@floegence/flowersec-core 5.0.4 → 5.0.5

package/THIRD_PARTY_NOTICES.md

@@ -3,11 +3,11 @@
 This file is generated from the canonical Flowersec source dependency inventory for flowersec-ts.
 Do not edit it manually. License decisions are reviewed by the repository source license policy.
 
-- @floegence/flowersec-node-native 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-darwin-arm64 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-darwin-x64 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-linux-arm64-gnu 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-linux-x64-gnu 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native 5.0.5 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-darwin-arm64 5.0.5 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-darwin-x64 5.0.5 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-linux-arm64-gnu 5.0.5 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-linux-x64-gnu 5.0.5 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
 - @noble/ciphers 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.4.0.tgz)
 - @noble/curves 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/curves/-/curves-2.4.0.tgz)
 - @noble/hashes 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/hashes/-/hashes-2.4.0.tgz)

package/dist/browser/connectSessionV3.js

@@ -2,14 +2,16 @@ import { SDK_DEFAULTS } from "../defaults.js";
 import { claimArtifactLeaseV3, retireArtifactLeaseV3, } from "../v3/artifactLease.js";
 import { createConnectionControllerV3 as createCoreControllerV3, } from "../v3/connectionController.js";
 import { BrowserRuntimeCapabilityRegistryV3, createBrowserWebTransportCarrierV3, } from "../v3/browserRuntime.js";
-import { attemptClaimedArtifactLeaseV3, connectArtifactLeaseV3 } from "../v3/sessionConnector.js";
+import { attemptClaimedArtifactLeaseV3, connectArtifactLeaseWithRuntimeV3, } from "../v3/sessionConnector.js";
 import { readyNativeAdmissionV3, readyWebSocketAdmissionV3 } from "../v3/runtimeAdapters.js";
 import { TransportFailureV3, ConnectErrorV3 } from "../v3/security.js";
 import { browserSessionRuntimeV3 } from "../v3/browserSessionRuntime.js";
 import { unwrapPrivateLoopbackArtifactLeaseV1, validatePrivateLoopbackOriginV1, } from "./privateLoopbackV1.js";
 export async function connectV3(lease, options = {}) {
-    const registry = await BrowserRuntimeCapabilityRegistryV3.create();
-    return await connectArtifactLeaseV3(lease, browserRuntime(registry, options.connectTimeoutMs), options.signal);
+    return await connectArtifactLeaseWithRuntimeV3(lease, options, async () => {
+        const registry = await BrowserRuntimeCapabilityRegistryV3.create();
+        return browserRuntime(registry, options.connectTimeoutMs);
+    });
 }
 export async function createConnectionControllerV3(source, options = {}) {
     const registry = await BrowserRuntimeCapabilityRegistryV3.create();
@@ -22,14 +24,15 @@ export async function createConnectionControllerV3(source, options = {}) {
     return createCoreControllerV3(source, async (context) => await attemptClaimedArtifactLeaseV3(context, runtime), coreOptions);
 }
 export async function connectPrivateLoopbackV1(lease, options) {
-    const privateOrigin = requirePrivateLoopbackOrigin(options.origin);
     const unwrapped = unwrapPrivateLoopbackLease(lease);
-    if (new URL(unwrapped.endpoint).origin.replace(/^ws:/, "http:") !== privateOrigin) {
-        await retireInnerLease(unwrapped.innerLease);
-        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
-    }
-    const registry = await BrowserRuntimeCapabilityRegistryV3.create();
-    return await connectArtifactLeaseV3(unwrapped.innerLease, privateLoopbackBrowserRuntime(registry, options.connectTimeoutMs, privateOrigin), options.signal);
+    return await connectArtifactLeaseWithRuntimeV3(unwrapped.innerLease, options, async () => {
+        const privateOrigin = requirePrivateLoopbackOrigin(options.origin);
+        if (new URL(unwrapped.endpoint).origin.replace(/^ws:/, "http:") !== privateOrigin) {
+            throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+        }
+        const registry = await BrowserRuntimeCapabilityRegistryV3.create();
+        return privateLoopbackBrowserRuntime(registry, options.connectTimeoutMs, privateOrigin);
+    });
 }
 export async function createPrivateLoopbackConnectionControllerV1(source, options) {
     const privateOrigin = requirePrivateLoopbackOrigin(options.origin);

package/dist/node/connectSessionV3.js

@@ -1,7 +1,7 @@
 import { SDK_DEFAULTS } from "../defaults.js";
 import { createConnectionControllerV3 as createCoreControllerV3, } from "../v3/connectionController.js";
 import { connectNodeWebSocketV3, detectNodeRuntimeCapabilityV3, } from "../v3/nodeRuntime.js";
-import { attemptClaimedArtifactLeaseV3, connectArtifactLeaseV3 } from "../v3/sessionConnector.js";
+import { attemptClaimedArtifactLeaseV3, connectArtifactLeaseWithRuntimeV3, } from "../v3/sessionConnector.js";
 import { readyNativeAdmissionV3, readyWebSocketAdmissionV3 } from "../v3/runtimeAdapters.js";
 import { ConnectErrorV3, TransportFailureV3 } from "../v3/security.js";
 import { nodeSessionRuntimeV3 } from "../v3/nodeSessionRuntime.js";
@@ -9,7 +9,7 @@ import { createNativeRawQuicDriver, tryLoadNativeTransportAddon, } from "./nativ
 import { createNodeRawQuicClientV3 } from "./rawQuicAdapterV3.js";
 import { createRPCRouter, freezeRPCHandlers, } from "./acceptor.js";
 export async function connectV3(lease, options) {
-    return await connectArtifactLeaseV3(lease, nodeRuntime(options), options.signal);
+    return await connectArtifactLeaseWithRuntimeV3(lease, options, () => nodeRuntime(options));
 }
 export function createConnectionControllerV3(source, options) {
     const runtime = nodeRuntime(options);
@@ -37,6 +37,7 @@ function nodeRuntime(options) {
     }
     return {
         capabilitySnapshot: () => capability,
+        candidateEligible: (candidate) => candidate.carrier !== "websocket" || options.origin !== undefined,
         connectTimeoutMilliseconds,
         protocolRuntime: nodeSessionRuntimeV3,
         ...(rpcSnapshot === undefined ? {} : { createRPCRouter: () => createRPCRouter(rpcSnapshot) }),

package/dist/node/proxyServer.js

@@ -28,6 +28,7 @@ export class ProxyServerError extends Error {
 export class ProxyServer {
     #config;
     #active = new Set();
+    #abortLinks = new WeakMap();
     #permits = new Set();
     #completion;
     #resolveCompletion;
@@ -132,15 +133,20 @@ export class ProxyServer {
             return controller;
         }
         if (parent !== undefined) {
+            const abort = () => controller.abort(parent.reason);
             if (parent.aborted)
-                controller.abort(parent.reason);
-            else
-                parent.addEventListener("abort", () => controller.abort(parent.reason), { once: true });
+                abort();
+            else {
+                parent.addEventListener("abort", abort, { once: true });
+                this.#abortLinks.set(controller, () => parent.removeEventListener("abort", abort));
+            }
         }
         this.#active.add(controller);
         return controller;
     }
     #untrack(controller) {
+        this.#abortLinks.get(controller)?.();
+        this.#abortLinks.delete(controller);
         this.#active.delete(controller);
         if (this.#closed && this.#active.size === 0)
             this.#resolveCompletion();

package/dist/rpc/client.js

@@ -106,11 +106,14 @@ export class RpcClient {
             while (!this.closed) {
                 const v = assertRpcEnvelope(await readJsonFrame(this.readExactly, DEFAULT_MAX_JSON_FRAME_BYTES));
                 if (v.response_to === 0) {
-                    // Notification: response_to=0 and request_id=0.
-                    if (v.request_id === 0) {
-                        const set = this.notifyHandlers.get(v.type_id);
-                        if (set != null) {
-                            for (const h of set) {
+                    if (v.request_id !== 0) {
+                        throw new Error("rpc invalid request on client stream");
+                    }
+                    const set = this.notifyHandlers.get(v.type_id);
+                    if (set != null) {
+                        const handlers = [...set];
+                        setTimeout(() => {
+                            for (const h of handlers) {
                                 try {
                                     h(v.payload);
                                 }
@@ -118,7 +121,7 @@ export class RpcClient {
                                     // User handlers should not be able to take down the transport read loop.
                                 }
                             }
-                        }
+                        });
                     }
                     continue;
                 }

package/dist/v3/artifact.js

@@ -623,7 +623,7 @@ function normalizeAuthority(authority) {
             portText = tail.slice(1);
         }
         if (host.includes("."))
-            throw invalidCandidate("IPv6 dotted subset");
+            throw invalidCandidate("embedded IPv4");
         let parsed;
         try {
             parsed = new URL(`http://[${host}]/`);

package/dist/v3/nodeRuntime.js

@@ -33,9 +33,35 @@ export async function connectNodeTLSSocketV3(candidate, attemptNowUnixSeconds, o
         ALPNProtocols: ["http/1.1"],
         secureOptions: constants.SSL_OP_NO_TICKET,
         rejectUnauthorized: policy.mode === "ca",
-        ...(isIPAddress(host)
-            ? { checkServerIdentity: (_servername, certificate) => tlsCheckServerIdentity(host, certificate) }
-            : { servername: host }),
+        ...(policy.mode === "ca"
+            ? (isIPAddress(host)
+                ? { checkServerIdentity: (_servername, certificate) => {
+                        const subjectAltName = certificate.subjectaltname;
+                        if (typeof subjectAltName !== "string" || !/(?:^|,\s*)(?:DNS|IP Address):/.test(subjectAltName)) {
+                            return Object.assign(new Error("certificate is missing a DNS-ID or IP-ID subjectAltName"), {
+                                code: "ERR_TLS_CERT_ALTNAME_INVALID",
+                            });
+                        }
+                        return tlsCheckServerIdentity(host, certificate);
+                    } }
+                : {
+                    servername: host,
+                    checkServerIdentity: (_servername, certificate) => {
+                        // Node's historical hostname verifier may fall back to CN when the
+                        // certificate has no subjectAltName. Transport v3 requires a DNS-ID
+                        // or IP-ID SAN; CN alone is never an identity proof.
+                        const subjectAltName = certificate.subjectaltname;
+                        if (typeof subjectAltName !== "string" || !/(?:^|,\s*)(?:DNS|IP Address):/.test(subjectAltName)) {
+                            return Object.assign(new Error("certificate is missing a DNS-ID or IP-ID subjectAltName"), {
+                                code: "ERR_TLS_CERT_ALTNAME_INVALID",
+                            });
+                        }
+                        return tlsCheckServerIdentity(host, certificate);
+                    },
+                })
+            : isIPAddress(host)
+                ? { checkServerIdentity: (_servername, certificate) => tlsCheckServerIdentity(host, certificate) }
+                : { servername: host }),
         ...(policy.mode === "ca" && options.roots !== undefined ? { ca: options.roots } : {}),
     };
     const timeout = options.timeoutMilliseconds ?? 10_000;
@@ -64,7 +90,7 @@ export async function connectNodeTLSSocketV3(candidate, attemptNowUnixSeconds, o
             if (policy.mode === "ca" && isNodeCertificateTrustErrorV3(error.code)) {
                 fail(new TransportFailureV3("tls_failed", "ca_untrusted", error));
             }
-            else if (policy.mode === "pin" && isTLSProtocolError(error.code)) {
+            else if (isTLSProtocolError(error.code)) {
                 fail(new TransportFailureV3("tls_failed", "unknown", error));
             }
             else {
@@ -89,6 +115,12 @@ export async function connectNodeTLSSocketV3(candidate, attemptNowUnixSeconds, o
             }
             settled = true;
             cleanup();
+            // Keep a settled error sink attached until close. A live TLSSocket may
+            // emit asynchronous errors after the handshake; letting those escape
+            // without a listener turns a recoverable socket failure into an
+            // uncaught Node process error.
+            socket.on("error", onError);
+            socket.once("close", () => socket.removeListener("error", onError));
             resolve(socket);
         });
         if (options.signal?.aborted === true)

package/dist/v3/session.js

@@ -460,7 +460,7 @@ export class SessionV3 {
             while (this.lifecycle === "open") {
                 const carrierStream = await this.carrier.acceptStream();
                 void this.acceptCarrierStream(carrierStream).catch((error) => {
-                    void carrierStream.reset();
+                    void carrierStream.reset().catch(() => undefined);
                     if (error instanceof StreamLifetimeLedgerV3Error && error.code === "duplicate") {
                         this.fail(protocolError(error.message));
                     }

package/dist/v3/sessionConnector.d.ts

@@ -26,6 +26,7 @@ export type ReadyAdmissionTransportV3 = Readonly<{
 export type CandidateDialerV3 = (candidate: CanonicalArtifactCandidateV3, artifact: ArtifactV3, attemptNowUnixSeconds: number, capability: RuntimeCapabilityDescriptorV3, signal: AbortSignal) => Promise<ReadyAdmissionTransportV3>;
 export type SessionConnectorRuntimeV3 = Readonly<{
     capabilitySnapshot(): RuntimeCapabilityDescriptorV3;
+    candidateEligible?: (candidate: CanonicalArtifactCandidateV3) => boolean;
     dial: CandidateDialerV3;
     protocolRuntime: SessionProtocolRuntimeV3;
     connectTimeoutMilliseconds?: number;
@@ -34,4 +35,8 @@ export type SessionConnectorRuntimeV3 = Readonly<{
     deadlineFactory?: SessionDeadlineFactoryV3;
 }>;
 export declare function connectArtifactLeaseV3(lease: ArtifactLeaseV3, runtime: SessionConnectorRuntimeV3, signal?: AbortSignal): Promise<Session>;
+export declare function connectArtifactLeaseWithRuntimeV3(lease: ArtifactLeaseV3, options: Readonly<{
+    connectTimeoutMs?: number;
+    signal?: AbortSignal;
+}>, createRuntime: (signal: AbortSignal) => SessionConnectorRuntimeV3 | Promise<SessionConnectorRuntimeV3>): Promise<Session>;
 export declare function attemptClaimedArtifactLeaseV3(context: LeaseAttemptContextV3, runtime: SessionConnectorRuntimeV3): Promise<LeaseAttemptResultV3<Session>>;

package/dist/v3/sessionConnector.js

@@ -15,7 +15,58 @@ export async function connectArtifactLeaseV3(lease, runtime, signal) {
     catch {
         throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
     }
-    const artifact = claimedArtifactV3(claim);
+    return await connectClaimedArtifactLeaseV3(claim, runtime, signal);
+}
+export async function connectArtifactLeaseWithRuntimeV3(lease, options, createRuntime) {
+    let claim;
+    try {
+        claim = claimArtifactLeaseV3(lease);
+    }
+    catch {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
+    let timeout;
+    let signal;
+    try {
+        timeout = normalizeConnectTimeoutMilliseconds(options.connectTimeoutMs);
+        signal = options.signal;
+    }
+    catch (error) {
+        await retireArtifactLeaseV3(claim);
+        throw publicPreSpendError(error);
+    }
+    const controller = new AbortController();
+    const unlink = linkPublicConnectAbort(signal, controller);
+    const timer = setTimeout(() => controller.abort(new ConnectErrorV3("connection_failed", { kind: "retryable" })), timeout);
+    try {
+        throwIfAborted(controller.signal);
+        let runtime;
+        try {
+            runtime = await raceAbort(Promise.resolve().then(() => createRuntime(controller.signal)), controller.signal);
+        }
+        catch (error) {
+            throw publicPreSpendError(error);
+        }
+        return await connectClaimedArtifactLeaseV3(claim, { ...runtime, connectTimeoutMilliseconds: timeout }, controller.signal, true);
+    }
+    catch (error) {
+        if (artifactLeaseStateV3(claim) === "claimed")
+            await retireArtifactLeaseV3(claim);
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+        unlink();
+    }
+}
+async function connectClaimedArtifactLeaseV3(claim, runtime, signal, deadlineStarted = false) {
+    let artifact;
+    try {
+        artifact = claimedArtifactV3(claim);
+    }
+    catch {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
     const now = runtime.nowUnixSeconds ?? (() => Math.floor(Date.now() / 1_000));
     let capability;
     let candidates;
@@ -33,7 +84,7 @@ export async function connectArtifactLeaseV3(lease, runtime, signal) {
     const controller = new AbortController();
     const unlink = linkAbort(signal, controller);
     try {
-        const result = await attemptClaimedArtifactLeaseV3({
+        const context = {
             kind: "primary",
             artifact,
             candidates,
@@ -41,7 +92,10 @@ export async function connectArtifactLeaseV3(lease, runtime, signal) {
             signal: controller.signal,
             capability,
             assertArtifactFresh: () => assertArtifactFresh(artifact, now),
-        }, runtime);
+        };
+        const result = deadlineStarted
+            ? await attemptClaimedArtifactLeaseUnderSignalV3(context, runtime)
+            : await attemptClaimedArtifactLeaseV3(context, runtime);
         if (result.kind === "established")
             return result.session;
         if (artifactLeaseStateV3(claim) === "claimed")
@@ -70,8 +124,17 @@ export async function attemptClaimedArtifactLeaseV3(context, runtime) {
     const unlink = linkConnectAttemptAbort(context.signal, controller);
     const timer = setTimeout(() => controller.abort(new ConnectErrorV3("connection_failed", { kind: "retryable" })), timeoutMilliseconds);
     try {
-        throwIfAborted(controller.signal);
-        return await attemptClaimedArtifactLeaseWithinDeadlineV3({ ...context, signal: controller.signal }, runtime);
+        return await attemptClaimedArtifactLeaseUnderSignalV3({ ...context, signal: controller.signal }, runtime);
+    }
+    finally {
+        clearTimeout(timer);
+        unlink();
+    }
+}
+async function attemptClaimedArtifactLeaseUnderSignalV3(context, runtime) {
+    try {
+        throwIfAborted(context.signal);
+        return await attemptClaimedArtifactLeaseWithinDeadlineV3(context, runtime);
     }
     catch (error) {
         const projected = error instanceof ConnectErrorV3
@@ -81,10 +144,6 @@ export async function attemptClaimedArtifactLeaseV3(context, runtime) {
             ? { kind: "pre_spend_failure", error: projected }
             : { kind: "post_spend_failure", error: projected };
     }
-    finally {
-        clearTimeout(timer);
-        unlink();
-    }
 }
 async function attemptClaimedArtifactLeaseWithinDeadlineV3(context, runtime) {
     const role = context.artifact.path.kind === "tunnel" && context.artifact.path.role === 2
@@ -115,6 +174,10 @@ async function attemptClaimedArtifactLeaseWithinDeadlineV3(context, runtime) {
     }
     for (const [index, candidate] of context.candidates.entries()) {
         throwIfAborted(context.signal);
+        if (runtime.candidateEligible?.(candidate) === false) {
+            failures.push({ candidate, failure: new TransportFailureV3("tls_unsupported") });
+            continue;
+        }
         if (!supportsCandidateSecurityV3(context.capability, candidate.carrier, context.artifact.path.kind, role, candidate.tls.mode)) {
             failures.push({ candidate, failure: new TransportFailureV3("tls_unsupported") });
             continue;
@@ -378,6 +441,16 @@ function linkConnectAttemptAbort(parent, child) {
         parent.addEventListener("abort", abort, { once: true });
     return () => parent.removeEventListener("abort", abort);
 }
+function linkPublicConnectAbort(parent, child) {
+    if (parent === undefined)
+        return () => undefined;
+    const abort = () => child.abort(new ConnectErrorV3("connection_failed", { kind: "terminal" }));
+    if (parent.aborted)
+        abort();
+    else
+        parent.addEventListener("abort", abort, { once: true });
+    return () => parent.removeEventListener("abort", abort);
+}
 function throwIfAborted(signal) {
     if (signal.aborted)
         throw signal.reason;

package/dist/v3/unreliableMessage.js

@@ -247,7 +247,8 @@ function throwIfAborted(signal) {
 }
 function isAbortError(error) {
     return error instanceof DOMException && error.name === "AbortError" ||
-        error instanceof Error && error.name === "AbortError";
+        error instanceof Error && (error.name === "AbortError" ||
+            error.code === "aborted");
 }
 function labelWith(label, ...parts) {
     return concat(encoder.encode(label), byte(0), ...parts);

package/dist/v3/webTransportCarrier.js

@@ -188,22 +188,40 @@ class WebTransportCarrierStreamAdapter {
     stopSendingPromise;
     resetPromise;
     released = false;
+    pendingRead = false;
     constructor(stream, onRelease) {
         this.onRelease = onRelease;
         this.reader = stream.readable.getReader();
         this.writer = stream.writable.getWriter();
     }
-    async read(options = {}) {
+    async read(_options = {}) {
         this.assertReadable();
         if (this.readClosed)
             return null;
-        const result = await carrierCall(raceAbort(this.reader.read(), options.signal), "WebTransport stream read failed", "reset");
-        if (result.done || result.value === undefined) {
-            this.readClosed = true;
-            this.releaseIfComplete();
-            return null;
+        this.pendingRead = true;
+        try {
+            const result = await carrierCall(this.reader.read(), "WebTransport stream read failed", "reset");
+            if (result.done || result.value === undefined) {
+                this.readClosed = true;
+                this.releaseIfComplete();
+                return null;
+            }
+            return result.value.slice();
+        }
+        finally {
+            this.pendingRead = false;
         }
-        return result.value.slice();
+    }
+    cancelPending() {
+        if (this.terminalError !== undefined || !this.pendingRead) {
+            if (!this.pendingRead && this.terminalError === undefined)
+                this.abort(abortedCarrierError());
+            return;
+        }
+        this.readClosed = true;
+        void this.reader.cancel(abortedCarrierError()).catch(() => undefined).finally(() => {
+            this.releaseIfComplete();
+        });
     }
     async write(data) {
         this.assertNotTerminal();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "5.0.4",
+  "version": "5.0.5",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {
@@ -95,7 +95,7 @@
     "vitest": "4.1.11"
   },
   "optionalDependencies": {
-    "@floegence/flowersec-node-native": "5.0.4"
+    "@floegence/flowersec-node-native": "5.0.5"
   },
-  "flowersecSourceCommit": "c7f7ef0ab82ca329703bd727433075f2996f1127"
+  "flowersecSourceCommit": "9ce4dcaa09c33b7c07261575768ee78b3170bbec"
 }

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6039ab01-9a2a-5a20-87ae-899bb738f3d0",
+  "serialNumber": "urn:uuid:e3cc825d-1afc-5661-8afa-202f2c82d8b5",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-core@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@5.0.4"
+      "version": "5.0.5",
+      "purl": "pkg:npm/%40floegence/flowersec-core@5.0.5",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@5.0.5"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "1d811c3e752603c670a7bd1edb9032d5ebc3bbb8e7dad0c537b40e0fd7c157d8"
+        "value": "f52ee88ce9361e3a5f87dfa29bbc3f70c025c20fb2a0b274cf90e88a5f773f50"
       }
     ]
   },
@@ -22,9 +22,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
+      "version": "5.0.5",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native@5.0.5",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.5",
       "licenses": [
         {
           "expression": "MIT"
@@ -50,9 +50,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-darwin-arm64",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
+      "version": "5.0.5",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.5",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.5",
       "licenses": [
         {
           "expression": "MIT"
@@ -78,9 +78,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-darwin-x64",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
+      "version": "5.0.5",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.5",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.5",
       "licenses": [
         {
           "expression": "MIT"
@@ -106,9 +106,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-linux-arm64-gnu",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
+      "version": "5.0.5",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.5",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.5",
       "licenses": [
         {
           "expression": "MIT"
@@ -134,9 +134,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-linux-x64-gnu",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4",
+      "version": "5.0.5",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.5",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.5",
       "licenses": [
         {
           "expression": "MIT"
@@ -330,9 +330,9 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-core@5.0.5",
       "dependsOn": [
-        "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
+        "pkg:npm/%40floegence/flowersec-node-native@5.0.5",
         "pkg:npm/%40noble/ciphers@2.4.0",
         "pkg:npm/%40noble/curves@2.4.0",
         "pkg:npm/%40noble/hashes@2.4.0",
@@ -341,28 +341,28 @@
       ]
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.5",
       "dependsOn": [
-        "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
-        "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
-        "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
-        "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4"
+        "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.5",
+        "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.5",
+        "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.5",
+        "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.5"
       ]
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.5",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.5",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.5",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.5",
       "dependsOn": []
     },
     {

package/sbom/spdx.json

@@ -3,9 +3,9 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "flowersec-ts",
-  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/1d811c3e752603c670a7bd1edb9032d5ebc3bbb8e7dad0c537b40e0fd7c157d8",
+  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/f52ee88ce9361e3a5f87dfa29bbc3f70c025c20fb2a0b274cf90e88a5f773f50",
   "creationInfo": {
-    "created": "2026-09-04T01:34:01Z",
+    "created": "2026-09-07T04:29:43Z",
     "creators": [
       "Tool: flowersec-source-inventory-1"
     ]
@@ -13,26 +13,26 @@
   "packages": [
     {
       "name": "@floegence/flowersec-core",
-      "SPDXID": "SPDXRef-Package-76f76655df85108ee0d0",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-453dd3dbe8557f33f1ac",
+      "versionInfo": "5.0.5",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "NOASSERTION",
       "copyrightText": "NOASSERTION",
-      "comment": "Flowersec source inventory SHA-256: 1d811c3e752603c670a7bd1edb9032d5ebc3bbb8e7dad0c537b40e0fd7c157d8",
+      "comment": "Flowersec source inventory SHA-256: f52ee88ce9361e3a5f87dfa29bbc3f70c025c20fb2a0b274cf90e88a5f773f50",
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@5.0.5"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native",
-      "SPDXID": "SPDXRef-Package-eaba5905b7c607ccf435",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-490a355ce8395380d6e7",
+      "versionInfo": "5.0.5",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -42,14 +42,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native@5.0.5"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-darwin-arm64",
-      "SPDXID": "SPDXRef-Package-7c37536aff97144c437d",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-2a8533025dcddb70e50f",
+      "versionInfo": "5.0.5",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -59,14 +59,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.5"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-darwin-x64",
-      "SPDXID": "SPDXRef-Package-810d8647e49cab312ddf",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-7708f9d84a482ac3cb09",
+      "versionInfo": "5.0.5",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -76,14 +76,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.5"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-linux-arm64-gnu",
-      "SPDXID": "SPDXRef-Package-16ea1010a290d52cbeae",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-0cab5a1460c5399db58c",
+      "versionInfo": "5.0.5",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -93,14 +93,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.5"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-linux-x64-gnu",
-      "SPDXID": "SPDXRef-Package-9f150aef88bc8208a2ed",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-924889f967e0c3d57857",
+      "versionInfo": "5.0.5",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -110,7 +110,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.5"
         }
       ]
     },
@@ -221,57 +221,57 @@
     {
       "spdxElementId": "SPDXRef-DOCUMENT",
       "relationshipType": "DESCRIBES",
-      "relatedSpdxElement": "SPDXRef-Package-76f76655df85108ee0d0"
+      "relatedSpdxElement": "SPDXRef-Package-453dd3dbe8557f33f1ac"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-eaba5905b7c607ccf435"
+      "relatedSpdxElement": "SPDXRef-Package-490a355ce8395380d6e7"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-6cdb8b3664bfb0d67b6a"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-e0e2cb449dffb239a794"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-2e6e3840217975457b7a"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-5b9d78698ec0a5c8f86f"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-453dd3dbe8557f33f1ac",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-b779412f685822663496"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
+      "spdxElementId": "SPDXRef-Package-490a355ce8395380d6e7",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-7c37536aff97144c437d"
+      "relatedSpdxElement": "SPDXRef-Package-2a8533025dcddb70e50f"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
+      "spdxElementId": "SPDXRef-Package-490a355ce8395380d6e7",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-810d8647e49cab312ddf"
+      "relatedSpdxElement": "SPDXRef-Package-7708f9d84a482ac3cb09"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
+      "spdxElementId": "SPDXRef-Package-490a355ce8395380d6e7",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-16ea1010a290d52cbeae"
+      "relatedSpdxElement": "SPDXRef-Package-0cab5a1460c5399db58c"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
+      "spdxElementId": "SPDXRef-Package-490a355ce8395380d6e7",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-9f150aef88bc8208a2ed"
+      "relatedSpdxElement": "SPDXRef-Package-924889f967e0c3d57857"
     },
     {
       "spdxElementId": "SPDXRef-Package-e0e2cb449dffb239a794",