@floegence/flowersec-core 5.0.4 → 5.1.0

package/THIRD_PARTY_NOTICES.md

@@ -3,11 +3,11 @@
 This file is generated from the canonical Flowersec source dependency inventory for flowersec-ts.
 Do not edit it manually. License decisions are reviewed by the repository source license policy.
 
-- @floegence/flowersec-node-native 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-darwin-arm64 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-darwin-x64 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-linux-arm64-gnu 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
-- @floegence/flowersec-node-native-linux-x64-gnu 5.0.4 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native 5.1.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-darwin-arm64 5.1.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-darwin-x64 5.1.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-linux-arm64-gnu 5.1.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
+- @floegence/flowersec-node-native-linux-x64-gnu 5.1.0 (Declared: MIT; selected: MIT; source: https://github.com/floegence/flowersec.git)
 - @noble/ciphers 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.4.0.tgz)
 - @noble/curves 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/curves/-/curves-2.4.0.tgz)
 - @noble/hashes 2.4.0 (Declared: MIT; selected: MIT; source: https://registry.npmjs.org/@noble/hashes/-/hashes-2.4.0.tgz)

package/dist/browser/connectSessionV3.js

@@ -2,14 +2,16 @@ import { SDK_DEFAULTS } from "../defaults.js";
 import { claimArtifactLeaseV3, retireArtifactLeaseV3, } from "../v3/artifactLease.js";
 import { createConnectionControllerV3 as createCoreControllerV3, } from "../v3/connectionController.js";
 import { BrowserRuntimeCapabilityRegistryV3, createBrowserWebTransportCarrierV3, } from "../v3/browserRuntime.js";
-import { attemptClaimedArtifactLeaseV3, connectArtifactLeaseV3 } from "../v3/sessionConnector.js";
+import { attemptClaimedArtifactLeaseV3, connectArtifactLeaseWithRuntimeV3, } from "../v3/sessionConnector.js";
 import { readyNativeAdmissionV3, readyWebSocketAdmissionV3 } from "../v3/runtimeAdapters.js";
 import { TransportFailureV3, ConnectErrorV3 } from "../v3/security.js";
 import { browserSessionRuntimeV3 } from "../v3/browserSessionRuntime.js";
 import { unwrapPrivateLoopbackArtifactLeaseV1, validatePrivateLoopbackOriginV1, } from "./privateLoopbackV1.js";
 export async function connectV3(lease, options = {}) {
-    const registry = await BrowserRuntimeCapabilityRegistryV3.create();
-    return await connectArtifactLeaseV3(lease, browserRuntime(registry, options.connectTimeoutMs), options.signal);
+    return await connectArtifactLeaseWithRuntimeV3(lease, options, async () => {
+        const registry = await BrowserRuntimeCapabilityRegistryV3.create();
+        return browserRuntime(registry, options.connectTimeoutMs);
+    });
 }
 export async function createConnectionControllerV3(source, options = {}) {
     const registry = await BrowserRuntimeCapabilityRegistryV3.create();
@@ -22,14 +24,15 @@ export async function createConnectionControllerV3(source, options = {}) {
     return createCoreControllerV3(source, async (context) => await attemptClaimedArtifactLeaseV3(context, runtime), coreOptions);
 }
 export async function connectPrivateLoopbackV1(lease, options) {
-    const privateOrigin = requirePrivateLoopbackOrigin(options.origin);
     const unwrapped = unwrapPrivateLoopbackLease(lease);
-    if (new URL(unwrapped.endpoint).origin.replace(/^ws:/, "http:") !== privateOrigin) {
-        await retireInnerLease(unwrapped.innerLease);
-        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
-    }
-    const registry = await BrowserRuntimeCapabilityRegistryV3.create();
-    return await connectArtifactLeaseV3(unwrapped.innerLease, privateLoopbackBrowserRuntime(registry, options.connectTimeoutMs, privateOrigin), options.signal);
+    return await connectArtifactLeaseWithRuntimeV3(unwrapped.innerLease, options, async () => {
+        const privateOrigin = requirePrivateLoopbackOrigin(options.origin);
+        if (new URL(unwrapped.endpoint).origin.replace(/^ws:/, "http:") !== privateOrigin) {
+            throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+        }
+        const registry = await BrowserRuntimeCapabilityRegistryV3.create();
+        return privateLoopbackBrowserRuntime(registry, options.connectTimeoutMs, privateOrigin);
+    });
 }
 export async function createPrivateLoopbackConnectionControllerV1(source, options) {
     const privateOrigin = requirePrivateLoopbackOrigin(options.origin);

package/dist/node/byteStreamDuplex.d.ts

@@ -0,0 +1,4 @@
+import { Duplex } from "node:stream";
+import type { ByteStream } from "../public/contract.js";
+/** A bounded Node stream that owns one application ByteStream, including half-close. */
+export declare function createByteStreamDuplex(stream: ByteStream, signal?: AbortSignal): Duplex;

package/dist/node/byteStreamDuplex.js

@@ -0,0 +1,69 @@
+import { Duplex } from "node:stream";
+/** A bounded Node stream that owns one application ByteStream, including half-close. */
+export function createByteStreamDuplex(stream, signal) {
+    const operations = new AbortController();
+    let reading = false;
+    let ended = false;
+    let duplex;
+    const abort = () => { duplex.destroy(new Error("Application stream canceled")); };
+    duplex = new Duplex({
+        allowHalfOpen: true,
+        readableHighWaterMark: 64 * 1024,
+        writableHighWaterMark: 64 * 1024,
+        read() {
+            if (reading || ended)
+                return;
+            reading = true;
+            void (async () => {
+                try {
+                    while (!duplex.destroyed) {
+                        const chunk = await stream.read({ signal: operations.signal });
+                        if (chunk === null) {
+                            ended = true;
+                            duplex.push(null);
+                            return;
+                        }
+                        if (chunk.byteLength && !duplex.push(chunk))
+                            return;
+                    }
+                }
+                catch {
+                    duplex.destroy(new Error("Application stream read failed"));
+                }
+                finally {
+                    reading = false;
+                }
+            })();
+        },
+        write(chunk, _encoding, callback) {
+            void (async () => {
+                try {
+                    for (let offset = 0; offset < chunk.byteLength;) {
+                        const part = chunk.subarray(offset, Math.min(offset + 64 * 1024, chunk.byteLength));
+                        const count = await stream.write(part, { signal: operations.signal });
+                        if (!Number.isSafeInteger(count) || count <= 0 || count > part.byteLength) {
+                            throw new Error("Invalid application stream write result");
+                        }
+                        offset += count;
+                    }
+                    callback();
+                }
+                catch {
+                    callback(new Error("Application stream write failed"));
+                }
+            })();
+        },
+        final(callback) {
+            void stream.closeWrite().then(() => callback(), () => callback(new Error("Application stream half-close failed")));
+        },
+        destroy(error, callback) {
+            signal?.removeEventListener("abort", abort);
+            operations.abort();
+            void (error ? stream.reset() : stream.close()).then(() => callback(error), () => callback(error ?? new Error("Application stream close failed")));
+        },
+    });
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted)
+        queueMicrotask(abort);
+    return duplex;
+}

package/dist/node/connectSessionV3.js

@@ -1,7 +1,7 @@
 import { SDK_DEFAULTS } from "../defaults.js";
 import { createConnectionControllerV3 as createCoreControllerV3, } from "../v3/connectionController.js";
 import { connectNodeWebSocketV3, detectNodeRuntimeCapabilityV3, } from "../v3/nodeRuntime.js";
-import { attemptClaimedArtifactLeaseV3, connectArtifactLeaseV3 } from "../v3/sessionConnector.js";
+import { attemptClaimedArtifactLeaseV3, connectArtifactLeaseWithRuntimeV3, } from "../v3/sessionConnector.js";
 import { readyNativeAdmissionV3, readyWebSocketAdmissionV3 } from "../v3/runtimeAdapters.js";
 import { ConnectErrorV3, TransportFailureV3 } from "../v3/security.js";
 import { nodeSessionRuntimeV3 } from "../v3/nodeSessionRuntime.js";
@@ -9,7 +9,7 @@ import { createNativeRawQuicDriver, tryLoadNativeTransportAddon, } from "./nativ
 import { createNodeRawQuicClientV3 } from "./rawQuicAdapterV3.js";
 import { createRPCRouter, freezeRPCHandlers, } from "./acceptor.js";
 export async function connectV3(lease, options) {
-    return await connectArtifactLeaseV3(lease, nodeRuntime(options), options.signal);
+    return await connectArtifactLeaseWithRuntimeV3(lease, options, () => nodeRuntime(options));
 }
 export function createConnectionControllerV3(source, options) {
     const runtime = nodeRuntime(options);
@@ -37,6 +37,7 @@ function nodeRuntime(options) {
     }
     return {
         capabilitySnapshot: () => capability,
+        candidateEligible: (candidate) => candidate.carrier !== "websocket" || options.origin !== undefined,
         connectTimeoutMilliseconds,
         protocolRuntime: nodeSessionRuntimeV3,
         ...(rpcSnapshot === undefined ? {} : { createRPCRouter: () => createRPCRouter(rpcSnapshot) }),

package/dist/node/index.d.ts

@@ -15,3 +15,4 @@ export { HandlerRegistrationError, RPCHandlers, SessionHandlersV3 as SessionHand
 export type { NotificationHandler, RPCHandler, RPCHandlerResult, SessionHandlerOptions, } from "./acceptor.js";
 export { ProxyServer, ProxyServerError } from "./proxyServer.js";
 export type { ProxyServerOptions } from "./proxyServer.js";
+export { createByteStreamDuplex } from "./byteStreamDuplex.js";

package/dist/node/index.js

@@ -5,3 +5,4 @@ export * from "../facade.js";
 export { connectV3 as connect, createConnectionControllerV3 as createConnectionController, } from "./connectSessionV3.js";
 export { HandlerRegistrationError, RPCHandlers, SessionHandlersV3 as SessionHandlers, } from "./acceptor.js";
 export { ProxyServer, ProxyServerError } from "./proxyServer.js";
+export { createByteStreamDuplex } from "./byteStreamDuplex.js";

package/dist/node/proxyServer.js

@@ -28,6 +28,7 @@ export class ProxyServerError extends Error {
 export class ProxyServer {
     #config;
     #active = new Set();
+    #abortLinks = new WeakMap();
     #permits = new Set();
     #completion;
     #resolveCompletion;
@@ -132,15 +133,20 @@ export class ProxyServer {
             return controller;
         }
         if (parent !== undefined) {
+            const abort = () => controller.abort(parent.reason);
             if (parent.aborted)
-                controller.abort(parent.reason);
-            else
-                parent.addEventListener("abort", () => controller.abort(parent.reason), { once: true });
+                abort();
+            else {
+                parent.addEventListener("abort", abort, { once: true });
+                this.#abortLinks.set(controller, () => parent.removeEventListener("abort", abort));
+            }
         }
         this.#active.add(controller);
         return controller;
     }
     #untrack(controller) {
+        this.#abortLinks.get(controller)?.();
+        this.#abortLinks.delete(controller);
         this.#active.delete(controller);
         if (this.#closed && this.#active.size === 0)
             this.#resolveCompletion();

package/dist/rpc/client.js

@@ -106,11 +106,14 @@ export class RpcClient {
             while (!this.closed) {
                 const v = assertRpcEnvelope(await readJsonFrame(this.readExactly, DEFAULT_MAX_JSON_FRAME_BYTES));
                 if (v.response_to === 0) {
-                    // Notification: response_to=0 and request_id=0.
-                    if (v.request_id === 0) {
-                        const set = this.notifyHandlers.get(v.type_id);
-                        if (set != null) {
-                            for (const h of set) {
+                    if (v.request_id !== 0) {
+                        throw new Error("rpc invalid request on client stream");
+                    }
+                    const set = this.notifyHandlers.get(v.type_id);
+                    if (set != null) {
+                        const handlers = [...set];
+                        setTimeout(() => {
+                            for (const h of handlers) {
                                 try {
                                     h(v.payload);
                                 }
@@ -118,7 +121,7 @@ export class RpcClient {
                                     // User handlers should not be able to take down the transport read loop.
                                 }
                             }
-                        }
+                        });
                     }
                     continue;
                 }

package/dist/v3/artifact.js

@@ -623,7 +623,7 @@ function normalizeAuthority(authority) {
             portText = tail.slice(1);
         }
         if (host.includes("."))
-            throw invalidCandidate("IPv6 dotted subset");
+            throw invalidCandidate("embedded IPv4");
         let parsed;
         try {
             parsed = new URL(`http://[${host}]/`);

package/dist/v3/nodeRuntime.js

@@ -33,9 +33,35 @@ export async function connectNodeTLSSocketV3(candidate, attemptNowUnixSeconds, o
         ALPNProtocols: ["http/1.1"],
         secureOptions: constants.SSL_OP_NO_TICKET,
         rejectUnauthorized: policy.mode === "ca",
-        ...(isIPAddress(host)
-            ? { checkServerIdentity: (_servername, certificate) => tlsCheckServerIdentity(host, certificate) }
-            : { servername: host }),
+        ...(policy.mode === "ca"
+            ? (isIPAddress(host)
+                ? { checkServerIdentity: (_servername, certificate) => {
+                        const subjectAltName = certificate.subjectaltname;
+                        if (typeof subjectAltName !== "string" || !/(?:^|,\s*)(?:DNS|IP Address):/.test(subjectAltName)) {
+                            return Object.assign(new Error("certificate is missing a DNS-ID or IP-ID subjectAltName"), {
+                                code: "ERR_TLS_CERT_ALTNAME_INVALID",
+                            });
+                        }
+                        return tlsCheckServerIdentity(host, certificate);
+                    } }
+                : {
+                    servername: host,
+                    checkServerIdentity: (_servername, certificate) => {
+                        // Node's historical hostname verifier may fall back to CN when the
+                        // certificate has no subjectAltName. Transport v3 requires a DNS-ID
+                        // or IP-ID SAN; CN alone is never an identity proof.
+                        const subjectAltName = certificate.subjectaltname;
+                        if (typeof subjectAltName !== "string" || !/(?:^|,\s*)(?:DNS|IP Address):/.test(subjectAltName)) {
+                            return Object.assign(new Error("certificate is missing a DNS-ID or IP-ID subjectAltName"), {
+                                code: "ERR_TLS_CERT_ALTNAME_INVALID",
+                            });
+                        }
+                        return tlsCheckServerIdentity(host, certificate);
+                    },
+                })
+            : isIPAddress(host)
+                ? { checkServerIdentity: (_servername, certificate) => tlsCheckServerIdentity(host, certificate) }
+                : { servername: host }),
         ...(policy.mode === "ca" && options.roots !== undefined ? { ca: options.roots } : {}),
     };
     const timeout = options.timeoutMilliseconds ?? 10_000;
@@ -64,7 +90,7 @@ export async function connectNodeTLSSocketV3(candidate, attemptNowUnixSeconds, o
             if (policy.mode === "ca" && isNodeCertificateTrustErrorV3(error.code)) {
                 fail(new TransportFailureV3("tls_failed", "ca_untrusted", error));
             }
-            else if (policy.mode === "pin" && isTLSProtocolError(error.code)) {
+            else if (isTLSProtocolError(error.code)) {
                 fail(new TransportFailureV3("tls_failed", "unknown", error));
             }
             else {
@@ -89,6 +115,12 @@ export async function connectNodeTLSSocketV3(candidate, attemptNowUnixSeconds, o
             }
             settled = true;
             cleanup();
+            // Keep a settled error sink attached until close. A live TLSSocket may
+            // emit asynchronous errors after the handshake; letting those escape
+            // without a listener turns a recoverable socket failure into an
+            // uncaught Node process error.
+            socket.on("error", onError);
+            socket.once("close", () => socket.removeListener("error", onError));
             resolve(socket);
         });
         if (options.signal?.aborted === true)

package/dist/v3/session.js

@@ -460,7 +460,7 @@ export class SessionV3 {
             while (this.lifecycle === "open") {
                 const carrierStream = await this.carrier.acceptStream();
                 void this.acceptCarrierStream(carrierStream).catch((error) => {
-                    void carrierStream.reset();
+                    void carrierStream.reset().catch(() => undefined);
                     if (error instanceof StreamLifetimeLedgerV3Error && error.code === "duplicate") {
                         this.fail(protocolError(error.message));
                     }

package/dist/v3/sessionConnector.d.ts

@@ -26,6 +26,7 @@ export type ReadyAdmissionTransportV3 = Readonly<{
 export type CandidateDialerV3 = (candidate: CanonicalArtifactCandidateV3, artifact: ArtifactV3, attemptNowUnixSeconds: number, capability: RuntimeCapabilityDescriptorV3, signal: AbortSignal) => Promise<ReadyAdmissionTransportV3>;
 export type SessionConnectorRuntimeV3 = Readonly<{
     capabilitySnapshot(): RuntimeCapabilityDescriptorV3;
+    candidateEligible?: (candidate: CanonicalArtifactCandidateV3) => boolean;
     dial: CandidateDialerV3;
     protocolRuntime: SessionProtocolRuntimeV3;
     connectTimeoutMilliseconds?: number;
@@ -34,4 +35,8 @@ export type SessionConnectorRuntimeV3 = Readonly<{
     deadlineFactory?: SessionDeadlineFactoryV3;
 }>;
 export declare function connectArtifactLeaseV3(lease: ArtifactLeaseV3, runtime: SessionConnectorRuntimeV3, signal?: AbortSignal): Promise<Session>;
+export declare function connectArtifactLeaseWithRuntimeV3(lease: ArtifactLeaseV3, options: Readonly<{
+    connectTimeoutMs?: number;
+    signal?: AbortSignal;
+}>, createRuntime: (signal: AbortSignal) => SessionConnectorRuntimeV3 | Promise<SessionConnectorRuntimeV3>): Promise<Session>;
 export declare function attemptClaimedArtifactLeaseV3(context: LeaseAttemptContextV3, runtime: SessionConnectorRuntimeV3): Promise<LeaseAttemptResultV3<Session>>;

package/dist/v3/sessionConnector.js

@@ -15,7 +15,58 @@ export async function connectArtifactLeaseV3(lease, runtime, signal) {
     catch {
         throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
     }
-    const artifact = claimedArtifactV3(claim);
+    return await connectClaimedArtifactLeaseV3(claim, runtime, signal);
+}
+export async function connectArtifactLeaseWithRuntimeV3(lease, options, createRuntime) {
+    let claim;
+    try {
+        claim = claimArtifactLeaseV3(lease);
+    }
+    catch {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
+    let timeout;
+    let signal;
+    try {
+        timeout = normalizeConnectTimeoutMilliseconds(options.connectTimeoutMs);
+        signal = options.signal;
+    }
+    catch (error) {
+        await retireArtifactLeaseV3(claim);
+        throw publicPreSpendError(error);
+    }
+    const controller = new AbortController();
+    const unlink = linkPublicConnectAbort(signal, controller);
+    const timer = setTimeout(() => controller.abort(new ConnectErrorV3("connection_failed", { kind: "retryable" })), timeout);
+    try {
+        throwIfAborted(controller.signal);
+        let runtime;
+        try {
+            runtime = await raceAbort(Promise.resolve().then(() => createRuntime(controller.signal)), controller.signal);
+        }
+        catch (error) {
+            throw publicPreSpendError(error);
+        }
+        return await connectClaimedArtifactLeaseV3(claim, { ...runtime, connectTimeoutMilliseconds: timeout }, controller.signal, true);
+    }
+    catch (error) {
+        if (artifactLeaseStateV3(claim) === "claimed")
+            await retireArtifactLeaseV3(claim);
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+        unlink();
+    }
+}
+async function connectClaimedArtifactLeaseV3(claim, runtime, signal, deadlineStarted = false) {
+    let artifact;
+    try {
+        artifact = claimedArtifactV3(claim);
+    }
+    catch {
+        throw new ConnectErrorV3("artifact_invalid", { kind: "terminal" });
+    }
     const now = runtime.nowUnixSeconds ?? (() => Math.floor(Date.now() / 1_000));
     let capability;
     let candidates;
@@ -33,7 +84,7 @@ export async function connectArtifactLeaseV3(lease, runtime, signal) {
     const controller = new AbortController();
     const unlink = linkAbort(signal, controller);
     try {
-        const result = await attemptClaimedArtifactLeaseV3({
+        const context = {
             kind: "primary",
             artifact,
             candidates,
@@ -41,7 +92,10 @@ export async function connectArtifactLeaseV3(lease, runtime, signal) {
             signal: controller.signal,
             capability,
             assertArtifactFresh: () => assertArtifactFresh(artifact, now),
-        }, runtime);
+        };
+        const result = deadlineStarted
+            ? await attemptClaimedArtifactLeaseUnderSignalV3(context, runtime)
+            : await attemptClaimedArtifactLeaseV3(context, runtime);
         if (result.kind === "established")
             return result.session;
         if (artifactLeaseStateV3(claim) === "claimed")
@@ -70,8 +124,17 @@ export async function attemptClaimedArtifactLeaseV3(context, runtime) {
     const unlink = linkConnectAttemptAbort(context.signal, controller);
     const timer = setTimeout(() => controller.abort(new ConnectErrorV3("connection_failed", { kind: "retryable" })), timeoutMilliseconds);
     try {
-        throwIfAborted(controller.signal);
-        return await attemptClaimedArtifactLeaseWithinDeadlineV3({ ...context, signal: controller.signal }, runtime);
+        return await attemptClaimedArtifactLeaseUnderSignalV3({ ...context, signal: controller.signal }, runtime);
+    }
+    finally {
+        clearTimeout(timer);
+        unlink();
+    }
+}
+async function attemptClaimedArtifactLeaseUnderSignalV3(context, runtime) {
+    try {
+        throwIfAborted(context.signal);
+        return await attemptClaimedArtifactLeaseWithinDeadlineV3(context, runtime);
     }
     catch (error) {
         const projected = error instanceof ConnectErrorV3
@@ -81,10 +144,6 @@ export async function attemptClaimedArtifactLeaseV3(context, runtime) {
             ? { kind: "pre_spend_failure", error: projected }
             : { kind: "post_spend_failure", error: projected };
     }
-    finally {
-        clearTimeout(timer);
-        unlink();
-    }
 }
 async function attemptClaimedArtifactLeaseWithinDeadlineV3(context, runtime) {
     const role = context.artifact.path.kind === "tunnel" && context.artifact.path.role === 2
@@ -115,6 +174,10 @@ async function attemptClaimedArtifactLeaseWithinDeadlineV3(context, runtime) {
     }
     for (const [index, candidate] of context.candidates.entries()) {
         throwIfAborted(context.signal);
+        if (runtime.candidateEligible?.(candidate) === false) {
+            failures.push({ candidate, failure: new TransportFailureV3("tls_unsupported") });
+            continue;
+        }
         if (!supportsCandidateSecurityV3(context.capability, candidate.carrier, context.artifact.path.kind, role, candidate.tls.mode)) {
             failures.push({ candidate, failure: new TransportFailureV3("tls_unsupported") });
             continue;
@@ -378,6 +441,16 @@ function linkConnectAttemptAbort(parent, child) {
         parent.addEventListener("abort", abort, { once: true });
     return () => parent.removeEventListener("abort", abort);
 }
+function linkPublicConnectAbort(parent, child) {
+    if (parent === undefined)
+        return () => undefined;
+    const abort = () => child.abort(new ConnectErrorV3("connection_failed", { kind: "terminal" }));
+    if (parent.aborted)
+        abort();
+    else
+        parent.addEventListener("abort", abort, { once: true });
+    return () => parent.removeEventListener("abort", abort);
+}
 function throwIfAborted(signal) {
     if (signal.aborted)
         throw signal.reason;

package/dist/v3/unreliableMessage.js

@@ -247,7 +247,8 @@ function throwIfAborted(signal) {
 }
 function isAbortError(error) {
     return error instanceof DOMException && error.name === "AbortError" ||
-        error instanceof Error && error.name === "AbortError";
+        error instanceof Error && (error.name === "AbortError" ||
+            error.code === "aborted");
 }
 function labelWith(label, ...parts) {
     return concat(encoder.encode(label), byte(0), ...parts);

package/dist/v3/webTransportCarrier.js

@@ -188,22 +188,40 @@ class WebTransportCarrierStreamAdapter {
     stopSendingPromise;
     resetPromise;
     released = false;
+    pendingRead = false;
     constructor(stream, onRelease) {
         this.onRelease = onRelease;
         this.reader = stream.readable.getReader();
         this.writer = stream.writable.getWriter();
     }
-    async read(options = {}) {
+    async read(_options = {}) {
         this.assertReadable();
         if (this.readClosed)
             return null;
-        const result = await carrierCall(raceAbort(this.reader.read(), options.signal), "WebTransport stream read failed", "reset");
-        if (result.done || result.value === undefined) {
-            this.readClosed = true;
-            this.releaseIfComplete();
-            return null;
+        this.pendingRead = true;
+        try {
+            const result = await carrierCall(this.reader.read(), "WebTransport stream read failed", "reset");
+            if (result.done || result.value === undefined) {
+                this.readClosed = true;
+                this.releaseIfComplete();
+                return null;
+            }
+            return result.value.slice();
+        }
+        finally {
+            this.pendingRead = false;
         }
-        return result.value.slice();
+    }
+    cancelPending() {
+        if (this.terminalError !== undefined || !this.pendingRead) {
+            if (!this.pendingRead && this.terminalError === undefined)
+                this.abort(abortedCarrierError());
+            return;
+        }
+        this.readClosed = true;
+        void this.reader.cancel(abortedCarrierError()).catch(() => undefined).finally(() => {
+            this.releaseIfComplete();
+        });
     }
     async write(data) {
         this.assertNotTerminal();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "5.0.4",
+  "version": "5.1.0",
   "description": "Flowersec core TypeScript library for carrier-neutral encrypted sessions and multiplexed streams.",
   "license": "MIT",
   "repository": {
@@ -53,7 +53,7 @@
     "postcss": "^8.5.23"
   },
   "scripts": {
-    "build": "node ./scripts/clean-dist.mjs && tsc -p tsconfig.build.json && node ./scripts/build-browser-vendor.mjs",
+    "build": "node ./scripts/clean-dist.mjs && node ./node_modules/@typescript/native/bin/tsc -p tsconfig.build.json && node ./scripts/build-browser-vendor.mjs",
     "bench": "vitest bench --run",
     "test": "npm run build && vitest run --exclude 'src/**/*.integration.test.ts'",
     "test:browser": "npm run test:browser:chromium",
@@ -64,7 +64,7 @@
     "ensure:browser:firefox": "node ./scripts/ensure-playwright-browsers.mjs firefox",
     "ensure:browser:webkit": "node ./scripts/ensure-playwright-browsers.mjs webkit",
     "test:coverage": "npm run build && node ../scripts/server-parity-native-addon.mjs --test-coverage",
-    "typecheck:native-integration": "tsc -p tsconfig.native-integration.json",
+    "typecheck:native-integration": "node ./node_modules/@typescript/native/bin/tsc -p tsconfig.native-integration.json",
     "lint": "eslint .",
     "verify:package": "node ./scripts/verify-package-exports.mjs",
     "prepack": "npm run build",
@@ -95,7 +95,7 @@
     "vitest": "4.1.11"
   },
   "optionalDependencies": {
-    "@floegence/flowersec-node-native": "5.0.4"
+    "@floegence/flowersec-node-native": "5.1.0"
   },
-  "flowersecSourceCommit": "c7f7ef0ab82ca329703bd727433075f2996f1127"
+  "flowersecSourceCommit": "86fb9e2918ab4e9c47b1dbd23f80fc79afae2ecb"
 }

package/sbom/cyclonedx.json

@@ -1,20 +1,20 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6039ab01-9a2a-5a20-87ae-899bb738f3d0",
+  "serialNumber": "urn:uuid:1625df75-bd47-5e81-8855-6c2b2a399676",
   "version": 1,
   "metadata": {
     "component": {
       "type": "library",
       "name": "@floegence/flowersec-core",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-core@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-core@5.0.4"
+      "version": "5.1.0",
+      "purl": "pkg:npm/%40floegence/flowersec-core@5.1.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-core@5.1.0"
     },
     "properties": [
       {
         "name": "flowersec:source-inventory-sha256",
-        "value": "1d811c3e752603c670a7bd1edb9032d5ebc3bbb8e7dad0c537b40e0fd7c157d8"
+        "value": "9152d30ed9f2c92baa032e9e085b406d8491098b5c2c6da19f6793b53cc9cdcf"
       }
     ]
   },
@@ -22,9 +22,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
+      "version": "5.1.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native@5.1.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native@5.1.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -50,9 +50,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-darwin-arm64",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
+      "version": "5.1.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.1.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.1.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -78,9 +78,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-darwin-x64",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
+      "version": "5.1.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.1.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.1.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -106,9 +106,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-linux-arm64-gnu",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
+      "version": "5.1.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.1.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.1.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -134,9 +134,9 @@
     {
       "type": "library",
       "name": "@floegence/flowersec-node-native-linux-x64-gnu",
-      "version": "5.0.4",
-      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4",
-      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4",
+      "version": "5.1.0",
+      "purl": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.1.0",
+      "bom-ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.1.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -330,9 +330,9 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:npm/%40floegence/flowersec-core@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-core@5.1.0",
       "dependsOn": [
-        "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
+        "pkg:npm/%40floegence/flowersec-node-native@5.1.0",
         "pkg:npm/%40noble/ciphers@2.4.0",
         "pkg:npm/%40noble/curves@2.4.0",
         "pkg:npm/%40noble/hashes@2.4.0",
@@ -341,28 +341,28 @@
       ]
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native@5.1.0",
       "dependsOn": [
-        "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
-        "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
-        "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
-        "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4"
+        "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.1.0",
+        "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.1.0",
+        "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.1.0",
+        "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.1.0"
       ]
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.1.0",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.1.0",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.1.0",
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4",
+      "ref": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.1.0",
       "dependsOn": []
     },
     {

package/sbom/spdx.json

@@ -3,9 +3,9 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "flowersec-ts",
-  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/1d811c3e752603c670a7bd1edb9032d5ebc3bbb8e7dad0c537b40e0fd7c157d8",
+  "documentNamespace": "https://github.com/floegence/flowersec/sbom/flowersec-ts/9152d30ed9f2c92baa032e9e085b406d8491098b5c2c6da19f6793b53cc9cdcf",
   "creationInfo": {
-    "created": "2026-09-04T01:34:01Z",
+    "created": "2026-09-07T04:29:43Z",
     "creators": [
       "Tool: flowersec-source-inventory-1"
     ]
@@ -13,26 +13,26 @@
   "packages": [
     {
       "name": "@floegence/flowersec-core",
-      "SPDXID": "SPDXRef-Package-76f76655df85108ee0d0",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-1d6258545a0c60e2f0bd",
+      "versionInfo": "5.1.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "NOASSERTION",
       "copyrightText": "NOASSERTION",
-      "comment": "Flowersec source inventory SHA-256: 1d811c3e752603c670a7bd1edb9032d5ebc3bbb8e7dad0c537b40e0fd7c157d8",
+      "comment": "Flowersec source inventory SHA-256: 9152d30ed9f2c92baa032e9e085b406d8491098b5c2c6da19f6793b53cc9cdcf",
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-core@5.1.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native",
-      "SPDXID": "SPDXRef-Package-eaba5905b7c607ccf435",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-5525b7c950bb6fce12a3",
+      "versionInfo": "5.1.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -42,14 +42,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native@5.1.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-darwin-arm64",
-      "SPDXID": "SPDXRef-Package-7c37536aff97144c437d",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-1a9c310184fc37447715",
+      "versionInfo": "5.1.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -59,14 +59,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-arm64@5.1.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-darwin-x64",
-      "SPDXID": "SPDXRef-Package-810d8647e49cab312ddf",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-e14c571269245c985108",
+      "versionInfo": "5.1.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -76,14 +76,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-darwin-x64@5.1.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-linux-arm64-gnu",
-      "SPDXID": "SPDXRef-Package-16ea1010a290d52cbeae",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-58cb80f3c8fbd1c8cc2c",
+      "versionInfo": "5.1.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -93,14 +93,14 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-arm64-gnu@5.1.0"
         }
       ]
     },
     {
       "name": "@floegence/flowersec-node-native-linux-x64-gnu",
-      "SPDXID": "SPDXRef-Package-9f150aef88bc8208a2ed",
-      "versionInfo": "5.0.4",
+      "SPDXID": "SPDXRef-Package-33afd79cc2f266255b63",
+      "versionInfo": "5.1.0",
       "downloadLocation": "https://github.com/floegence/flowersec.git",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -110,7 +110,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.0.4"
+          "referenceLocator": "pkg:npm/%40floegence/flowersec-node-native-linux-x64-gnu@5.1.0"
         }
       ]
     },
@@ -221,57 +221,57 @@
     {
       "spdxElementId": "SPDXRef-DOCUMENT",
       "relationshipType": "DESCRIBES",
-      "relatedSpdxElement": "SPDXRef-Package-76f76655df85108ee0d0"
+      "relatedSpdxElement": "SPDXRef-Package-1d6258545a0c60e2f0bd"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-1d6258545a0c60e2f0bd",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-eaba5905b7c607ccf435"
+      "relatedSpdxElement": "SPDXRef-Package-5525b7c950bb6fce12a3"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-1d6258545a0c60e2f0bd",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-6cdb8b3664bfb0d67b6a"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-1d6258545a0c60e2f0bd",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-e0e2cb449dffb239a794"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-1d6258545a0c60e2f0bd",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-2e6e3840217975457b7a"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-1d6258545a0c60e2f0bd",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-5b9d78698ec0a5c8f86f"
     },
     {
-      "spdxElementId": "SPDXRef-Package-76f76655df85108ee0d0",
+      "spdxElementId": "SPDXRef-Package-1d6258545a0c60e2f0bd",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-b779412f685822663496"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
+      "spdxElementId": "SPDXRef-Package-5525b7c950bb6fce12a3",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-7c37536aff97144c437d"
+      "relatedSpdxElement": "SPDXRef-Package-1a9c310184fc37447715"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
+      "spdxElementId": "SPDXRef-Package-5525b7c950bb6fce12a3",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-810d8647e49cab312ddf"
+      "relatedSpdxElement": "SPDXRef-Package-e14c571269245c985108"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
+      "spdxElementId": "SPDXRef-Package-5525b7c950bb6fce12a3",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-16ea1010a290d52cbeae"
+      "relatedSpdxElement": "SPDXRef-Package-58cb80f3c8fbd1c8cc2c"
     },
     {
-      "spdxElementId": "SPDXRef-Package-eaba5905b7c607ccf435",
+      "spdxElementId": "SPDXRef-Package-5525b7c950bb6fce12a3",
       "relationshipType": "DEPENDS_ON",
-      "relatedSpdxElement": "SPDXRef-Package-9f150aef88bc8208a2ed"
+      "relatedSpdxElement": "SPDXRef-Package-33afd79cc2f266255b63"
     },
     {
       "spdxElementId": "SPDXRef-Package-e0e2cb449dffb239a794",