@floegence/flowersec-core 2.5.3 → 3.0.0

package/dist/v3/webTransportCarrier.js

@@ -0,0 +1,534 @@
+import { CarrierError, } from "./carrier.js";
+export function adaptWebTransportCarrierSessionV3(native, options) {
+    requireWebTransportSessionSurfaceV3(native);
+    return new WebTransportCarrierSessionAdapter(native, options);
+}
+export function hasWebTransportConstructorSurfaceV3(value) {
+    if (typeof value !== "function")
+        return false;
+    const prototype = value.prototype;
+    return typeof prototype === "object" && prototype !== null &&
+        typeof prototype.createBidirectionalStream === "function" &&
+        typeof prototype.close === "function" &&
+        "incomingBidirectionalStreams" in prototype &&
+        "datagrams" in prototype &&
+        "ready" in prototype &&
+        "closed" in prototype;
+}
+function requireWebTransportSessionSurfaceV3(value) {
+    const missing = [];
+    if (typeof value.createBidirectionalStream !== "function")
+        missing.push("outgoing bidirectional streams");
+    if (typeof value.incomingBidirectionalStreams?.getReader !== "function")
+        missing.push("incoming bidirectional streams");
+    if (typeof value.datagrams?.readable?.getReader !== "function")
+        missing.push("incoming DATAGRAMs");
+    if (typeof value.datagrams?.writable?.getWriter !== "function")
+        missing.push("outgoing DATAGRAMs");
+    if (typeof value.close !== "function")
+        missing.push("close");
+    if (typeof value.closed?.then !== "function")
+        missing.push("termination");
+    if (missing.length !== 0) {
+        throw new TypeError(`WebTransport runtime lacks required ${missing.join(", ")}`);
+    }
+}
+class WebTransportCarrierSessionAdapter {
+    native;
+    kind = "webtransport";
+    path;
+    inboundBidirectionalStreamCapacity;
+    unreliableDatagrams;
+    incoming;
+    incomingQueue = new IncomingWebTransportStreamQueue();
+    streams = new Set();
+    datagramsAdapter;
+    closed = false;
+    terminalError;
+    closePromise;
+    activeIncomingStreams = 0;
+    constructor(native, options) {
+        this.native = native;
+        if (!Number.isInteger(options.inboundBidirectionalStreamCapacity) || options.inboundBidirectionalStreamCapacity < 3) {
+            throw new RangeError("WebTransport carrier stream capacity must be at least 3");
+        }
+        this.path = options.path;
+        this.inboundBidirectionalStreamCapacity = options.inboundBidirectionalStreamCapacity;
+        this.incoming = native.incomingBidirectionalStreams.getReader();
+        this.datagramsAdapter = new WebTransportDatagramAdapter(native.datagrams, options.datagramMaxSize);
+        this.unreliableDatagrams = this.datagramsAdapter;
+        void this.pumpIncoming();
+        void native.closed.then(() => { this.terminate(new CarrierError("closed", "WebTransport carrier is closed")); }, (error) => {
+            this.terminate(carrierFailure("WebTransport closed with an error", error));
+        });
+    }
+    async openStream(options = {}) {
+        this.assertOpen();
+        if (options.signal?.aborted === true)
+            throw abortedCarrierError(options.signal.reason);
+        const pending = this.native.createBidirectionalStream();
+        let stream;
+        try {
+            stream = await carrierCall(raceAbort(pending, options.signal), "WebTransport failed to open a stream");
+        }
+        catch (error) {
+            if (isAborted(options.signal)) {
+                void pending.then((late) => abortNativeStream(late, abortedCarrierError()), () => undefined);
+            }
+            throw error;
+        }
+        try {
+            this.assertOpen();
+        }
+        catch (error) {
+            abortNativeStream(stream, asError(error));
+            throw error;
+        }
+        return this.track(stream);
+    }
+    async acceptStream(options = {}) {
+        this.assertOpen();
+        return await this.incomingQueue.shift(options.signal);
+    }
+    async waitTermination() {
+        try {
+            await this.native.closed;
+        }
+        catch (error) {
+            throw carrierFailure("WebTransport terminated with an error", error);
+        }
+    }
+    close() {
+        this.closePromise ??= this.closeOnce({ closeCode: 0, reason: "" });
+        return this.closePromise;
+    }
+    abort(error = { code: 6, reason: "carrier aborted" }) {
+        if (this.closed)
+            return;
+        this.terminate(new CarrierError("aborted", "WebTransport carrier aborted"));
+        try {
+            this.native.close({ closeCode: error.code, reason: error.reason });
+        }
+        catch (cause) {
+            this.terminalError = carrierFailure("WebTransport abort failed", cause);
+        }
+    }
+    async closeOnce(info) {
+        if (this.closed)
+            return;
+        this.terminate(new CarrierError("closed", "WebTransport carrier is closed"));
+        try {
+            this.native.close(info);
+            await this.native.closed;
+        }
+        catch (error) {
+            throw carrierFailure("WebTransport close failed", error);
+        }
+    }
+    assertOpen() {
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
+        if (this.closed)
+            throw new CarrierError("closed", "WebTransport carrier is closed");
+    }
+    track(native, incoming = false) {
+        if (incoming)
+            this.activeIncomingStreams += 1;
+        let stream;
+        stream = new WebTransportCarrierStreamAdapter(native, () => {
+            this.streams.delete(stream);
+            if (incoming)
+                this.activeIncomingStreams = Math.max(0, this.activeIncomingStreams - 1);
+        });
+        this.streams.add(stream);
+        return stream;
+    }
+    async pumpIncoming() {
+        try {
+            while (!this.closed) {
+                const result = await this.incoming.read();
+                if (result.done || result.value === undefined) {
+                    this.terminate(new CarrierError("closed", "WebTransport incoming streams closed"));
+                    return;
+                }
+                if (this.activeIncomingStreams >= this.inboundBidirectionalStreamCapacity) {
+                    abortNativeStream(result.value, new CarrierError("reset", "WebTransport inbound stream capacity exceeded"));
+                    continue;
+                }
+                this.incomingQueue.push(this.track(result.value, true));
+            }
+        }
+        catch (error) {
+            if (!this.closed)
+                this.terminate(carrierFailure("WebTransport stream accept failed", error));
+        }
+    }
+    terminate(error) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        if (error.code !== "closed")
+            this.terminalError = error;
+        this.incomingQueue.fail(error);
+        for (const stream of [...this.streams])
+            stream.abort(error);
+        this.streams.clear();
+        this.datagramsAdapter.abort(error);
+    }
+}
+class WebTransportCarrierStreamAdapter {
+    onRelease;
+    reader;
+    writer;
+    readClosed = false;
+    readStopError;
+    writeClosed = false;
+    terminalError;
+    closeWritePromise;
+    stopSendingPromise;
+    resetPromise;
+    released = false;
+    constructor(stream, onRelease) {
+        this.onRelease = onRelease;
+        this.reader = stream.readable.getReader();
+        this.writer = stream.writable.getWriter();
+    }
+    async read(options = {}) {
+        this.assertReadable();
+        if (this.readClosed)
+            return null;
+        const result = await carrierCall(raceAbort(this.reader.read(), options.signal), "WebTransport stream read failed", "reset");
+        if (result.done || result.value === undefined) {
+            this.readClosed = true;
+            this.releaseIfComplete();
+            return null;
+        }
+        return result.value.slice();
+    }
+    async write(data) {
+        this.assertNotTerminal();
+        if (this.writeClosed)
+            throw new CarrierError("write_closed", "WebTransport stream write side is closed");
+        await carrierCall(this.writer.write(data.slice()), "WebTransport stream write failed", "reset");
+        return data.byteLength;
+    }
+    closeWrite() {
+        if (this.closeWritePromise !== undefined)
+            return this.closeWritePromise;
+        this.assertNotTerminal();
+        this.writeClosed = true;
+        this.closeWritePromise = carrierCall(this.writer.close(), "WebTransport stream FIN failed", "reset")
+            .then(() => { this.releaseIfComplete(); });
+        return this.closeWritePromise;
+    }
+    stopSending() {
+        if (this.stopSendingPromise !== undefined)
+            return this.stopSendingPromise;
+        this.assertNotTerminal();
+        const stopped = new CarrierError("stop_sending", "WebTransport stream receive side stopped");
+        this.readClosed = true;
+        this.readStopError = stopped;
+        this.stopSendingPromise ??= carrierCall(this.reader.cancel(stopped), "WebTransport STOP_SENDING failed", "stop_sending").then(() => { this.releaseIfComplete(); });
+        return this.stopSendingPromise;
+    }
+    reset() {
+        this.resetPromise ??= this.resetOnce();
+        return this.resetPromise;
+    }
+    abort(error = new CarrierError("aborted", "WebTransport stream aborted")) {
+        if (this.terminalError !== undefined)
+            return;
+        this.terminalError = error instanceof CarrierError
+            ? error
+            : new CarrierError("aborted", "WebTransport stream aborted", error);
+        this.readClosed = true;
+        this.writeClosed = true;
+        void this.writer.abort(this.terminalError).catch(() => undefined);
+        void this.reader.cancel(this.terminalError).catch(() => undefined);
+        this.release();
+    }
+    async resetOnce() {
+        if (this.terminalError !== undefined)
+            return;
+        this.writeClosed = true;
+        this.readClosed = true;
+        const error = new CarrierError("reset", "WebTransport stream reset");
+        this.terminalError = error;
+        try {
+            await Promise.allSettled([this.writer.abort(error), this.reader.cancel(error)]);
+        }
+        finally {
+            this.release();
+        }
+    }
+    assertReadable() {
+        this.assertNotTerminal();
+        if (this.readStopError !== undefined)
+            throw this.readStopError;
+    }
+    assertNotTerminal() {
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
+    }
+    releaseIfComplete() {
+        if (this.readClosed && this.writeClosed)
+            this.release();
+    }
+    release() {
+        if (this.released)
+            return;
+        this.released = true;
+        this.onRelease();
+    }
+}
+class WebTransportDatagramAdapter {
+    maxDatagramSize;
+    readable;
+    writable;
+    incoming = new IncomingDatagramQueue();
+    terminalError;
+    constructor(native, configuredMaxSize) {
+        const maxDatagramSize = configuredMaxSize ?? native.maxDatagramSize;
+        if (!Number.isInteger(maxDatagramSize) || maxDatagramSize < 1) {
+            throw new TypeError("WebTransport runtime did not provide a valid DATAGRAM size");
+        }
+        this.maxDatagramSize = maxDatagramSize;
+        this.readable = native.readable.getReader();
+        this.writable = native.writable.getWriter();
+        void this.pumpIncoming();
+    }
+    async send(data, options = {}) {
+        this.assertOpen();
+        if (options.signal?.aborted === true)
+            throw abortedCarrierError(options.signal.reason);
+        if (options.expiresAt !== undefined && options.expiresAt <= Date.now())
+            return "dropped_expired";
+        if (data.byteLength < 1 || data.byteLength > this.maxDatagramSize)
+            return "dropped_carrier";
+        try {
+            await raceAbort(this.writable.write(data.slice()), options.signal);
+            return "accepted";
+        }
+        catch (error) {
+            if (isAborted(options.signal))
+                throw abortedCarrierError(error);
+            if (this.terminalError !== undefined)
+                throw this.terminalError;
+            return "dropped_carrier";
+        }
+    }
+    async receive(options = {}) {
+        this.assertOpen();
+        return await this.incoming.shift(options.signal);
+    }
+    abort(error) {
+        if (this.terminalError !== undefined)
+            return;
+        this.terminalError = error;
+        this.incoming.fail(error);
+        void this.writable.abort(error).catch(() => undefined);
+        void this.readable.cancel(error).catch(() => undefined);
+    }
+    assertOpen() {
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
+    }
+    async pumpIncoming() {
+        try {
+            while (this.terminalError === undefined) {
+                const result = await this.readable.read();
+                if (result.done || result.value === undefined) {
+                    this.abort(new CarrierError("closed", "WebTransport datagrams closed"));
+                    return;
+                }
+                if (result.value.byteLength < 1 || result.value.byteLength > this.maxDatagramSize)
+                    continue;
+                this.incoming.push(result.value.slice());
+            }
+        }
+        catch (error) {
+            if (this.terminalError === undefined) {
+                this.abort(carrierFailure("WebTransport datagram receive failed", error));
+            }
+        }
+    }
+}
+class IncomingWebTransportStreamQueue {
+    values = [];
+    waiters = new Set();
+    terminalError;
+    push(stream) {
+        if (this.terminalError !== undefined) {
+            stream.abort(this.terminalError);
+            return;
+        }
+        const waiter = this.waiters.values().next().value;
+        if (waiter === undefined)
+            this.values.push(stream);
+        else
+            waiter.deliver(stream);
+    }
+    shift(signal) {
+        if (signal?.aborted === true)
+            return Promise.reject(abortedCarrierError(signal.reason));
+        if (this.terminalError !== undefined)
+            return Promise.reject(this.terminalError);
+        const value = this.values.shift();
+        if (value !== undefined)
+            return Promise.resolve(value);
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const cleanup = () => {
+                this.waiters.delete(waiter);
+                signal?.removeEventListener("abort", abort);
+            };
+            const waiter = {
+                deliver: (stream) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    resolve(stream);
+                },
+                fail: (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    reject(error);
+                },
+            };
+            const abort = () => waiter.fail(abortedCarrierError(signal?.reason));
+            this.waiters.add(waiter);
+            signal?.addEventListener("abort", abort, { once: true });
+            if (signal?.aborted === true)
+                abort();
+        });
+    }
+    fail(error) {
+        if (this.terminalError !== undefined)
+            return;
+        this.terminalError = error;
+        for (const stream of this.values)
+            stream.abort(error);
+        this.values.length = 0;
+        for (const waiter of [...this.waiters])
+            waiter.fail(error);
+    }
+}
+class IncomingDatagramQueue {
+    static MAX_VALUES = 256;
+    static MAX_BYTES = 4 * 1024 * 1024;
+    values = [];
+    bufferedBytes = 0;
+    waiters = new Set();
+    terminalError;
+    push(value) {
+        if (this.terminalError !== undefined)
+            return;
+        const waiter = this.waiters.values().next().value;
+        if (waiter === undefined) {
+            // DATAGRAMs are lossy by contract. Drop an incoming value once the
+            // bounded queue budget is exhausted, while keeping the native reader
+            // drained so an unconsumed peer cannot grow memory without bound.
+            if (this.values.length >= IncomingDatagramQueue.MAX_VALUES ||
+                this.bufferedBytes + value.byteLength > IncomingDatagramQueue.MAX_BYTES)
+                return;
+            this.values.push(value);
+            this.bufferedBytes += value.byteLength;
+        }
+        else
+            waiter.deliver(value);
+    }
+    shift(signal) {
+        if (signal?.aborted === true)
+            return Promise.reject(abortedCarrierError(signal.reason));
+        if (this.terminalError !== undefined)
+            return Promise.reject(this.terminalError);
+        const value = this.values.shift();
+        if (value !== undefined) {
+            this.bufferedBytes -= value.byteLength;
+            return Promise.resolve(value);
+        }
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const cleanup = () => {
+                this.waiters.delete(waiter);
+                signal?.removeEventListener("abort", abort);
+            };
+            const waiter = {
+                deliver: (next) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    resolve(next);
+                },
+                fail: (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    reject(error);
+                },
+            };
+            const abort = () => waiter.fail(abortedCarrierError(signal?.reason));
+            this.waiters.add(waiter);
+            signal?.addEventListener("abort", abort, { once: true });
+            if (signal?.aborted === true)
+                abort();
+        });
+    }
+    fail(error) {
+        if (this.terminalError !== undefined)
+            return;
+        this.terminalError = error;
+        this.values.length = 0;
+        this.bufferedBytes = 0;
+        for (const waiter of [...this.waiters])
+            waiter.fail(error);
+    }
+}
+function abortNativeStream(stream, error) {
+    const reader = stream.readable.getReader();
+    const writer = stream.writable.getWriter();
+    void reader.cancel(error).catch(() => undefined);
+    void writer.abort(error).catch(() => undefined);
+}
+function abortedCarrierError(cause) {
+    return new CarrierError("aborted", "WebTransport operation aborted", cause);
+}
+function isAborted(signal) {
+    return signal?.aborted === true;
+}
+async function raceAbort(promise, signal) {
+    if (signal === undefined)
+        return await promise;
+    if (signal.aborted)
+        throw abortedCarrierError(signal.reason);
+    return await new Promise((resolve, reject) => {
+        const abort = () => reject(abortedCarrierError(signal.reason));
+        signal.addEventListener("abort", abort, { once: true });
+        void promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+async function carrierCall(promise, message, code = "closed") {
+    try {
+        return await promise;
+    }
+    catch (error) {
+        if (error instanceof CarrierError)
+            throw error;
+        if (error instanceof DOMException && error.name === "AbortError" ||
+            error instanceof Error && error.name === "AbortError") {
+            throw new CarrierError("aborted", message, error);
+        }
+        throw new CarrierError(code, message, error);
+    }
+}
+function carrierFailure(message, cause) {
+    return cause instanceof CarrierError ? cause : new CarrierError("closed", message, cause);
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}

package/dist/yamux/stream.d.ts

@@ -12,6 +12,8 @@ export declare class YamuxStream {
     private readWaiters;
     private error;
     private resetTask;
+    private closeTask;
+    private closeRequested;
     private writeChain;
     private writeQueueBytes;
     private finalized;
@@ -23,6 +25,7 @@ export declare class YamuxStream {
     write(data: Uint8Array): Promise<void>;
     private writeSerial;
     close(): Promise<void>;
+    private closeSerial;
     reset(err?: Error): Promise<void>;
     abort(err?: Error): void;
     private fail;

package/dist/yamux/stream.js

@@ -24,6 +24,8 @@ export class YamuxStream {
     // Terminal error (reset/overflow) for the stream.
     error = null;
     resetTask;
+    closeTask;
+    closeRequested = false;
     writeChain = Promise.resolve();
     writeQueueBytes = 0;
     finalized = false;
@@ -89,6 +91,8 @@ export class YamuxStream {
     }
     // write sends DATA frames, respecting the send window.
     async write(data) {
+        if (this.closeRequested)
+            throw new Error("stream closed");
         this.ensureWritable();
         const byteCount = data.byteLength;
         const nextQueueBytes = this.writeQueueBytes + byteCount;
@@ -129,10 +133,19 @@ export class YamuxStream {
         }
     }
     // close sends FIN and transitions to local close.
-    async close() {
-        if (this.state === "closed")
-            return;
-        if (this.state === "reset")
+    close() {
+        if (this.closeTask !== undefined)
+            return this.closeTask;
+        if (this.state === "closed" || this.state === "reset" || this.state === "localClose")
+            return Promise.resolve();
+        this.closeRequested = true;
+        const task = this.writeChain.then(async () => await this.closeSerial());
+        this.writeChain = task.catch(() => undefined);
+        this.closeTask = task;
+        return task;
+    }
+    async closeSerial() {
+        if (this.state === "closed" || this.state === "reset" || this.state === "localClose")
             return;
         const wasRemoteClose = this.state === "remoteClose";
         const flags = this.sendFlags() | FLAG_FIN;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "2.5.3",
+  "version": "3.0.0",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {
@@ -63,7 +63,7 @@
     "ensure:browser": "node ./scripts/ensure-playwright-browsers.mjs chromium",
     "ensure:browser:firefox": "node ./scripts/ensure-playwright-browsers.mjs firefox",
     "ensure:browser:webkit": "node ./scripts/ensure-playwright-browsers.mjs webkit",
-    "test:coverage": "npm run build && vitest run --coverage",
+    "test:coverage": "npm run build && node ../scripts/server-parity-native-addon.mjs --test-coverage",
     "lint": "eslint .",
     "verify:package": "node ./scripts/verify-package-exports.mjs",
     "prepack": "npm run build",
@@ -77,7 +77,7 @@
     "ws": "^8.21.2"
   },
   "optionalDependencies": {
-    "@floegence/flowersec-node-native": "2.5.3"
+    "@floegence/flowersec-node-native": "3.0.0"
   },
   "devDependencies": {
     "@playwright/test": "1.62.1",
@@ -95,5 +95,5 @@
     "vite": "^8.2.1",
     "vitest": "4.1.10"
   },
-  "flowersecSourceCommit": "aa50aab509e3519b2b9c8e49abccc407a831a741"
+  "flowersecSourceCommit": "ec1f9697daa70e4781cd460ec551d40df436335c"
 }

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ec0f2db1-aea5-5835-89bb-52b08c4a4a1c",
+  "serialNumber": "urn:uuid:c9faed3c-b0e2-55ed-8e12-98bc68091c8c",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "2.5.3",
-      "purl": "pkg:npm/%40floegence/flowersec-core@2.5.3",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@2.5.3"
+      "version": "3.0.0",
+      "purl": "pkg:npm/%40floegence/flowersec-core@3.0.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@3.0.0"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "1a8ba3adc252c3c72e7a5129a172b0c767a075161ac1d0379f0b257f091816fb"
+        "value": "8146654f4a197f2c5a7d100c8e25ee624d6f7ea2a6a57da0bc318ab1653b4a5c"
       }
     ]
   },
@@ -190,7 +190,7 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@2.5.3",
+      "ref": "pkg:npm/%40floegence/flowersec-core@3.0.0",
       "dependsOn": [
         "pkg:npm/%40noble/ciphers@2.3.0",
         "pkg:npm/%40noble/curves@2.3.0",