@undefineds.co/xpod 0.4.14 → 0.4.16

package/dist/edge/reachability/TcpP2PDataPlaneTransport.js

@@ -5,9 +5,16 @@ exports.createTcpP2PDataPlaneServer = createTcpP2PDataPlaneServer;
 exports.attachTcpP2PDataPlaneSocket = attachTcpP2PDataPlaneSocket;
 exports.computeTcpHolePunchPlan = computeTcpHolePunchPlan;
 const node_net_1 = require("node:net");
+const P2PDataPlaneCrypto_1 = require("./P2PDataPlaneCrypto");
+const P2PDataPlane_1 = require("./P2PDataPlane");
 const REQUEST_ENVELOPE = 'xpod-p2p-http-request';
 const RESPONSE_ENVELOPE = 'xpod-p2p-http-response';
 const ERROR_ENVELOPE = 'xpod-p2p-http-error';
+const CHUNK_ENVELOPE = 'xpod-p2p-http-response-chunk';
+const END_ENVELOPE = 'xpod-p2p-http-response-end';
+const CANCEL_ENVELOPE = 'xpod-p2p-http-cancel';
+const SEALED_ENVELOPE = 'xpod-p2p-sealed';
+const HELLO_ENVELOPE = 'xpod-p2p-secure-hello';
 const DEFAULT_TIMEOUT_MS = 5_000;
 const DEFAULT_WINDOW_SECONDS = 42;
 const DEFAULT_MAX_CLOCK_ERROR_SECONDS = 20;
@@ -17,6 +24,40 @@ const DEFAULT_BASE_PORT = 30_000;
 const DEFAULT_PORT_RANGE = 20_000;
 const LARGE_PRIME = 2654435761n;
 const UINT32_MODULUS = 0xffffffffn;
+const DEFAULT_HANDSHAKE_TIMEOUT_MS = 5_000;
+const MAX_REMEMBERED_CLIENT_NONCES = 1_024;
+/**
+ * Client nonces already consumed, keyed by session.
+ *
+ * A replayed handshake re-derives exactly the same keys, so frame sequence numbers alone would
+ * happily accept a replayed connection. Remembering the nonce per process closes that hole; it
+ * is process-local by design (a peer would have to replay into the same process that saw the
+ * original connection).
+ */
+const consumedClientNonces = new Map();
+function rememberClientNonce(sessionId, nonce) {
+    const key = `${sessionId}|${nonce.toString('base64')}`;
+    if (consumedClientNonces.has(key)) {
+        throw new P2PDataPlaneCrypto_1.P2PDataPlaneSecurityError('Data plane handshake replayed with a consumed nonce');
+    }
+    consumedClientNonces.set(key, true);
+    if (consumedClientNonces.size > MAX_REMEMBERED_CLIENT_NONCES) {
+        const oldest = consumedClientNonces.keys().next();
+        if (!oldest.done) {
+            consumedClientNonces.delete(oldest.value);
+        }
+    }
+}
+/** Decodes either form of secret a caller may hand over. */
+function normalizeSecret(secret) {
+    return typeof secret === 'string' ? (0, P2PDataPlaneCrypto_1.decodeDataPlaneSecret)(secret) : Buffer.from(secret);
+}
+function resolveDirection(role) {
+    return role === 'client' ? 'client-to-server' : 'server-to-client';
+}
+function peerDirection(role) {
+    return role === 'client' ? 'server-to-client' : 'client-to-server';
+}
 function createTcpP2PDataPlaneTransport(options) {
     return new TcpP2PTransport(options);
 }
@@ -24,7 +65,7 @@ function createTcpP2PDataPlaneServer(options) {
     return new TcpP2PServer(options);
 }
 function attachTcpP2PDataPlaneSocket(options) {
-    return attachTcpP2PDataPlaneSocketInternal(options.socket, options.handler);
+    return attachTcpP2PDataPlaneSocketInternal(options.socket, options.handler, undefined, options, options.secure);
 }
 function computeTcpHolePunchPlan(options = {}) {
     const nowSeconds = options.nowSeconds ?? Math.floor(Date.now() / 1_000);
@@ -48,29 +89,219 @@ function computeTcpHolePunchPlan(options = {}) {
         ports: stablePorts(boundary, numPorts, basePort, portRange),
     };
 }
+/**
+ * The handshake and per-frame sealing for one data-plane connection.
+ *
+ * Each side announces a nonce; keys are derived from the session secret plus both nonces, so
+ * they are unique per connection and separated by direction. Everything after the handshake is
+ * sealed and strictly ordered: a frame that arrives out of order, cannot be authenticated, or
+ * is not sealed at all tears the connection down instead of being processed.
+ */
+class SecureSession {
+    constructor(options, hooks) {
+        this.options = options;
+        this.hooks = hooks;
+        this.localNonce = (0, P2PDataPlaneCrypto_1.createDataPlaneNonce)();
+        this.outboundSequence = 0;
+        this.inboundSequence = 0;
+        this.sessionId = options.sessionId ?? '';
+        this.ready = new Promise((resolve, reject) => {
+            this.markReady = resolve;
+            this.failHandshake = reject;
+        });
+        // Nobody may await `ready` (for example when the socket dies first): keep the rejection
+        // from surfacing as an unhandled rejection.
+        this.ready.catch(() => undefined);
+        const timeoutMs = options.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS;
+        this.timer = setTimeout(() => {
+            if (!this.keys) {
+                const error = new P2PDataPlaneCrypto_1.P2PDataPlaneSecurityError(`Data plane secure handshake did not complete within ${timeoutMs}ms`);
+                // Settle the waiters as well as the connection: otherwise a request that is waiting for
+                // the handshake hangs forever instead of failing closed.
+                this.failHandshake(error);
+                this.hooks.fail(error);
+            }
+        }, timeoutMs);
+    }
+    hello() {
+        return {
+            type: HELLO_ENVELOPE,
+            sessionId: this.options.sessionId ?? '',
+            nonce: this.localNonce.toString('base64'),
+            role: this.options.role,
+        };
+    }
+    waitReady() {
+        return this.ready;
+    }
+    isEstablished() {
+        return this.keys !== undefined;
+    }
+    /** Settles waiters when the connection dies before the handshake completed. */
+    abort(error) {
+        if (this.keys) {
+            return;
+        }
+        if (this.timer) {
+            clearTimeout(this.timer);
+            this.timer = undefined;
+        }
+        this.failHandshake(error);
+    }
+    /** Wraps an envelope for the wire: sealed once the handshake completed. */
+    seal(envelope) {
+        if (!this.keys) {
+            throw new P2PDataPlaneCrypto_1.P2PDataPlaneSecurityError('Data plane secure handshake has not completed');
+        }
+        const direction = resolveDirection(this.options.role);
+        const sealed = (0, P2PDataPlaneCrypto_1.sealDataPlaneFrame)((0, P2PDataPlaneCrypto_1.keyForDirection)(this.keys, direction), this.sessionId, direction, this.outboundSequence, Buffer.from(JSON.stringify(envelope), 'utf8'));
+        this.outboundSequence += 1;
+        return { type: SEALED_ENVELOPE, sealed };
+    }
+    /** Unwraps an inbound envelope, advancing the replay window. Returns undefined for handshakes. */
+    async open(envelope) {
+        if (envelope.type === HELLO_ENVELOPE) {
+            await this.acceptHello(envelope);
+            return undefined;
+        }
+        if (!this.keys) {
+            throw new P2PDataPlaneCrypto_1.P2PDataPlaneSecurityError('Data plane frame arrived before the secure handshake completed');
+        }
+        if (envelope.type !== SEALED_ENVELOPE) {
+            throw new P2PDataPlaneCrypto_1.P2PDataPlaneSecurityError('Data plane frame is not sealed');
+        }
+        const direction = peerDirection(this.options.role);
+        const plaintext = (0, P2PDataPlaneCrypto_1.openDataPlaneFrame)((0, P2PDataPlaneCrypto_1.keyForDirection)(this.keys, direction), this.sessionId, direction, envelope.sealed, this.inboundSequence);
+        this.inboundSequence += 1;
+        return JSON.parse(plaintext.toString('utf8'));
+    }
+    async acceptHello(envelope) {
+        if (this.keys) {
+            // A second hello would restart the key schedule mid-connection; refuse it.
+            throw new P2PDataPlaneCrypto_1.P2PDataPlaneSecurityError('Data plane secure handshake was repeated');
+        }
+        if (this.options.sessionId && envelope.sessionId && envelope.sessionId !== this.options.sessionId) {
+            throw new P2PDataPlaneCrypto_1.P2PDataPlaneSecurityError(`Data plane peer announced session ${envelope.sessionId}, expected ${this.options.sessionId}`);
+        }
+        const secret = await this.resolveSecret(envelope.sessionId);
+        if (!secret) {
+            throw new P2PDataPlaneCrypto_1.P2PDataPlaneSecurityError(`No data plane secret is available for session ${envelope.sessionId || '(none)'}`);
+        }
+        const peerNonce = Buffer.from(envelope.nonce, 'base64');
+        if (peerNonce.byteLength === 0) {
+            throw new P2PDataPlaneCrypto_1.P2PDataPlaneSecurityError('Data plane hello carried no nonce');
+        }
+        this.sessionId = this.options.sessionId ?? envelope.sessionId;
+        if (this.options.role === 'server') {
+            rememberClientNonce(this.sessionId, peerNonce);
+        }
+        const clientNonce = this.options.role === 'client' ? this.localNonce : peerNonce;
+        const serverNonce = this.options.role === 'server' ? this.localNonce : peerNonce;
+        this.keys = (0, P2PDataPlaneCrypto_1.deriveDataPlaneKeys)(secret, this.sessionId, clientNonce, serverNonce);
+        if (this.timer) {
+            clearTimeout(this.timer);
+            this.timer = undefined;
+        }
+        this.markReady();
+    }
+    async resolveSecret(sessionId) {
+        if (this.options.secret !== undefined) {
+            return normalizeSecret(this.options.secret);
+        }
+        if (!this.options.resolveSessionSecret) {
+            return undefined;
+        }
+        const resolved = await this.options.resolveSessionSecret(sessionId);
+        return resolved === undefined ? undefined : normalizeSecret(resolved);
+    }
+}
 class TcpP2PTransport {
     constructor(options) {
         this.options = options;
+        /** This transport carries chunk/end envelopes, so it may ask for streamed bodies. */
+        this.supportsStreaming = true;
         this.readBuffer = '';
         this.pending = new Map();
+        /** Serialises inbound processing so sealed sequence numbers stay in order. */
+        this.readChain = Promise.resolve();
         this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
         this.randomId = options.randomId ?? (() => `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`);
+        this.maxFrameBytes = options.maxFrameBytes ?? P2PDataPlane_1.P2P_DATA_PLANE_LIMITS.maxFrameBytes;
+        this.maxBodyBytes = options.maxBodyBytes ?? P2PDataPlane_1.P2P_DATA_PLANE_LIMITS.maxBodyBytes;
+        this.maxConcurrentRequests = options.maxConcurrentRequests ?? P2PDataPlane_1.P2P_DATA_PLANE_LIMITS.maxConcurrentRequests;
+        if (options.secure) {
+            this.secureSession = new SecureSession(options.secure, {
+                sendPlaintext: (envelope) => {
+                    if (this.socket) {
+                        writeEnvelope(this.socket, envelope);
+                    }
+                },
+                fail: (error) => {
+                    this.socket?.destroy();
+                    this.rejectPending(error);
+                },
+            });
+        }
         if (options.socket) {
             this.attachSocket(options.socket);
         }
     }
-    async request(frame) {
+    async request(frame, options = {}) {
+        if (options.signal?.aborted) {
+            throw new P2PDataPlane_1.P2PDataPlaneAbortError();
+        }
+        // Reject rather than queue: a peer that cannot keep up must see backpressure instead of
+        // silently growing an in-memory backlog (audit N17).
+        if (this.pending.size >= this.maxConcurrentRequests) {
+            throw new P2PDataPlane_1.P2PDataPlaneLimitError(`TCP P2P transport already has ${this.pending.size} requests in flight (max ${this.maxConcurrentRequests})`, 'maxConcurrentRequests');
+        }
         const requestId = frame.requestId ?? `tcp_${this.randomId()}`;
         const requestFrame = { ...frame, requestId };
+        if (requestFrame.bodyBase64 !== undefined && (0, P2PDataPlane_1.base64ByteLength)(requestFrame.bodyBase64) > this.maxBodyBytes) {
+            throw new P2PDataPlane_1.P2PDataPlaneLimitError(`TCP P2P request body exceeds ${this.maxBodyBytes} bytes`, 'maxBodyBytes');
+        }
+        // Connect first (that is what announces our nonce), then wait for the peer's hello: waiting
+        // before the socket exists would deadlock, because the handshake needs the connection.
         const socket = await this.ensureSocket();
+        if (this.secureSession) {
+            await this.secureSession.waitReady();
+        }
         const response = new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => {
-                this.pending.delete(requestId);
-                reject(new Error(`TCP P2P request ${requestId} timed out after ${this.timeoutMs}ms`));
-            }, this.timeoutMs);
-            this.pending.set(requestId, { resolve, reject, timeout });
+            const pending = {
+                resolve,
+                reject,
+                options,
+                streaming: false,
+            };
+            const armTimeout = () => {
+                clearTimeout(pending.timeout);
+                pending.timeout = setTimeout(() => {
+                    this.pending.delete(requestId);
+                    reject(new Error(`TCP P2P request ${requestId} timed out after ${this.timeoutMs}ms`));
+                }, this.timeoutMs);
+            };
+            this.pending.set(requestId, pending);
+            armTimeout();
+            if (options.signal) {
+                const onAbort = () => {
+                    if (!this.pending.delete(requestId)) {
+                        return;
+                    }
+                    clearTimeout(pending.timeout);
+                    // Tell the peer to stop working on a request nobody is waiting for any more.
+                    this.write(socket, { type: CANCEL_ENVELOPE, requestId, reason: 'client aborted' });
+                    reject(new P2PDataPlane_1.P2PDataPlaneAbortError());
+                };
+                options.signal.addEventListener('abort', onAbort, { once: true });
+                pending.detachAbort = () => options.signal?.removeEventListener('abort', onAbort);
+            }
         });
-        writeEnvelope(socket, { type: REQUEST_ENVELOPE, requestId, frame: requestFrame });
+        const line = JSON.stringify({ type: REQUEST_ENVELOPE, requestId, frame: requestFrame });
+        if (Buffer.byteLength(line, 'utf8') > this.maxFrameBytes) {
+            this.pending.delete(requestId);
+            throw new P2PDataPlane_1.P2PDataPlaneLimitError(`TCP P2P request frame exceeds ${this.maxFrameBytes} bytes`, 'maxFrameBytes');
+        }
+        this.write(socket, JSON.parse(line));
         return response;
     }
     close() {
@@ -102,38 +333,159 @@ class TcpP2PTransport {
         }
         return this.connectPromise;
     }
+    /**
+     * A connection that dies before the handshake completed failed to authenticate at all, so the
+     * caller is told that instead of a bare socket error it cannot act on.
+     */
+    abortSecure(error) {
+        if (!this.secureSession) {
+            this.rejectPending(error);
+            return;
+        }
+        if (!this.secureSession.isEstablished()) {
+            const handshakeError = new P2PDataPlaneCrypto_1.P2PDataPlaneSecurityError(`Data plane connection ended before the secure handshake completed (${error.message})`);
+            this.secureSession.abort(handshakeError);
+            this.rejectPending(handshakeError);
+            return;
+        }
+        // The session was sealed, so a drop while requests are in flight is reported as such: a
+        // peer that cannot authenticate looks exactly like this from here.
+        this.rejectPending(new P2PDataPlaneCrypto_1.P2PDataPlaneSecurityError(`Data plane sealed connection ended while requests were pending (${error.message})`));
+    }
+    /** Seals when the session is secure; the hello itself is the only plaintext envelope. */
+    write(socket, envelope) {
+        try {
+            writeEnvelope(socket, this.secureSession ? this.secureSession.seal(envelope) : envelope);
+        }
+        catch (error) {
+            this.rejectPending(error instanceof Error ? error : new Error(String(error)));
+            socket.destroy();
+        }
+    }
     attachSocket(socket) {
         this.socket = socket;
         socket.on('data', (chunk) => this.handleData(chunk));
-        socket.on('error', (error) => this.rejectPending(error));
-        socket.on('close', () => this.rejectPending(new Error('TCP P2P socket closed')));
+        socket.on('error', (error) => this.abortSecure(error));
+        socket.on('close', () => this.abortSecure(new Error('TCP P2P socket closed')));
+        if (this.secureSession) {
+            writeEnvelope(socket, this.secureSession.hello());
+        }
     }
     handleData(chunk) {
         this.readBuffer += chunk.toString('utf8');
+        if (Buffer.byteLength(this.readBuffer, 'utf8') > this.maxFrameBytes) {
+            // A line that never ends cannot be resynchronised: dropping the connection is the only
+            // bounded answer, and it must happen before the buffer grows without limit.
+            const error = new P2PDataPlane_1.P2PDataPlaneLimitError(`TCP P2P frame exceeds ${this.maxFrameBytes} bytes without a delimiter`, 'maxFrameBytes');
+            this.readBuffer = '';
+            this.socket?.destroy();
+            this.rejectPending(error);
+            return;
+        }
         const { lines, remainder } = splitLines(this.readBuffer);
         this.readBuffer = remainder;
-        for (const line of lines) {
-            const envelope = parseEnvelope(line);
-            if (!envelope || (envelope.type !== RESPONSE_ENVELOPE && envelope.type !== ERROR_ENVELOPE)) {
-                continue;
+        // Sealing is strictly ordered per direction, so inbound lines are processed one at a time.
+        this.readChain = this.readChain.then(async () => {
+            for (const line of lines) {
+                await this.processLine(line);
+            }
+        }).catch((error) => this.failSecure(error));
+    }
+    failSecure(error) {
+        const failure = error instanceof Error ? error : new Error(String(error));
+        this.socket?.destroy();
+        this.rejectPending(failure);
+    }
+    async processLine(line) {
+        {
+            const parsed = parseEnvelope(line);
+            if (!parsed) {
+                return;
+            }
+            // `open` returns undefined for handshake envelopes and throws on anything that is not a
+            // valid sealed frame, which tears the connection down instead of processing it.
+            const envelope = this.secureSession ? await this.secureSession.open(parsed) : parsed;
+            if (!envelope) {
+                return;
+            }
+            if (envelope.type === CHUNK_ENVELOPE) {
+                const pending = this.pending.get(envelope.requestId);
+                if (!pending) {
+                    return;
+                }
+                this.rearmTimeout(envelope.requestId, pending);
+                pending.options.onChunk?.(Buffer.from(envelope.chunkBase64, 'base64'));
+                return;
+            }
+            if (envelope.type === END_ENVELOPE) {
+                const pending = this.pending.get(envelope.requestId);
+                if (!pending) {
+                    return;
+                }
+                clearTimeout(pending.timeout);
+                pending.detachAbort?.();
+                this.pending.delete(envelope.requestId);
+                pending.options.onEnd?.();
+                return;
+            }
+            if (envelope.type !== RESPONSE_ENVELOPE && envelope.type !== ERROR_ENVELOPE) {
+                return;
             }
             const pending = this.pending.get(envelope.requestId);
             if (!pending) {
-                continue;
+                return;
             }
-            clearTimeout(pending.timeout);
-            this.pending.delete(envelope.requestId);
             if (envelope.type === ERROR_ENVELOPE) {
-                pending.reject(new Error(envelope.error));
-                continue;
+                clearTimeout(pending.timeout);
+                pending.detachAbort?.();
+                this.pending.delete(envelope.requestId);
+                const error = new Error(envelope.error);
+                if (pending.streaming) {
+                    // The head already reached the caller: the body can only fail, not reject again.
+                    pending.options.onError?.(error);
+                }
+                else {
+                    pending.reject(error);
+                }
+                return;
+            }
+            if (envelope.frame.streamed) {
+                // Head first: keep the entry so chunks and the end envelope find their callbacks.
+                pending.streaming = true;
+                this.rearmTimeout(envelope.requestId, pending);
+                pending.resolve(envelope.frame);
+                return;
             }
+            clearTimeout(pending.timeout);
+            pending.detachAbort?.();
+            this.pending.delete(envelope.requestId);
             pending.resolve(envelope.frame);
         }
     }
+    /** An in-flight stream is bounded by idle time, not by total duration (SSE never ends). */
+    rearmTimeout(requestId, pending) {
+        clearTimeout(pending.timeout);
+        pending.timeout = setTimeout(() => {
+            this.pending.delete(requestId);
+            const error = new Error(`TCP P2P request ${requestId} stalled for ${this.timeoutMs}ms`);
+            if (pending.streaming) {
+                pending.options.onError?.(error);
+            }
+            else {
+                pending.reject(error);
+            }
+        }, this.timeoutMs);
+    }
     rejectPending(error) {
         for (const [requestId, pending] of this.pending) {
             clearTimeout(pending.timeout);
-            pending.reject(error);
+            pending.detachAbort?.();
+            if (pending.streaming) {
+                pending.options.onError?.(error);
+            }
+            else {
+                pending.reject(error);
+            }
             this.pending.delete(requestId);
         }
     }
@@ -180,50 +532,191 @@ class TcpP2PServer {
     handleSocket(socket) {
         const handle = attachTcpP2PDataPlaneSocketInternal(socket, this.options.handler, () => {
             this.sockets.delete(handle);
-        });
+        }, this.options, this.options.secure);
         this.sockets.add(handle);
     }
 }
-function attachTcpP2PDataPlaneSocketInternal(socket, handler, onClose) {
+function attachTcpP2PDataPlaneSocketInternal(socket, handler, onClose, limits = {}, secure) {
+    const context = {
+        limits: {
+            maxFrameBytes: limits.maxFrameBytes ?? P2PDataPlane_1.P2P_DATA_PLANE_LIMITS.maxFrameBytes,
+            maxBodyBytes: limits.maxBodyBytes ?? P2PDataPlane_1.P2P_DATA_PLANE_LIMITS.maxBodyBytes,
+            maxConcurrentRequests: limits.maxConcurrentRequests ?? P2PDataPlane_1.P2P_DATA_PLANE_LIMITS.maxConcurrentRequests,
+        },
+        inFlight: new Map(),
+    };
+    const secureSession = secure
+        ? new SecureSession(secure, {
+            sendPlaintext: (envelope) => writeEnvelope(socket, envelope),
+            fail: (error) => {
+                abortInFlight(context, error);
+                socket.destroy();
+            },
+        })
+        : undefined;
     let readBuffer = '';
     const onData = (chunk) => {
         readBuffer += chunk.toString('utf8');
+        if (Buffer.byteLength(readBuffer, 'utf8') > context.limits.maxFrameBytes) {
+            // A line that never ends cannot be resynchronised, and buffering it is exactly the
+            // resource exhaustion this limit exists to stop.
+            readBuffer = '';
+            abortInFlight(context, new P2PDataPlane_1.P2PDataPlaneLimitError(`TCP P2P frame exceeds ${context.limits.maxFrameBytes} bytes without a delimiter`, 'maxFrameBytes'));
+            socket.destroy();
+            return;
+        }
         const split = splitLines(readBuffer);
         readBuffer = split.remainder;
-        for (const line of split.lines) {
-            void handleRequestLine(socket, handler, line);
-        }
+        // Decoding is sequential (sealed frames must be opened in order) but handling is not:
+        // awaiting a long request here would serialise the whole socket and make the concurrency
+        // ceiling meaningless.
+        readChain = readChain.then(async () => {
+            for (const line of split.lines) {
+                const envelope = await decodeLine(line, secureSession);
+                if (envelope) {
+                    void dispatchEnvelope(socket, handler, envelope, context, secureSession).catch(() => undefined);
+                }
+            }
+        }).catch((error) => {
+            abortInFlight(context, error instanceof Error ? error : new Error(String(error)));
+            socket.destroy();
+        });
     };
     const onSocketClose = () => {
+        abortInFlight(context, new P2PDataPlane_1.P2PDataPlaneAbortError('TCP P2P socket closed'));
         onClose?.();
     };
+    let readChain = Promise.resolve();
     socket.on('data', onData);
     socket.on('close', onSocketClose);
+    if (secureSession) {
+        // Announce our nonce immediately; the peer's hello is what unlocks sealed frames.
+        writeEnvelope(socket, secureSession.hello());
+    }
     return {
         close() {
             socket.off('data', onData);
             socket.off('close', onSocketClose);
+            abortInFlight(context, new P2PDataPlane_1.P2PDataPlaneAbortError('TCP P2P socket closed'));
             socket.destroy();
             onClose?.();
         },
     };
 }
-async function handleRequestLine(socket, handler, line) {
-    const envelope = parseEnvelope(line);
-    if (!envelope || envelope.type !== REQUEST_ENVELOPE) {
+function abortInFlight(context, error) {
+    for (const controller of context.inFlight.values()) {
+        controller.abort(error);
+    }
+    context.inFlight.clear();
+}
+/** Decodes one wire line, opening it when the connection is secure. */
+async function decodeLine(line, secureSession) {
+    const parsed = parseEnvelope(line);
+    if (!parsed) {
+        return undefined;
+    }
+    // A secure endpoint processes nothing that is not sealed, and `open` throws on tampering,
+    // reordering or a repeated handshake: the connection is dropped instead.
+    return secureSession ? await secureSession.open(parsed) : parsed;
+}
+async function dispatchEnvelope(socket, handler, envelope, context, secureSession) {
+    if (envelope.type === CANCEL_ENVELOPE) {
+        // The peer stopped waiting: abort the upstream work instead of finishing a response
+        // nobody will read.
+        context.inFlight.get(envelope.requestId)?.abort(new P2PDataPlane_1.P2PDataPlaneAbortError(envelope.reason ?? 'peer cancelled the request'));
+        return;
+    }
+    if (envelope.type !== REQUEST_ENVELOPE) {
+        return;
+    }
+    const requestId = envelope.requestId;
+    if (!requestId) {
+        return;
+    }
+    if (context.inFlight.has(requestId)) {
+        writeSealed(secureSession, socket, { type: ERROR_ENVELOPE, requestId, error: `Duplicate P2P request id ${requestId}` });
         return;
     }
+    if (context.inFlight.size >= context.limits.maxConcurrentRequests) {
+        writeSealed(secureSession, socket, {
+            type: ERROR_ENVELOPE,
+            requestId,
+            error: new P2PDataPlane_1.P2PDataPlaneLimitError(`TCP P2P socket already has ${context.inFlight.size} requests in flight (max ${context.limits.maxConcurrentRequests})`, 'maxConcurrentRequests').message,
+        });
+        return;
+    }
+    const controller = new AbortController();
+    context.inFlight.set(requestId, controller);
     try {
-        const response = await handler.handleRequest(envelope.frame);
-        writeEnvelope(socket, { type: RESPONSE_ENVELOPE, requestId: envelope.requestId, frame: response });
+        const response = await handler.handleRequest(envelope.frame, { signal: controller.signal });
+        if (controller.signal.aborted) {
+            return;
+        }
+        if (response.bodyStream) {
+            await writeStreamedResponse(socket, requestId, response, context.limits.maxFrameBytes, secureSession);
+            return;
+        }
+        writeSealed(secureSession, socket, { type: RESPONSE_ENVELOPE, requestId, frame: response });
     }
     catch (error) {
-        writeEnvelope(socket, {
+        if (controller.signal.aborted) {
+            return;
+        }
+        writeSealed(secureSession, socket, {
             type: ERROR_ENVELOPE,
-            requestId: envelope.requestId,
+            requestId,
             error: error instanceof Error ? error.message : String(error),
         });
     }
+    finally {
+        context.inFlight.delete(requestId);
+    }
+}
+/**
+ * Writes a body that is not fully buffered: head envelope first, then bounded chunks, then an
+ * end envelope. Chunk size is capped so a single frame stays well inside the frame limit.
+ */
+async function writeStreamedResponse(socket, requestId, frame, maxFrameBytes, secureSession) {
+    const { bodyStream, ...head } = frame;
+    writeSealed(secureSession, socket, {
+        type: RESPONSE_ENVELOPE,
+        requestId,
+        frame: { ...head, bodyBase64: undefined, streamed: true },
+    });
+    if (!bodyStream) {
+        writeSealed(secureSession, socket, { type: END_ENVELOPE, requestId });
+        return;
+    }
+    const reader = bodyStream.getReader();
+    const chunkBytes = Math.min(P2PDataPlane_1.P2P_DATA_PLANE_LIMITS.chunkBytes, Math.max(1, Math.floor(maxFrameBytes / 2)));
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done) {
+                break;
+            }
+            // Flush every read immediately: buffering until a full chunk accumulates would hold an
+            // SSE event until the next one arrives, which is exactly the streaming failure N17 names.
+            // `chunkBytes` only bounds how large a single frame may get, it does not delay a chunk.
+            let pending = Buffer.from(value);
+            while (pending.byteLength > 0) {
+                const slice = pending.subarray(0, chunkBytes);
+                writeChunkEnvelope(socket, requestId, slice, secureSession);
+                pending = pending.subarray(slice.byteLength);
+            }
+        }
+        writeSealed(secureSession, socket, { type: END_ENVELOPE, requestId });
+    }
+    finally {
+        reader.releaseLock?.();
+    }
+}
+function writeChunkEnvelope(socket, requestId, chunk, secureSession) {
+    writeSealed(secureSession, socket, { type: CHUNK_ENVELOPE, requestId, chunkBase64: chunk.toString('base64') });
+}
+/** Seals when the connection is secure, writes directly otherwise. */
+function writeSealed(secureSession, socket, envelope) {
+    writeEnvelope(socket, secureSession ? secureSession.seal(envelope) : envelope);
 }
 function writeEnvelope(socket, envelope) {
     socket.write(`${JSON.stringify(envelope)}\n`);
@@ -244,6 +737,21 @@ function parseEnvelope(line) {
         if (parsed.type === ERROR_ENVELOPE && typeof parsed.requestId === 'string' && typeof parsed.error === 'string') {
             return parsed;
         }
+        if (parsed.type === CHUNK_ENVELOPE && typeof parsed.requestId === 'string' && typeof parsed.chunkBase64 === 'string') {
+            return parsed;
+        }
+        if (parsed.type === END_ENVELOPE && typeof parsed.requestId === 'string') {
+            return parsed;
+        }
+        if (parsed.type === CANCEL_ENVELOPE && typeof parsed.requestId === 'string') {
+            return parsed;
+        }
+        if (parsed.type === SEALED_ENVELOPE && parsed.sealed && typeof parsed.sealed.ciphertext === 'string') {
+            return parsed;
+        }
+        if (parsed.type === HELLO_ENVELOPE && typeof parsed.nonce === 'string' && typeof parsed.sessionId === 'string') {
+            return parsed;
+        }
     }
     catch {
         return undefined;