@floegence/flowersec-core 2.5.4 → 3.0.1

package/dist/node/v2.d.ts

@@ -0,0 +1,11 @@
+export * from "../v2/index.js";
+export { connect, createConnectionController } from "./connectSession.js";
+export type { ConnectionControllerOptions, SessionOptions, SessionTLSOptions, } from "./connectSession.js";
+export { AcceptedSession, Acceptor, HandlerRegistrationError, RPCHandlers, SessionHandlers, createAcceptor, } from "./acceptor.js";
+export type { AcceptorListener, AcceptorOptions, AuthorizationDecision, RPCHandler, RPCHandlerResult, NotificationHandler, SessionHandlerOptions, } from "./acceptor.js";
+export { TunnelRuntime, createTunnelRuntime } from "./tunnelRuntime.js";
+export type { TunnelAuthorizationDecision, TunnelRuntimeListener, TunnelRuntimeOptions, } from "./tunnelRuntime.js";
+export { AuthorizationRecord, AuthorizationResponse, TunnelAuthorizationResponse, ControlPlaneError, EndpointSet, IssuedArtifact, Issuer, RuntimeAuthorizationRequest, authorizeRuntime, authorizeTunnelRuntime, createEndpointSet, parseAuthorizationRecord, parseRuntimeAuthorizationRequest, rejectRuntime, rejectTunnelRuntime, } from "./controlplane.js";
+export type { ArtifactMetadata, ControlPlaneErrorCode, DirectIssueOptions, IssuedTunnelPair, Scope, SessionOptions as ControlPlaneSessionOptions, TunnelIssueOptions, } from "./controlplane.js";
+export { ProxyServer, ProxyServerError } from "./proxyServer.js";
+export type { ProxyServerOptions, StreamHandlerRegistrar } from "./proxyServer.js";

package/dist/node/v2.js

@@ -0,0 +1,6 @@
+export * from "../v2/index.js";
+export { connect, createConnectionController } from "./connectSession.js";
+export { AcceptedSession, Acceptor, HandlerRegistrationError, RPCHandlers, SessionHandlers, createAcceptor, } from "./acceptor.js";
+export { TunnelRuntime, createTunnelRuntime } from "./tunnelRuntime.js";
+export { AuthorizationRecord, AuthorizationResponse, TunnelAuthorizationResponse, ControlPlaneError, EndpointSet, IssuedArtifact, Issuer, RuntimeAuthorizationRequest, authorizeRuntime, authorizeTunnelRuntime, createEndpointSet, parseAuthorizationRecord, parseRuntimeAuthorizationRequest, rejectRuntime, rejectTunnelRuntime, } from "./controlplane.js";
+export { ProxyServer, ProxyServerError } from "./proxyServer.js";

package/dist/node/webSocketServerV3.d.ts

@@ -0,0 +1,27 @@
+import type { CarrierSessionV3 } from "../v3/carrier.js";
+import type { PathKind } from "../v3/contract.js";
+export type NodeWebSocketListenerOptionsV3 = Readonly<{
+    host: string;
+    port: number;
+    path: PathKind;
+    tls: Readonly<{
+        certificate: string;
+        privateKey: string;
+    }>;
+    allowedOrigins: readonly string[];
+    inboundBidirectionalStreamCapacity: number;
+    maxPendingSessions?: number;
+    pendingSessionTimeoutMs?: number;
+    cleanupTimeoutMs?: number;
+}>;
+export type NodeWebSocketListenerV3 = Readonly<{
+    address(): Readonly<{
+        host: string;
+        port: number;
+    }>;
+    accept(options?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<CarrierSessionV3>;
+    close(): Promise<void>;
+}>;
+export declare function startNodeWebSocketListenerV3(options: NodeWebSocketListenerOptionsV3): Promise<NodeWebSocketListenerV3>;

package/dist/node/webSocketServerV3.js

@@ -0,0 +1,219 @@
+import { createServer as createHTTPSServer } from "node:https";
+import { createRequire } from "node:module";
+import { constants } from "node:crypto";
+import { createServerWebSocketCarrierSessionV3 } from "../v3/webSocketCarrier.js";
+import { WebSocketBinaryTransport } from "../ws-client/binaryTransport.js";
+import { defaultWsMaxPayload } from "./wsDefaults.js";
+import { FLOWERSEC_V3_PATHS, websocketSubprotocolForPathV3, } from "../v3/transportConstants.js";
+export async function startNodeWebSocketListenerV3(options) {
+    validateOptions(options);
+    const maxPendingSessions = options.maxPendingSessions ?? 1_024;
+    const pendingSessionTimeoutMs = options.pendingSessionTimeoutMs ?? 10_000;
+    const cleanupTimeoutMs = options.cleanupTimeoutMs ?? 2_000;
+    const protocol = websocketSubprotocolForPathV3(options.path);
+    const endpoint = FLOWERSEC_V3_PATHS.websocket[options.path];
+    const require = createRequire(import.meta.url);
+    const wsModule = require("ws");
+    const WebSocketServer = wsModule.WebSocketServer;
+    const server = createHTTPSServer({
+        key: options.tls.privateKey,
+        cert: options.tls.certificate,
+        minVersion: "TLSv1.3",
+        maxVersion: "TLSv1.3",
+        secureOptions: constants.SSL_OP_NO_TICKET,
+    });
+    const sessions = new SessionQueueV3(maxPendingSessions, pendingSessionTimeoutMs);
+    const sockets = new Set();
+    const networkSockets = new Set();
+    const wss = new WebSocketServer({
+        noServer: true,
+        perMessageDeflate: false,
+        maxPayload: defaultWsMaxPayload({}),
+        handleProtocols(protocols) { return protocols.size === 1 && protocols.has(protocol) ? protocol : false; },
+    });
+    server.on("connection", (socket) => {
+        networkSockets.add(socket);
+        socket.once("close", () => networkSockets.delete(socket));
+    });
+    server.on("upgrade", (request, socket, head) => {
+        const origin = request.headers.origin;
+        const requested = request.headers["sec-websocket-protocol"];
+        if (request.url !== endpoint || typeof origin !== "string" ||
+            !options.allowedOrigins.includes(origin) || requested !== protocol) {
+            socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+            socket.destroy();
+            return;
+        }
+        wss.handleUpgrade(request, socket, head, (webSocket) => wss.emit("connection", webSocket));
+    });
+    wss.on("connection", (socket) => {
+        sockets.add(socket);
+        const session = createServerWebSocketCarrierSessionV3(new WebSocketBinaryTransport(socket), {
+            path: options.path,
+            inboundBidirectionalStreamCapacity: options.inboundBidirectionalStreamCapacity,
+        });
+        socket.once("close", () => {
+            sockets.delete(socket);
+            sessions.remove(session);
+        });
+        sessions.push(session);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port, options.host, resolve);
+    });
+    let closePromise;
+    return Object.freeze({
+        address() {
+            const address = server.address();
+            if (address === null || typeof address === "string")
+                throw new Error("Node WebSocket v3 listener is not listening");
+            return Object.freeze({ host: address.address, port: address.port });
+        },
+        async accept(acceptOptions = {}) { return await sessions.shift(acceptOptions.signal); },
+        async close() {
+            closePromise ??= closeListener();
+            await closePromise;
+        },
+    });
+    async function closeListener() {
+        sessions.close();
+        for (const socket of sockets)
+            socket.close();
+        const graceful = Promise.all([
+            new Promise((resolve, reject) => {
+                wss.close((error) => error === undefined ? resolve() : reject(error));
+            }),
+            new Promise((resolve, reject) => {
+                server.close((error) => error === undefined ? resolve() : reject(error));
+            }),
+        ]);
+        let timer;
+        let timedOut;
+        try {
+            timedOut = await Promise.race([
+                graceful.then(() => false),
+                new Promise((resolve) => {
+                    timer = setTimeout(() => resolve(true), cleanupTimeoutMs);
+                    timer.unref?.();
+                }),
+            ]);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+        if (!timedOut)
+            return;
+        for (const socket of sockets)
+            socket.terminate();
+        for (const socket of networkSockets)
+            socket.destroy();
+    }
+}
+function validateOptions(options) {
+    if (!Number.isInteger(options.port) || options.port < 0 || options.port > 65_535 ||
+        options.allowedOrigins.length === 0 || new Set(options.allowedOrigins).size !== options.allowedOrigins.length ||
+        options.allowedOrigins.some((origin) => !validOrigin(origin)) ||
+        !Number.isInteger(options.inboundBidirectionalStreamCapacity) ||
+        options.inboundBidirectionalStreamCapacity < 3 || options.inboundBidirectionalStreamCapacity > 130 ||
+        (options.maxPendingSessions !== undefined && (!Number.isSafeInteger(options.maxPendingSessions) || options.maxPendingSessions < 1 || options.maxPendingSessions > 1_024)) ||
+        (options.pendingSessionTimeoutMs !== undefined && (!Number.isSafeInteger(options.pendingSessionTimeoutMs) || options.pendingSessionTimeoutMs < 1 || options.pendingSessionTimeoutMs > 600_000)) ||
+        (options.cleanupTimeoutMs !== undefined && (!Number.isSafeInteger(options.cleanupTimeoutMs) || options.cleanupTimeoutMs < 1 || options.cleanupTimeoutMs > 600_000)) ||
+        options.tls.certificate.length === 0 || options.tls.privateKey.length === 0) {
+        throw new TypeError("invalid Node WebSocket v3 listener options");
+    }
+}
+function validOrigin(raw) {
+    try {
+        const value = new URL(raw);
+        return (value.protocol === "https:" || value.protocol === "http:") && value.origin === raw &&
+            value.username === "" && value.password === "";
+    }
+    catch {
+        return false;
+    }
+}
+class SessionQueueV3 {
+    maximum;
+    timeoutMs;
+    values = [];
+    waiters = new Set();
+    closed = false;
+    constructor(maximum, timeoutMs) {
+        this.maximum = maximum;
+        this.timeoutMs = timeoutMs;
+    }
+    push(value) {
+        if (this.closed) {
+            value.abort({ code: 1, reason: "WebSocket v3 listener closed" });
+            return;
+        }
+        const waiter = this.waiters.values().next().value;
+        if (waiter !== undefined) {
+            this.waiters.delete(waiter);
+            waiter.resolve(value);
+            return;
+        }
+        if (this.values.length >= this.maximum) {
+            value.abort({ code: 1, reason: "WebSocket v3 pending capacity exceeded" });
+            return;
+        }
+        const entry = {
+            value,
+            timer: setTimeout(() => {
+                if (this.remove(value)) {
+                    value.abort({ code: 1, reason: "WebSocket v3 pending admission timed out" });
+                }
+            }, this.timeoutMs),
+        };
+        this.values.push(entry);
+    }
+    remove(value) {
+        const index = this.values.findIndex((entry) => entry.value === value);
+        if (index < 0)
+            return false;
+        const [entry] = this.values.splice(index, 1);
+        if (entry !== undefined)
+            clearTimeout(entry.timer);
+        return true;
+    }
+    async shift(signal) {
+        if (signal?.aborted === true)
+            throw signal.reason ?? new Error("accept canceled");
+        const entry = this.values.shift();
+        if (entry !== undefined) {
+            clearTimeout(entry.timer);
+            return entry.value;
+        }
+        if (this.closed)
+            throw new Error("WebSocket v3 listener is closed");
+        return await new Promise((resolve, reject) => {
+            const waiter = {
+                resolve: (session) => { cleanup(); resolve(session); },
+                reject: (error) => { cleanup(); reject(error); },
+            };
+            const abort = () => {
+                this.waiters.delete(waiter);
+                reject(signal?.reason ?? new Error("accept canceled"));
+            };
+            const cleanup = () => signal?.removeEventListener("abort", abort);
+            this.waiters.add(waiter);
+            signal?.addEventListener("abort", abort, { once: true });
+        });
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        const error = new Error("WebSocket v3 listener is closed");
+        for (const waiter of this.waiters)
+            waiter.reject(error);
+        this.waiters.clear();
+        for (const entry of this.values) {
+            clearTimeout(entry.timer);
+            entry.value.abort({ code: 1, reason: "WebSocket v3 listener closed" });
+        }
+        this.values.length = 0;
+    }
+}

package/dist/public/streamHandlers.d.ts

@@ -18,3 +18,6 @@ export declare class StreamHandlers {
     handleStream(kind: string, handler: StreamHandler): void;
     serve(session: Session, options?: OperationOptions): Promise<void>;
 }
+/** Explicit-compatibility application-stream handlers. */
+export declare class LegacyStreamHandlers extends StreamHandlers {
+}

package/dist/public/streamHandlers.js

@@ -11,6 +11,7 @@ export class HandlerRegistrationError extends Error {
     }
 }
 const streamHandlerStates = new WeakMap();
+const RESERVED_RPC_KINDS = new Set(["flowersec.rpc.v2", "flowersec.rpc.v3"]);
 /** Carrier-neutral application-stream handlers for any established Session. */
 export class StreamHandlers {
     constructor(options = {}) {
@@ -22,6 +23,7 @@ export class StreamHandlers {
         }
         streamHandlerStates.set(this, {
             maxConcurrentStreams: maximum,
+            reservedRPCKinds: RESERVED_RPC_KINDS,
             streams: new Map(),
             frozen: false,
         });
@@ -36,6 +38,9 @@ export class StreamHandlers {
         await serveFrozenStreamHandlers(freezeStreamHandlers(this), session, options, async () => await session.close());
     }
 }
+/** Explicit-compatibility application-stream handlers. */
+export class LegacyStreamHandlers extends StreamHandlers {
+}
 function mutableStreamHandlerState(handlers) {
     const state = streamHandlerStates.get(handlers);
     if (state === undefined)
@@ -50,7 +55,7 @@ function registerIntoState(state, entries) {
     const pending = new Set();
     for (const [kind, handler] of entries) {
         if (!validApplicationStreamKind(kind) ||
-            kind === "flowersec.rpc.v2" ||
+            state.reservedRPCKinds.has(kind) ||
             typeof handler !== "function") {
             throw new HandlerRegistrationError("invalid_handler");
         }

package/dist/v2/index.d.ts

@@ -0,0 +1,14 @@
+export type { ByteStream, IncomingStream, JsonObject, JsonPrimitive, JsonValue, OperationOptions, RpcPeer, RpcResult, SessionErrorCode, StreamOpenOptions, UnreliableMessageChannel, UnreliableMessageSendOptions, UnreliableMessageSendResult, SessionTermination, Session, } from "../public/contract.js";
+export { SessionError, UnreliableMessageError } from "../public/contract.js";
+export { createStreamMetadata, StreamMetadataError } from "../public/streamMetadata.js";
+export type { StreamMetadata } from "../public/streamMetadata.js";
+export { HandlerRegistrationError, LegacyStreamHandlers as StreamHandlers, } from "../public/streamHandlers.js";
+export type { StreamHandler, StreamHandlerOptions, } from "../public/streamHandlers.js";
+export { ArtifactLeaseError, createArtifactLease, } from "../public/artifactLease.js";
+export type { ArtifactLease } from "../public/artifactLease.js";
+export { Artifact, ArtifactError, parseArtifact } from "../public/artifact.js";
+export type { ArtifactErrorCode } from "../public/artifact.js";
+export type { ConnectErrorCode } from "../public/connectError.js";
+export { ConnectError } from "../public/connectError.js";
+export { ConnectionControllerError } from "../connectionController.js";
+export type { ArtifactSource, ArtifactSourceResult, ConnectionController, ConnectionControllerFailure, ConnectionControllerOptions, ConnectionSnapshot, ConnectionState, RetryDisposition, } from "../connectionController.js";

package/dist/v2/index.js

@@ -0,0 +1,7 @@
+export { SessionError, UnreliableMessageError } from "../public/contract.js";
+export { createStreamMetadata, StreamMetadataError } from "../public/streamMetadata.js";
+export { HandlerRegistrationError, LegacyStreamHandlers as StreamHandlers, } from "../public/streamHandlers.js";
+export { ArtifactLeaseError, createArtifactLease, } from "../public/artifactLease.js";
+export { Artifact, ArtifactError, parseArtifact } from "../public/artifact.js";
+export { ConnectError } from "../public/connectError.js";
+export { ConnectionControllerError } from "../connectionController.js";

package/dist/v2/protocol.js

@@ -616,68 +616,59 @@ export function canonicalStreamMetadataJSONV2Internal(value) {
     if (!isJSONObject(value))
         throw new ProtocolV2Error("OPEN metadata root must be an object");
     const state = { nodes: -1 };
-    validateMetadataValue(value, 1, state);
-    const canonical = canonicalJSONString(value);
+    const canonical = canonicalValidatedMetadataJSONString(value, 1, state);
     if (encoder.encode(canonical).length > MAX_OPEN_METADATA_BYTES) {
         throw new ProtocolV2Error("OPEN metadata is too large");
     }
     return canonical;
 }
-function validateMetadataValue(value, depth, state) {
+function canonicalValidatedMetadataJSONString(value, depth, state) {
     if (depth > MAX_OPEN_METADATA_DEPTH)
         throw new ProtocolV2Error("OPEN metadata exceeds depth limit");
     state.nodes += 1;
     if (state.nodes > MAX_OPEN_METADATA_NODES)
         throw new ProtocolV2Error("OPEN metadata exceeds node limit");
-    if (value === null || typeof value === "boolean")
-        return;
+    if (value === null)
+        return "null";
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
     if (typeof value === "number") {
-        if (!Number.isSafeInteger(value))
+        if (!Number.isSafeInteger(value) || Object.is(value, -0))
             throw new ProtocolV2Error("OPEN metadata number is not an I-JSON safe integer");
-        return;
+        return value.toString(10);
     }
     if (typeof value === "string") {
         if (!validOpenUnicodeString(value, MAX_OPEN_METADATA_STRING_BYTES, true)) {
             throw new ProtocolV2Error("invalid OPEN metadata string");
         }
-        return;
+        return quoteCanonicalJSONString(value);
     }
     if (Array.isArray(value)) {
-        if (value.length > MAX_OPEN_METADATA_ARRAY)
+        const length = value.length;
+        if (length > MAX_OPEN_METADATA_ARRAY)
             throw new ProtocolV2Error("OPEN metadata array is too large");
-        for (const item of value)
-            validateMetadataValue(item, depth + 1, state);
-        return;
+        const items = new Array(length);
+        for (let index = 0; index < length; index++) {
+            const item = value[index];
+            items[index] = canonicalValidatedMetadataJSONString(item, depth + 1, state);
+        }
+        return `[${items.join(",")}]`;
     }
     if (!isJSONObject(value))
         throw new ProtocolV2Error("unsupported OPEN metadata value");
-    const keys = Object.keys(value);
+    const keys = Object.keys(value).sort();
     if (keys.length > MAX_OPEN_METADATA_KEYS)
         throw new ProtocolV2Error("OPEN metadata object is too large");
+    const members = new Array(keys.length);
+    let index = 0;
     for (const key of keys) {
         if (!validOpenUnicodeString(key, MAX_OPEN_METADATA_KEY_BYTES, false)) {
             throw new ProtocolV2Error("invalid OPEN metadata key");
         }
-        validateMetadataValue(value[key], depth + 1, state);
+        const item = value[key];
+        members[index++] = `${quoteCanonicalJSONString(key)}:${canonicalValidatedMetadataJSONString(item, depth + 1, state)}`;
     }
-}
-function canonicalJSONString(value) {
-    if (value === null)
-        return "null";
-    if (typeof value === "boolean")
-        return value ? "true" : "false";
-    if (typeof value === "number")
-        return value.toString(10);
-    if (typeof value === "string")
-        return quoteCanonicalJSONString(value);
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJSONString).join(",")}]`;
-    if (!isJSONObject(value))
-        throw new ProtocolV2Error("unsupported OPEN metadata value");
-    return `{${Object.keys(value)
-        .sort()
-        .map((key) => `${quoteCanonicalJSONString(key)}:${canonicalJSONString(value[key])}`)
-        .join(",")}}`;
+    return `{${members.join(",")}}`;
 }
 function quoteCanonicalJSONString(value) {
     return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;

package/dist/v2/session.d.ts

@@ -91,6 +91,7 @@ export declare class SessionV2 implements SessionV2Contract {
     private controlReceiveEpoch;
     private controlReceiveSequence;
     private controlWriteTail;
+    private controlTerminalSealed;
     private nextLogicalID;
     private receivedGoAway;
     private receivedGoAwayLastAccepted;
@@ -164,6 +165,10 @@ export declare class SessionV2 implements SessionV2Contract {
     private acceptCarrierStreamAfterFSS2;
     private resetInboundBeforeDelivery;
     private sendControl;
+    private sendControlResponse;
+    private sendControlCleanup;
+    private sendTerminalControl;
+    private writeControl;
     private readControl;
     private controlLoop;
     private closeOnce;

package/dist/v2/session.js

@@ -96,6 +96,7 @@ export class SessionV2 {
     controlReceiveEpoch = 0;
     controlReceiveSequence = 0n;
     controlWriteTail = Promise.resolve();
+    controlTerminalSealed = false;
     nextLogicalID;
     receivedGoAway = false;
     receivedGoAwayLastAccepted = 0n;
@@ -312,10 +313,11 @@ export class SessionV2 {
         this.releaseStream(stream);
         let controlConfirmed = false;
         try {
-            await this.sendControl(InnerTypeV2.StreamReset, idReason(stream.id, 6));
-            this.commitLocalReset(stream.id);
-            if (stream.hasRemoteFIN())
-                controlConfirmed = await this.confirmControlDelivery();
+            if (await this.sendControlCleanup(InnerTypeV2.StreamReset, idReason(stream.id, 6))) {
+                this.commitLocalReset(stream.id);
+                if (stream.hasRemoteFIN())
+                    controlConfirmed = await this.confirmControlDelivery();
+            }
         }
         catch (cause) {
             this.fail(asError(cause));
@@ -343,6 +345,8 @@ export class SessionV2 {
         this.cleanupEpochRoots();
     }
     async confirmControlDelivery() {
+        if (this.lifecycle !== "open" || this.controlTerminalSealed)
+            return false;
         const nonce = this.nextPing++;
         const pending = deferred();
         this.pings.set(nonce, pending);
@@ -567,33 +571,87 @@ export class SessionV2 {
     async resetInboundBeforeDelivery(id, carrierStream) {
         await carrierStream.reset().catch(() => undefined);
         try {
-            await this.sendControl(InnerTypeV2.StreamReset, idReason(id, 3));
-            this.peerLedger.localResetCommitted(id);
+            if (await this.sendControlCleanup(InnerTypeV2.StreamReset, idReason(id, 3))) {
+                this.peerLedger.localResetCommitted(id);
+            }
         }
         catch (error) {
             this.fail(asError(error));
         }
     }
     async sendControl(type, payload, signal) {
+        if (this.controlTerminalSealed) {
+            throw this.terminalError ?? new SessionV2Error("closed", "Flowersec v2 control stream is sealed");
+        }
         const task = this.controlWriteTail.then(async () => {
             if (this.lifecycle === "closed")
                 throw this.terminalError ?? new SessionV2Error("closed", "Flowersec v2 session closed");
-            const inner = encodeInnerRecordV2(type, payload);
-            const roots = this.rootForSend(this.controlSendEpoch);
-            const material = deriveControlMaterial(roots.controlRoot, this.h3, this.sendDirection, this.controlSendEpoch);
-            const header = {
-                epoch: this.controlSendEpoch,
-                sequence: this.controlSendSequence,
-                ciphertextLength: inner.length + 16,
-            };
-            const ciphertext = sealRecord(this.config.suite, material, this.h3, 0n, this.sendDirection, header, inner);
-            this.controlSendSequence += 1n;
-            await writeAll(this.control, concat(encodeRecordHeader(header), ciphertext), signal);
-            this.markAuthenticatedActivity();
+            await this.writeControl(type, payload, signal);
         });
         this.controlWriteTail = task.catch(() => undefined);
         await task;
     }
+    async sendControlResponse(type, payload) {
+        if (this.lifecycle !== "open" || this.controlTerminalSealed)
+            return false;
+        const task = this.controlWriteTail.then(async () => {
+            if (this.lifecycle !== "open" || this.controlTerminalSealed)
+                return false;
+            await this.writeControl(type, payload);
+            return true;
+        });
+        this.controlWriteTail = task.then(() => undefined, () => undefined);
+        return await task;
+    }
+    async sendControlCleanup(type, payload) {
+        if (this.controlTerminalSealed || this.lifecycle === "closed")
+            return false;
+        const task = this.controlWriteTail.then(async () => {
+            if (this.lifecycle === "closed")
+                return false;
+            await this.writeControl(type, payload);
+            return true;
+        });
+        this.controlWriteTail = task.then(() => undefined, () => undefined);
+        return await task;
+    }
+    sendTerminalControl(reason) {
+        if (this.controlTerminalSealed)
+            return this.controlWriteTail;
+        this.controlTerminalSealed = true;
+        const task = this.controlWriteTail.then(async () => {
+            if (this.lifecycle === "closed")
+                throw this.terminalError ?? new SessionV2Error("closed", "Flowersec v2 session closed");
+            if (!this.sentGoAway) {
+                this.sentGoAway = true;
+                this.sentGoAwayLastAccepted = this.peerLedger.frontier;
+                this.sentGoAwayReason = reason;
+            }
+            await this.writeControl(InnerTypeV2.GoAway, idReason(this.sentGoAwayLastAccepted, this.sentGoAwayReason));
+            if (!this.sentSessionClose) {
+                this.sentSessionClose = true;
+                await this.writeControl(InnerTypeV2.SessionClose, Uint8Array.of(0, reason));
+                this.sessionCloseCommitted = true;
+            }
+            await this.control.closeWrite();
+        });
+        this.controlWriteTail = task.catch(() => undefined);
+        return task;
+    }
+    async writeControl(type, payload, signal) {
+        const inner = encodeInnerRecordV2(type, payload);
+        const roots = this.rootForSend(this.controlSendEpoch);
+        const material = deriveControlMaterial(roots.controlRoot, this.h3, this.sendDirection, this.controlSendEpoch);
+        const header = {
+            epoch: this.controlSendEpoch,
+            sequence: this.controlSendSequence,
+            ciphertextLength: inner.length + 16,
+        };
+        const ciphertext = sealRecord(this.config.suite, material, this.h3, 0n, this.sendDirection, header, inner);
+        this.controlSendSequence += 1n;
+        await writeAll(this.control, concat(encodeRecordHeader(header), ciphertext), signal);
+        this.markAuthenticatedActivity();
+    }
     async readControl() {
         const header = decodeRecordHeader(await this.controlReader.readExactly(24));
         const cutover = header.epoch === this.controlReceiveEpoch + 1 &&
@@ -622,7 +680,7 @@ export class SessionV2 {
                 const record = await this.readControl();
                 switch (record.type) {
                     case InnerTypeV2.Ping:
-                        await this.sendControl(InnerTypeV2.Pong, record.payload);
+                        await this.sendControlResponse(InnerTypeV2.Pong, record.payload);
                         break;
                     case InnerTypeV2.Pong:
                         this.pings.get(readU64(record.payload))?.resolve();
@@ -685,20 +743,10 @@ export class SessionV2 {
         if (this.lifecycle === "closed")
             return;
         const closed = new SessionV2Error("closed", "Flowersec v2 session closed");
+        const terminal = this.sendTerminalControl(1);
         const work = (async () => {
             try {
-                await this.sendGoAway(1);
-            }
-            catch {
-                // A prior GOAWAY boundary must not suppress the close response.
-            }
-            try {
-                if (!this.sentSessionClose) {
-                    this.sentSessionClose = true;
-                    await this.sendControl(InnerTypeV2.SessionClose, Uint8Array.of(0, 1));
-                    this.sessionCloseCommitted = true;
-                    await this.control.closeWrite();
-                }
+                await terminal;
             }
             catch {
                 // Closing is best-effort once the bounded shutdown has started.
@@ -853,7 +901,12 @@ export class SessionV2 {
         }
         const streams = [...this.streams.values()];
         await Promise.all(streams.map(async (stream) => await stream.waitReceiveRekey(transition, nextEpoch, signal)));
-        await raceAbort(this.sendControl(InnerTypeV2.SessionKeyUpdateACK, payload), signal);
+        const acknowledged = await raceAbort(this.sendControlResponse(InnerTypeV2.SessionKeyUpdateACK, payload), signal);
+        if (!acknowledged) {
+            this.pendingReceiveEpoch = undefined;
+            this.cleanupEpochRoots();
+            return;
+        }
         throwIfAborted(signal);
         this.receiveEpoch = nextEpoch;
         this.receiveTransition = transition;
@@ -897,9 +950,10 @@ export class SessionV2 {
         }
     }
     async commitOutboundReset(id) {
-        await this.sendControl(InnerTypeV2.StreamReset, idReason(id, 6));
-        this.outboundLedger.localResetCommitted(id);
-        this.notifyOutboundFrontierChanged();
+        if (await this.sendControlCleanup(InnerTypeV2.StreamReset, idReason(id, 6))) {
+            this.outboundLedger.localResetCommitted(id);
+            this.notifyOutboundFrontierChanged();
+        }
     }
     commitLocalReset(id) {
         if (this.isLocalLogicalID(id)) {
@@ -1026,6 +1080,7 @@ export class SessionV2 {
     fail(error, abortCarrier = true) {
         if (this.lifecycle === "closed")
             return;
+        this.controlTerminalSealed = true;
         this.beginClosing();
         const normalPeerCarrierClose = this.sessionCloseCommitted && error instanceof CarrierError && error.code === "closed";
         if (normalPeerCarrierClose)

package/dist/v3/admissionError.d.ts

@@ -0,0 +1,4 @@
+export declare class AdmissionSessionV3Error extends Error {
+    readonly reason: string;
+    constructor(reason: string, message: string);
+}

package/dist/v3/admissionError.js

@@ -0,0 +1,8 @@
+export class AdmissionSessionV3Error extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "AdmissionSessionV3Error";
+    }
+}