@floegence/flowersec-core 3.0.2 → 3.1.0

package/dist/v2/session.js

@@ -140,6 +140,7 @@ export class SessionV2 {
     idleWatchdogStarted = false;
     idleTimerCancel;
     terminationState = deferred();
+    terminationController = new AbortController();
     rpcRouter;
     constructor(carrier, control, controlReader, config, material) {
         this.carrier = carrier;
@@ -269,6 +270,9 @@ export class SessionV2 {
     receiveDirectionValue() {
         return this.receiveDirection;
     }
+    terminationSignal() {
+        return this.terminationController.signal;
+    }
     async sendStreamRecord(stream, type, payload, signal) {
         this.assertOpen();
         const inner = encodeInnerRecordV2(type, payload);
@@ -1080,6 +1084,7 @@ export class SessionV2 {
     fail(error, abortCarrier = true) {
         if (this.lifecycle === "closed")
             return;
+        this.terminationController.abort(error);
         this.controlTerminalSealed = true;
         this.beginClosing();
         const normalPeerCarrierClose = this.sessionCloseCommitted && error instanceof CarrierError && error.code === "closed";
@@ -1147,6 +1152,7 @@ class EncryptedStreamV2 {
     pendingSendRekey;
     lastSendRekeyACK;
     receiveRekey;
+    receiveRekeyChanged = deferred();
     constructor(session, carrier, id, kind, sendEpoch, receiveEpoch, permitRelease, reader) {
         this.session = session;
         this.carrier = carrier;
@@ -1256,7 +1262,7 @@ class EncryptedStreamV2 {
                 await raceAbort(pending.acknowledged.promise, signal);
                 return;
             }
-            await raceAbort(new Promise((resolve) => setTimeout(resolve, 0)), signal);
+            await raceAbort(this.receiveRekeyChanged.promise, signal);
             if (this.terminalError !== undefined || this.remoteFIN)
                 return;
         }
@@ -1266,6 +1272,11 @@ class EncryptedStreamV2 {
             this.receiveRekey = undefined;
         }
     }
+    notifyReceiveRekeyChanged() {
+        const changed = this.receiveRekeyChanged;
+        this.receiveRekeyChanged = deferred();
+        changed.resolve();
+    }
     startPump() {
         if (this.pumpStarted)
             return;
@@ -1283,6 +1294,7 @@ class EncryptedStreamV2 {
         this.pendingSendRekey = undefined;
         pendingSendRekey?.armed.reject(error);
         pendingSendRekey?.done.reject(error);
+        this.notifyReceiveRekeyChanged();
         this.opened.reject(error);
         this.data.fail(error);
         return true;
@@ -1412,11 +1424,12 @@ class EncryptedStreamV2 {
         this.receiveSequence = 0n;
         const pending = { transition, epoch: nextEpoch, acknowledged: deferred() };
         this.receiveRekey = pending;
+        this.notifyReceiveRekeyChanged();
         await this.send(InnerTypeV2.StreamKeyUpdateACK, encodeStreamKeyUpdateACKV2({
             logicalStreamID: this.id,
             transition,
             epoch: nextEpoch,
-        }));
+        }), this.session.terminationSignal());
         pending.acknowledged.resolve();
     }
     receiveStreamKeyUpdateACK(payload) {

package/dist/v2/unreliableMessage.js

@@ -34,10 +34,12 @@ class InternalUnreliableMessageChannelV2 {
     }
     async send(message, options) {
         throwIfAborted(options.signal);
-        if (!(message instanceof Uint8Array) || message.byteLength < 1 ||
-            message.byteLength > UNRELIABLE_MESSAGE_MAX_PLAINTEXT_BYTES_V2) {
+        if (!(message instanceof Uint8Array) || message.byteLength < 1) {
             throw new UnreliableMessageError("invalid_message");
         }
+        if (message.byteLength > UNRELIABLE_MESSAGE_MAX_PLAINTEXT_BYTES_V2) {
+            throw new UnreliableMessageError("too_large");
+        }
         const payload = message.slice();
         const expiresAt = requireFutureExpiry(options.expiresAtUnixMs, this.now());
         if (expiresAt === undefined)
@@ -70,8 +72,8 @@ class InternalUnreliableMessageChannelV2 {
             });
         }
         catch (error) {
-            if (error instanceof DOMException && error.name === "AbortError")
-                throw error;
+            if (isAbortError(error))
+                throw new UnreliableMessageError("canceled");
             throw new UnreliableMessageError("operation_failed");
         }
         finally {
@@ -87,7 +89,7 @@ class InternalUnreliableMessageChannelV2 {
             }
             catch (error) {
                 if (isAbortError(error))
-                    throw error;
+                    throw new UnreliableMessageError("canceled");
                 throw new UnreliableMessageError("closed");
             }
             const decoded = decodeHeader(wire);
@@ -219,7 +221,7 @@ function requireFutureExpiry(value, now) {
 }
 function throwIfAborted(signal) {
     if (signal?.aborted === true)
-        throw new DOMException("operation aborted", "AbortError");
+        throw new UnreliableMessageError("canceled");
 }
 function isAbortError(error) {
     return error instanceof DOMException && error.name === "AbortError" ||

package/dist/v3/connectionController.d.ts

@@ -57,6 +57,14 @@ export type ConnectionControllerSnapshotV3<Session extends ManagedSessionV3 = Ma
     failure?: ConnectionControllerFailureV3;
     retryDisposition?: RetryDispositionV3;
 }>;
+export type ConnectionDiagnosticV3 = Readonly<{
+    state: ConnectionControllerStateV3;
+    attempt: number;
+    failure?: ConnectionControllerFailureV3;
+    retryDisposition?: RetryDispositionV3;
+}>;
+/** Produces a stable diagnostic value without retaining a Session or transport detail. */
+export declare function connectionDiagnosticV3(snapshot: ConnectionControllerSnapshotV3): ConnectionDiagnosticV3;
 export type ConnectionControllerOptionsV3 = Readonly<{
     maximumAttempts?: number;
     clock?: ControllerClockV3;
@@ -68,7 +76,8 @@ export declare class ConnectionControllerV3Error extends Error {
     readonly code: "failed" | "closed" | "canceled";
     readonly failure?: ConnectionControllerFailureV3 | undefined;
     readonly retryDisposition?: RetryDispositionV3 | undefined;
-    constructor(code: "failed" | "closed" | "canceled", failure?: ConnectionControllerFailureV3 | undefined, retryDisposition?: RetryDispositionV3 | undefined);
+    readonly diagnostic: ConnectionDiagnosticV3;
+    constructor(code: "failed" | "closed" | "canceled", failure?: ConnectionControllerFailureV3 | undefined, retryDisposition?: RetryDispositionV3 | undefined, diagnostic?: ConnectionDiagnosticV3);
 }
 export declare class ConnectionControllerV3<Session extends ManagedSessionV3 = ManagedSessionV3> {
     #private;

package/dist/v3/connectionController.js

@@ -8,16 +8,40 @@ const ARTIFACT_SOURCE_FAILURE_CODES_V3 = new Set([
     "connection_failed",
     "expired_artifact",
 ]);
+/** Produces a stable diagnostic value without retaining a Session or transport detail. */
+export function connectionDiagnosticV3(snapshot) {
+    const failure = snapshot.failure === undefined
+        ? undefined
+        : Object.freeze({ phase: snapshot.failure.phase, code: snapshot.failure.code });
+    const retryDisposition = snapshot.retryDisposition === undefined
+        ? undefined
+        : validateRetryDispositionV3(snapshot.retryDisposition);
+    return Object.freeze({
+        state: snapshot.state,
+        attempt: snapshot.attempt,
+        ...(failure === undefined ? {} : { failure }),
+        ...(retryDisposition === undefined ? {} : { retryDisposition }),
+    });
+}
 export class ConnectionControllerV3Error extends Error {
     code;
     failure;
     retryDisposition;
-    constructor(code, failure, retryDisposition) {
-        super(`Flowersec v3 connection controller stopped (code=${code})`);
+    diagnostic;
+    constructor(code, failure, retryDisposition, diagnostic) {
+        super(`Flowersec connection controller stopped (code=${code})`);
         this.code = code;
         this.failure = failure;
         this.retryDisposition = retryDisposition;
         this.name = "ConnectionControllerError";
+        this.diagnostic = diagnostic ?? Object.freeze({
+            state: code === "failed" ? "failed" : code === "closed" ? "closed" : "idle",
+            attempt: 0,
+            ...(failure === undefined ? {} : { failure }),
+            ...(retryDisposition === undefined ? {} : {
+                retryDisposition: validateRetryDispositionV3(retryDisposition),
+            }),
+        });
     }
 }
 export class ConnectionControllerV3 {
@@ -95,15 +119,22 @@ export class ConnectionControllerV3 {
         if (this.currentSession !== undefined)
             return this.currentSession;
         if (this.#state === "failed") {
-            throw new ConnectionControllerV3Error("failed", this.#failure, this.#disposition);
+            const snapshot = this.#snapshot();
+            throw new ConnectionControllerV3Error("failed", this.#failure, this.#disposition, connectionDiagnosticV3(snapshot));
         }
         if (this.#state === "closed") {
-            throw new ConnectionControllerV3Error("closed", this.#failure, this.#disposition);
+            const snapshot = this.#snapshot();
+            throw new ConnectionControllerV3Error("closed", this.#failure, this.#disposition, connectionDiagnosticV3(snapshot));
+        }
+        if (options.signal?.aborted === true) {
+            throw new ConnectionControllerV3Error("canceled", undefined, undefined, connectionDiagnosticV3(this.#snapshot()));
         }
-        if (options.signal?.aborted === true)
-            throw new ConnectionControllerV3Error("canceled");
         return await new Promise((resolve, reject) => {
+            let settled = false;
             const finish = (session, error) => {
+                if (settled)
+                    return;
+                settled = true;
                 this.#listeners.delete(listener);
                 options.signal?.removeEventListener("abort", canceled);
                 session === undefined ? reject(error) : resolve(session);
@@ -113,15 +144,22 @@ export class ConnectionControllerV3 {
                     finish(snapshot.currentSession);
                 }
                 else if (snapshot.state === "failed") {
-                    finish(undefined, new ConnectionControllerV3Error("failed", snapshot.failure, snapshot.retryDisposition));
+                    finish(undefined, new ConnectionControllerV3Error("failed", snapshot.failure, snapshot.retryDisposition, connectionDiagnosticV3(snapshot)));
                 }
                 else if (snapshot.state === "closed") {
-                    finish(undefined, new ConnectionControllerV3Error("closed", snapshot.failure, snapshot.retryDisposition));
+                    finish(undefined, new ConnectionControllerV3Error("closed", snapshot.failure, snapshot.retryDisposition, connectionDiagnosticV3(snapshot)));
                 }
             };
-            const canceled = () => finish(undefined, new ConnectionControllerV3Error("canceled"));
+            const canceled = () => {
+                const snapshot = this.#snapshot();
+                finish(undefined, new ConnectionControllerV3Error("canceled", undefined, undefined, connectionDiagnosticV3(snapshot)));
+            };
             this.#listeners.add(listener);
             options.signal?.addEventListener("abort", canceled, { once: true });
+            if (options.signal?.aborted === true)
+                canceled();
+            else
+                listener(this.#snapshot());
         });
     }
     close() {
@@ -190,10 +228,10 @@ export class ConnectionControllerV3 {
             if (acquisition.kind === "failure") {
                 const error = sourceFailure(acquisition);
                 const ordinal = this.#cycle.recordFailedAcquisitionOrLease();
-                this.#recordFailure("artifact", error.code, error.disposition);
-                if (error.disposition.kind === "terminal" || this.#attemptBudgetExhausted())
+                this.#recordFailure("artifact", error.code, error.retryDisposition);
+                if (error.retryDisposition.kind === "terminal" || this.#attemptBudgetExhausted())
                     return;
-                pendingDisposition = error.disposition;
+                pendingDisposition = error.retryDisposition;
                 void ordinal;
                 continue;
             }
@@ -222,7 +260,7 @@ export class ConnectionControllerV3 {
                 await retireArtifactLeaseV3(claim);
                 this.#cycle.recordFailedAcquisitionOrLease();
                 const error = new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
-                this.#recordFailure("connect", error.code, error.disposition);
+                this.#recordFailure("connect", error.code, error.retryDisposition);
                 return;
             }
             try {
@@ -232,12 +270,12 @@ export class ConnectionControllerV3 {
                 await retireArtifactLeaseV3(claim);
                 this.#cycle.recordFailedAcquisitionOrLease();
                 const error = new ConnectErrorV3("expired_artifact", { kind: "retryable" });
-                this.#recordFailure("connect", error.code, error.disposition);
+                this.#recordFailure("connect", error.code, error.retryDisposition);
                 if (this.#attemptBudgetExhausted())
                     return;
                 next = "primary";
                 replacementContext = undefined;
-                pendingDisposition = error.disposition;
+                pendingDisposition = error.retryDisposition;
                 continue;
             }
             const candidates = next === "replacement"
@@ -249,7 +287,7 @@ export class ConnectionControllerV3 {
                 const error = next === "replacement"
                     ? replacementTerminal(replacementContext)
                     : this.#cycle.blockedPolicyTerminal();
-                this.#recordFailure("connect", error.code, error.disposition);
+                this.#recordFailure("connect", error.code, error.retryDisposition);
                 return;
             }
             let rawResult;
@@ -319,12 +357,12 @@ export class ConnectionControllerV3 {
                 let sessionFailure;
                 try {
                     sessionFailure = this.#projectSessionFailure(termination.error);
-                    validateRetryDispositionV3(sessionFailure.disposition);
+                    validateRetryDispositionV3(sessionFailure.retryDisposition);
                 }
                 catch {
                     sessionFailure = new ConnectErrorV3("connection_failed", { kind: "terminal" });
                 }
-                const disposition = sessionFailure.disposition;
+                const disposition = sessionFailure.retryDisposition;
                 this.#cycle.recordFailedAcquisitionOrLease();
                 this.#recordFailure("session", sessionFailure.code, disposition);
                 if (disposition.kind === "terminal")
@@ -345,13 +383,13 @@ export class ConnectionControllerV3 {
                 const error = next === "replacement" && result.error.code !== "expired_artifact"
                     ? replacementTerminal(replacementContext)
                     : result.error;
-                const disposition = error.disposition;
+                const disposition = error.retryDisposition;
                 this.#recordFailure("connect", error.code, disposition);
                 if (disposition.kind === "terminal" || this.#attemptBudgetExhausted())
                     return;
                 next = "primary";
                 replacementContext = undefined;
-                pendingDisposition = result.error.disposition;
+                pendingDisposition = result.error.retryDisposition;
                 continue;
             }
             if (result.kind === "post_spend_failure") {
@@ -365,12 +403,12 @@ export class ConnectionControllerV3 {
                     };
                 }
                 this.#cycle.recordFailedAcquisitionOrLease();
-                this.#recordFailure("connect", postSpendResult.error.code, postSpendResult.error.disposition);
-                if (postSpendResult.error.disposition.kind === "terminal" || this.#attemptBudgetExhausted())
+                this.#recordFailure("connect", postSpendResult.error.code, postSpendResult.error.retryDisposition);
+                if (postSpendResult.error.retryDisposition.kind === "terminal" || this.#attemptBudgetExhausted())
                     return;
                 next = "primary";
                 replacementContext = undefined;
-                pendingDisposition = postSpendResult.error.disposition;
+                pendingDisposition = postSpendResult.error.retryDisposition;
                 continue;
             }
             if (artifactLeaseStateV3(claim) !== "claimed") {
@@ -382,17 +420,17 @@ export class ConnectionControllerV3 {
             this.#cycle.recordFailedAcquisitionOrLease();
             if (isExpired(artifact, this.#nowUnixSeconds)) {
                 const error = new ConnectErrorV3("expired_artifact", { kind: "retryable" });
-                this.#recordFailure("connect", error.code, error.disposition);
+                this.#recordFailure("connect", error.code, error.retryDisposition);
                 if (this.#attemptBudgetExhausted())
                     return;
                 next = "primary";
                 replacementContext = undefined;
-                pendingDisposition = error.disposition;
+                pendingDisposition = error.retryDisposition;
                 continue;
             }
             if (next === "replacement") {
                 const error = replacementTerminal(replacementContext);
-                this.#recordFailure("connect", error.code, error.disposition);
+                this.#recordFailure("connect", error.code, error.retryDisposition);
                 return;
             }
             const triggerKeys = blockPolicyRefreshTriggersV3(artifact.path.kind, result.failures, this.#cycle);
@@ -406,14 +444,14 @@ export class ConnectionControllerV3 {
             }
             if (triggerKeys.size > 0 && refresh.code === "connection_failed") {
                 const terminal = this.#cycle.blockedPolicyTerminal();
-                this.#recordFailure("connect", terminal.code, terminal.disposition);
+                this.#recordFailure("connect", terminal.code, terminal.retryDisposition);
                 return;
             }
-            this.#recordFailure("connect", refresh.code, refresh.disposition);
-            if (refresh.disposition.kind === "terminal" || this.#attemptBudgetExhausted())
+            this.#recordFailure("connect", refresh.code, refresh.retryDisposition);
+            if (refresh.retryDisposition.kind === "terminal" || this.#attemptBudgetExhausted())
                 return;
             next = "primary";
-            pendingDisposition = refresh.disposition;
+            pendingDisposition = refresh.retryDisposition;
         }
     }
     async #acquire() {
@@ -467,7 +505,7 @@ export class ConnectionControllerV3 {
                     return {
                         kind: "failure",
                         code: error.code,
-                        disposition: validateRetryDispositionV3(error.disposition),
+                        disposition: validateRetryDispositionV3(error.retryDisposition),
                     };
                 }
                 catch {
@@ -696,7 +734,7 @@ function normalizeLeaseAttemptResultV3(value, candidates, capability) {
         const error = Reflect.get(value, "error");
         if (!(error instanceof ConnectErrorV3) || !CONNECT_ERROR_CODES_V3.has(error.code))
             return undefined;
-        const normalizedError = new ConnectErrorV3(error.code, validateRetryDispositionV3(error.disposition));
+        const normalizedError = new ConnectErrorV3(error.code, validateRetryDispositionV3(error.retryDisposition));
         return Object.freeze({ kind, error: normalizedError });
     }
     catch {

package/dist/v3/controller.js

@@ -206,7 +206,7 @@ export class ControllerRetryWaitV3 {
         this.#waiting = true;
         this.#manual = false;
         this.#absoluteDeadline = validated.kind === "retry_after"
-            ? validated.absoluteUnixMilliseconds
+            ? validated.notBeforeUnixMilliseconds
             : undefined;
         try {
             while (!signal.aborted) {
@@ -264,11 +264,21 @@ function saturatingDifferenceMilliseconds(deadline, now) {
 function validateControllerWaitDisposition(value) {
     if (value.kind === "terminal" || value.kind === "retryable")
         return value;
-    if (value.kind !== "retry_after" || !Number.isSafeInteger(value.absoluteUnixMilliseconds) ||
-        value.absoluteUnixMilliseconds < 0 || value.absoluteUnixMilliseconds > 253_402_300_799_999) {
+    if (value.kind !== "retry_after") {
         throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
     }
-    return value;
+    const deadline = value.notBeforeUnixMilliseconds ?? value.absoluteUnixMilliseconds;
+    if (deadline === undefined || !Number.isSafeInteger(deadline) || deadline < 0 ||
+        deadline > 253_402_300_799_999 || value.notBeforeUnixMilliseconds !== undefined &&
+        value.absoluteUnixMilliseconds !== undefined &&
+        value.notBeforeUnixMilliseconds !== value.absoluteUnixMilliseconds) {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
+    return Object.freeze({
+        kind: "retry_after",
+        notBeforeUnixMilliseconds: deadline,
+        absoluteUnixMilliseconds: deadline,
+    });
 }
 function controllerBackoffForWait(consecutiveFailure) {
     if (!Number.isSafeInteger(consecutiveFailure) || consecutiveFailure < 1) {

package/dist/v3/protocol.js

@@ -405,6 +405,8 @@ export function decodeStreamKeyUpdateACKV3(raw) {
     assertLogicalStreamID(value.logicalStreamID);
     if (value.transition === 0n)
         throw new ProtocolV3Error("stream rekey transition must be non-zero");
+    if (value.epoch === 0)
+        throw new ProtocolV3Error("stream rekey epoch must be non-zero");
     return value;
 }
 export function buildRecordAAD(h3, logicalStreamID, direction, rawHeader) {

package/dist/v3/security.d.ts

@@ -13,12 +13,22 @@ export type RetryDispositionV3 = Readonly<{
     kind: "retryable";
 }> | Readonly<{
     kind: "retry_after";
+    notBeforeUnixMilliseconds: number;
+    /** @deprecated Use notBeforeUnixMilliseconds. */
+    absoluteUnixMilliseconds?: number;
+}>;
+type RetryDispositionInputV3 = RetryDispositionV3 | Readonly<{
+    kind: "retry_after";
+    /** @deprecated Use notBeforeUnixMilliseconds. */
     absoluteUnixMilliseconds: number;
+    notBeforeUnixMilliseconds?: number;
 }>;
 export declare class ConnectErrorV3 extends Error {
     readonly code: PublicConnectErrorCodeV3;
-    readonly disposition: RetryDispositionV3;
-    constructor(code: PublicConnectErrorCodeV3, disposition: RetryDispositionV3);
+    readonly retryDisposition: RetryDispositionV3;
+    constructor(code: PublicConnectErrorCodeV3, disposition: RetryDispositionInputV3);
+    /** @deprecated Use retryDisposition. */
+    get disposition(): RetryDispositionV3;
 }
 export type TransportSecuritySnapshotV3 = Readonly<{
     mode: "ca";
@@ -29,6 +39,7 @@ export type TransportSecuritySnapshotV3 = Readonly<{
 }>;
 export declare function snapshotTransportSecurityPolicyV3(policy: TransportSecurityPolicyV3, attemptNowUnixSeconds: number, supportedModes: readonly ("ca" | "pin")[]): TransportSecuritySnapshotV3;
 export declare function projectTransportFailureV3(failure: TransportFailureV3, _policyMode: "ca" | "pin"): ConnectErrorV3;
-export declare function validateRetryDispositionV3(value: RetryDispositionV3): RetryDispositionV3;
-export declare function aggregateRetryDispositionsV3(values: readonly RetryDispositionV3[]): RetryDispositionV3;
+export declare function validateRetryDispositionV3(value: RetryDispositionInputV3): RetryDispositionV3;
+export declare function aggregateRetryDispositionsV3(values: readonly RetryDispositionInputV3[]): RetryDispositionV3;
 export declare function controllerBackoffMillisecondsV3(consecutiveFailure: number): number;
+export {};

package/dist/v3/security.js

@@ -11,13 +11,15 @@ export class TransportFailureV3 extends Error {
 }
 export class ConnectErrorV3 extends Error {
     code;
-    disposition;
+    retryDisposition;
     constructor(code, disposition) {
         super(`Flowersec connection failed (code=${code})`);
         this.code = code;
-        this.disposition = disposition;
         this.name = "ConnectError";
+        this.retryDisposition = validateRetryDispositionValueV3(disposition);
     }
+    /** @deprecated Use retryDisposition. */
+    get disposition() { return this.retryDisposition; }
 }
 export function snapshotTransportSecurityPolicyV3(policy, attemptNowUnixSeconds, supportedModes) {
     if (!Number.isSafeInteger(attemptNowUnixSeconds) || attemptNowUnixSeconds < 0) {
@@ -64,28 +66,26 @@ export function projectTransportFailureV3(failure, _policyMode) {
     }
 }
 export function validateRetryDispositionV3(value) {
-    if (value.kind === "terminal")
-        return terminal();
-    if (value.kind === "retryable")
-        return retryable();
-    if (value.kind !== "retry_after" || !Number.isSafeInteger(value.absoluteUnixMilliseconds) ||
-        value.absoluteUnixMilliseconds < 0 || value.absoluteUnixMilliseconds > 253_402_300_799_999) {
+    try {
+        return validateRetryDispositionValueV3(value);
+    }
+    catch {
         throw new ConnectErrorV3("artifact_invalid", terminal());
     }
-    return Object.freeze({ kind: "retry_after", absoluteUnixMilliseconds: value.absoluteUnixMilliseconds });
 }
 export function aggregateRetryDispositionsV3(values) {
     let latest;
     let canRetry = false;
     for (const input of values) {
         const value = validateRetryDispositionV3(input);
-        if (value.kind === "retry_after")
-            latest = Math.max(latest ?? 0, value.absoluteUnixMilliseconds);
+        if (value.kind === "retry_after") {
+            latest = Math.max(latest ?? 0, value.notBeforeUnixMilliseconds);
+        }
         else if (value.kind === "retryable")
             canRetry = true;
     }
     if (latest !== undefined)
-        return Object.freeze({ kind: "retry_after", absoluteUnixMilliseconds: latest });
+        return retryAfter(latest);
     return canRetry ? retryable() : terminal();
 }
 export function controllerBackoffMillisecondsV3(consecutiveFailure) {
@@ -98,3 +98,23 @@ export function controllerBackoffMillisecondsV3(consecutiveFailure) {
 }
 const terminal = () => Object.freeze({ kind: "terminal" });
 const retryable = () => Object.freeze({ kind: "retryable" });
+const retryAfter = (notBeforeUnixMilliseconds) => Object.freeze({
+    kind: "retry_after",
+    notBeforeUnixMilliseconds,
+    absoluteUnixMilliseconds: notBeforeUnixMilliseconds,
+});
+function validateRetryDispositionValueV3(value) {
+    if (value.kind === "terminal")
+        return terminal();
+    if (value.kind === "retryable")
+        return retryable();
+    const legacy = value.absoluteUnixMilliseconds;
+    const canonical = value.notBeforeUnixMilliseconds;
+    const deadline = canonical ?? legacy;
+    if (deadline === undefined ||
+        canonical !== undefined && legacy !== undefined && canonical !== legacy ||
+        !Number.isSafeInteger(deadline) || deadline < 0 || deadline > 253_402_300_799_999) {
+        throw new TypeError("invalid Flowersec retry-after deadline");
+    }
+    return retryAfter(deadline);
+}

package/dist/v3/session.d.ts

@@ -136,6 +136,7 @@ export declare class SessionV3 implements SessionV3Contract {
     private idleDeadlineMs;
     private idleTimerCancel;
     private readonly terminationState;
+    private readonly terminationController;
     private readonly rpcRouter;
     constructor(carrier: CarrierSessionV3, control: CarrierStreamV3, controlReader: ExactReader, config: SessionConfigV3, material: HandshakeMaterial);
     openStream(kind: string, options?: InternalStreamOpenOptionsV3): Promise<ByteStreamV3>;
@@ -150,6 +151,7 @@ export declare class SessionV3 implements SessionV3Contract {
     installReceiveRoots(epoch: number, roots: EpochRootsV3): void;
     transcriptHash(): Uint8Array;
     receiveDirectionValue(): DirectionV3;
+    terminationSignal(): AbortSignal;
     sendStreamRecord(stream: EncryptedStreamV3, type: InnerTypeV3, payload: Uint8Array, signal?: AbortSignal): Promise<void>;
     readStreamRecord(stream: EncryptedStreamV3): Promise<Readonly<{
         type: InnerTypeV3;
@@ -244,6 +246,7 @@ declare class EncryptedStreamV3 implements ByteStreamV3 {
     private receiveRekey;
     private readonly sendMaterials;
     private readonly receiveMaterials;
+    private receiveRekeyChanged;
     constructor(session: SessionV3, carrier: CarrierStreamV3, id: bigint, kind: string, sendEpoch: number, receiveEpoch: number, permitRelease: () => void, reader?: ExactReader);
     read(options?: OperationOptionsV3): Promise<Uint8Array | null>;
     write(payload: Uint8Array, options?: OperationOptionsV3): Promise<number>;
@@ -259,6 +262,7 @@ declare class EncryptedStreamV3 implements ByteStreamV3 {
     }>;
     waitReceiveRekey(transition: bigint, epoch: number, signal?: AbortSignal): Promise<void>;
     publishReceiveRekey(transition: bigint, epoch: number): void;
+    private notifyReceiveRekeyChanged;
     startPump(): void;
     markOpen(): void;
     markTerminal(error: Error): boolean;

package/dist/v3/session.js

@@ -143,6 +143,7 @@ export class SessionV3 {
     idleDeadlineMs;
     idleTimerCancel;
     terminationState = deferred();
+    terminationController = new AbortController();
     rpcRouter;
     constructor(carrier, control, controlReader, config, material) {
         this.carrier = carrier;
@@ -279,6 +280,9 @@ export class SessionV3 {
     receiveDirectionValue() {
         return this.receiveDirection;
     }
+    terminationSignal() {
+        return this.terminationController.signal;
+    }
     async sendStreamRecord(stream, type, payload, signal) {
         this.assertOpen();
         const inner = encodeInnerRecordV3(type, payload);
@@ -1192,6 +1196,7 @@ export class SessionV3 {
     fail(error, abortCarrier = true) {
         if (this.lifecycle === "closed")
             return;
+        this.terminationController.abort(error);
         this.controlTerminalSealed = true;
         this.beginClosing();
         const pendingSessionRekey = this.pendingSessionRekey;
@@ -1265,6 +1270,7 @@ class EncryptedStreamV3 {
     receiveRekey;
     sendMaterials = new Map();
     receiveMaterials = new Map();
+    receiveRekeyChanged = deferred();
     constructor(session, carrier, id, kind, sendEpoch, receiveEpoch, permitRelease, reader) {
         this.session = session;
         this.carrier = carrier;
@@ -1374,7 +1380,7 @@ class EncryptedStreamV3 {
                 await raceAbort(pending.acknowledged.promise, signal);
                 return;
             }
-            await raceAbort(new Promise((resolve) => setTimeout(resolve, 0)), signal);
+            await raceAbort(this.receiveRekeyChanged.promise, signal);
             if (this.terminalError !== undefined || this.remoteFIN)
                 return;
         }
@@ -1384,6 +1390,11 @@ class EncryptedStreamV3 {
             this.receiveRekey = undefined;
         }
     }
+    notifyReceiveRekeyChanged() {
+        const changed = this.receiveRekeyChanged;
+        this.receiveRekeyChanged = deferred();
+        changed.resolve();
+    }
     startPump() {
         if (this.pumpStarted)
             return;
@@ -1401,6 +1412,7 @@ class EncryptedStreamV3 {
         this.pendingSendRekey = undefined;
         pendingSendRekey?.armed.reject(error);
         pendingSendRekey?.done.reject(error);
+        this.notifyReceiveRekeyChanged();
         this.opened.reject(error);
         this.data.fail(error);
         return true;
@@ -1558,11 +1570,12 @@ class EncryptedStreamV3 {
         pruneRecordMaterials(this.receiveMaterials, new Set(this.priorACK === undefined ? [nextEpoch] : [header.epoch, nextEpoch]));
         const pending = { transition, epoch: nextEpoch, acknowledged: deferred() };
         this.receiveRekey = pending;
+        this.notifyReceiveRekeyChanged();
         await this.send(InnerTypeV3.StreamKeyUpdateACK, encodeStreamKeyUpdateACKV3({
             logicalStreamID: this.id,
             transition,
             epoch: nextEpoch,
-        }));
+        }), this.session.terminationSignal());
         pending.acknowledged.resolve();
     }
     receiveStreamKeyUpdateACK(payload) {