "2.5.2"
+    "@floegence/flowersec-node-native": "2.5.4"
   },
   "devDependencies": {
     "@playwright/test": "1.62.1",
@@ -95,5 +95,5 @@
     "vite": "^8.2.1",
     "vitest": "4.1.10"
   },
-  "flowersecSourceCommit": "2aca169b79bc65a1e1ff51ca5356d0ed5dcbf18a"
+  "flowersecSourceCommit": "026cb52d116d2a04de50d0f0621fff57c7657120"
 }

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3a83166e-0cec-5e55-814a-79ffaf005d24",
+  "serialNumber": "urn:uuid:9db05d70-0170-5669-8eb4-881e06b18415",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "2.5.2",
-      "purl": "pkg:npm/%40floegence/flowersec-core@2.5.2",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.5.2"
+      "version": "2.5.4",
+      "purl": "pkg:npm/%40floegence/flowersec-core@2.5.4",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.5.4"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "8d179ba65d4598bdeb169b3dbcc8732a8e0aa8fc724f228eacbb117ad49ce149"
+        "value": "308ce3a2dd421245b940297e16fbb6cae9cc3d79e4835164e4304b5f7acd5ca8"
       }
     ]
   },
@@ -190,7 +190,7 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@2.5.2",
+      "ref": "pkg:npm/%40floegence/flowersec-core@2.5.4",
       "dependsOn": [
         "pkg:npm/%40noble/ciphers@2.3.0",
         "pkg:npm/%40noble/curves@2.3.0",