@floegence/flowersec-core 2.5.3 → 2.5.4

package/dist/framing/jsonframe.d.ts

@@ -9,6 +9,6 @@ type ReadExactlyFn = (n: number) => Promise<Uint8Array>;
 type ReadExactlyLike = Readonly<{
     readExactly: (n: number) => Promise<Uint8Array>;
 }>;
-export declare function writeJsonFrame(write: WriteFn | WriteLike, v: unknown): Promise<void>;
+export declare function writeJsonFrame(write: WriteFn | WriteLike, v: unknown, maxBytes?: number): Promise<void>;
 export declare function readJsonFrame(readExactly: ReadExactlyFn | ReadExactlyLike, maxBytes: number): Promise<unknown>;
 export {};

package/dist/framing/jsonframe.js

@@ -13,8 +13,10 @@ function normalizeReadExactly(readExactly) {
     return typeof readExactly === "function" ? readExactly : (n) => readExactly.readExactly(n);
 }
 // writeJsonFrame encodes a JSON payload with a 4-byte length prefix.
-export async function writeJsonFrame(write, v) {
+export async function writeJsonFrame(write, v, maxBytes = 0) {
     const json = te.encode(JSON.stringify(v));
+    if (maxBytes > 0 && json.length > maxBytes)
+        throw new JsonFramingError("frame too large");
     const hdr = u32be(json.length);
     const out = new Uint8Array(4 + json.length);
     out.set(hdr, 0);

package/dist/node/acceptor.js

@@ -1,5 +1,5 @@
 import { RpcRouter } from "../rpc/server.js";
-import { assertRpcError } from "../rpc/validate.js";
+import { assertRpcError, assertRpcTypeId } from "../rpc/validate.js";
 import { acceptReceivedSessionV2, receiveSessionAdmissionV2, rejectSessionAdmissionV2, } from "../connector/sessionAcceptor.js";
 import { nodeSessionRuntimeV2 } from "./sessionRuntime.js";
 import { startNodeWebSocketServer, } from "./webSocketServer.js";
@@ -85,10 +85,13 @@ function registerNotification(state, typeId, handler) {
     state.notifications.set(typeId, handler);
 }
 function validateRPCRegistration(typeId, handler) {
-    if (!Number.isSafeInteger(typeId)
-        || typeId < 1
-        || typeId > 0xffff_ffff
-        || typeof handler !== "function") {
+    try {
+        assertRpcTypeId(typeId);
+    }
+    catch {
+        throw new HandlerRegistrationError("invalid_handler");
+    }
+    if (typeof handler !== "function") {
         throw new HandlerRegistrationError("invalid_handler");
     }
 }

package/dist/proxy/runtime.js

@@ -45,11 +45,34 @@ function normalizeTimeout(input) {
     }
     return input;
 }
+class InvalidProxyPathError extends TypeError {
+}
 function normalizePath(input) {
-    if (input !== input.trim() || !input.startsWith("/") || input.startsWith("//") || /[\u0000-\u0020]/u.test(input) || input.includes("://")) {
-        throw new TypeError("proxy path must be an origin-relative path");
+    if (input !== input.trim() || !input.startsWith("/") || input.startsWith("//") || /[\u0000-\u0020]/u.test(input) || input.includes("://") || input.includes("#")) {
+        throw new InvalidProxyPathError("proxy path must be an origin-relative path");
     }
-    return input;
+    let parsed;
+    try {
+        parsed = new URL(input, "https://flowersec.invalid/");
+    }
+    catch {
+        throw new InvalidProxyPathError("proxy path must be an origin-relative path");
+    }
+    const pathname = normalizePercentEscapes(parsed.pathname, true).replace(/\/{2,}/gu, "/");
+    const search = normalizePercentEscapes(parsed.search, false);
+    return pathname + search;
+}
+function normalizePercentEscapes(input, rejectEncodedSeparators) {
+    if (/%(?![0-9a-f]{2})/iu.test(input))
+        throw new InvalidProxyPathError("proxy path contains invalid percent encoding");
+    return input.replace(/%([0-9a-f]{2})/giu, (_match, hex) => {
+        const value = Number.parseInt(hex, 16);
+        if (rejectEncodedSeparators && (value === 0x2f || value === 0x5c)) {
+            throw new InvalidProxyPathError("proxy path contains an encoded separator");
+        }
+        const character = String.fromCharCode(value);
+        return /[A-Za-z0-9\-._~]/u.test(character) ? character : `%${hex.toUpperCase()}`;
+    });
 }
 function pathName(path) {
     const query = path.indexOf("?");
@@ -176,11 +199,19 @@ class StreamAdmission {
             return Promise.reject(new SessionError("resource_exhausted"));
         }
         return new Promise((resolve, reject) => {
+            let cleaned = false;
+            const cleanup = () => {
+                if (cleaned)
+                    return;
+                cleaned = true;
+                signal?.removeEventListener("abort", onAbort);
+            };
             const entry = {
                 bytes,
                 ...(signal === undefined ? {} : { signal }),
-                resolve,
-                reject: (error) => reject(error),
+                cleanup,
+                resolve: (release) => { cleanup(); resolve(release); },
+                reject: (error) => { cleanup(); reject(error); },
             };
             const onAbort = () => {
                 const index = this.queue.indexOf(entry);
@@ -188,7 +219,7 @@ class StreamAdmission {
                     return;
                 this.queue.splice(index, 1);
                 this.queuedBytes -= bytes;
-                reject(new SessionError("canceled"));
+                entry.reject(new SessionError("canceled"));
             };
             signal?.addEventListener("abort", onAbort, { once: true });
             this.queue.push(entry);
@@ -251,6 +282,8 @@ async function* readChunks(reader, maxChunkBytes, maxBodyBytes) {
 function publicFailure(error) {
     if (error instanceof ProxyPolicyError)
         return { status: 403, code: "policy_denied", message: "proxy request denied" };
+    if (error instanceof InvalidProxyPathError)
+        return { status: 400, code: "invalid_request", message: "invalid proxy request" };
     if (error instanceof SessionError && (error.code === "resource_exhausted" || error.code === "closed" || error.code === "going_away")) {
         return { status: 503, code: error.code, message: "proxy service unavailable" };
     }

package/dist/proxy/serviceWorker.d.ts

@@ -15,6 +15,8 @@ export type ProxyServiceWorkerScriptOptions = Readonly<{
     sameOriginOnly?: boolean;
     maxRequestBodyBytes?: number;
     maxInjectHTMLBytes?: number;
+    responseMetadataTimeoutMs?: number;
+    responseBodyInactivityTimeoutMs?: number;
     passthrough?: ProxyServiceWorkerPassthroughOptions;
     proxyPathPrefix?: string;
     stripProxyPathPrefix?: boolean;

package/dist/proxy/serviceWorker.js

@@ -17,6 +17,12 @@ function bounded(name, value, fallback, maximum) {
         throw new TypeError(`${name} is invalid`);
     return result;
 }
+function optionalBounded(name, value, maximum) {
+    const result = value ?? 0;
+    if (!Number.isSafeInteger(result) || result < 0 || result > maximum)
+        throw new TypeError(`${name} is invalid`);
+    return result;
+}
 function token(name, value, fallback = "") {
     const result = value ?? fallback;
     if (result !== result.trim() || /[\u0000-\u0020\u007f]/u.test(result) || result.length > 512)
@@ -42,6 +48,8 @@ function normalizeOptions(options) {
         sameOriginOnly: options.sameOriginOnly ?? true,
         maxRequestBodyBytes: bounded("maxRequestBodyBytes", options.maxRequestBodyBytes, 64 * 1024 * 1024, 256 * 1024 * 1024),
         maxInjectHTMLBytes: bounded("maxInjectHTMLBytes", options.maxInjectHTMLBytes, 8 * 1024 * 1024, 32 * 1024 * 1024),
+        responseMetadataTimeoutMs: bounded("responseMetadataTimeoutMs", options.responseMetadataTimeoutMs, 10_000, 300_000),
+        responseBodyInactivityTimeoutMs: optionalBounded("responseBodyInactivityTimeoutMs", options.responseBodyInactivityTimeoutMs, 300_000),
         passthroughPaths: strings("passthrough.paths", options.passthrough?.paths),
         passthroughPrefixes: strings("passthrough.prefixes", options.passthrough?.prefixes),
         proxyPathPrefix,
@@ -127,6 +135,8 @@ function serviceWorkerMain(config) {
                 return new Response("proxy runtime unavailable", { status: 503 });
             }
             let body;
+            if (request.signal.aborted)
+                return new Response("proxy request canceled", { status: 499 });
             if (request.method !== "GET" && request.method !== "HEAD") {
                 const requestBody = await request.clone().arrayBuffer();
                 if (requestBody.byteLength > config.maxRequestBodyBytes)
@@ -138,16 +148,54 @@ function serviceWorkerMain(config) {
                 let metadata = null;
                 let controller = null;
                 let finished = false;
-                const finishError = (status, message) => {
+                let remoteAbortSent = false;
+                let bodyInactivityTimer;
+                const abortRemote = () => {
+                    if (remoteAbortSent)
+                        return;
+                    remoteAbortSent = true;
+                    try {
+                        channel.port1.postMessage({ type: "flowersec-proxy:abort" });
+                    }
+                    catch { /* Port already failed. */ }
+                };
+                const cleanup = () => {
+                    clearTimeout(metadataTimer);
+                    clearTimeout(bodyInactivityTimer);
+                    clearInterval(runtimeWatchdog);
+                    request.signal.removeEventListener("abort", requestAborted);
+                    channel.port1.close();
+                };
+                const finishError = (status, message, cancelRemote = false) => {
                     if (finished)
                         return;
                     finished = true;
+                    if (cancelRemote)
+                        abortRemote();
                     if (controller !== null)
                         controller.error(new Error(message));
                     else
                         resolve(new Response(message, { status }));
-                    channel.port1.close();
+                    cleanup();
+                };
+                const requestAborted = () => finishError(499, "proxy request canceled", true);
+                const armBodyInactivityTimer = () => {
+                    clearTimeout(bodyInactivityTimer);
+                    if (config.responseBodyInactivityTimeoutMs === 0)
+                        return;
+                    bodyInactivityTimer = setTimeout(() => finishError(504, "proxy response body timed out", true), config.responseBodyInactivityTimeoutMs);
                 };
+                const metadataTimer = setTimeout(() => finishError(504, "proxy response timed out", true), config.responseMetadataTimeoutMs);
+                const runtimeWatchdog = setInterval(() => {
+                    void worker.clients.get(target.id).then((current) => {
+                        if (current !== null || finished)
+                            return;
+                        if (config.windowTarget === "registered_runtime")
+                            runtimeClientId = "";
+                        finishError(503, "proxy runtime unavailable", true);
+                    }).catch(() => finishError(503, "proxy runtime unavailable", true));
+                }, 250);
+                request.signal.addEventListener("abort", requestAborted, { once: true });
                 channel.port1.onmessage = (message) => {
                     const value = message.data;
                     if (value === null || typeof value !== "object" || finished)
@@ -162,13 +210,21 @@ function serviceWorkerMain(config) {
                                     headers.append(entry.name, entry.value);
                             }
                         metadata = { status: value.status, headers };
+                        clearTimeout(metadataTimer);
+                        armBodyInactivityTimer();
                         const stream = new ReadableStream({
                             start(valueController) {
                                 controller = valueController;
                                 channel.port1.postMessage({ type: "flowersec-proxy:response_credit" });
                             },
                             pull() { channel.port1.postMessage({ type: "flowersec-proxy:response_credit" }); },
-                            cancel() { channel.port1.postMessage({ type: "flowersec-proxy:abort" }); channel.port1.close(); },
+                            cancel() {
+                                if (finished)
+                                    return;
+                                finished = true;
+                                abortRemote();
+                                cleanup();
+                            },
                         });
                         resolve(new Response(stream, { status: metadata.status, headers: metadata.headers }));
                         return;
@@ -177,19 +233,20 @@ function serviceWorkerMain(config) {
                         if (controller === null || !(value.data instanceof ArrayBuffer))
                             return finishError(502, "invalid proxy response");
                         controller.enqueue(new Uint8Array(value.data));
+                        armBodyInactivityTimer();
                         return;
                     }
                     if (value.type === "flowersec-proxy:response_end") {
                         finished = true;
                         controller?.close();
-                        channel.port1.close();
+                        cleanup();
                         return;
                     }
                     if (value.type === "flowersec-proxy:response_error") {
                         finishError(Number.isInteger(value.status) ? value.status : 502, typeof value.message === "string" ? value.message : "proxy request failed");
                     }
                 };
-                channel.port1.onmessageerror = () => finishError(502, "proxy request failed");
+                channel.port1.onmessageerror = () => finishError(502, "proxy request failed", true);
                 const headers = Array.from(request.headers.entries()).map(([name, value]) => ({ name, value }));
                 try {
                     target.postMessage({
@@ -207,8 +264,7 @@ function serviceWorkerMain(config) {
                 catch {
                     if (config.windowTarget === "registered_runtime")
                         runtimeClientId = "";
-                    channel.port1.close();
-                    resolve(new Response("proxy runtime unavailable", { status: 503 }));
+                    finishError(503, "proxy runtime unavailable");
                 }
             });
             const injection = config.injectHTML;

package/dist/proxy/windowBridge.d.ts

@@ -23,6 +23,7 @@ export declare class MessagePortByteStream implements ByteStream {
     private handle;
     private finish;
     private fail;
+    private settleWrite;
 }
 export type RegisterProxyAppWindowOptions = Readonly<{
     controllerOrigin: string;

package/dist/proxy/windowBridge.js

@@ -39,12 +39,17 @@ export class MessagePortByteStream {
         if (this.terminalError !== undefined)
             throw this.terminalError;
         return await new Promise((resolve, reject) => {
-            const waiter = { resolve, reject };
+            const cleanup = () => options.signal?.removeEventListener("abort", onAbort);
+            const waiter = {
+                resolve: (value) => { cleanup(); resolve(value); },
+                reject: (error) => { cleanup(); reject(error); },
+            };
             const onAbort = () => {
                 const index = this.readWaiters.indexOf(waiter);
-                if (index >= 0)
-                    this.readWaiters.splice(index, 1);
-                reject(new SessionError("canceled"));
+                if (index < 0)
+                    return;
+                this.readWaiters.splice(index, 1);
+                waiter.reject(new SessionError("canceled"));
             };
             options.signal?.addEventListener("abort", onAbort, { once: true });
             this.readWaiters.push(waiter);
@@ -66,17 +71,19 @@ export class MessagePortByteStream {
         const copy = data.slice();
         this.buffered += copy.length;
         await new Promise((resolve, reject) => {
+            const onAbort = () => this.settleWrite(id, new SessionError("canceled"));
             this.writeWaiters.set(id, {
-                resolve: () => { this.buffered -= copy.length; resolve(); },
-                reject: (error) => { this.buffered -= copy.length; reject(error); },
+                bytes: copy.length,
+                ...(options.signal === undefined ? {} : { signal: options.signal, onAbort }),
+                resolve,
+                reject,
             });
+            options.signal?.addEventListener("abort", onAbort, { once: true });
             try {
                 this.port.postMessage({ type: "chunk", id, data: copy.buffer }, [copy.buffer]);
             }
             catch {
-                this.writeWaiters.delete(id);
-                this.buffered -= copy.length;
-                reject(new SessionError("operation_failed"));
+                this.settleWrite(id, new SessionError("operation_failed"));
             }
         });
         return data.length;
@@ -130,11 +137,7 @@ export class MessagePortByteStream {
             return;
         }
         if (message.type === "ack" && Number.isSafeInteger(message.id)) {
-            const waiter = this.writeWaiters.get(message.id);
-            if (waiter !== undefined) {
-                this.writeWaiters.delete(message.id);
-                waiter.resolve();
-            }
+            this.settleWrite(message.id);
             return;
         }
         if (message.type === "end") {
@@ -159,9 +162,8 @@ export class MessagePortByteStream {
         this.readBuffered = 0;
         for (const waiter of this.readWaiters.splice(0))
             waiter.resolve(null);
-        for (const waiter of this.writeWaiters.values())
-            waiter.reject(new SessionError("closed"));
-        this.writeWaiters.clear();
+        for (const id of [...this.writeWaiters.keys()])
+            this.settleWrite(id, new SessionError("closed"));
         this.port.close();
     }
     fail(error) {
@@ -173,11 +175,22 @@ export class MessagePortByteStream {
         this.readBuffered = 0;
         for (const waiter of this.readWaiters.splice(0))
             waiter.reject(error);
-        for (const waiter of this.writeWaiters.values())
-            waiter.reject(error);
-        this.writeWaiters.clear();
+        for (const id of [...this.writeWaiters.keys()])
+            this.settleWrite(id, error);
         this.port.close();
     }
+    settleWrite(id, error) {
+        const waiter = this.writeWaiters.get(id);
+        if (waiter === undefined)
+            return;
+        this.writeWaiters.delete(id);
+        waiter.signal?.removeEventListener("abort", waiter.onAbort);
+        this.buffered = Math.max(0, this.buffered - waiter.bytes);
+        if (error === undefined)
+            waiter.resolve();
+        else
+            waiter.reject(error);
+    }
 }
 function bridgeLimits(maxWsFrameBytes, maxWsBufferedAmountBytes) {
     const wsFrame = maxWsFrameBytes ?? SDK_DEFAULTS.proxy.maxWsFrameBytes;
@@ -279,33 +292,65 @@ export function registerProxyAppWindow(options) {
         dispose: () => { disposed = true; },
     });
 }
-async function bridgeStreams(runtimeStream, port) {
+async function bridgeStreams(runtimeStream, port, signal) {
     const bridge = new MessagePortByteStream(port);
+    const controller = new AbortController();
+    let resetTask;
+    const resetBoth = () => {
+        resetTask ??= Promise.allSettled([
+            Promise.resolve().then(async () => await runtimeStream.reset()),
+            Promise.resolve().then(async () => await bridge.reset()),
+        ]);
+        return resetTask;
+    };
+    const abort = () => {
+        controller.abort(signal?.reason ?? new SessionError("canceled"));
+        void resetBoth();
+    };
+    if (signal?.aborted === true)
+        abort();
+    else
+        signal?.addEventListener("abort", abort, { once: true });
     const left = (async () => {
         while (true) {
-            const chunk = await runtimeStream.read();
+            const chunk = await runtimeStream.read({ signal: controller.signal });
             if (chunk === null) {
                 await bridge.closeWrite();
                 return;
             }
-            await bridge.write(chunk);
+            await bridge.write(chunk, { signal: controller.signal });
         }
-    })();
+    })().catch((error) => { controller.abort(error); void resetBoth(); throw error; });
     const right = (async () => {
         while (true) {
-            const chunk = await bridge.read();
+            const chunk = await bridge.read({ signal: controller.signal });
             if (chunk === null) {
                 await runtimeStream.closeWrite();
                 return;
             }
             let offset = 0;
             while (offset < chunk.length)
-                offset += await runtimeStream.write(chunk.subarray(offset));
+                offset += await runtimeStream.write(chunk.subarray(offset), { signal: controller.signal });
         }
-    })();
-    await Promise.all([left, right]);
-    await runtimeStream.close();
-    await bridge.close();
+    })().catch((error) => { controller.abort(error); void resetBoth(); throw error; });
+    try {
+        const settled = await Promise.allSettled([left, right]);
+        const failure = settled.find((result) => result.status === "rejected");
+        if (failure !== undefined) {
+            await resetBoth();
+            throw failure.reason;
+        }
+        try {
+            await Promise.all([runtimeStream.close(), bridge.close()]);
+        }
+        catch (error) {
+            await resetBoth();
+            throw error;
+        }
+    }
+    finally {
+        signal?.removeEventListener("abort", abort);
+    }
 }
 export function registerProxyControllerWindow(options) {
     const target = options.targetWindow ?? globalThis.window;
@@ -315,6 +360,7 @@ export function registerProxyControllerWindow(options) {
     }
     const nonce = capability(options.capabilityNonce);
     let disposed = false;
+    const active = new Set();
     const onMessage = (event) => {
         if (disposed || !allowed.has(event.origin) || (options.expectedSource !== undefined && event.source !== options.expectedSource))
             return;
@@ -331,6 +377,7 @@ export function registerProxyControllerWindow(options) {
             void (async () => {
                 let canceled = false;
                 const openController = new AbortController();
+                active.add(openController);
                 port.onmessage = (message) => {
                     if (message.data?.type === "reset" ||
                         message.data?.type === "close") {
@@ -349,17 +396,30 @@ export function registerProxyControllerWindow(options) {
                         return;
                     }
                     port.postMessage({ type: WEBSOCKET_ACK_MESSAGE, ok: true, protocol: opened.protocol });
-                    await bridgeStreams(opened.stream, port);
+                    await bridgeStreams(opened.stream, port, openController.signal);
                 }
                 catch {
-                    port.postMessage({ type: WEBSOCKET_ACK_MESSAGE, ok: false });
+                    try {
+                        port.postMessage({ type: WEBSOCKET_ACK_MESSAGE, ok: false });
+                    }
+                    catch { /* Port is already closed. */ }
                     port.close();
                 }
+                finally {
+                    active.delete(openController);
+                }
             })();
         }
     };
     target.addEventListener("message", onMessage);
-    return Object.freeze({ dispose: () => { disposed = true; target.removeEventListener("message", onMessage); } });
+    return Object.freeze({
+        dispose: () => {
+            disposed = true;
+            target.removeEventListener("message", onMessage);
+            for (const controller of active)
+                controller.abort(new SessionError("closed"));
+        },
+    });
 }
 export async function registerProxyAppWindowWithServiceWorkerControl(options) {
     await registerServiceWorkerAndEnsureControl({

package/dist/proxy/wsPatch.d.ts

@@ -4,6 +4,7 @@ export type WebSocketPatchOptions = Readonly<{
     shouldProxy?: (url: URL) => boolean;
     maxWsFrameBytes?: number;
     maxWsBufferedAmountBytes?: number;
+    closeHandshakeTimeoutMs?: number;
 }>;
 export declare function installWebSocketPatch(options: WebSocketPatchOptions): Readonly<{
     uninstall(): void;

package/dist/proxy/wsPatch.js

@@ -64,6 +64,7 @@ export function installWebSocketPatch(options) {
     const runtimeLimits = options.runtime.limits;
     const maxFrameBytes = limit("maxWsFrameBytes", options.maxWsFrameBytes, runtimeLimits.maxWsFrameBytes ?? 1024 * 1024);
     const maxBufferedBytes = limit("maxWsBufferedAmountBytes", options.maxWsBufferedAmountBytes, runtimeLimits.maxWsBufferedAmountBytes ?? 4 * 1024 * 1024);
+    const closeHandshakeTimeoutMs = limit("closeHandshakeTimeoutMs", options.closeHandshakeTimeoutMs, 5_000);
     const shouldProxy = options.shouldProxy ?? ((url) => {
         const location = globalThis.location;
         if (location?.hostname === undefined || location.hostname === "")
@@ -95,6 +96,7 @@ export function installWebSocketPatch(options) {
         abort = new AbortController();
         stream;
         writes = Promise.resolve();
+        closeTimer;
         constructor(input, protocols) {
             const url = new URL(String(input), globalThis.location?.href);
             if (!shouldProxy(url))
@@ -152,12 +154,17 @@ export function installWebSocketPatch(options) {
             const reasonBytes = encoder.encode(reason);
             if (reasonBytes.length > 123)
                 throw new DOMException("WebSocket close reason is too long", "SyntaxError");
+            if (this.readyState === ProxyWebSocket.CONNECTING || this.stream === undefined) {
+                this.fail();
+                return;
+            }
             this.readyState = ProxyWebSocket.CLOSING;
             const payload = code === undefined ? new Uint8Array() : new Uint8Array([...u16be(code), ...reasonBytes]);
-            this.writes = this.writes.then(async () => {
-                if (this.stream !== undefined)
-                    await writeFrame(this.stream, 8, payload, maxFrameBytes);
-            }).catch(() => undefined).finally(() => this.abort.abort());
+            const stream = this.stream;
+            this.closeTimer = setTimeout(() => this.fail(), closeHandshakeTimeoutMs);
+            this.writes = this.writes
+                .then(async () => await writeFrame(stream, 8, payload, maxFrameBytes))
+                .catch(() => this.fail());
         }
         async connect(url, protocols) {
             try {
@@ -183,10 +190,19 @@ export function installWebSocketPatch(options) {
                     this.writes = this.writes.then(async () => await writeFrame(stream, 10, frame.payload, maxFrameBytes)).catch(() => this.fail());
                 }
                 else if (frame.opcode === 8) {
+                    if (frame.payload.length === 1)
+                        throw new Error("invalid WebSocket close frame");
                     const code = frame.payload.length >= 2 ? readU16(frame.payload) : 1000;
                     const reason = frame.payload.length > 2 ? decoder.decode(frame.payload.subarray(2)) : "";
-                    this.readyState = ProxyWebSocket.CLOSED;
-                    this.emit("close", new CloseEvent("close", { code, reason, wasClean: true }));
+                    const peerInitiated = this.readyState === ProxyWebSocket.OPEN;
+                    this.readyState = ProxyWebSocket.CLOSING;
+                    if (this.closeTimer !== undefined)
+                        clearTimeout(this.closeTimer);
+                    if (peerInitiated) {
+                        this.writes = this.writes.then(async () => await writeFrame(stream, 8, frame.payload, maxFrameBytes));
+                    }
+                    await this.writes;
+                    this.completeClose(code, reason);
                     return;
                 }
                 else if (frame.opcode === 1) {
@@ -211,12 +227,29 @@ export function installWebSocketPatch(options) {
         fail() {
             if (this.readyState === ProxyWebSocket.CLOSED)
                 return;
+            if (this.closeTimer !== undefined)
+                clearTimeout(this.closeTimer);
             this.readyState = ProxyWebSocket.CLOSED;
             this.bufferedAmount = 0;
             this.emit("error", new Event("error"));
             this.emit("close", new CloseEvent("close", { code: 1006, reason: "proxy WebSocket failed", wasClean: false }));
+            const stream = this.stream;
+            this.stream = undefined;
+            this.abort.abort();
+            void stream?.reset().catch(() => undefined);
+        }
+        completeClose(code, reason) {
+            if (this.readyState === ProxyWebSocket.CLOSED)
+                return;
+            if (this.closeTimer !== undefined)
+                clearTimeout(this.closeTimer);
+            this.readyState = ProxyWebSocket.CLOSED;
+            this.bufferedAmount = 0;
+            this.emit("close", new CloseEvent("close", { code, reason, wasClean: true }));
+            const stream = this.stream;
             this.stream = undefined;
             this.abort.abort();
+            void stream?.close().catch(() => stream.reset().catch(() => undefined));
         }
     }
     globalThis.WebSocket = ProxyWebSocket;

package/dist/rpc/client.js

@@ -1,5 +1,5 @@
 import { DEFAULT_MAX_JSON_FRAME_BYTES, readJsonFrame, writeJsonFrame } from "../framing/jsonframe.js";
-import { assertRpcEnvelope } from "./validate.js";
+import { assertRpcEnvelope, assertRpcTypeId } from "./validate.js";
 // Guard against precision loss when encoding request IDs as numbers.
 const MAX_SAFE_REQUEST_ID = BigInt(Number.MAX_SAFE_INTEGER);
 // RpcClient sends request/response envelopes and dispatches notifications.
@@ -25,12 +25,13 @@ export class RpcClient {
     async call(typeId, payload, signal) {
         if (this.closed)
             throw new Error("rpc client closed");
+        const validatedTypeId = assertRpcTypeId(typeId);
         if (this.nextId > MAX_SAFE_REQUEST_ID)
             throw new Error("request id overflow");
         const requestId = this.nextId;
         this.nextId += 1n;
         const env = {
-            type_id: typeId >>> 0,
+            type_id: validatedTypeId,
             request_id: Number(requestId),
             response_to: 0,
             payload
@@ -39,7 +40,7 @@ export class RpcClient {
             this.pending.set(requestId, { resolve, reject });
         });
         try {
-            await writeJsonFrame(this.write, env);
+            await writeJsonFrame(this.write, env, DEFAULT_MAX_JSON_FRAME_BYTES);
         }
         catch (e) {
             this.pending.delete(requestId);
@@ -71,7 +72,7 @@ export class RpcClient {
     }
     // onNotify registers a handler for incoming notifications.
     onNotify(typeId, handler) {
-        const tid = typeId >>> 0;
+        const tid = assertRpcTypeId(typeId);
         const set = this.notifyHandlers.get(tid) ?? new Set();
         set.add(handler);
         this.notifyHandlers.set(tid, set);
@@ -86,13 +87,14 @@ export class RpcClient {
     async notify(typeId, payload) {
         if (this.closed)
             throw new Error("rpc client closed");
+        const validatedTypeId = assertRpcTypeId(typeId);
         const env = {
-            type_id: typeId >>> 0,
+            type_id: validatedTypeId,
             request_id: 0,
             response_to: 0,
             payload
         };
-        await writeJsonFrame(this.write, env);
+        await writeJsonFrame(this.write, env, DEFAULT_MAX_JSON_FRAME_BYTES);
     }
     async readLoop() {
         try {
@@ -101,7 +103,7 @@ export class RpcClient {
                 if (v.response_to === 0) {
                     // Notification: response_to=0 and request_id=0.
                     if (v.request_id === 0) {
-                        const set = this.notifyHandlers.get(v.type_id >>> 0);
+                        const set = this.notifyHandlers.get(v.type_id);
                         if (set != null) {
                             for (const h of set) {
                                 try {

package/dist/rpc/server.js

@@ -1,5 +1,5 @@
 import { DEFAULT_MAX_JSON_FRAME_BYTES, readJsonFrame, writeJsonFrame } from "../framing/jsonframe.js";
-import { assertRpcEnvelope, assertRpcError } from "./validate.js";
+import { assertRpcEnvelope, assertRpcError, assertRpcTypeId } from "./validate.js";
 import { SDK_DEFAULTS } from "../defaults.js";
 const DEFAULT_RPC_SERVER_OPTIONS = Object.freeze({
     maxConcurrentRequests: SDK_DEFAULTS.rpc.maxConcurrentRequests,
@@ -10,13 +10,13 @@ export class RpcRouter {
     handlers = new Map();
     notifyHandlers = new Map();
     register(typeId, handler) {
-        this.handlers.set(typeId >>> 0, handler);
+        this.handlers.set(assertRpcTypeId(typeId), handler);
     }
     handler(typeId) {
-        return this.handlers.get(typeId >>> 0);
+        return this.handlers.get(assertRpcTypeId(typeId));
     }
     onNotify(typeId, handler) {
-        const normalized = typeId >>> 0;
+        const normalized = assertRpcTypeId(typeId);
         const handlers = this.notifyHandlers.get(normalized) ?? new Set();
         handlers.add(handler);
         this.notifyHandlers.set(normalized, handlers);
@@ -27,7 +27,7 @@ export class RpcRouter {
         };
     }
     async dispatchNotification(typeId, payload) {
-        const normalized = typeId >>> 0;
+        const normalized = assertRpcTypeId(typeId);
         const requestHandler = this.handlers.get(normalized);
         if (requestHandler !== undefined)
             await requestHandler(payload);
@@ -76,7 +76,7 @@ export class RpcServer {
         if (this.closed)
             throw new Error("rpc server closed");
         await this.writeEnvelope({
-            type_id: typeId >>> 0,
+            type_id: assertRpcTypeId(typeId),
             request_id: 0,
             response_to: 0,
             payload,
@@ -93,6 +93,7 @@ export class RpcServer {
             return await new Promise(() => undefined);
         }));
         let failure;
+        const aborted = abortPromise(signal);
         try {
             while (!this.closed) {
                 if (signal?.aborted)
@@ -101,6 +102,7 @@ export class RpcServer {
                     readJsonFrame(this.transport.readExactly, DEFAULT_MAX_JSON_FRAME_BYTES),
                     this.terminalSignal.then((error) => { throw error; }),
                     workerFailure,
+                    ...(aborted === undefined ? [] : [aborted.promise]),
                 ]);
                 const v = assertRpcEnvelope(next);
                 if (v.response_to !== 0)
@@ -126,6 +128,9 @@ export class RpcServer {
             failure = err;
             this.terminalError = err;
         }
+        finally {
+            aborted?.cleanup();
+        }
         let closeError;
         try {
             this.close(failure ?? this.terminalError ?? new Error("rpc server closed"));
@@ -173,19 +178,23 @@ export class RpcServer {
             if (work == null)
                 return;
             const v = work.envelope;
-            const h = this.router.handler(v.type_id);
-            let out;
-            if (h == null)
-                out = { payload: null, error: { code: 404, message: "handler not found" } };
-            else {
-                try {
-                    out = await h(v.payload);
-                }
-                catch {
-                    out = { payload: null, error: { code: 500, message: "internal error" } };
-                }
-            }
             try {
+                const h = this.router.handler(v.type_id);
+                let out;
+                if (h == null)
+                    out = { payload: null, error: { code: 404, message: "handler not found" } };
+                else {
+                    const outcome = await Promise.race([
+                        Promise.resolve().then(() => h(v.payload)).then((value) => ({ kind: "completed", value }), () => ({
+                            kind: "completed",
+                            value: { payload: null, error: { code: 500, message: "internal error" } },
+                        })),
+                        this.terminalSignal.then(() => ({ kind: "terminated" })),
+                    ]);
+                    if (outcome.kind === "terminated")
+                        return;
+                    out = outcome.value;
+                }
                 if (this.closed)
                     return;
                 await this.writeResponse(v, out);
@@ -201,7 +210,12 @@ export class RpcServer {
             if (work == null)
                 return;
             const v = work.envelope;
-            await this.router.dispatchNotification(v.type_id, v.payload);
+            const completed = await Promise.race([
+                Promise.resolve().then(() => this.router.dispatchNotification(v.type_id, v.payload)).then(() => true),
+                this.terminalSignal.then(() => false),
+            ]);
+            if (!completed)
+                return;
         }
     }
     async nextWork(queue, waiters) {
@@ -236,7 +250,7 @@ export class RpcServer {
         await this.writeEnvelope(resp);
     }
     async writeEnvelope(envelope) {
-        const write = this.writeChain.then(() => writeJsonFrame(this.transport.write, envelope));
+        const write = this.writeChain.then(() => writeJsonFrame(this.transport.write, envelope, DEFAULT_MAX_JSON_FRAME_BYTES));
         this.writeChain = write;
         try {
             await write;
@@ -247,6 +261,16 @@ export class RpcServer {
         }
     }
 }
+function abortPromise(signal) {
+    if (signal === undefined || signal.aborted)
+        return undefined;
+    let onAbort;
+    const promise = new Promise((_resolve, reject) => {
+        onAbort = () => reject(signal.reason ?? new Error("aborted"));
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+    return { promise, cleanup: () => signal.removeEventListener("abort", onAbort) };
+}
 function positiveInteger(value, name) {
     if (!Number.isSafeInteger(value) || value <= 0)
         throw new RangeError(`${name} must be a positive integer`);

package/dist/rpc/validate.d.ts

@@ -1,3 +1,4 @@
 import type { RpcEnvelope, RpcError } from "./wire.js";
 export declare function assertRpcEnvelope(v: unknown): RpcEnvelope;
+export declare function assertRpcTypeId(value: unknown): number;
 export declare function assertRpcError(value: unknown): RpcError;

package/dist/rpc/validate.js

@@ -6,21 +6,33 @@ const strictDecoder = new TextDecoder("utf-8", { fatal: true });
 // The wire format is JSON, so JS numbers are used. For u64 we enforce the safe integer range
 // to avoid silent precision loss on request/response correlation.
 export function assertRpcEnvelope(v) {
-    if (typeof v !== "object" || v == null)
+    if (typeof v !== "object" || v == null || Array.isArray(v))
         throw new Error("bad rpc envelope");
     const o = v;
-    if (!isSafeU32Number(o.type_id))
-        throw new Error("bad rpc envelope: type_id");
+    const keys = Object.keys(o);
+    if (keys.some((key) => key !== "type_id" && key !== "request_id" && key !== "response_to" && key !== "payload" && key !== "error")) {
+        throw new Error("bad rpc envelope: shape");
+    }
+    if (!Object.prototype.hasOwnProperty.call(o, "payload"))
+        throw new Error("bad rpc envelope: payload");
+    assertRpcTypeId(o.type_id);
     if (!isSafeU64Number(o.request_id))
         throw new Error("bad rpc envelope: request_id");
     if (!isSafeU64Number(o.response_to))
         throw new Error("bad rpc envelope: response_to");
-    // payload: unknown (JSON)
-    if (o.error != null) {
+    if (o.request_id !== 0 && o.response_to !== 0)
+        throw new Error("bad rpc envelope: request/response shape");
+    if (o.error != null && o.response_to === 0)
+        throw new Error("bad rpc envelope: error shape");
+    if (o.error != null)
         assertRpcError(o.error);
-    }
     return o;
 }
+export function assertRpcTypeId(value) {
+    if (!isSafeU32Number(value) || value === 0)
+        throw new RangeError("RPC typeId must be a non-zero u32 integer");
+    return value;
+}
 export function assertRpcError(value) {
     if (typeof value !== "object" || value == null)
         throw new Error("bad rpc envelope: error");

package/dist/v2/publicSession.js

@@ -1,5 +1,6 @@
 import { SessionError } from "./contract.js";
 import { createStreamMetadataV2, streamMetadataValuesV2 } from "./streamMetadata.js";
+import { assertRpcTypeId } from "../rpc/validate.js";
 /** @internal */
 export function projectSessionV2(session) {
     const notificationOwner = {
@@ -132,6 +133,7 @@ function projectRpcPeerV2(peer, notificationOwner) {
     return Object.freeze({
         async call(typeId, payload, decodeResponse, options) {
             try {
+                assertRpcTypeId(typeId);
                 assertJsonValue(payload);
                 const result = await peer.call(typeId, payload, options?.signal);
                 if (result.error !== undefined) {
@@ -146,6 +148,7 @@ function projectRpcPeerV2(peer, notificationOwner) {
         },
         async notify(typeId, payload, options) {
             try {
+                assertRpcTypeId(typeId);
                 assertJsonValue(payload);
                 if (options?.signal?.aborted)
                     throw options.signal.reason ?? new DOMException("The operation was aborted", "AbortError");
@@ -156,6 +159,7 @@ function projectRpcPeerV2(peer, notificationOwner) {
             }
         },
         onNotify(typeId, decodePayload, handler) {
+            assertRpcTypeId(typeId);
             if (notificationOwner.closed)
                 return () => undefined;
             const unsubscribe = peer.onNotify(typeId, (payload) => {

package/dist/v2/session.js

@@ -1224,6 +1224,10 @@ class EncryptedStreamV2 {
         if (this.terminalError !== undefined)
             return false;
         this.terminalError = error;
+        const pendingSendRekey = this.pendingSendRekey;
+        this.pendingSendRekey = undefined;
+        pendingSendRekey?.armed.reject(error);
+        pendingSendRekey?.done.reject(error);
         this.opened.reject(error);
         this.data.fail(error);
         return true;

package/dist/yamux/stream.d.ts

@@ -12,6 +12,8 @@ export declare class YamuxStream {
     private readWaiters;
     private error;
     private resetTask;
+    private closeTask;
+    private closeRequested;
     private writeChain;
     private writeQueueBytes;
     private finalized;
@@ -23,6 +25,7 @@ export declare class YamuxStream {
     write(data: Uint8Array): Promise<void>;
     private writeSerial;
     close(): Promise<void>;
+    private closeSerial;
     reset(err?: Error): Promise<void>;
     abort(err?: Error): void;
     private fail;

package/dist/yamux/stream.js

@@ -24,6 +24,8 @@ export class YamuxStream {
     // Terminal error (reset/overflow) for the stream.
     error = null;
     resetTask;
+    closeTask;
+    closeRequested = false;
     writeChain = Promise.resolve();
     writeQueueBytes = 0;
     finalized = false;
@@ -89,6 +91,8 @@ export class YamuxStream {
     }
     // write sends DATA frames, respecting the send window.
     async write(data) {
+        if (this.closeRequested)
+            throw new Error("stream closed");
         this.ensureWritable();
         const byteCount = data.byteLength;
         const nextQueueBytes = this.writeQueueBytes + byteCount;
@@ -129,10 +133,19 @@ export class YamuxStream {
         }
     }
     // close sends FIN and transitions to local close.
-    async close() {
-        if (this.state === "closed")
-            return;
-        if (this.state === "reset")
+    close() {
+        if (this.closeTask !== undefined)
+            return this.closeTask;
+        if (this.state === "closed" || this.state === "reset" || this.state === "localClose")
+            return Promise.resolve();
+        this.closeRequested = true;
+        const task = this.writeChain.then(async () => await this.closeSerial());
+        this.writeChain = task.catch(() => undefined);
+        this.closeTask = task;
+        return task;
+    }
+    async closeSerial() {
+        if (this.state === "closed" || this.state === "reset" || this.state === "localClose")
             return;
         const wasRemoteClose = this.state === "remoteClose";
         const flags = this.sendFlags() | FLAG_FIN;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "2.5.3",
+  "version": "2.5.4",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {
@@ -77,7 +77,7 @@
     "ws": "^8.21.2"
   },
   "optionalDependencies": {
-    "@floegence/flowersec-node-native": "2.5.3"
+    "@floegence/flowersec-node-native": "2.5.4"
   },
   "devDependencies": {
     "@playwright/test": "1.62.1",
@@ -95,5 +95,5 @@
     "vite": "^8.2.1",
     "vitest": "4.1.10"
   },
-  "flowersecSourceCommit": "aa50aab509e3519b2b9c8e49abccc407a831a741"
+  "flowersecSourceCommit": "026cb52d116d2a04de50d0f0621fff57c7657120"
 }

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ec0f2db1-aea5-5835-89bb-52b08c4a4a1c",
+  "serialNumber": "urn:uuid:9db05d70-0170-5669-8eb4-881e06b18415",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "2.5.3",
-      "purl": "pkg:npm/%40floegence/flowersec-core@2.5.3",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.5.3"
+      "version": "2.5.4",
+      "purl": "pkg:npm/%40floegence/flowersec-core@2.5.4",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.5.4"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "1a8ba3adc252c3c72e7a5129a172b0c767a075161ac1d0379f0b257f091816fb"
+        "value": "308ce3a2dd421245b940297e16fbb6cae9cc3d79e4835164e4304b5f7acd5ca8"
       }
     ]
   },
@@ -190,7 +190,7 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@2.5.3",
+      "ref": "pkg:npm/%40floegence/flowersec-core@2.5.4",
       "dependsOn": [
         "pkg:npm/%40noble/ciphers@2.3.0",
         "pkg:npm/%40noble/curves@2.3.0",

package/sbom/spdx.json

@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "flowersec-ts",
-  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/1a8ba3adc252c3c72e7a5129a172b0c767a075161ac1d0379f0b257f091816fb",
+  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/308ce3a2dd421245b940297e16fbb6cae9cc3d79e4835164e4304b5f7acd5ca8",
   "creationInfo": {
     "created": "1970-01-01T00:00:00Z",
     "creators": [
@@ -13,19 +13,19 @@
   "packages": [
     {
       "name": "@floegence/flowersec-core",
-      "SPDXID": "SPDXRef-Package-290762592d648256929a",
-      "versionInfo": "2.5.3",
+      "SPDXID": "SPDXRef-Package-972ad62e2707c407a361",
+      "versionInfo": "2.5.4",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "NOASSERTION",
       "copyrightText": "NOASSERTION",
-      "comment": "Flowersec source inventory SHA-256: 1a8ba3adc252c3c72e7a5129a172b0c767a075161ac1d0379f0b257f091816fb",
+      "comment": "Flowersec source inventory SHA-256: 308ce3a2dd421245b940297e16fbb6cae9cc3d79e4835164e4304b5f7acd5ca8",
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@2.5.3"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@2.5.4"
         }
       ]
     },
@@ -136,30 +136,30 @@
     {
       "spdxElementId": "SPDXRef-DOCUMENT",
       "relationshipType": "DESCRIBES",
-      "relatedSpdxElement": "SPDXRef-Package-290762592d648256929a"
+      "relatedSpdxElement": "SPDXRef-Package-972ad62e2707c407a361"
     },
     {
-      "spdxElementId": "SPDXRef-Package-290762592d648256929a",
+      "spdxElementId": "SPDXRef-Package-972ad62e2707c407a361",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-5ce913a03239b02770fb"
     },
     {
-      "spdxElementId": "SPDXRef-Package-290762592d648256929a",
+      "spdxElementId": "SPDXRef-Package-972ad62e2707c407a361",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-01009adf60db02c13634"
     },
     {
-      "spdxElementId": "SPDXRef-Package-290762592d648256929a",
+      "spdxElementId": "SPDXRef-Package-972ad62e2707c407a361",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-8815b117c8a1d5f7eeb0"
     },
     {
-      "spdxElementId": "SPDXRef-Package-290762592d648256929a",
+      "spdxElementId": "SPDXRef-Package-972ad62e2707c407a361",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-f8b45a289df643042b94"
     },
     {
-      "spdxElementId": "SPDXRef-Package-290762592d648256929a",
+      "spdxElementId": "SPDXRef-Package-972ad62e2707c407a361",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-b779412f685822663496"
     },