@floegence/flowersec-core 5.0.2 → 5.0.4

package/THIRD_PARTY_NOTICES.md

@@ -3,11 +3,11 @@
 This file is generated from the canonical Flowersec source dependency inventory for flowersec-ts.
 Do not edit it manually. License decisions are reviewed by the repository source license policy.
 
-- @floegence/flowersec-node-native 5.0.2 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-darwin-arm64 5.0.2 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-darwin-x64 5.0.2 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-linux-arm64-gnu 5.0.2 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-linux-x64-gnu 5.0.2 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-darwin-arm64 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-darwin-x64 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-linux-arm64-gnu 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-linux-x64-gnu 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
 - @noble/ciphers 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.4.0.tgz)
 - @noble/curves 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/curves/-/curves-2.4.0.tgz)
 - @noble/hashes 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/hashes/-/hashes-2.4.0.tgz)

package/dist/node/proxyServer.js

@@ -149,93 +149,111 @@ export class ProxyServer {
         this.#config.report?.(error);
     }
     catch { /* reporting is isolated */ } }
-    async #serveHTTP(stream, signal) {
-        const reader = new ProxyByteReader(stream, { signal });
-        let meta;
+    async #serveHTTP(stream, parentSignal) {
+        const started = performance.now();
+        const timeoutController = new AbortController();
+        let timer = setTimeout(() => timeoutController.abort(), this.#config.maxTimeout);
+        const linked = linkSignals(parentSignal, timeoutController.signal);
+        const signal = linked.signal;
+        let reset;
+        const abort = () => { reset ??= stream.reset().catch(() => undefined); };
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted)
+            abort();
         try {
-            meta = decodeHTTPMeta(await readFrame(reader, this.#config.maxJSON));
-        }
-        catch {
-            await writeHTTPError(stream, "unknown", "invalid_request_meta");
-            return;
-        }
-        const requestID = meta.request_id.trim();
-        const path = normalizePath(meta.path);
-        if (meta.v !== WIRE_VERSION || requestID === "" || meta.method.trim() === "" || path === undefined) {
-            await writeHTTPError(stream, requestID, "invalid_request_meta");
-            return;
-        }
-        const timeout = normalizeTimeout(meta.timeout_ms, this.#config.defaultTimeout, this.#config.maxTimeout);
-        if (timeout === undefined) {
-            await writeHTTPError(stream, requestID, "invalid_request_meta");
-            return;
-        }
-        const body = await readBody(reader, this.#config.maxChunk, this.#config.maxBody);
-        if (body === undefined) {
-            await writeHTTPError(stream, requestID, "request_body_invalid");
-            return;
-        }
-        const externalOrigin = validateOrigin(meta.external_origin, this.#config.allowedOrigins);
-        if (meta.external_origin !== undefined && externalOrigin === undefined) {
-            await writeHTTPError(stream, requestID, "invalid_request_meta");
-            return;
-        }
-        const requestHeaders = filterRequestHeaders(meta.headers, this.#config);
-        if (externalOrigin !== undefined) {
-            const explicitOrigin = requestHeaders.find((header) => header.name === "origin")?.value;
-            if (explicitOrigin !== undefined && explicitOrigin !== externalOrigin) {
+            const reader = new ProxyByteReader(stream, { signal });
+            let meta;
+            try {
+                meta = decodeHTTPMeta(await readFrame(reader, this.#config.maxJSON));
+            }
+            catch {
+                await writeHTTPError(stream, "unknown", "invalid_request_meta");
+                return;
+            }
+            const requestID = meta.request_id.trim();
+            const path = normalizePath(meta.path);
+            if (meta.v !== WIRE_VERSION || requestID === "" || meta.method.trim() === "" || path === undefined) {
                 await writeHTTPError(stream, requestID, "invalid_request_meta");
                 return;
             }
-            const origin = new URL(externalOrigin);
-            requestHeaders.push({ name: "x-forwarded-proto", value: origin.protocol.slice(0, -1) });
-        }
-        const headers = Object.fromEntries(requestHeaders.map((header) => [header.name, header.value]));
-        const target = new URL(path, this.#config.upstream);
-        const requestInit = {
-            method: meta.method.trim().toUpperCase(), headers, redirect: "manual", signal,
-            ...(body.byteLength === 0 ? {} : { body: body.slice().buffer, duplex: "half" }),
-        };
-        const timeoutController = new AbortController();
-        const timer = setTimeout(() => timeoutController.abort(), timeout);
-        const linked = linkSignals(signal, timeoutController.signal);
-        try {
-            requestInit.signal = linked.signal;
-            const response = await fetch(target, requestInit);
-            const contentLength = response.headers.get("content-length");
-            if (contentLength !== null && Number(contentLength) > this.#config.maxBody) {
-                await writeHTTPError(stream, requestID, "response_body_too_large");
+            const timeout = normalizeTimeout(meta.timeout_ms, this.#config.defaultTimeout, this.#config.maxTimeout);
+            if (timeout === undefined) {
+                await writeHTTPError(stream, requestID, "invalid_request_meta");
+                return;
+            }
+            clearTimeout(timer);
+            const remaining = timeout - (performance.now() - started);
+            if (remaining <= 0)
+                timeoutController.abort();
+            else
+                timer = setTimeout(() => timeoutController.abort(), remaining);
+            const body = await readBody(reader, this.#config.maxChunk, this.#config.maxBody);
+            if (body === undefined) {
+                await writeHTTPError(stream, requestID, "request_body_invalid");
+                return;
+            }
+            const externalOrigin = validateOrigin(meta.external_origin, this.#config.allowedOrigins);
+            if (meta.external_origin !== undefined && externalOrigin === undefined) {
+                await writeHTTPError(stream, requestID, "invalid_request_meta");
                 return;
             }
-            await writeFrame(stream, {
-                v: WIRE_VERSION, request_id: requestID, ok: true, status: response.status,
-                headers: filterHeaders(responseHeaderList(response.headers), RESPONSE_HEADERS, this.#config.responseHeaders, this.#config.blockedResponseHeaders),
-            }, signal);
-            let total = 0;
-            const reader = response.body?.getReader();
-            if (reader !== undefined) {
-                while (true) {
-                    const result = await reader.read();
-                    if (result.done)
-                        break;
-                    total += result.value.length;
-                    if (total > this.#config.maxBody)
-                        throw new Error("upstream response body exceeds limit");
-                    for (let offset = 0; offset < result.value.length; offset += this.#config.maxChunk) {
-                        await writeChunk(stream, result.value.subarray(offset, offset + this.#config.maxChunk), signal);
+            const requestHeaders = filterRequestHeaders(meta.headers, this.#config);
+            if (externalOrigin !== undefined) {
+                const explicitOrigin = requestHeaders.find((header) => header.name === "origin")?.value;
+                if (explicitOrigin !== undefined && explicitOrigin !== externalOrigin) {
+                    await writeHTTPError(stream, requestID, "invalid_request_meta");
+                    return;
+                }
+                const origin = new URL(externalOrigin);
+                requestHeaders.push({ name: "x-forwarded-proto", value: origin.protocol.slice(0, -1) });
+            }
+            const headers = Object.fromEntries(requestHeaders.map((header) => [header.name, header.value]));
+            const target = new URL(path, this.#config.upstream);
+            const requestInit = {
+                method: meta.method.trim().toUpperCase(), headers, redirect: "manual", signal,
+                ...(body.byteLength === 0 ? {} : { body: body.slice().buffer, duplex: "half" }),
+            };
+            try {
+                const response = await fetch(target, requestInit);
+                const contentLength = response.headers.get("content-length");
+                if (contentLength !== null && Number(contentLength) > this.#config.maxBody) {
+                    await writeHTTPError(stream, requestID, "response_body_too_large");
+                    return;
+                }
+                await writeFrame(stream, {
+                    v: WIRE_VERSION, request_id: requestID, ok: true, status: response.status,
+                    headers: filterHeaders(responseHeaderList(response.headers), RESPONSE_HEADERS, this.#config.responseHeaders, this.#config.blockedResponseHeaders),
+                }, signal);
+                let total = 0;
+                const reader = response.body?.getReader();
+                if (reader !== undefined) {
+                    while (true) {
+                        const result = await reader.read();
+                        if (result.done)
+                            break;
+                        total += result.value.length;
+                        if (total > this.#config.maxBody)
+                            throw new Error("upstream response body exceeds limit");
+                        for (let offset = 0; offset < result.value.length; offset += this.#config.maxChunk) {
+                            await writeChunk(stream, result.value.subarray(offset, offset + this.#config.maxChunk), signal);
+                        }
                     }
                 }
+                await writeChunk(stream, new Uint8Array(), signal);
+            }
+            catch (error) {
+                if (signal.aborted)
+                    throw error;
+                const code = timeoutController.signal.aborted ? "timeout" : signal.aborted ? "canceled" : "upstream_request_failed";
+                await writeHTTPError(stream, requestID, code);
+                this.#report(error);
             }
-            await writeChunk(stream, new Uint8Array(), signal);
-        }
-        catch (error) {
-            const code = timeoutController.signal.aborted ? "timeout" : signal.aborted ? "canceled" : "upstream_request_failed";
-            await writeHTTPError(stream, requestID, code);
-            this.#report(error);
         }
         finally {
             clearTimeout(timer);
             linked.dispose();
+            signal.removeEventListener("abort", abort);
+            await reset;
         }
     }
     async #serveWebSocket(stream, signal) {
@@ -457,7 +475,10 @@ function validateOrigin(value, allowed) { if (value === undefined || value === "
 catch {
     return undefined;
 } }
-function linkSignals(parent, timeout) { const controller = new AbortController(); const abort = (event) => controller.abort(event.target.reason); parent.addEventListener("abort", abort, { once: true }); timeout.addEventListener("abort", abort, { once: true }); return { signal: controller.signal, dispose: () => { parent.removeEventListener("abort", abort); timeout.removeEventListener("abort", abort); } }; }
+function linkSignals(parent, timeout) { const controller = new AbortController(); const abort = (event) => controller.abort(event.target.reason); parent.addEventListener("abort", abort, { once: true }); timeout.addEventListener("abort", abort, { once: true }); if (parent.aborted)
+    controller.abort(parent.reason);
+else if (timeout.aborted)
+    controller.abort(timeout.reason); return { signal: controller.signal, dispose: () => { parent.removeEventListener("abort", abort); timeout.removeEventListener("abort", abort); } }; }
 function decodeHTTPMeta(value) { if (!isRecord(value) || value.v !== WIRE_VERSION || typeof value.request_id !== "string" || typeof value.method !== "string" || typeof value.path !== "string" || !Array.isArray(value.headers) || (value.external_origin !== undefined && typeof value.external_origin !== "string") || (value.timeout_ms !== undefined && typeof value.timeout_ms !== "number"))
     throw new Error("invalid HTTP metadata"); return { v: value.v, request_id: value.request_id, method: value.method, path: value.path, headers: value.headers.filter(isHeader), ...(value.external_origin === undefined ? {} : { external_origin: value.external_origin }), ...(value.timeout_ms === undefined ? {} : { timeout_ms: value.timeout_ms }) }; }
 function decodeWSOpen(value) { if (!isRecord(value) || value.v !== WIRE_VERSION || typeof value.conn_id !== "string" || typeof value.path !== "string" || !Array.isArray(value.headers))

package/dist/rpc/client.d.ts

@@ -6,8 +6,9 @@ export declare class RpcClient {
     private readonly pending;
     private readonly notifyHandlers;
     private closed;
+    private writeTail;
     private readonly onTerminal;
-    constructor(readExactly: (n: number) => Promise<Uint8Array>, write: (b: Uint8Array) => Promise<void>, opts?: Readonly<{
+    constructor(readExactly: (n: number) => Promise<Uint8Array>, write: (b: Uint8Array, signal?: AbortSignal) => Promise<void>, opts?: Readonly<{
         onTerminal?: (error: Error) => void;
     }>);
     call(typeId: number, payload: unknown, signal?: AbortSignal): Promise<{
@@ -16,6 +17,7 @@ export declare class RpcClient {
     }>;
     close(): void;
     onNotify(typeId: number, handler: (payload: unknown) => void): () => void;
-    notify(typeId: number, payload: unknown): Promise<void>;
+    notify(typeId: number, payload: unknown, signal?: AbortSignal): Promise<void>;
+    private writeEnvelope;
     private readLoop;
 }

package/dist/rpc/client.js

@@ -14,6 +14,7 @@ export class RpcClient {
     notifyHandlers = new Map();
     // Closed state to stop the read loop and reject calls.
     closed = false;
+    writeTail = Promise.resolve();
     onTerminal;
     constructor(readExactly, write, opts = {}) {
         this.readExactly = readExactly;
@@ -25,6 +26,8 @@ export class RpcClient {
     async call(typeId, payload, signal) {
         if (this.closed)
             throw new Error("rpc client closed");
+        if (signal?.aborted)
+            throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
         const validatedTypeId = assertRpcTypeId(typeId);
         if (this.nextId > MAX_SAFE_REQUEST_ID)
             throw new Error("request id overflow");
@@ -39,24 +42,15 @@ export class RpcClient {
         const p = new Promise((resolve, reject) => {
             this.pending.set(requestId, { resolve, reject });
         });
-        try {
-            await writeJsonFrame(this.write, env, DEFAULT_MAX_JSON_FRAME_BYTES);
-        }
-        catch (e) {
-            this.pending.delete(requestId);
-            throw e;
-        }
-        if (signal?.aborted) {
-            this.pending.delete(requestId);
-            throw signal.reason ?? new Error("aborted");
-        }
         let resp;
         try {
-            resp = await raceAbort(p, signal);
+            // Own both rejections before either side can settle. Cancellation covers
+            // queued writes as well as the response wait.
+            const result = await raceAbort(Promise.all([this.writeEnvelope(env, signal), p]), signal);
+            resp = result[1];
         }
-        catch (e) {
+        finally {
             this.pending.delete(requestId);
-            throw e;
         }
         if (resp.error == null)
             return { payload: resp.payload };
@@ -84,7 +78,7 @@ export class RpcClient {
         };
     }
     // notify sends a one-way notification to the peer.
-    async notify(typeId, payload) {
+    async notify(typeId, payload, signal) {
         if (this.closed)
             throw new Error("rpc client closed");
         const validatedTypeId = assertRpcTypeId(typeId);
@@ -94,7 +88,18 @@ export class RpcClient {
             response_to: 0,
             payload
         };
-        await writeJsonFrame(this.write, env, DEFAULT_MAX_JSON_FRAME_BYTES);
+        await raceAbort(this.writeEnvelope(env, signal), signal);
+    }
+    writeEnvelope(envelope, signal) {
+        const operation = this.writeTail.then(async () => {
+            if (signal?.aborted)
+                throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+            if (this.closed)
+                throw new Error("rpc client closed");
+            await writeJsonFrame((bytes) => this.write(bytes, signal), envelope, DEFAULT_MAX_JSON_FRAME_BYTES);
+        });
+        this.writeTail = operation.catch(() => undefined);
+        return operation;
     }
     async readLoop() {
         try {
@@ -144,6 +149,7 @@ export class RpcClient {
 }
 // raceAbort resolves p unless the signal aborts first.
 async function raceAbort(p, signal) {
+    void p.catch(() => undefined);
     if (signal == null)
         return p;
     if (signal.aborted)

package/dist/v3/contract.d.ts

@@ -56,7 +56,7 @@ export interface InternalRpcPeerV3 {
         payload: unknown;
         error?: RpcError;
     }>;
-    notify(typeId: number, payload: unknown): Promise<void>;
+    notify(typeId: number, payload: unknown, signal?: AbortSignal): Promise<void>;
     onNotify(typeId: number, handler: (payload: unknown) => void): () => void;
     close(): void;
 }

package/dist/v3/publicSession.js

@@ -152,7 +152,7 @@ function projectRpcPeerV3(peer, notificationOwner) {
                 assertJsonValue(payload);
                 if (options?.signal?.aborted)
                     throw options.signal.reason ?? new DOMException("The operation was aborted", "AbortError");
-                await raceWithSignal(peer.notify(typeId, payload), options?.signal);
+                await raceWithSignal(peer.notify(typeId, payload, options?.signal), options?.signal);
             }
             catch (error) {
                 throw redactSessionError(error);

package/dist/v3/session.d.ts

@@ -57,7 +57,7 @@ declare class SessionRpcPeerV3 implements InternalRpcPeerV3 {
         payload: unknown;
         error?: import("../rpc/wire.js").RpcError;
     }>;
-    notify(typeId: number, payload: unknown): Promise<void>;
+    notify(typeId: number, payload: unknown, signal?: AbortSignal): Promise<void>;
     onNotify(typeId: number, handler: (payload: unknown) => void): () => void;
     close(): void;
 }

package/dist/v3/session.js

@@ -33,8 +33,8 @@ class SessionRpcPeerV3 {
     call(typeId, payload, signal) {
         return this.outbound.call(typeId, payload, signal);
     }
-    notify(typeId, payload) {
-        return this.outbound.notify(typeId, payload);
+    notify(typeId, payload, signal) {
+        return this.outbound.notify(typeId, payload, signal);
     }
     onNotify(typeId, handler) {
         return this.inbound.onNotify(typeId, handler);
@@ -188,10 +188,10 @@ export class SessionV3 {
             const stream = await this.ensureRPCStream();
             rpcReadState.reader ??= new ExactReader(stream);
             return await rpcReadState.reader.readExactly(length);
-        }, async (payload) => {
+        }, async (payload, signal) => {
             this.rpcActivation.resolve();
             const stream = await this.ensureRPCStream();
-            await stream.write(payload);
+            await stream.write(payload, signal === undefined ? {} : { signal });
         }, { onTerminal: (error) => this.fail(error) });
         this.rpc = new SessionRpcPeerV3(rpcClient, this.rpcRouter);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "5.0.2",
+  "version": "5.0.4",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {
@@ -95,7 +95,7 @@
     "vitest": "4.1.11"
   },
   "optionalDependencies": {
-    "@floegence/flowersec-node-native": "5.0.2"
+    "@floegence/flowersec-node-native": "5.0.4"
   },
-  "flowersecSourceCommit": "cca9f235e01df9970fd51f89ddbe4b3f34638ac7"
+  "flowersecSourceCommit": "c7f7ef0ab82ca329703bd727433075f2996f1127"
 }

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a8485900-cd6f-537e-845f-57e3364869e6",
+  "serialNumber": "urn:uuid:6039ab01-9a2a-5a20-87ae-899bb738f3d0",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "5.0.2",
-      "purl": "pkg:npm/%40floegence/flowersec-core@5.0.2",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@5.0.2"
+      "version": "5.0.4",
+      "purl": "pkg:npm/%40floegence/flowersec-core@5.0.4",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@5.0.4"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "c6e5b1e0decb548a26303cf750bea8331a58853ca8666992c84adca0d747eb0d"
+        "value": "1d811c3e752603c670a7bd1edb9032d5ebc3bbb8e7dad0c537b40e0fd7c157d8"
       }
     ]
   },
@@ -22,9 +22,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native",
-      "version": "5.0.2",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native@5.0.2",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.2",
+      "version": "5.0.4",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
       "licenses": [
         {
           "expression": "MIT"
@@ -50,9 +50,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-darwin-arm64",
-      "version": "5.0.2",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.2",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.2",
+      "version": "5.0.4",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
       "licenses": [
         {
           "expression": "MIT"
@@ -78,9 +78,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-darwin-x64",
-      "version": "5.0.2",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.2",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.2",
+      "version": "5.0.4",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
       "licenses": [
         {
           "expression": "MIT"
@@ -106,9 +106,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-linux-arm64-gnu",
-      "version": "5.0.2",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.2",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.2",
+      "version": "5.0.4",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
       "licenses": [
         {
           "expression": "MIT"
@@ -134,9 +134,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-linux-x64-gnu",
-      "version": "5.0.2",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.2",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.2",
+      "version": "5.0.4",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4",
       "licenses": [
         {
           "expression": "MIT"
@@ -330,9 +330,9 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@5.0.2",
+      "ref": "pkg:npm/%40floegence/flowersec-core@5.0.4",
       "dependsOn": [
-        "pkg:npm/%40floegence/flowersec-node-native@5.0.2",
+        "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
         "pkg:npm/%40noble/ciphers@2.4.0",
         "pkg:npm/%40noble/curves@2.4.0",
         "pkg:npm/%40noble/hashes@2.4.0",
@@ -341,28 +341,28 @@
       ]
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.2",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
       "dependsOn": [
-        "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.2",
-        "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.2",
-        "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.2",
-        "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.2"
+        "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
+        "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
+        "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
+        "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4"
       ]
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.2",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.2",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.2",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.2",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4",
       "dependsOn": []
     },
     {

package/sbom/spdx.json

@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "flowersec-ts",
-  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/c6e5b1e0decb548a26303cf750bea8331a58853ca8666992c84adca0d747eb0d",
+  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/1d811c3e752603c670a7bd1edb9032d5ebc3bbb8e7dad0c537b40e0fd7c157d8",
   "creationInfo": {
     "created": "2026-09-04T01:34:01Z",
     "creators": [
@@ -13,26 +13,26 @@
   "packages": [
     {
       "name": "@floegence/flowersec-core",
-      "SPDXID": "SPDXRef-Package-53cfe9ccbbe852c310ad",
-      "versionInfo": "5.0.2",
+      "SPDXID": "SPDXRef-Package-76f76655df85108ee0d0",
+      "versionInfo": "5.0.4",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "NOASSERTION",
       "copyrightText": "NOASSERTION",
-      "comment": "Flowersec source inventory SHA-256: c6e5b1e0decb548a26303cf750bea8331a58853ca8666992c84adca0d747eb0d",
+      "comment": "Flowersec source inventory SHA-256: 1d811c3e752603c670a7bd1edb9032d5ebc3bbb8e7dad0c537b40e0fd7c157d8",
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@5.0.2"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@5.0.4"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native",
-      "SPDXID": "SPDXRef-Package-eb6d85d4320af38c1b4e",
-      "versionInfo": "5.0.2",
+      "SPDXID": "SPDXRef-Package-eaba5905b7c607ccf435",
+      "versionInfo": "5.0.4",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -42,14 +42,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native@5.0.2"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native@5.0.4"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-darwin-arm64",
-      "SPDXID": "SPDXRef-Package-f140cc71c9fce4662541",
-      "versionInfo": "5.0.2",
+      "SPDXID": "SPDXRef-Package-7c37536aff97144c437d",
+      "versionInfo": "5.0.4",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -59,14 +59,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.2"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-darwin-x64",
-      "SPDXID": "SPDXRef-Package-f8e487bdb4a6822e7793",
-      "versionInfo": "5.0.2",
+      "SPDXID": "SPDXRef-Package-810d8647e49cab312ddf",
+      "versionInfo": "5.0.4",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -76,14 +76,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.2"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-linux-arm64-gnu",
-      "SPDXID": "SPDXRef-Package-8fa54d6560a54d673e83",
-      "versionInfo": "5.0.2",
+      "SPDXID": "SPDXRef-Package-16ea1010a290d52cbeae",
+      "versionInfo": "5.0.4",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -93,14 +93,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.2"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-linux-x64-gnu",
-      "SPDXID": "SPDXRef-Package-463a5df61f8d45fceba9",
-      "versionInfo": "5.0.2",
+      "SPDXID": "SPDXRef-Package-9f150aef88bc8208a2ed",
+      "versionInfo": "5.0.4",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -110,7 +110,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.2"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4"
         }
       ]
     },
@@ -221,57 +221,57 @@
     {
       "spdxElementId": "SPDXRef-DOCUMENT",
       "relationshipType": "DESCRIBES",
-      "relatedSpdxElement": "SPDXRef-Package-53cfe9ccbbe852c310ad"
+      "relatedSpdxElement": "SPDXRef-Package-76f76655df85108ee0d0"
     },
     {
-      "spdxElementId": "SPDXRef-Package-53cfe9ccbbe852c310ad",
+      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-eb6d85d4320af38c1b4e"
+      "relatedSpdxElement": "SPDXRef-Package-eaba5905b7c607ccf435"
     },
     {
-      "spdxElementId": "SPDXRef-Package-53cfe9ccbbe852c310ad",
+      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-6cdb8b3664bfb0d67b6a"
     },
     {
-      "spdxElementId": "SPDXRef-Package-53cfe9ccbbe852c310ad",
+      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-e0e2cb449dffb239a794"
     },
     {
-      "spdxElementId": "SPDXRef-Package-53cfe9ccbbe852c310ad",
+      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-2e6e3840217975457b7a"
     },
     {
-      "spdxElementId": "SPDXRef-Package-53cfe9ccbbe852c310ad",
+      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-5b9d78698ec0a5c8f86f"
     },
     {
-      "spdxElementId": "SPDXRef-Package-53cfe9ccbbe852c310ad",
+      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-b779412f685822663496"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eb6d85d4320af38c1b4e",
+      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-f140cc71c9fce4662541"
+      "relatedSpdxElement": "SPDXRef-Package-7c37536aff97144c437d"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eb6d85d4320af38c1b4e",
+      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-f8e487bdb4a6822e7793"
+      "relatedSpdxElement": "SPDXRef-Package-810d8647e49cab312ddf"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eb6d85d4320af38c1b4e",
+      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-8fa54d6560a54d673e83"
+      "relatedSpdxElement": "SPDXRef-Package-16ea1010a290d52cbeae"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eb6d85d4320af38c1b4e",
+      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-463a5df61f8d45fceba9"
+      "relatedSpdxElement": "SPDXRef-Package-9f150aef88bc8208a2ed"
     },
     {
       "spdxElementId": "SPDXRef-Package-e0e2cb449dffb239a794",