@floegence/flowersec-core 2.5.4 → 3.0.1

package/dist/v3/session.js

@@ -0,0 +1,2289 @@
+import { RpcClient } from "../rpc/client.js";
+import { RpcRouter, RpcServer } from "../rpc/server.js";
+import { CarrierError } from "./carrier.js";
+import { FLOWERSEC_V3_PROFILE } from "./transportConstants.js";
+import { computeClientConfirmV3, computeHandshakeH0V3, computeHandshakeH1V3, computeHandshakeH2V3, computeHandshakeH3V3, computeServerConfirmV3, computeSharedSecretV3, decodeClientFinishedV3, decodeClientInitV3, decodeHandshakeFrameV3, decodeServerFinishedV3, deriveHandshakePRKV3, deriveSessionPRKV3, encodeClientFinishedCoreV3, encodeClientFinishedV3, encodeClientInitV3, encodeControlPrefaceV3, encodeServerFinishedCoreV3, encodeServerFinishedV3, generateEphemeralKeyV3, parseControlPrefaceV3, validateClientInitV3, validateServerFinishedV3, } from "./handshake.js";
+import { DirectionV3, InnerTypeV3, computeValidatedFSS3HashV3Internal, computeValidatedOpenHashV3Internal, computeSetupMAC, decodeInnerRecordV3, decodeOpenACKV3, decodeOpenPayload, decodeOpenRejectV3, decodeRecordHeader, decodeSetupPrefaceV3, decodeStreamKeyUpdateACKV3, deriveControlMaterial, deriveEpochZero, deriveEpochRoots, deriveNextEpoch, deriveStreamMaterial, encodeInnerRecordV3, encodeOpenACKV3, encodeOpenPayloadFromMetadataV3Internal, encodeOpenRejectV3, encodeSetupPreface, encodeStreamKeyUpdateACKV3, openRecordWithRawHeaderV3Internal, sealRecordWireV3Internal, verifySetupMAC, } from "./protocol.js";
+import { StreamLifetimeLedgerV3, StreamLifetimeLedgerV3Error, maxLogicalStreamIDV3, } from "./streamLifetimeLedger.js";
+import { UNRELIABLE_MESSAGES_FEATURE_V3, UNRELIABLE_MESSAGE_WIRE_BYTES_V3, createInternalUnreliableMessageChannelV3, } from "./unreliableMessage.js";
+const decoder = new TextDecoder();
+const MAX_DATA_BYTES = 16_384;
+const MAX_BUFFERED_STREAM_BYTES = 4 * 1024 * 1024;
+const RESERVED_RPC_KIND = "flowersec.rpc.v3";
+const DEFAULT_IDLE_TIMEOUT_MS = 60_000;
+const DEFAULT_CLOSE_TIMEOUT_MS = 2_000;
+const DEFAULT_CONTROL_CONFIRM_TIMEOUT_MS = 2_000;
+const MAX_UINT32 = 0xffffffff;
+const MAX_UINT64 = (1n << 64n) - 1n;
+export class SessionV3Error extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "SessionV3Error";
+    }
+}
+class SessionRpcPeerV3 {
+    outbound;
+    inbound;
+    constructor(outbound, inbound) {
+        this.outbound = outbound;
+        this.inbound = inbound;
+    }
+    call(typeId, payload, signal) {
+        return this.outbound.call(typeId, payload, signal);
+    }
+    notify(typeId, payload) {
+        return this.outbound.notify(typeId, payload);
+    }
+    onNotify(typeId, handler) {
+        return this.inbound.onNotify(typeId, handler);
+    }
+    close() {
+        this.outbound.close();
+    }
+}
+export async function establishSessionV3(carrier, config, options = {}) {
+    validateConfig(carrier, config);
+    const establishDeadline = createSessionDeadline(config, "establish");
+    const establishSignal = combineSignals(options.signal, establishDeadline.signal);
+    throwIfAborted(establishSignal.signal);
+    let control;
+    try {
+        control = config.role === "client"
+            ? await carrier.openStream(signalOptions(establishSignal.signal))
+            : await carrier.acceptStream(signalOptions(establishSignal.signal));
+        const reader = new ExactReader(control);
+        const localFeatures = supportedFeatures(carrier.unreliableDatagrams);
+        const material = config.role === "client"
+            ? await clientHandshake(control, reader, config, localFeatures, establishSignal.signal)
+            : await serverHandshake(control, reader, config, localFeatures, establishSignal.signal);
+        const session = new SessionV3(carrier, control, reader, config, material);
+        session.start();
+        return session;
+    }
+    catch (error) {
+        control?.abort(asError(error));
+        carrier.abort({ code: 6, reason: "handshake failed" });
+        if (error instanceof SessionV3Error)
+            throw error;
+        throw new SessionV3Error("handshake", `Flowersec v3 handshake failed: ${errorMessage(error)}`);
+    }
+    finally {
+        establishSignal.cancel();
+        establishDeadline.cancel();
+    }
+}
+export class SessionV3 {
+    carrier;
+    control;
+    controlReader;
+    config;
+    path;
+    endpointInstanceId;
+    rpc;
+    termination;
+    unreliableMessages;
+    terminalError;
+    role;
+    sendDirection;
+    receiveDirection;
+    h3;
+    sendRoots = new Map();
+    receiveRoots = new Map();
+    sendEpoch = 0;
+    receiveEpoch = 0;
+    controlSendEpoch = 0;
+    controlSendSequence = 0n;
+    controlReceiveEpoch = 0;
+    controlReceiveSequence = 0n;
+    controlWriteTail = Promise.resolve();
+    controlTerminalSealed = false;
+    nextLogicalID;
+    receivedGoAway = false;
+    receivedGoAwayLastAccepted = 0n;
+    receivedGoAwayReason = 0;
+    sentGoAway = false;
+    sentGoAwayLastAccepted = 0n;
+    sentGoAwayReason = 0;
+    closePromise;
+    lifecycle = "opening";
+    sentSessionClose = false;
+    sessionCloseCommitted = false;
+    peerSessionClose = deferred();
+    streams = new Map();
+    releasedStreams = new Map();
+    releasedStreamCleanup = releasedStreamCleanup(this.releasedStreams);
+    peerLedger;
+    outboundLedger;
+    incoming = new AsyncQueue();
+    outboundPermits;
+    inboundPermits;
+    pings = new Map();
+    backgroundTasks = new Set();
+    nextPing = 1n;
+    rpcActivation = deferred();
+    rpcStreamPromise;
+    rpcServing = false;
+    rekeyTail = Promise.resolve();
+    nextTransition = 1n;
+    receiveTransition = 0n;
+    pendingSessionRekey;
+    lastSessionRekeyACK;
+    preparingSendEpoch;
+    pendingReceiveEpoch;
+    openFrozen = false;
+    openGate = deferred();
+    outboundFrontierChanged = deferred();
+    activeInboundResponders = 0;
+    localResponderFrozen = false;
+    peerResponderFrozen = false;
+    responderChanged = deferred();
+    idleWatchdogStarted = false;
+    idleDeadlineMs;
+    idleTimerCancel;
+    terminationState = deferred();
+    rpcRouter;
+    constructor(carrier, control, controlReader, config, material) {
+        this.carrier = carrier;
+        this.control = control;
+        this.controlReader = controlReader;
+        this.config = config;
+        this.path = config.path;
+        this.termination = this.terminationState.promise;
+        this.endpointInstanceId = config.path === "tunnel" ? config.expectedPeerEndpointInstanceID : undefined;
+        this.role = config.role === "client" ? 1 : 2;
+        this.sendDirection = this.role === 1 ? DirectionV3.ClientToServer : DirectionV3.ServerToClient;
+        this.receiveDirection = this.role === 1 ? DirectionV3.ServerToClient : DirectionV3.ClientToServer;
+        this.nextLogicalID = this.role === 1 ? 1n : 2n;
+        this.peerLedger = new StreamLifetimeLedgerV3(this.role === 1 ? 2 : 1);
+        this.outboundLedger = new StreamLifetimeLedgerV3(this.role);
+        this.h3 = material.h3.slice();
+        this.sendRoots.set(0, deriveEpochZero(material.sessionPRK, this.sendDirection));
+        this.receiveRoots.set(0, deriveEpochZero(material.sessionPRK, this.receiveDirection));
+        this.unreliableMessages = (material.selectedFeatures & UNRELIABLE_MESSAGES_FEATURE_V3) !== 0
+            ? createInternalUnreliableMessageChannelV3({
+                transport: requireUnreliableDatagrams(carrier),
+                suite: config.suite,
+                h3: this.h3,
+                sendDirection: this.sendDirection,
+                receiveDirection: this.receiveDirection,
+                currentSendEpoch: () => ({
+                    epoch: this.sendEpoch,
+                    epochSecret: this.rootForSend(this.sendEpoch).epochSecret,
+                }),
+                receiveEpochSecret: (epoch) => epoch <= this.receiveEpoch && epoch + 1 >= this.receiveEpoch
+                    ? this.receiveRoots.get(epoch)?.epochSecret
+                    : undefined,
+                onProtocolFailure: () => this.fail(protocolError("previous protocol unreliable frame")),
+            })
+            : undefined;
+        this.outboundPermits = new AsyncSemaphore(config.maxInboundStreams);
+        this.inboundPermits = new AsyncSemaphore(config.maxInboundStreams);
+        this.rpcRouter = config.rpcRouter ?? new RpcRouter();
+        const rpcReadState = { reader: undefined };
+        const rpcClient = new RpcClient(async (length) => {
+            await this.rpcActivation.promise;
+            const stream = await this.ensureRPCStream();
+            rpcReadState.reader ??= new ExactReader(stream);
+            return await rpcReadState.reader.readExactly(length);
+        }, async (payload) => {
+            this.rpcActivation.resolve();
+            const stream = await this.ensureRPCStream();
+            await stream.write(payload);
+        }, { onTerminal: (error) => this.fail(error) });
+        this.rpc = new SessionRpcPeerV3(rpcClient, this.rpcRouter);
+    }
+    async openStream(kind, options = {}) {
+        if (kind === RESERVED_RPC_KIND)
+            throw new SessionV3Error("open_rejected", "reserved RPC stream kind");
+        return await this.openLogicalStream(kind, options, false);
+    }
+    async acceptStream(options = {}) {
+        this.assertOpen();
+        return await this.incoming.shift(options.signal);
+    }
+    async probeLiveness(options = {}) {
+        this.assertOpen();
+        throwIfAborted(options.signal);
+        const nonce = this.nextPing++;
+        const pending = deferred();
+        this.pings.set(nonce, pending);
+        const started = this.config.runtime.monotonicMilliseconds();
+        try {
+            await this.sendControl(InnerTypeV3.Ping, u64(nonce), options.signal);
+            await raceAbort(pending.promise, options.signal);
+            return Math.max(0, this.config.runtime.monotonicMilliseconds() - started);
+        }
+        finally {
+            this.pings.delete(nonce);
+        }
+    }
+    async rekey(options = {}) {
+        const callerCancellation = canonicalCallerCancellation(options.signal);
+        try {
+            this.assertOpen();
+            throwIfAborted(callerCancellation.signal);
+            const task = this.rekeyTail.then(async () => {
+                throwIfAborted(callerCancellation.signal);
+                await this.rekeyOnce({ signal: callerCancellation.signal });
+            });
+            this.rekeyTail = task.catch(() => undefined);
+            await raceAbort(task, callerCancellation.signal);
+        }
+        finally {
+            callerCancellation.cancel();
+        }
+    }
+    close() {
+        if (this.closePromise === undefined) {
+            this.beginClosing();
+            this.closePromise = this.closeOnce();
+        }
+        return this.closePromise;
+    }
+    start() {
+        if (this.lifecycle !== "opening")
+            return;
+        this.lifecycle = "open";
+        this.startIdleWatchdog();
+        void this.controlLoop();
+        void this.acceptCarrierLoop();
+        void this.carrier.waitTermination().then(() => this.fail(new CarrierError("closed", "carrier session terminated"), false), (error) => this.fail(asError(error), false));
+    }
+    rootForSend(epoch) {
+        const roots = this.sendRoots.get(epoch);
+        if (roots === undefined)
+            throw protocolError("missing send epoch roots");
+        return roots;
+    }
+    rootForReceive(epoch) {
+        const roots = this.receiveRoots.get(epoch);
+        if (roots === undefined)
+            throw protocolError("missing receive epoch roots");
+        return roots;
+    }
+    hasReceiveRoots(epoch) {
+        return this.receiveRoots.has(epoch);
+    }
+    installReceiveRoots(epoch, roots) {
+        const existing = this.receiveRoots.get(epoch);
+        if (existing !== undefined && !bytesEqual(existing.epochSecret, roots.epochSecret)) {
+            throw protocolError("conflicting receive epoch roots");
+        }
+        this.receiveRoots.set(epoch, roots);
+    }
+    transcriptHash() {
+        return this.h3;
+    }
+    receiveDirectionValue() {
+        return this.receiveDirection;
+    }
+    async sendStreamRecord(stream, type, payload, signal) {
+        this.assertOpen();
+        const inner = encodeInnerRecordV3(type, payload);
+        const roots = this.rootForSend(stream.sendEpoch);
+        const material = stream.sendMaterial(roots, this.h3, this.sendDirection);
+        const header = {
+            epoch: stream.sendEpoch,
+            sequence: stream.sendSequence,
+            ciphertextLength: inner.length + 16,
+        };
+        const sealed = sealRecordWireV3Internal(this.config.suite, material, this.h3, stream.id, this.sendDirection, header, inner);
+        stream.sendSequence += 1n;
+        await writeAll(stream.carrier, concat(sealed.rawHeader, sealed.ciphertext), signal);
+        this.markAuthenticatedActivity();
+    }
+    async readStreamRecord(stream) {
+        const rawHeader = await stream.reader.readExactly(24);
+        const header = decodeRecordHeader(rawHeader);
+        const priorACK = stream.priorACK !== undefined &&
+            header.epoch === stream.priorACK.epoch && header.sequence === stream.priorACK.sequence;
+        if (!priorACK && (header.epoch !== stream.receiveEpoch || header.sequence !== stream.receiveSequence)) {
+            throw protocolError("unexpected stream epoch or sequence");
+        }
+        const roots = this.rootForReceive(header.epoch);
+        const material = stream.receiveMaterial(roots, this.h3, this.receiveDirection, header.epoch);
+        const ciphertext = await stream.reader.readExactly(header.ciphertextLength);
+        const inner = decodeInnerRecordV3(openRecordWithRawHeaderV3Internal(this.config.suite, material, this.h3, stream.id, this.receiveDirection, header, rawHeader, ciphertext));
+        if (priorACK) {
+            if (inner.type !== InnerTypeV3.StreamKeyUpdateACK)
+                throw protocolError("late old-epoch record is not rekey ACK");
+            stream.priorACK = undefined;
+            stream.pruneReceiveMaterials();
+            this.cleanupEpochRoots();
+        }
+        else {
+            stream.receiveSequence += 1n;
+        }
+        this.markAuthenticatedActivity();
+        return { ...inner, header };
+    }
+    async localReset(stream, error) {
+        if (!stream.markTerminal(error))
+            return;
+        this.releaseStream(stream);
+        let controlConfirmed = false;
+        try {
+            if (await this.sendControlCleanup(InnerTypeV3.StreamReset, idReason(stream.id, 6))) {
+                this.commitLocalReset(stream.id);
+                if (stream.hasRemoteFIN())
+                    controlConfirmed = await this.confirmControlDelivery();
+            }
+        }
+        catch (cause) {
+            this.fail(asError(cause));
+        }
+        if (controlConfirmed) {
+            await stream.carrier.closeWrite().catch(async () => await stream.carrier.reset().catch(() => undefined));
+        }
+        else {
+            await stream.carrier.reset().catch(() => undefined);
+        }
+    }
+    releaseStream(stream) {
+        stream.wipeRecordMaterials();
+        if (stream.terminalError !== undefined) {
+            this.releasedStreams.delete(stream.id);
+            this.releasedStreamCleanup.unregister(stream);
+        }
+        if (this.streams.get(stream.id) !== stream)
+            return;
+        this.streams.delete(stream.id);
+        if (stream.terminalError === undefined) {
+            this.releasedStreams.set(stream.id, new WeakRef(stream));
+            this.releasedStreamCleanup.register(stream, stream.id, stream);
+        }
+        stream.releasePermit();
+        this.cleanupEpochRoots();
+    }
+    async confirmControlDelivery() {
+        if (this.lifecycle !== "open" || this.controlTerminalSealed)
+            return false;
+        const nonce = this.nextPing++;
+        const pending = deferred();
+        this.pings.set(nonce, pending);
+        try {
+            await this.sendControl(InnerTypeV3.Ping, u64(nonce));
+            return await resolveWithin(pending.promise, DEFAULT_CONTROL_CONFIRM_TIMEOUT_MS);
+        }
+        finally {
+            this.pings.delete(nonce);
+        }
+    }
+    async openLogicalStream(kind, options, internal) {
+        this.assertOpen();
+        throwIfAborted(options.signal);
+        await this.waitOpenGate(options.signal);
+        const releasePermit = internal ? () => undefined : await this.outboundPermits.acquire(options.signal);
+        let stream;
+        let carrierStream;
+        let id;
+        let ledgerAllocated = false;
+        try {
+            this.assertOpen();
+            await this.waitOpenGate(options.signal);
+            if (this.sentGoAway || this.receivedGoAway)
+                throw new SessionV3Error("going_away", "session is going away");
+            id = this.nextLogicalID;
+            if (id > maxLogicalStreamIDV3(this.role)) {
+                await this.sendGoAway(5);
+                throw new SessionV3Error("resource_exhausted", "logical stream lifetime ledger exhausted");
+            }
+            this.nextLogicalID += 2n;
+            const setupAction = this.outboundLedger.validFSS3(id);
+            ledgerAllocated = true;
+            if (setupAction === "reset") {
+                this.notifyOutboundFrontierChanged();
+                throw new SessionV3Error("closed", "logical stream identity was already reset by peer");
+            }
+            carrierStream = await this.carrier.openStream(options);
+            if (!this.localOpeningAllowedAfterGoAway(id)) {
+                throw new SessionV3Error("going_away", "logical stream is beyond the peer GOAWAY boundary");
+            }
+            const roots = this.rootForSend(this.sendEpoch);
+            const unsigned = {
+                openerRole: this.role,
+                logicalStreamID: id,
+                initialSendEpoch: this.sendEpoch,
+                setupMAC: new Uint8Array(32),
+            };
+            const prefaceRaw = encodeSetupPreface({
+                ...unsigned,
+                setupMAC: computeSetupMAC(roots.setupRoot, this.h3, unsigned),
+            });
+            await writeAll(carrierStream, prefaceRaw, options.signal);
+            if (!this.localOpeningAllowedAfterGoAway(id)) {
+                throw new SessionV3Error("going_away", "logical stream is beyond the peer GOAWAY boundary");
+            }
+            const openRaw = encodeOpenPayloadFromMetadataV3Internal({
+                logicalStreamID: id,
+                fss3Hash: computeValidatedFSS3HashV3Internal(prefaceRaw),
+                kind,
+                metadata: options.metadata ?? {},
+            });
+            stream = new EncryptedStreamV3(this, carrierStream, id, kind, this.sendEpoch, this.receiveEpoch, releasePermit);
+            this.streams.set(id, stream);
+            stream.setOpenHash(computeValidatedOpenHashV3Internal(openRaw));
+            await stream.send(InnerTypeV3.Open, openRaw, options.signal);
+            stream.startPump();
+            await raceAbort(stream.opened.promise, options.signal);
+            if (!this.localOpeningAllowedAfterGoAway(id)) {
+                throw new SessionV3Error("going_away", "logical stream is beyond the peer GOAWAY boundary");
+            }
+            return stream;
+        }
+        catch (error) {
+            if (stream !== undefined)
+                await this.localReset(stream, asError(error));
+            else {
+                await carrierStream?.reset().catch(() => undefined);
+                if (id !== undefined && ledgerAllocated) {
+                    await this.commitOutboundReset(id).catch((cause) => this.fail(asError(cause)));
+                }
+                releasePermit();
+            }
+            throw error;
+        }
+    }
+    ensureRPCStream() {
+        this.rpcActivation.resolve();
+        this.rpcStreamPromise ??= this.openLogicalStream(RESERVED_RPC_KIND, {}, true);
+        return this.rpcStreamPromise;
+    }
+    async acceptCarrierLoop() {
+        try {
+            while (this.lifecycle === "open") {
+                const carrierStream = await this.carrier.acceptStream();
+                void this.acceptCarrierStream(carrierStream).catch((error) => {
+                    void carrierStream.reset();
+                    if (error instanceof StreamLifetimeLedgerV3Error && error.code === "duplicate") {
+                        this.fail(protocolError(error.message));
+                    }
+                });
+            }
+        }
+        catch (error) {
+            if (this.lifecycle !== "closed")
+                this.fail(asError(error));
+        }
+    }
+    async acceptCarrierStream(carrierStream) {
+        let responderHeld = false;
+        let ledgerID;
+        try {
+            this.assertOpen();
+            await this.enterInboundResponder();
+            responderHeld = true;
+            const reader = new ExactReader(carrierStream);
+            let prefaceRaw;
+            let preface;
+            prefaceRaw = await reader.readExactly(56);
+            preface = decodeSetupPrefaceV3(prefaceRaw);
+            const peerRole = this.role === 1 ? 2 : 1;
+            if (preface.openerRole !== peerRole || preface.initialSendEpoch !== this.receiveEpoch) {
+                await carrierStream.reset().catch(() => undefined);
+                return;
+            }
+            const receiveRoots = this.rootForReceive(preface.initialSendEpoch);
+            if (!verifySetupMAC(receiveRoots.setupRoot, this.h3, preface) || !this.acceptsPeerStreamAfterGoAway(preface.logicalStreamID)) {
+                await carrierStream.reset().catch(() => undefined);
+                return;
+            }
+            let setupAction;
+            try {
+                setupAction = this.peerLedger.validFSS3(preface.logicalStreamID);
+            }
+            catch (error) {
+                if (error instanceof StreamLifetimeLedgerV3Error && error.code === "duplicate")
+                    throw error;
+                await carrierStream.reset().catch(() => undefined);
+                return;
+            }
+            if (setupAction === "reset") {
+                await carrierStream.reset().catch(() => undefined);
+                return;
+            }
+            ledgerID = preface.logicalStreamID;
+            await this.acceptCarrierStreamAfterFSS3(carrierStream, reader, prefaceRaw, preface);
+        }
+        catch (error) {
+            if (ledgerID !== undefined)
+                await this.resetInboundBeforeDelivery(ledgerID, carrierStream);
+            else
+                await carrierStream.reset().catch(() => undefined);
+            if (error instanceof StreamLifetimeLedgerV3Error && error.code === "duplicate")
+                throw error;
+        }
+        finally {
+            if (responderHeld)
+                this.leaveInboundResponder();
+        }
+    }
+    async acceptCarrierStreamAfterFSS3(carrierStream, reader, prefaceRaw, preface) {
+        this.assertOpen();
+        const temporary = new EncryptedStreamV3(this, carrierStream, preface.logicalStreamID, "", this.sendEpoch, preface.initialSendEpoch, () => undefined, reader);
+        let stream;
+        try {
+            const first = await this.readStreamRecord(temporary);
+            if (first.type !== InnerTypeV3.Open)
+                throw protocolError("OPEN must be first");
+            const open = decodeOpenPayload(first.payload);
+            const openHash = computeValidatedOpenHashV3Internal(first.payload);
+            if (open.logicalStreamID !== preface.logicalStreamID ||
+                !bytesEqual(open.fss3Hash, computeValidatedFSS3HashV3Internal(prefaceRaw))) {
+                throw protocolError("OPEN binding mismatch");
+            }
+            this.peerLedger.validOpen(preface.logicalStreamID);
+            const internalRPC = open.kind === RESERVED_RPC_KIND;
+            if (internalRPC && decoder.decode(open.metadata) !== "{}") {
+                await temporary.send(InnerTypeV3.OpenReject, encodeOpenRejectV3(openHash, 4));
+                temporary.wipeRecordMaterials();
+                await carrierStream.closeWrite();
+                return;
+            }
+            const releasePermit = internalRPC ? () => undefined : this.inboundPermits.tryAcquire();
+            if (releasePermit === undefined) {
+                await temporary.send(InnerTypeV3.OpenReject, encodeOpenRejectV3(openHash, 2));
+                temporary.wipeRecordMaterials();
+                await carrierStream.closeWrite();
+                return;
+            }
+            stream = new EncryptedStreamV3(this, carrierStream, preface.logicalStreamID, open.kind, this.sendEpoch, preface.initialSendEpoch, releasePermit, reader);
+            this.assertOpen();
+            stream.receiveSequence = temporary.receiveSequence;
+            temporary.transferReceiveMaterialsTo(stream);
+            this.streams.set(stream.id, stream);
+            await stream.send(InnerTypeV3.OpenACK, encodeOpenACKV3(openHash));
+            stream.markOpen();
+            stream.startPump();
+            if (!this.acceptsPeerStreamAfterGoAway(stream.id)) {
+                await this.localReset(stream, new SessionV3Error("going_away", "peer stream exceeds the sent GOAWAY boundary"));
+                return;
+            }
+            if (internalRPC) {
+                if (this.rpcServing) {
+                    await this.localReset(stream, protocolError("duplicate reserved RPC stream"));
+                    return;
+                }
+                this.rpcServing = true;
+                const rpcStream = stream;
+                const rpcReader = new ExactReader(rpcStream);
+                const server = new RpcServer({
+                    readExactly: async (length) => await rpcReader.readExactly(length),
+                    write: async (payload) => { await rpcStream.write(payload); },
+                    close: () => { void rpcStream.reset(); },
+                }, this.config.rpcServerOptions, this.rpcRouter);
+                void server.serve().catch((error) => {
+                    if (this.lifecycle !== "closed")
+                        this.fail(asError(error));
+                });
+                return;
+            }
+            this.incoming.push({
+                id: stream.id,
+                kind: stream.kind,
+                metadata: decodeMetadata(open.metadata),
+                stream,
+            });
+        }
+        catch (error) {
+            if (stream !== undefined) {
+                stream.markTerminal(asError(error));
+                this.releaseStream(stream);
+            }
+            throw error;
+        }
+        finally {
+            temporary.wipeRecordMaterials();
+        }
+    }
+    async resetInboundBeforeDelivery(id, carrierStream) {
+        await carrierStream.reset().catch(() => undefined);
+        try {
+            if (await this.sendControlCleanup(InnerTypeV3.StreamReset, idReason(id, 3))) {
+                this.peerLedger.localResetCommitted(id);
+            }
+        }
+        catch (error) {
+            this.fail(asError(error));
+        }
+    }
+    async sendControl(type, payload, signal) {
+        if (this.controlTerminalSealed) {
+            throw this.terminalError ?? new SessionV3Error("closed", "Flowersec v3 control stream is sealed");
+        }
+        const task = this.controlWriteTail.then(async () => {
+            if (this.lifecycle === "closed")
+                throw this.terminalError ?? new SessionV3Error("closed", "Flowersec v3 session closed");
+            await this.writeControl(type, payload, signal);
+        });
+        this.controlWriteTail = task.catch(() => undefined);
+        if (signal === undefined)
+            await task;
+        else
+            await raceAbort(task, signal);
+    }
+    async sendControlResponse(type, payload, publish) {
+        if (this.lifecycle !== "open" || this.controlTerminalSealed)
+            return false;
+        const task = this.controlWriteTail.then(async () => {
+            if (this.lifecycle !== "open" || this.controlTerminalSealed)
+                return false;
+            publish?.();
+            await this.writeControl(type, payload);
+            return true;
+        });
+        this.controlWriteTail = task.then(() => undefined, () => undefined);
+        return await task;
+    }
+    async sendControlCleanup(type, payload) {
+        if (this.controlTerminalSealed || this.lifecycle === "closed")
+            return false;
+        const task = this.controlWriteTail.then(async () => {
+            if (this.lifecycle === "closed")
+                return false;
+            await this.writeControl(type, payload);
+            return true;
+        });
+        this.controlWriteTail = task.then(() => undefined, () => undefined);
+        return await task;
+    }
+    sendTerminalControl(reason) {
+        if (this.controlTerminalSealed)
+            return this.controlWriteTail;
+        this.controlTerminalSealed = true;
+        const task = this.controlWriteTail.then(async () => {
+            if (this.lifecycle === "closed")
+                throw this.terminalError ?? new SessionV3Error("closed", "Flowersec v3 session closed");
+            if (!this.sentGoAway) {
+                this.sentGoAway = true;
+                this.sentGoAwayLastAccepted = this.peerLedger.frontier;
+                this.sentGoAwayReason = reason;
+            }
+            await this.writeControl(InnerTypeV3.GoAway, idReason(this.sentGoAwayLastAccepted, this.sentGoAwayReason));
+            if (!this.sentSessionClose) {
+                this.sentSessionClose = true;
+                await this.writeControl(InnerTypeV3.SessionClose, Uint8Array.of(0, reason));
+                this.sessionCloseCommitted = true;
+            }
+            await this.control.closeWrite();
+        });
+        this.controlWriteTail = task.catch(() => undefined);
+        return task;
+    }
+    async writeControl(type, payload, signal) {
+        const inner = encodeInnerRecordV3(type, payload);
+        const roots = this.rootForSend(this.controlSendEpoch);
+        const material = deriveControlMaterial(roots.controlRoot, this.h3, this.sendDirection, this.controlSendEpoch);
+        const header = {
+            epoch: this.controlSendEpoch,
+            sequence: this.controlSendSequence,
+            ciphertextLength: inner.length + 16,
+        };
+        const sealed = sealRecordWireV3Internal(this.config.suite, material, this.h3, 0n, this.sendDirection, header, inner);
+        this.controlSendSequence += 1n;
+        await writeAll(this.control, concat(sealed.rawHeader, sealed.ciphertext), signal);
+        this.markAuthenticatedActivity();
+    }
+    async readControl() {
+        const rawHeader = await this.controlReader.readExactly(24);
+        const header = decodeRecordHeader(rawHeader);
+        const cutover = header.epoch === this.controlReceiveEpoch + 1 &&
+            header.epoch <= this.receiveEpoch && header.sequence === 0n;
+        if (!cutover && (header.epoch !== this.controlReceiveEpoch || header.sequence !== this.controlReceiveSequence)) {
+            throw protocolError("unexpected control epoch or sequence");
+        }
+        const roots = this.rootForReceive(header.epoch);
+        const material = deriveControlMaterial(roots.controlRoot, this.h3, this.receiveDirection, header.epoch);
+        const ciphertext = await this.controlReader.readExactly(header.ciphertextLength);
+        const inner = decodeInnerRecordV3(openRecordWithRawHeaderV3Internal(this.config.suite, material, this.h3, 0n, this.receiveDirection, header, rawHeader, ciphertext));
+        if (cutover) {
+            this.controlReceiveEpoch = header.epoch;
+            this.controlReceiveSequence = 1n;
+            this.cleanupEpochRoots();
+        }
+        else {
+            this.controlReceiveSequence += 1n;
+        }
+        this.markAuthenticatedActivity();
+        return inner;
+    }
+    async controlLoop() {
+        try {
+            while (this.lifecycle !== "closed") {
+                const record = await this.readControl();
+                switch (record.type) {
+                    case InnerTypeV3.Ping:
+                        await this.sendControlResponse(InnerTypeV3.Pong, record.payload);
+                        break;
+                    case InnerTypeV3.Pong:
+                        this.pings.get(readU64(record.payload))?.resolve();
+                        break;
+                    case InnerTypeV3.StreamReset: {
+                        const { id, reason } = parseIDReason(record.payload);
+                        if (id === 0n || reason === 0)
+                            throw protocolError("invalid STREAM_RESET");
+                        const stream = this.streams.get(id);
+                        if (stream !== undefined) {
+                            stream.peerReset(new SessionV3Error("stream_reset", "logical stream reset by peer"));
+                        }
+                        else {
+                            const released = this.releasedStreams.get(id);
+                            if (released !== undefined) {
+                                this.releasedStreams.delete(id);
+                                const releasedStream = released.deref();
+                                if (releasedStream !== undefined) {
+                                    this.releasedStreamCleanup.unregister(releasedStream);
+                                    releasedStream.markTerminal(new SessionV3Error("stream_reset", "logical stream reset by peer"));
+                                }
+                            }
+                        }
+                        if (this.isLocalLogicalID(id)) {
+                            this.outboundLedger.peerReset(id);
+                            this.notifyOutboundFrontierChanged();
+                        }
+                        else {
+                            this.peerLedger.peerReset(id);
+                        }
+                        break;
+                    }
+                    case InnerTypeV3.SessionKeyUpdate:
+                        await this.receiveSessionRekey(record.payload);
+                        break;
+                    case InnerTypeV3.SessionKeyUpdateACK:
+                        this.receiveSessionRekeyACK(record.payload);
+                        break;
+                    case InnerTypeV3.GoAway:
+                        await this.receiveGoAway(record.payload);
+                        break;
+                    case InnerTypeV3.SessionClose:
+                        if (record.payload.length !== 2 || readU16(record.payload, 0) === 0) {
+                            throw protocolError("invalid SESSION_CLOSE");
+                        }
+                        this.peerSessionClose.resolve();
+                        await this.close();
+                        throw new SessionV3Error("closed", "Flowersec v3 session closed by peer");
+                    default:
+                        throw protocolError(`unexpected control type ${record.type}`);
+                }
+            }
+        }
+        catch (error) {
+            if (this.lifecycle !== "closed")
+                this.fail(asError(error));
+        }
+    }
+    async closeOnce() {
+        if (this.lifecycle === "closed") {
+            await this.rekeyTail;
+            return;
+        }
+        const closed = new SessionV3Error("closed", "Flowersec v3 session closed");
+        const terminal = this.sendTerminalControl(1);
+        const work = (async () => {
+            try {
+                await terminal;
+            }
+            catch {
+                // Closing is best-effort once the bounded shutdown has started.
+            }
+            await this.peerSessionClose.promise;
+            this.fail(closed, false);
+            await this.carrier.close({ code: 1, reason: "session closed" }).catch(() => undefined);
+        })();
+        if (!await settleWithin(work, sessionCloseTimeoutMs(this.config))) {
+            this.carrier.abort({ code: 1, reason: "session close deadline exceeded" });
+            this.peerSessionClose.resolve();
+            void work.catch(() => undefined);
+        }
+        this.fail(closed, false);
+        // Close is the barrier for every workflow the session owns. A caller may
+        // already have stopped observing a committed rekey, but its internal task
+        // must release all gates before Close returns.
+        await this.rekeyTail;
+    }
+    async waitTermination() {
+        return await this.termination;
+    }
+    async rekeyOnce(options) {
+        this.assertOpen();
+        throwIfAborted(options.signal);
+        this.openFrozen = true;
+        this.openGate = deferred();
+        let committed = false;
+        const prepareDeadline = createSessionDeadline(this.config, "rekey_prepare");
+        const prepareSignal = combineSignals(options.signal, prepareDeadline.signal);
+        let completionDeadline;
+        let completionSignal;
+        let respondersFrozen = false;
+        try {
+            const currentEpoch = this.sendEpoch;
+            if (currentEpoch === MAX_UINT32) {
+                await this.rejectExhaustedRekey("session epoch exhausted", prepareSignal.signal, options.signal);
+            }
+            if (this.nextTransition < 1n || this.nextTransition > MAX_UINT64) {
+                await this.rejectExhaustedRekey("session transition exhausted", prepareSignal.signal, options.signal);
+            }
+            await this.freezeInboundResponders(false, prepareSignal.signal);
+            respondersFrozen = true;
+            const nextEpoch = currentEpoch + 1;
+            const currentRoots = this.rootForSend(currentEpoch);
+            const nextRoots = deriveEpochRoots(deriveNextEpoch(currentRoots.rekeyRoot, this.h3, this.sendDirection, nextEpoch));
+            this.sendRoots.set(nextEpoch, nextRoots);
+            this.preparingSendEpoch = nextEpoch;
+            const watermark = this.nextLogicalID > 2n ? this.nextLogicalID - 2n : 0n;
+            await this.waitOutboundFrontier(watermark, prepareSignal.signal);
+            // Do not consume a transition id until preparation has completed and
+            // the caller has not cancelled the operation.
+            throwIfAborted(prepareSignal.signal);
+            prepareSignal.cancel();
+            prepareDeadline.cancel();
+            completionDeadline = createSessionDeadline(this.config, "rekey_completion");
+            // Once preparation has committed, caller cancellation only cancels the
+            // caller's wait (the outer rekey() race), while this operation continues
+            // under its bounded completion deadline.
+            completionSignal = combineSignals(completionDeadline.signal);
+            committed = true;
+            throwIfAborted(completionSignal.signal);
+            const transition = this.nextTransition;
+            this.nextTransition = transition === MAX_UINT64 ? 0n : transition + 1n;
+            const payload = concat(u64(transition), u32(nextEpoch), u64(watermark));
+            const active = [...this.streams.values()].filter((stream) => stream.canRekeySend());
+            const updates = active.map((stream) => stream.startSendRekey(transition, nextEpoch));
+            await Promise.all(updates.map(async (update) => await raceAbort(update.armed.promise, completionSignal.signal)));
+            const pending = {
+                payload,
+                epoch: nextEpoch,
+                acknowledged: deferred(),
+                committed: { value: false },
+            };
+            this.pendingSessionRekey = pending;
+            this.preparingSendEpoch = undefined;
+            await Promise.all([
+                this.sendControl(InnerTypeV3.SessionKeyUpdate, payload, completionSignal.signal),
+                raceAbort(pending.acknowledged.promise, completionSignal.signal),
+            ]);
+            await Promise.all(updates.map(async (update) => await raceAbort(update.done.promise, completionSignal.signal)));
+            if (this.pendingSessionRekey === pending)
+                this.pendingSessionRekey = undefined;
+            this.cleanupEpochRoots();
+        }
+        catch (error) {
+            const failure = asError(error);
+            if (committed) {
+                this.fail(failure);
+                if (failure instanceof SessionV3Error && failure.code === "closed")
+                    throw failure;
+                const message = failure instanceof SessionV3Error && failure.code === "timeout"
+                    ? "Flowersec v3 rekey completion deadline exceeded"
+                    : "Flowersec v3 rekey completion failed";
+                throw new SessionV3Error("rekey_failed", message);
+            }
+            if (failure instanceof SessionV3Error && failure.code === "timeout") {
+                throw new SessionV3Error("rekey_failed", "Flowersec v3 rekey preparation deadline exceeded");
+            }
+            throw error;
+        }
+        finally {
+            prepareSignal.cancel();
+            prepareDeadline.cancel();
+            completionSignal?.cancel();
+            completionDeadline?.cancel();
+            this.openFrozen = false;
+            this.openGate.resolve();
+            if (respondersFrozen)
+                this.unfreezeInboundResponders(false);
+            this.preparingSendEpoch = undefined;
+            this.cleanupEpochRoots();
+        }
+    }
+    async rejectExhaustedRekey(message, signal, callerSignal) {
+        try {
+            await this.sendGoAway(5, signal);
+        }
+        catch (error) {
+            const failure = asError(error);
+            this.fail(failure);
+            if (failure instanceof SessionV3Error && failure.code === "aborted" && callerSignal?.aborted === true) {
+                throw abortedError();
+            }
+            if (failure instanceof SessionV3Error && failure.code === "timeout") {
+                throw new SessionV3Error("rekey_failed", "exhaustion GOAWAY preparation deadline exceeded");
+            }
+        }
+        throw new SessionV3Error("resource_exhausted", message);
+    }
+    async receiveSessionRekey(payload) {
+        this.validateSessionRekeySequence(payload);
+        const completionDeadline = createSessionDeadline(this.config, "rekey_completion");
+        let respondersFrozen = false;
+        try {
+            await this.freezeInboundResponders(true, completionDeadline.signal);
+            respondersFrozen = true;
+            await this.receiveSessionRekeyBeforeDeadline(payload, completionDeadline.signal);
+        }
+        finally {
+            if (respondersFrozen)
+                this.unfreezeInboundResponders(true);
+            completionDeadline.cancel();
+        }
+    }
+    async enterInboundResponder() {
+        while (this.localResponderFrozen || this.peerResponderFrozen) {
+            this.assertOpen();
+            await this.responderChanged.promise;
+        }
+        this.assertOpen();
+        this.activeInboundResponders++;
+        this.notifyResponderChanged();
+    }
+    leaveInboundResponder() {
+        if (this.activeInboundResponders === 0)
+            return;
+        this.activeInboundResponders--;
+        this.notifyResponderChanged();
+    }
+    async freezeInboundResponders(peer, signal) {
+        if (peer)
+            this.peerResponderFrozen = true;
+        else
+            this.localResponderFrozen = true;
+        this.notifyResponderChanged();
+        try {
+            while (this.activeInboundResponders !== 0) {
+                await raceAbort(this.responderChanged.promise, signal);
+                this.assertOpen();
+            }
+        }
+        catch (error) {
+            this.unfreezeInboundResponders(peer);
+            throw error;
+        }
+    }
+    unfreezeInboundResponders(peer) {
+        if (peer)
+            this.peerResponderFrozen = false;
+        else
+            this.localResponderFrozen = false;
+        this.notifyResponderChanged();
+    }
+    notifyResponderChanged() {
+        this.responderChanged.resolve();
+        this.responderChanged = deferred();
+    }
+    async receiveSessionRekeyBeforeDeadline(payload, signal) {
+        throwIfAborted(signal);
+        this.validateSessionRekeySequence(payload);
+        const transition = readU64(payload);
+        const nextEpoch = readU32(payload, 8);
+        const watermark = readU64At(payload, 12);
+        if (watermark !== this.peerLedger.frontier)
+            throw protocolError("SESSION_KEY_UPDATE watermark mismatch");
+        this.pendingReceiveEpoch = nextEpoch;
+        const current = this.rootForReceive(this.receiveEpoch);
+        if (!this.receiveRoots.has(nextEpoch)) {
+            this.receiveRoots.set(nextEpoch, deriveEpochRoots(deriveNextEpoch(current.rekeyRoot, this.h3, this.receiveDirection, nextEpoch)));
+        }
+        const streams = [...this.streams.values()];
+        await Promise.all(streams.map(async (stream) => await stream.waitReceiveRekey(transition, nextEpoch, signal)));
+        const acknowledged = await raceAbort(this.sendControlResponse(InnerTypeV3.SessionKeyUpdateACK, payload, () => {
+            this.receiveEpoch = nextEpoch;
+            this.receiveTransition = transition;
+            this.pendingReceiveEpoch = undefined;
+            for (const stream of streams)
+                stream.publishReceiveRekey(transition, nextEpoch);
+            this.cleanupEpochRoots();
+        }), signal);
+        if (!acknowledged) {
+            this.pendingReceiveEpoch = undefined;
+            this.cleanupEpochRoots();
+            return;
+        }
+        throwIfAborted(signal);
+    }
+    validateSessionRekeySequence(payload) {
+        if (payload.length !== 20)
+            throw protocolError("invalid SESSION_KEY_UPDATE");
+        const transition = readU64(payload);
+        const nextEpoch = readU32(payload, 8);
+        if (this.receiveTransition >= MAX_UINT64 || this.receiveEpoch >= MAX_UINT32 ||
+            transition !== this.receiveTransition + 1n || nextEpoch !== this.receiveEpoch + 1) {
+            throw protocolError("invalid SESSION_KEY_UPDATE");
+        }
+    }
+    receiveSessionRekeyACK(payload) {
+        if (this.lastSessionRekeyACK !== undefined && bytesEqual(payload, this.lastSessionRekeyACK))
+            return;
+        const pending = this.pendingSessionRekey;
+        if (pending === undefined) {
+            throw protocolError("unexpected SESSION_KEY_UPDATE_ACK");
+        }
+        if (!bytesEqual(payload, pending.payload))
+            throw protocolError("unexpected SESSION_KEY_UPDATE_ACK");
+        if (pending.committed.value)
+            return;
+        pending.committed.value = true;
+        this.sendEpoch = pending.epoch;
+        this.controlSendEpoch = pending.epoch;
+        this.controlSendSequence = 0n;
+        this.lastSessionRekeyACK = payload.slice();
+        pending.acknowledged.resolve();
+        this.cleanupEpochRoots();
+    }
+    async waitOpenGate(signal) {
+        while (this.openFrozen)
+            await raceAbort(this.openGate.promise, signal);
+    }
+    resolveOutboundOpen(id) {
+        this.outboundLedger.validOpen(id);
+        this.notifyOutboundFrontierChanged();
+    }
+    async waitOutboundFrontier(watermark, signal) {
+        while (this.outboundLedger.frontier !== watermark) {
+            if (this.outboundLedger.frontier > watermark)
+                throw protocolError("outbound frontier exceeded watermark");
+            await raceAbort(this.outboundFrontierChanged.promise, signal);
+        }
+    }
+    async commitOutboundReset(id) {
+        if (await this.sendControlCleanup(InnerTypeV3.StreamReset, idReason(id, 6))) {
+            this.outboundLedger.localResetCommitted(id);
+            this.notifyOutboundFrontierChanged();
+        }
+    }
+    commitLocalReset(id) {
+        if (this.isLocalLogicalID(id)) {
+            this.outboundLedger.localResetCommitted(id);
+            this.notifyOutboundFrontierChanged();
+            return;
+        }
+        this.peerLedger.localResetCommitted(id);
+    }
+    notifyOutboundFrontierChanged() {
+        this.outboundFrontierChanged.resolve();
+        this.outboundFrontierChanged = deferred();
+    }
+    isLocalLogicalID(id) {
+        return id > 0n && (this.role === 1 ? (id & 1n) === 1n : (id & 1n) === 0n);
+    }
+    localOpenHighWatermark() {
+        const first = this.role === 1 ? 1n : 2n;
+        return this.nextLogicalID === first ? 0n : this.nextLogicalID - 2n;
+    }
+    validGoAwayBoundary(lastAccepted) {
+        if (lastAccepted === 0n)
+            return true;
+        return this.isLocalLogicalID(lastAccepted) && lastAccepted <= this.localOpenHighWatermark();
+    }
+    async sendGoAway(reason, signal) {
+        if (!Number.isInteger(reason) || reason < 1 || reason > 0xffff)
+            throw protocolError("invalid GOAWAY reason");
+        if (this.sentGoAway) {
+            if (this.sentGoAwayReason !== reason)
+                throw protocolError("conflicting local GOAWAY reason");
+            return;
+        }
+        const lastAccepted = this.peerLedger.frontier;
+        this.sentGoAway = true;
+        this.sentGoAwayLastAccepted = lastAccepted;
+        this.sentGoAwayReason = reason;
+        await this.sendControl(InnerTypeV3.GoAway, idReason(lastAccepted, reason), signal);
+    }
+    async receiveGoAway(payload) {
+        const { id: lastAccepted, reason } = parseIDReason(payload);
+        if (reason === 0 || !this.validGoAwayBoundary(lastAccepted))
+            throw protocolError("invalid GOAWAY boundary");
+        if (this.receivedGoAway) {
+            if (this.receivedGoAwayLastAccepted !== lastAccepted || this.receivedGoAwayReason !== reason) {
+                throw protocolError("conflicting GOAWAY");
+            }
+            return;
+        }
+        this.receivedGoAway = true;
+        this.receivedGoAwayLastAccepted = lastAccepted;
+        this.receivedGoAwayReason = reason;
+        const excluded = [...this.streams.values()].filter((stream) => this.isLocalLogicalID(stream.id) && stream.id > lastAccepted);
+        for (const stream of excluded) {
+            this.trackBackground(this.localReset(stream, new SessionV3Error("going_away", "logical stream exceeds peer GOAWAY boundary")));
+        }
+    }
+    trackBackground(task) {
+        this.backgroundTasks.add(task);
+        void task.catch((error) => {
+            if (this.lifecycle !== "closed")
+                this.fail(asError(error));
+        }).finally(() => this.backgroundTasks.delete(task));
+    }
+    localOpeningAllowedAfterGoAway(id) {
+        return !this.receivedGoAway || id <= this.receivedGoAwayLastAccepted;
+    }
+    acceptsPeerStreamAfterGoAway(id) {
+        return !this.sentGoAway || id <= this.sentGoAwayLastAccepted;
+    }
+    cleanupEpochRoots() {
+        const sendInUse = new Set([this.sendEpoch, this.controlSendEpoch]);
+        const receiveInUse = new Set([this.receiveEpoch, this.controlReceiveEpoch]);
+        if (this.preparingSendEpoch !== undefined)
+            sendInUse.add(this.preparingSendEpoch);
+        if (this.pendingReceiveEpoch !== undefined)
+            receiveInUse.add(this.pendingReceiveEpoch);
+        if (this.pendingSessionRekey !== undefined)
+            sendInUse.add(this.pendingSessionRekey.epoch);
+        for (const stream of this.streams.values()) {
+            for (const epoch of stream.sendEpochsInUse())
+                sendInUse.add(epoch);
+            for (const epoch of stream.receiveEpochsInUse())
+                receiveInUse.add(epoch);
+        }
+        this.cleanupRootMap(this.sendRoots, sendInUse);
+        this.cleanupRootMap(this.receiveRoots, receiveInUse);
+    }
+    streamEpochStateChanged() {
+        this.cleanupEpochRoots();
+    }
+    cleanupRootMap(roots, inUse) {
+        for (const [epoch, value] of roots) {
+            if (inUse.has(epoch))
+                continue;
+            wipeEpochRoots(value);
+            roots.delete(epoch);
+        }
+    }
+    wipeAllRoots() {
+        for (const roots of this.sendRoots.values())
+            wipeEpochRoots(roots);
+        for (const roots of this.receiveRoots.values())
+            wipeEpochRoots(roots);
+        this.sendRoots.clear();
+        this.receiveRoots.clear();
+    }
+    startIdleWatchdog() {
+        this.idleWatchdogStarted = true;
+        this.markAuthenticatedActivity();
+    }
+    markAuthenticatedActivity() {
+        if (!this.idleWatchdogStarted || this.lifecycle !== "open")
+            return;
+        const timeoutMs = sessionIdleTimeoutMs(this.config);
+        if (timeoutMs === 0)
+            return;
+        this.idleDeadlineMs = this.config.runtime.monotonicMilliseconds() + timeoutMs;
+        if (this.idleTimerCancel !== undefined)
+            return;
+        this.scheduleIdleWatchdog();
+    }
+    scheduleIdleWatchdog() {
+        const deadlineMs = this.idleDeadlineMs;
+        if (deadlineMs === undefined || this.lifecycle !== "open")
+            return;
+        const remainingMs = Math.max(0, deadlineMs - this.config.runtime.monotonicMilliseconds());
+        this.idleTimerCancel = scheduleLongTimeout(() => {
+            this.idleTimerCancel = undefined;
+            if (this.lifecycle !== "open" || this.idleDeadlineMs === undefined)
+                return;
+            if (this.config.runtime.monotonicMilliseconds() < this.idleDeadlineMs) {
+                this.scheduleIdleWatchdog();
+                return;
+            }
+            this.fail(new SessionV3Error("timeout", "Flowersec v3 session idle timeout exceeded"));
+        }, remainingMs);
+    }
+    fail(error, abortCarrier = true) {
+        if (this.lifecycle === "closed")
+            return;
+        this.controlTerminalSealed = true;
+        this.beginClosing();
+        const pendingSessionRekey = this.pendingSessionRekey;
+        this.pendingSessionRekey = undefined;
+        pendingSessionRekey?.acknowledged.reject(error);
+        const normalPeerCarrierClose = this.sessionCloseCommitted && error instanceof CarrierError && error.code === "closed";
+        if (normalPeerCarrierClose)
+            this.peerSessionClose.resolve();
+        this.terminalError = error;
+        this.lifecycle = "closed";
+        this.terminationState.resolve({ error });
+        this.idleTimerCancel?.();
+        this.idleTimerCancel = undefined;
+        this.idleDeadlineMs = undefined;
+        this.incoming.fail(error);
+        this.outboundPermits.fail(error);
+        this.inboundPermits.fail(error);
+        this.notifyResponderChanged();
+        for (const ping of this.pings.values())
+            ping.reject(error);
+        this.pings.clear();
+        this.rpc.close();
+        for (const stream of [...this.streams.values()])
+            stream.peerReset(error);
+        for (const released of this.releasedStreams.values()) {
+            const stream = released.deref();
+            if (stream !== undefined)
+                this.releasedStreamCleanup.unregister(stream);
+        }
+        this.releasedStreams.clear();
+        this.wipeAllRoots();
+        this.h3.fill(0);
+        if (abortCarrier && !normalPeerCarrierClose)
+            this.carrier.abort({ code: 6, reason: "session terminated" });
+    }
+    assertOpen() {
+        if (this.lifecycle === "open")
+            return;
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
+        throw new SessionV3Error("closed", "Flowersec v3 session closed");
+    }
+    beginClosing() {
+        if (this.lifecycle === "opening" || this.lifecycle === "open")
+            this.lifecycle = "closing";
+    }
+}
+class EncryptedStreamV3 {
+    session;
+    carrier;
+    id;
+    kind;
+    sendEpoch;
+    receiveEpoch;
+    permitRelease;
+    reader;
+    opened = deferred();
+    data = new ByteQueue(MAX_BUFFERED_STREAM_BYTES);
+    terminalError;
+    sendSequence = 0n;
+    receiveSequence = 0n;
+    priorACK;
+    sendTail = Promise.resolve();
+    localFIN = false;
+    remoteFIN = false;
+    pumpStarted = false;
+    permitReleased = false;
+    closeWriteTask;
+    pendingSendRekey;
+    lastSendRekeyACK;
+    receiveRekey;
+    sendMaterials = new Map();
+    receiveMaterials = new Map();
+    constructor(session, carrier, id, kind, sendEpoch, receiveEpoch, permitRelease, reader) {
+        this.session = session;
+        this.carrier = carrier;
+        this.id = id;
+        this.kind = kind;
+        this.sendEpoch = sendEpoch;
+        this.receiveEpoch = receiveEpoch;
+        this.permitRelease = permitRelease;
+        this.reader = reader ?? new ExactReader(carrier);
+    }
+    async read(options = {}) {
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
+        return await this.data.read(options.signal);
+    }
+    async write(payload, options = {}) {
+        if (!(payload instanceof Uint8Array))
+            throw new TypeError("stream write requires Uint8Array");
+        if (payload.length === 0)
+            return 0;
+        throwIfAborted(options.signal);
+        await this.opened.promise;
+        await this.waitSendRekey(options.signal);
+        if (this.localFIN)
+            throw new SessionV3Error("closed", "write after FIN");
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
+        const copy = payload.slice();
+        await this.enqueueSend(async () => {
+            try {
+                for (let offset = 0; offset < copy.length; offset += MAX_DATA_BYTES) {
+                    throwIfAborted(options.signal);
+                    await this.session.sendStreamRecord(this, InnerTypeV3.Data, copy.subarray(offset, Math.min(copy.length, offset + MAX_DATA_BYTES)), options.signal);
+                }
+            }
+            catch (error) {
+                const normalized = asError(error);
+                void this.session.localReset(this, normalized);
+                throw normalized;
+            }
+        });
+        return copy.length;
+    }
+    async closeWrite() {
+        await this.opened.promise;
+        await this.waitSendRekey();
+        if (this.localFIN)
+            return;
+        if (this.terminalError !== undefined)
+            throw this.terminalError;
+        this.closeWriteTask ??= this.enqueueSend(async () => {
+            try {
+                if (this.localFIN)
+                    return;
+                await this.session.sendStreamRecord(this, InnerTypeV3.FIN, new Uint8Array());
+                await this.carrier.closeWrite();
+                this.localFIN = true;
+                this.releaseIfClean();
+            }
+            catch (error) {
+                const normalized = asError(error);
+                void this.session.localReset(this, normalized);
+                throw normalized;
+            }
+        });
+        await this.closeWriteTask;
+    }
+    async reset() {
+        await this.session.localReset(this, new SessionV3Error("stream_reset", "logical stream reset"));
+    }
+    async close() {
+        await this.reset();
+    }
+    send(type, payload, signal) {
+        return this.enqueueSend(async () => await this.session.sendStreamRecord(this, type, payload, signal));
+    }
+    canRekeySend() {
+        return this.terminalError === undefined && this.opened.settled && !this.localFIN;
+    }
+    hasRemoteFIN() {
+        return this.remoteFIN;
+    }
+    startSendRekey(transition, epoch) {
+        if (this.pendingSendRekey !== undefined)
+            throw protocolError("overlapping stream rekey");
+        const pending = { transition, epoch, armed: deferred(), done: deferred() };
+        this.pendingSendRekey = pending;
+        void this.enqueueSend(async () => {
+            await this.session.sendStreamRecord(this, InnerTypeV3.StreamKeyUpdate, concat(u64(transition), u32(epoch)));
+            pending.armed.resolve();
+        }).catch((error) => {
+            pending.armed.reject(error);
+            pending.done.reject(error);
+            void this.session.localReset(this, asError(error));
+        });
+        return pending;
+    }
+    async waitReceiveRekey(transition, epoch, signal) {
+        throwIfAborted(signal);
+        if (this.terminalError !== undefined || this.remoteFIN)
+            return;
+        while (true) {
+            const pending = this.receiveRekey;
+            if (pending !== undefined) {
+                if (pending.transition !== transition || pending.epoch !== epoch)
+                    throw protocolError("stream rekey mismatch");
+                await raceAbort(pending.acknowledged.promise, signal);
+                return;
+            }
+            await raceAbort(new Promise((resolve) => setTimeout(resolve, 0)), signal);
+            if (this.terminalError !== undefined || this.remoteFIN)
+                return;
+        }
+    }
+    publishReceiveRekey(transition, epoch) {
+        if (this.receiveRekey?.transition === transition && this.receiveRekey.epoch === epoch) {
+            this.receiveRekey = undefined;
+        }
+    }
+    startPump() {
+        if (this.pumpStarted)
+            return;
+        this.pumpStarted = true;
+        void this.pump();
+    }
+    markOpen() {
+        this.opened.resolve();
+    }
+    markTerminal(error) {
+        if (this.terminalError !== undefined)
+            return false;
+        this.terminalError = error;
+        const pendingSendRekey = this.pendingSendRekey;
+        this.pendingSendRekey = undefined;
+        pendingSendRekey?.armed.reject(error);
+        pendingSendRekey?.done.reject(error);
+        this.opened.reject(error);
+        this.data.fail(error);
+        return true;
+    }
+    peerReset(error) {
+        if (!this.markTerminal(error))
+            return;
+        this.carrier.abort(error);
+        this.session.releaseStream(this);
+    }
+    carrierReset() {
+        if (!this.markTerminal(new SessionV3Error("stream_reset", "logical stream reset by peer")))
+            return;
+        this.session.releaseStream(this);
+    }
+    abort(error = new SessionV3Error("closed", "logical stream aborted")) {
+        this.peerReset(error);
+    }
+    releasePermit() {
+        if (this.permitReleased)
+            return;
+        this.permitReleased = true;
+        this.permitRelease();
+    }
+    sendMaterial(roots, h3, direction) {
+        let material = this.sendMaterials.get(this.sendEpoch);
+        if (material === undefined) {
+            material = deriveStreamMaterial(roots.streamRoot, h3, this.id, direction, this.sendEpoch);
+            this.sendMaterials.set(this.sendEpoch, material);
+        }
+        return material;
+    }
+    receiveMaterial(roots, h3, direction, epoch) {
+        let material = this.receiveMaterials.get(epoch);
+        if (material === undefined) {
+            material = deriveStreamMaterial(roots.streamRoot, h3, this.id, direction, epoch);
+            this.receiveMaterials.set(epoch, material);
+        }
+        return material;
+    }
+    pruneReceiveMaterials() {
+        pruneRecordMaterials(this.receiveMaterials, new Set([this.receiveEpoch]));
+    }
+    wipeRecordMaterials() {
+        pruneRecordMaterials(this.sendMaterials, new Set());
+        pruneRecordMaterials(this.receiveMaterials, new Set());
+    }
+    transferReceiveMaterialsTo(destination) {
+        if (destination.receiveMaterials.size !== 0)
+            throw protocolError("receive material destination is not empty");
+        for (const [epoch, material] of this.receiveMaterials)
+            destination.receiveMaterials.set(epoch, material);
+        this.receiveMaterials.clear();
+    }
+    async pump() {
+        try {
+            while (this.terminalError === undefined) {
+                const record = await this.session.readStreamRecord(this);
+                if (!this.opened.settled) {
+                    if (record.type === InnerTypeV3.OpenACK) {
+                        const got = decodeOpenACKV3(record.payload);
+                        if (!bytesEqual(got, this.openedHash()))
+                            throw protocolError("OPEN ACK hash mismatch");
+                        this.session.resolveOutboundOpen(this.id);
+                        this.markOpen();
+                        continue;
+                    }
+                    if (record.type === InnerTypeV3.OpenReject) {
+                        const reject = decodeOpenRejectV3(record.payload);
+                        if (!bytesEqual(reject.openHash, this.openedHash()))
+                            throw protocolError("OPEN REJECT hash mismatch");
+                        this.session.resolveOutboundOpen(this.id);
+                        const error = new SessionV3Error("open_rejected", `logical stream rejected (${reject.reason})`);
+                        this.markTerminal(error);
+                        this.session.releaseStream(this);
+                        await this.carrier.closeWrite().catch(() => undefined);
+                        return;
+                    }
+                    throw protocolError("expected OPEN ACK or REJECT");
+                }
+                switch (record.type) {
+                    case InnerTypeV3.Data:
+                        if (this.remoteFIN)
+                            throw protocolError("DATA after FIN");
+                        await this.data.waitForCapacity(record.payload.length);
+                        this.data.push(record.payload);
+                        break;
+                    case InnerTypeV3.FIN:
+                        if (this.remoteFIN)
+                            throw protocolError("duplicate FIN");
+                        await this.reader.readEOF();
+                        this.remoteFIN = true;
+                        this.data.close();
+                        this.releaseIfClean();
+                        return;
+                    case InnerTypeV3.StreamKeyUpdate:
+                        await this.receiveStreamKeyUpdate(record.payload, record.header);
+                        break;
+                    case InnerTypeV3.StreamKeyUpdateACK:
+                        this.receiveStreamKeyUpdateACK(record.payload);
+                        break;
+                    default:
+                        throw protocolError(`unexpected stream type ${record.type}`);
+                }
+            }
+        }
+        catch (error) {
+            const normalized = asError(error);
+            if (normalized instanceof CarrierError && normalized.code === "reset") {
+                this.carrierReset();
+                return;
+            }
+            await this.session.localReset(this, normalized);
+        }
+    }
+    openedHash() {
+        const value = this.openHash;
+        if (value === undefined)
+            throw protocolError("missing OPEN hash");
+        return value;
+    }
+    setOpenHash(value) {
+        this.openHash = value.slice();
+    }
+    enqueueSend(operation) {
+        const task = this.sendTail.then(async () => {
+            if (this.terminalError !== undefined)
+                throw this.terminalError;
+            await operation();
+        });
+        this.sendTail = task.catch(() => undefined);
+        return task;
+    }
+    async waitSendRekey(signal) {
+        while (this.pendingSendRekey !== undefined) {
+            await raceAbort(this.pendingSendRekey.done.promise, signal);
+        }
+    }
+    async receiveStreamKeyUpdate(payload, header) {
+        if (payload.length !== 12 || this.receiveRekey !== undefined)
+            throw protocolError("invalid STREAM_KEY_UPDATE");
+        const transition = readU64(payload);
+        const nextEpoch = readU32(payload, 8);
+        if (transition === 0n || nextEpoch !== this.receiveEpoch + 1)
+            throw protocolError("invalid stream rekey transition");
+        const current = this.session.rootForReceive(this.receiveEpoch);
+        if (!this.session.hasReceiveRoots(nextEpoch)) {
+            this.session.installReceiveRoots(nextEpoch, deriveEpochRoots(deriveNextEpoch(current.rekeyRoot, this.session.transcriptHash(), this.session.receiveDirectionValue(), nextEpoch)));
+        }
+        if (this.pendingSendRekey?.transition === transition && this.pendingSendRekey.epoch === nextEpoch) {
+            this.priorACK = { epoch: header.epoch, sequence: this.receiveSequence };
+        }
+        this.receiveEpoch = nextEpoch;
+        this.receiveSequence = 0n;
+        pruneRecordMaterials(this.receiveMaterials, new Set(this.priorACK === undefined ? [nextEpoch] : [header.epoch, nextEpoch]));
+        const pending = { transition, epoch: nextEpoch, acknowledged: deferred() };
+        this.receiveRekey = pending;
+        await this.send(InnerTypeV3.StreamKeyUpdateACK, encodeStreamKeyUpdateACKV3({
+            logicalStreamID: this.id,
+            transition,
+            epoch: nextEpoch,
+        }));
+        pending.acknowledged.resolve();
+    }
+    receiveStreamKeyUpdateACK(payload) {
+        const decoded = decodeStreamKeyUpdateACKV3(payload);
+        if (decoded.logicalStreamID !== this.id)
+            throw protocolError("invalid STREAM_KEY_UPDATE_ACK");
+        const { transition, epoch } = decoded;
+        if (this.lastSendRekeyACK?.transition === transition && this.lastSendRekeyACK.epoch === epoch)
+            return;
+        const pending = this.pendingSendRekey;
+        if (pending === undefined) {
+            throw protocolError("unexpected STREAM_KEY_UPDATE_ACK");
+        }
+        if (pending.transition !== transition || pending.epoch !== epoch)
+            throw protocolError("unexpected STREAM_KEY_UPDATE_ACK");
+        this.sendEpoch = epoch;
+        this.sendSequence = 0n;
+        pruneRecordMaterials(this.sendMaterials, new Set([epoch]));
+        this.pendingSendRekey = undefined;
+        this.lastSendRekeyACK = { transition, epoch };
+        pending.done.resolve();
+        this.session.streamEpochStateChanged();
+    }
+    sendEpochsInUse() {
+        return this.pendingSendRekey === undefined ? [this.sendEpoch] : [this.sendEpoch, this.pendingSendRekey.epoch];
+    }
+    receiveEpochsInUse() {
+        const epochs = new Set([this.receiveEpoch]);
+        if (this.priorACK !== undefined)
+            epochs.add(this.priorACK.epoch);
+        if (this.receiveRekey !== undefined)
+            epochs.add(this.receiveRekey.epoch);
+        return [...epochs];
+    }
+    releaseIfClean() {
+        if (!this.localFIN || !this.remoteFIN || this.terminalError !== undefined)
+            return;
+        this.session.releaseStream(this);
+    }
+}
+async function clientHandshake(control, reader, config, offeredFeatures, signal) {
+    const key = generateEphemeralKeyV3(config.suite, config.runtime.entropy);
+    const controlPreface = encodeControlPrefaceV3();
+    const initRaw = encodeClientInitV3({
+        profile: FLOWERSEC_V3_PROFILE,
+        channelID: config.channelID,
+        sessionContractHash: config.sessionContractHash,
+        clientRole: 1,
+        suite: config.suite,
+        clientEphemeralPublic: key.publicKey,
+        nonceC: sessionRandomBytes(config, 32),
+        selectedFeatures: offeredFeatures,
+        maxInboundStreams: config.maxInboundStreams,
+        clientAdmissionBinding: config.localAdmissionBinding,
+        clientEndpointInstanceID: config.localEndpointInstanceID,
+    });
+    await writeAll(control, controlPreface, signal);
+    await writeAll(control, initRaw, signal);
+    const serverRaw = await readHandshakeFrame(reader, signal);
+    const server = decodeServerFinishedV3(serverRaw, config.suite);
+    validateServerFinishedV3(server, expectations(config, false));
+    if ((server.core.selectedFeatures & ~offeredFeatures) !== 0) {
+        throw protocolError("server selected an unoffered feature");
+    }
+    const shared = computeSharedSecretV3(config.suite, key.privateKey, server.core.serverEphemeralPublic);
+    const handshakePRK = deriveHandshakePRKV3(config.psk, shared);
+    const h0 = computeHandshakeH0V3(controlPreface, initRaw);
+    const h1 = computeHandshakeH1V3(h0, encodeServerFinishedCoreV3(server.core, config.suite));
+    if (!bytesEqual(server.serverConfirm, computeServerConfirmV3(handshakePRK, h1))) {
+        throw protocolError("server confirm mismatch");
+    }
+    const clientCore = encodeClientFinishedCoreV3(server.core.handshakeID);
+    const h2 = computeHandshakeH2V3(h1, serverRaw, clientCore);
+    const clientRaw = encodeClientFinishedV3({
+        handshakeID: server.core.handshakeID,
+        clientConfirm: computeClientConfirmV3(handshakePRK, h2),
+    });
+    await writeAll(control, clientRaw, signal);
+    const h3 = computeHandshakeH3V3(h2, clientRaw);
+    return {
+        h3,
+        sessionPRK: deriveSessionPRKV3(h3, handshakePRK),
+        selectedFeatures: server.core.selectedFeatures,
+    };
+}
+async function serverHandshake(control, reader, config, localFeatures, signal) {
+    const controlPreface = await reader.readExactly(16, signal);
+    parseControlPrefaceV3(controlPreface);
+    const clientRaw = await readHandshakeFrame(reader, signal);
+    const client = decodeClientInitV3(clientRaw);
+    validateClientInitV3(client, expectations(config, true));
+    const key = generateEphemeralKeyV3(config.suite, config.runtime.entropy);
+    const shared = computeSharedSecretV3(config.suite, key.privateKey, client.clientEphemeralPublic);
+    const handshakePRK = deriveHandshakePRKV3(config.psk, shared);
+    const core = {
+        suite: config.suite,
+        handshakeID: sessionRandomBytes(config, 16),
+        serverEphemeralPublic: key.publicKey,
+        nonceS: sessionRandomBytes(config, 32),
+        sessionContractHash: config.sessionContractHash,
+        selectedFeatures: client.selectedFeatures & localFeatures,
+        maxInboundStreams: config.maxInboundStreams,
+        serverAdmissionBinding: config.localAdmissionBinding,
+        serverEndpointInstanceID: config.localEndpointInstanceID,
+    };
+    const h0 = computeHandshakeH0V3(controlPreface, clientRaw);
+    const h1 = computeHandshakeH1V3(h0, encodeServerFinishedCoreV3(core, config.suite));
+    const serverRaw = encodeServerFinishedV3({
+        core,
+        serverConfirm: computeServerConfirmV3(handshakePRK, h1),
+    }, config.suite);
+    await writeAll(control, serverRaw, signal);
+    const clientFinishedRaw = await readHandshakeFrame(reader, signal);
+    const clientFinished = decodeClientFinishedV3(clientFinishedRaw);
+    if (!bytesEqual(clientFinished.handshakeID, core.handshakeID))
+        throw protocolError("handshake ID mismatch");
+    const clientCore = encodeClientFinishedCoreV3(clientFinished.handshakeID);
+    const h2 = computeHandshakeH2V3(h1, serverRaw, clientCore);
+    if (!bytesEqual(clientFinished.clientConfirm, computeClientConfirmV3(handshakePRK, h2))) {
+        throw protocolError("client confirm mismatch");
+    }
+    const h3 = computeHandshakeH3V3(h2, clientFinishedRaw);
+    return {
+        h3,
+        sessionPRK: deriveSessionPRKV3(h3, handshakePRK),
+        selectedFeatures: core.selectedFeatures,
+    };
+}
+function expectations(config, peerIsClient) {
+    return {
+        path: config.path,
+        channelID: peerIsClient ? config.channelID : "",
+        sessionContractHash: config.sessionContractHash,
+        suite: config.suite,
+        maxInboundStreams: config.maxInboundStreams,
+        admissionBinding: config.peerAdmissionBinding,
+        expectedEndpointInstanceID: config.expectedPeerEndpointInstanceID,
+    };
+}
+async function readHandshakeFrame(reader, signal) {
+    const header = await reader.readExactly(12, signal);
+    const length = new DataView(header.buffer, header.byteOffset, header.byteLength).getUint32(8, false);
+    if (length < 1 || length > 8_192)
+        throw protocolError("invalid handshake payload length");
+    const raw = concat(header, await reader.readExactly(length, signal));
+    decodeHandshakeFrameV3(raw);
+    return raw;
+}
+class ExactReader {
+    stream;
+    chunks = [];
+    offset = 0;
+    bytes = 0;
+    constructor(stream) {
+        this.stream = stream;
+    }
+    async readExactly(length, signal) {
+        while (this.bytes < length) {
+            const chunk = await this.stream.read(signal === undefined ? {} : { signal });
+            if (chunk === null)
+                throw new SessionV3Error("closed", "unexpected carrier EOF");
+            if (chunk.length === 0)
+                continue;
+            this.chunks.push(chunk);
+            this.bytes += chunk.length;
+        }
+        const out = new Uint8Array(length);
+        let written = 0;
+        while (written < length) {
+            const chunk = this.chunks[0];
+            const take = Math.min(length - written, chunk.length - this.offset);
+            out.set(chunk.subarray(this.offset, this.offset + take), written);
+            written += take;
+            this.offset += take;
+            this.bytes -= take;
+            if (this.offset === chunk.length) {
+                this.chunks.shift();
+                this.offset = 0;
+            }
+        }
+        return out;
+    }
+    async readEOF(signal) {
+        if (this.bytes !== 0)
+            throw protocolError("trailing carrier bytes after logical FIN");
+        while (true) {
+            const chunk = await this.stream.read(signal === undefined ? {} : { signal });
+            if (chunk === null)
+                return;
+            if (chunk.length !== 0)
+                throw protocolError("trailing carrier bytes after logical FIN");
+        }
+    }
+}
+class ByteQueue {
+    limit;
+    chunks = [];
+    head = 0;
+    bytes = 0;
+    closed = false;
+    error;
+    waiters = new Set();
+    capacityWaiters = new Set();
+    constructor(limit) {
+        this.limit = limit;
+    }
+    push(chunk) {
+        if (this.closed || this.error !== undefined)
+            throw protocolError("DATA after terminal stream state");
+        if (this.bytes + chunk.length > this.limit)
+            throw new SessionV3Error("resource_exhausted", "stream receive buffer exceeded");
+        this.chunks.push(chunk.slice());
+        this.bytes += chunk.length;
+        this.wake();
+    }
+    close() {
+        this.closed = true;
+        this.wake();
+    }
+    fail(error) {
+        if (this.error !== undefined)
+            return;
+        this.error = error;
+        this.chunks.length = 0;
+        this.head = 0;
+        this.bytes = 0;
+        this.wake(error);
+        this.wakeCapacity(error);
+    }
+    async waitForCapacity(required) {
+        if (!Number.isInteger(required) || required < 0 || required > this.limit) {
+            throw new RangeError("invalid stream receive capacity request");
+        }
+        while (this.bytes + required > this.limit) {
+            if (this.error !== undefined)
+                throw this.error;
+            if (this.closed)
+                return;
+            const waiter = deferred();
+            this.capacityWaiters.add(waiter);
+            try {
+                await waiter.promise;
+            }
+            finally {
+                this.capacityWaiters.delete(waiter);
+            }
+        }
+    }
+    async read(signal) {
+        while (true) {
+            if (this.error !== undefined)
+                throw this.error;
+            if (this.head < this.chunks.length) {
+                const chunk = this.chunks[this.head++];
+                this.bytes -= chunk.length;
+                this.wakeCapacity();
+                if (this.head > 1_024 && this.head * 2 > this.chunks.length) {
+                    this.chunks.splice(0, this.head);
+                    this.head = 0;
+                }
+                return chunk;
+            }
+            if (this.closed)
+                return null;
+            const waiter = deferred();
+            this.waiters.add(waiter);
+            try {
+                await raceAbort(waiter.promise, signal);
+            }
+            finally {
+                this.waiters.delete(waiter);
+            }
+        }
+    }
+    wake(error) {
+        for (const waiter of [...this.waiters])
+            error === undefined ? waiter.resolve() : waiter.reject(error);
+        this.waiters.clear();
+    }
+    wakeCapacity(error) {
+        for (const waiter of [...this.capacityWaiters])
+            error === undefined ? waiter.resolve() : waiter.reject(error);
+        this.capacityWaiters.clear();
+    }
+}
+class AsyncSemaphore {
+    available;
+    waiters = new Set();
+    error;
+    constructor(count) { this.available = count; }
+    async acquire(signal) {
+        if (this.error !== undefined)
+            throw this.error;
+        if (this.available > 0) {
+            this.available--;
+            return this.releaser();
+        }
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            const cleanup = () => {
+                this.waiters.delete(waiter);
+                signal?.removeEventListener("abort", abort);
+            };
+            const waiter = {
+                deliver: (release) => {
+                    if (settled) {
+                        release();
+                        return false;
+                    }
+                    settled = true;
+                    cleanup();
+                    resolve(release);
+                    return true;
+                },
+                fail: (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    reject(error);
+                },
+            };
+            const abort = () => waiter.fail(abortReason(signal));
+            this.waiters.add(waiter);
+            signal?.addEventListener("abort", abort, { once: true });
+            if (signal?.aborted === true)
+                abort();
+        });
+    }
+    tryAcquire() {
+        if (this.error !== undefined || this.available === 0)
+            return undefined;
+        this.available--;
+        return this.releaser();
+    }
+    fail(error) {
+        this.error = error;
+        for (const waiter of [...this.waiters])
+            waiter.fail(error);
+    }
+    releaser() {
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            const waiter = this.waiters.values().next().value;
+            if (waiter === undefined)
+                this.available++;
+            else
+                waiter.deliver(this.releaser());
+        };
+    }
+}
+class AsyncQueue {
+    values = [];
+    waiters = new Set();
+    error;
+    push(value) {
+        if (this.error !== undefined)
+            return;
+        const waiter = this.waiters.values().next().value;
+        if (waiter === undefined || !waiter.deliver(value))
+            this.values.push(value);
+    }
+    async shift(signal) {
+        if (this.error !== undefined)
+            throw this.error;
+        const value = this.values.shift();
+        if (value !== undefined)
+            return value;
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            const cleanup = () => {
+                this.waiters.delete(waiter);
+                signal?.removeEventListener("abort", abort);
+            };
+            const waiter = {
+                deliver: (next) => {
+                    if (settled)
+                        return false;
+                    settled = true;
+                    cleanup();
+                    resolve(next);
+                    return true;
+                },
+                fail: (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    reject(error);
+                },
+            };
+            const abort = () => waiter.fail(abortReason(signal));
+            this.waiters.add(waiter);
+            signal?.addEventListener("abort", abort, { once: true });
+            if (signal?.aborted === true)
+                abort();
+        });
+    }
+    fail(error) {
+        this.error = error;
+        this.values.length = 0;
+        for (const waiter of [...this.waiters])
+            waiter.fail(error);
+    }
+}
+function deferred() {
+    let resolvePromise;
+    let rejectPromise;
+    let settled = false;
+    const promise = new Promise((resolve, reject) => {
+        resolvePromise = resolve;
+        rejectPromise = reject;
+    });
+    return {
+        promise,
+        resolve: (value) => { if (!settled) {
+            settled = true;
+            resolvePromise(value);
+        } },
+        reject: (reason) => { if (!settled) {
+            settled = true;
+            rejectPromise(reason);
+        } },
+        get settled() { return settled; },
+    };
+}
+function validateConfig(carrier, config) {
+    if (config.runtime === undefined ||
+        typeof config.runtime.entropy !== "function" ||
+        typeof config.runtime.monotonicMilliseconds !== "function") {
+        throw new SessionV3Error("handshake", "session protocol runtime is required");
+    }
+    if (carrier.path !== config.path || (config.role !== "client" && config.role !== "server")) {
+        throw new SessionV3Error("handshake", "invalid session carrier/config binding");
+    }
+    if (!Number.isInteger(config.maxInboundStreams) || config.maxInboundStreams < 1 || config.maxInboundStreams > 128) {
+        throw new SessionV3Error("handshake", "invalid maxInboundStreams");
+    }
+    if (carrier.inboundBidirectionalStreamCapacity !== config.maxInboundStreams + 2) {
+        throw new SessionV3Error("handshake", "carrier inbound bidirectional stream capacity mismatch");
+    }
+    sessionIdleTimeoutMs(config);
+    sessionCloseTimeoutMs(config);
+    for (const [name, value] of [
+        ["session contract hash", config.sessionContractHash],
+        ["PSK", config.psk],
+        ["local admission binding", config.localAdmissionBinding],
+        ["peer admission binding", config.peerAdmissionBinding],
+    ]) {
+        if (value.length !== 32)
+            throw new SessionV3Error("handshake", `${name} must be 32 bytes`);
+    }
+    if (config.path === "direct") {
+        if (config.localEndpointInstanceID !== "" || config.expectedPeerEndpointInstanceID !== "") {
+            throw new SessionV3Error("handshake", "direct session endpoint IDs must be empty");
+        }
+    }
+    else if (config.localEndpointInstanceID === "" || config.expectedPeerEndpointInstanceID === "") {
+        throw new SessionV3Error("handshake", "tunnel session endpoint IDs are required");
+    }
+}
+function supportedFeatures(datagrams) {
+    return datagrams !== undefined && datagrams.maxDatagramSize >= UNRELIABLE_MESSAGE_WIRE_BYTES_V3
+        ? UNRELIABLE_MESSAGES_FEATURE_V3
+        : 0;
+}
+function requireUnreliableDatagrams(carrier) {
+    const datagrams = carrier.unreliableDatagrams;
+    if (datagrams === undefined || datagrams.maxDatagramSize < UNRELIABLE_MESSAGE_WIRE_BYTES_V3) {
+        throw new SessionV3Error("handshake", "negotiated unreliable messages require native DATAGRAM support");
+    }
+    return datagrams;
+}
+function decodeMetadata(raw) {
+    return JSON.parse(decoder.decode(raw));
+}
+async function writeAll(stream, value, signal) {
+    let offset = 0;
+    while (offset < value.length) {
+        throwIfAborted(signal);
+        const written = await stream.write(value.subarray(offset), signal === undefined ? {} : { signal });
+        if (written < 1 || written > value.length - offset)
+            throw protocolError("short carrier write");
+        offset += written;
+    }
+}
+async function settleWithin(promise, timeoutMs) {
+    return await new Promise((resolve) => {
+        const timer = setTimeout(() => resolve(false), timeoutMs);
+        void promise.then(() => { clearTimeout(timer); resolve(true); }, () => { clearTimeout(timer); resolve(true); });
+    });
+}
+async function resolveWithin(promise, timeoutMs) {
+    return await new Promise((resolve) => {
+        const timer = setTimeout(() => resolve(false), timeoutMs);
+        void promise.then(() => { clearTimeout(timer); resolve(true); }, () => { clearTimeout(timer); resolve(false); });
+    });
+}
+function sessionIdleTimeoutMs(config) {
+    const timeoutMs = config.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 0) {
+        throw new RangeError("idleTimeoutMs must be a non-negative integer");
+    }
+    return timeoutMs;
+}
+function sessionCloseTimeoutMs(config) {
+    const timeoutMs = config.closeTimeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60_000) {
+        throw new RangeError("closeTimeoutMs must be an integer from 1 to 60000");
+    }
+    return timeoutMs;
+}
+function sessionRandomBytes(config, length) {
+    const output = config.runtime.entropy(length);
+    if (!(output instanceof Uint8Array) || output.length !== length) {
+        throw new SessionV3Error("handshake", `session entropy must return exactly ${length} bytes`);
+    }
+    return output.slice();
+}
+function idReason(id, reason) {
+    return concat(u64(id), Uint8Array.of((reason >>> 8) & 0xff, reason & 0xff));
+}
+function parseIDReason(payload) {
+    if (payload.length !== 10)
+        throw protocolError("invalid ID/reason payload");
+    return { id: readU64(payload), reason: readU16(payload, 8) };
+}
+function u64(value) {
+    if (typeof value !== "bigint" || value < 0n || value > MAX_UINT64) {
+        throw new RangeError("uint64 value is out of range");
+    }
+    const out = new Uint8Array(8);
+    new DataView(out.buffer).setBigUint64(0, value, false);
+    return out;
+}
+function u32(value) {
+    if (!Number.isInteger(value) || value < 0 || value > MAX_UINT32) {
+        throw new RangeError("uint32 value is out of range");
+    }
+    const out = new Uint8Array(4);
+    new DataView(out.buffer).setUint32(0, value, false);
+    return out;
+}
+function readU64(value) {
+    if (value.length < 8)
+        throw protocolError("truncated uint64");
+    return new DataView(value.buffer, value.byteOffset, value.byteLength).getBigUint64(0, false);
+}
+function readU64At(value, offset) {
+    if (value.length < offset + 8)
+        throw protocolError("truncated uint64");
+    return new DataView(value.buffer, value.byteOffset, value.byteLength).getBigUint64(offset, false);
+}
+function readU32(value, offset) {
+    if (value.length < offset + 4)
+        throw protocolError("truncated uint32");
+    return new DataView(value.buffer, value.byteOffset, value.byteLength).getUint32(offset, false);
+}
+function readU16(value, offset) {
+    if (value.length < offset + 2)
+        throw protocolError("truncated uint16");
+    return new DataView(value.buffer, value.byteOffset, value.byteLength).getUint16(offset, false);
+}
+function concat(...values) {
+    const out = new Uint8Array(values.reduce((sum, value) => sum + value.length, 0));
+    let offset = 0;
+    for (const value of values) {
+        out.set(value, offset);
+        offset += value.length;
+    }
+    return out;
+}
+function bytesEqual(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < left.length; index++)
+        difference |= left[index] ^ right[index];
+    return difference === 0;
+}
+function wipeEpochRoots(roots) {
+    roots.epochSecret.fill(0);
+    roots.controlRoot.fill(0);
+    roots.streamRoot.fill(0);
+    roots.setupRoot.fill(0);
+    roots.rekeyRoot.fill(0);
+}
+function pruneRecordMaterials(materials, retained) {
+    for (const [epoch, material] of materials) {
+        if (retained.has(epoch))
+            continue;
+        material.secret.fill(0);
+        material.recordKey.fill(0);
+        material.noncePrefix.fill(0);
+        materials.delete(epoch);
+    }
+}
+async function raceAbort(promise, signal) {
+    if (signal === undefined)
+        return await promise;
+    throwIfAborted(signal);
+    return await new Promise((resolve, reject) => {
+        const abort = () => reject(abortReason(signal));
+        signal.addEventListener("abort", abort, { once: true });
+        void promise.then((value) => { signal.removeEventListener("abort", abort); resolve(value); }, (error) => { signal.removeEventListener("abort", abort); reject(error); });
+    });
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted === true)
+        throw abortReason(signal);
+}
+function abortedError() {
+    return new SessionV3Error("aborted", "operation aborted");
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : abortedError();
+}
+function releasedStreamCleanup(streams) {
+    return new FinalizationRegistry((id) => {
+        const stream = streams.get(id);
+        if (stream !== undefined && stream.deref() === undefined)
+            streams.delete(id);
+    });
+}
+function createSessionDeadline(config, phase) {
+    const deadlines = config.deadlines;
+    const timeoutMs = phase === "establish"
+        ? deadlines?.establishTimeoutMs ?? 30_000
+        : phase === "rekey_prepare"
+            ? deadlines?.rekeyPrepareTimeoutMs ?? 10_000
+            : deadlines?.rekeyCompletionTimeoutMs ?? 30_000;
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+        throw new RangeError(`${phase} timeout must be positive`);
+    return (deadlines?.factory ?? defaultDeadlineFactory)(timeoutMs, phase);
+}
+function defaultDeadlineFactory(timeoutMs, phase) {
+    const controller = new AbortController();
+    const cancelTimer = scheduleLongTimeout(() => {
+        controller.abort(new SessionV3Error("timeout", `${phase} deadline exceeded`));
+    }, timeoutMs);
+    return {
+        signal: controller.signal,
+        cancel: cancelTimer,
+    };
+}
+const MAX_NATIVE_TIMEOUT_MS = 2_147_483_647;
+// Node and browsers clamp setTimeout delays above a signed 32-bit integer.
+// Keep the public timeout range intact by scheduling the remaining duration in
+// bounded segments against a monotonic wall-clock deadline.
+function scheduleLongTimeout(callback, timeoutMs) {
+    const clock = () => typeof performance !== "undefined" ? performance.now() : Date.now();
+    const deadline = clock() + timeoutMs;
+    let timer;
+    let canceled = false;
+    const schedule = () => {
+        if (canceled)
+            return;
+        const remaining = deadline - clock();
+        if (remaining <= 0) {
+            callback();
+            return;
+        }
+        timer = setTimeout(schedule, Math.min(remaining, MAX_NATIVE_TIMEOUT_MS));
+    };
+    schedule();
+    return () => {
+        canceled = true;
+        if (timer !== undefined)
+            clearTimeout(timer);
+    };
+}
+function combineSignals(...signals) {
+    const controller = new AbortController();
+    const cleanups = [];
+    const abortFrom = (signal) => {
+        if (!controller.signal.aborted)
+            controller.abort(abortReason(signal));
+    };
+    for (const signal of signals) {
+        if (signal === undefined)
+            continue;
+        const abort = () => abortFrom(signal);
+        signal.addEventListener("abort", abort, { once: true });
+        cleanups.push(() => signal.removeEventListener("abort", abort));
+        if (signal.aborted)
+            abortFrom(signal);
+    }
+    return {
+        signal: controller.signal,
+        cancel: () => { for (const cleanup of cleanups.splice(0))
+            cleanup(); },
+    };
+}
+function canonicalCallerCancellation(signal) {
+    const controller = new AbortController();
+    if (signal === undefined)
+        return { signal: controller.signal, cancel: () => undefined };
+    const abort = () => {
+        if (!controller.signal.aborted)
+            controller.abort(abortedError());
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted)
+        abort();
+    return {
+        signal: controller.signal,
+        cancel: () => signal.removeEventListener("abort", abort),
+    };
+}
+function signalOptions(signal) {
+    return signal === undefined ? {} : { signal };
+}
+function protocolError(message) {
+    return new SessionV3Error("protocol", message);
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}