iosignal 5.3.0 → 6.1.0

package/dist/node/iosignal.js

@@ -2,19 +2,19 @@ import require$$0$2, { Transform } from 'stream';
 import net from 'net';
 import require$$0$3 from 'events';
 import require$$1$1 from 'https';
-import require$$2$2 from 'http';
+import require$$2$1 from 'http';
 import require$$4 from 'tls';
 import require$$1 from 'crypto';
 import require$$7 from 'url';
 import require$$0 from 'zlib';
-import fs, { readFileSync } from 'fs';
-import path from 'path';
-import require$$2, { networkInterfaces } from 'os';
 import require$$0$1 from 'buffer';
-import require$$2$1 from 'util';
+import require$$2 from 'util';
+import { networkInterfaces } from 'os';
+import fs, { readFileSync } from 'fs';
 import { memoryUsage } from 'process';
+import path from 'path';
 
-var version$1 = "5.3.0";
+var version$1 = "6.1.0";
 var pkg = {
 	version: version$1};
 
@@ -665,6 +665,7 @@ const encoder$2 = new TextEncoder();
 function getSignalPack(tag, ...args) {
   if (typeof tag !== 'string') throw TypeError('tag should be string.')
   let tagEncoded = encoder$2.encode(tag);
+  if (tagEncoded.byteLength > SIZE_LIMIT.TAG_LEN1) throw TypeError('tag UTF-8 byte length exceeds 255')
   let payload = parsePayload(args);
 
   let sigPack;
@@ -772,6 +773,16 @@ const Buffer$1 = $$1.Buffer;
 const encoder$1 = new TextEncoder();
 const decoder$4 = new TextDecoder();
 
+// Wire tag lengths use one byte, regardless of JavaScript string length.
+function encodeTag(tag, allowEmpty = true) {
+  if (typeof tag !== 'string') throw TypeError('tag should be string.')
+  const encoded = encoder$1.encode(tag);
+  if ((!allowEmpty && encoded.byteLength === 0) || encoded.byteLength > SIZE_LIMIT.TAG_LEN1) {
+    throw TypeError('tag UTF-8 byte length must be ' + (allowEmpty ? '0' : '1') + '~255')
+  }
+  return encoded
+}
+
 function byteToUrl(buffer) {
   //ipv4(4bytes) , port(2bytes)
   if (buffer.byteLength != 6) return
@@ -1306,10 +1317,10 @@ class IOCore extends EventEmitter {
           switch (payloadType) {
 
             case PAYLOAD_TYPE.EMPTY:
-              if (tag.indexOf('@') === 0) this.emit('@', tag, null);
+              if (tag.indexOf('@') === 0) this.emit('@', tag);
               else {
-                this.emit(tag, tag, null);
-                this.emit('message', tag, null);
+                this.emit(tag, tag);
+                this.emit('message', tag);
               }
               break;
 
@@ -1593,6 +1604,7 @@ class IOCore extends EventEmitter {
    */
   signal(tag, ...args) {
     if (typeof tag !== 'string') throw TypeError('tag should be string.')
+    if (tag.startsWith('@') && this.cid) encodeTag(this.cid + tag);
     let signalPack = getSignalPack(tag, ...args);
     this.send_enc_mode(signalPack);
   }
@@ -1616,9 +1628,9 @@ class IOCore extends EventEmitter {
    */
   signal_e2e(tag, data, key) {
 
+    const tagEncoded = encodeTag(tag);
+    if (tag.startsWith('@') && this.cid) encodeTag(this.cid + tag);
     if( !this.boho.isAuthorized ) return;
-    if (typeof tag !== 'string') throw TypeError('tag should be string.')
-    let tagEncoded = encoder$1.encode(tag);
     let dataPack = $$1.B8(data);
 
     //encrypt payload area with key
@@ -1703,39 +1715,37 @@ class IOCore extends EventEmitter {
    * @throws {TypeError} If tag is not a string or exceeds length limit.
    */
   subscribe(tag) {
-    if (typeof tag !== 'string') throw TypeError('tag should be string.')
-    if (tag.length > SIZE_LIMIT.TAG_LEN1) throw TypeError('please check tag string length limit:' + SIZE_LIMIT.TAG_LEN1)
-
-    try {
-      let tagEncoded = encoder$1.encode(tag);
-      this.send_enc_mode(
-        Buffer$1.concat([
-          $$1.NB('8', IOMsg.SUBSCRIBE),
-          $$1.NB('8', tagEncoded.byteLength),
-          tagEncoded]));
-    } catch (error) { }
-
+    const tagEncoded = encodeTag(tag);
+    this.send_enc_mode(Buffer$1.concat([
+      $$1.NB('8', IOMsg.SUBSCRIBE),
+      $$1.NB('8', tagEncoded.byteLength),
+      tagEncoded]));
   }
 
 
   /**
-   * Subscribes stored channels.
-   * called client state become 'ready'
+   * Sends subscriptions stored by listen()/link() on each CID-ready transition,
+   * including reconnection. This automates subscription setup for simple clients.
    */
   subscribe_channels() {
-    if (this.state !== STATE.READY) return
-    if (this.channels.size == 0) return
-    let tag = Array.from(this.channels).join(',');
-
-    try {
-      let tagEncoded = encoder$1.encode(tag);
-      this.send_enc_mode(
-        Buffer$1.concat([
-          $$1.NB('8', IOMsg.SUBSCRIBE),
-          $$1.NB('8', tagEncoded.byteLength),
-          tagEncoded]));
-    } catch (error) { }
-
+    if (this.state !== STATE.READY || this.channels.size === 0) return
+    // Validate the entire list first, then split only at tag boundaries.
+    // Preserve comma-separated entries accepted by existing registration APIs.
+    const tags = Array.from(this.channels).join(',').split(',');
+    const sizes = tags.map(tag => encodeTag(tag).byteLength);
+    const batches = [];
+    let batch = [], bytes = 0;
+    tags.forEach((tag, i) => {
+      if (batch.length && bytes + 1 + sizes[i] > SIZE_LIMIT.TAG_LEN1) {
+        batches.push(batch.join(','));
+        batch = [];
+        bytes = 0;
+      }
+      bytes += (batch.length ? 1 : 0) + sizes[i];
+      batch.push(tag);
+    });
+    if (batch.length) batches.push(batch.join(','));
+    batches.forEach(tag => this.subscribe(tag));
   }
 
   /**
@@ -1744,7 +1754,7 @@ class IOCore extends EventEmitter {
    * @throws {TypeError} If tag is not a string or exceeds length limit.
    */
   unsubscribe(tag = "") {
-    if (typeof tag !== 'string') throw TypeError('tag should be string.')
+    const tagEncoded = encodeTag(tag);
 
     if (tag == "") { // blank tag means unsubscribe all
       this.channels.clear();
@@ -1755,8 +1765,6 @@ class IOCore extends EventEmitter {
       });
     }
 
-    let tagEncoded = encoder$1.encode(tag);
-    if (tagEncoded.byteLength > SIZE_LIMIT.TAG_LEN1) throw TypeError('please use tag string bytelength below:' + SIZE_LIMIT.TAG_LEN1)
 
     this.send_enc_mode(Buffer$1.concat([
       $$1.NB('8', IOMsg.UNSUBSCRIBE),
@@ -1766,22 +1774,28 @@ class IOCore extends EventEmitter {
 
 
   /**
-   * Listens for signals on a specific tag.
+   * Convenience API for simple clients (for example, CLI tools): register a
+   * tag handler once and remember its subscription in channels. Register before
+   * connection readiness; the CID-ready flow subscribes on initial connection
+   * and again after reconnect, without application-level ready/subscribe code.
+   * This does not send a subscription immediately, even if already ready.
+   * For precise subscription/send ordering or dynamic subscriptions, use
+   * on() with subscribe() in a ready handler instead. Direct signals use on('@').
    * @param {string} tag - The tag to listen on.
    * @param {Function} handler - The callback function to handle the signal.
    * @throws {TypeError} If tag is not a string, handler is not a function, or tag length is invalid.
    */
   listen(tag, handler) {
     if (typeof tag !== 'string') throw TypeError('tag should be string.')
-    if (tag.length > 255 || tag.length == 0) throw TypeError('tag string length range: 1~255')
+    encodeTag(tag, false);
     if (typeof handler !== 'function') throw TypeError('handler is not a function.')
 
     if (tag.indexOf('@') !== 0) {
       this.channels.add(tag);
     }
     this.on(tag, handler);
-    // do not subscribe now.
-    // will subscribe when io state is 'ready'. (receive CID_RES from server)
+    // Subscribe from the CID-ready flow, initially and after reconnect.
+    // Keep registration separate from immediate subscription/send ordering.
 
   }
 
@@ -1797,7 +1811,7 @@ class IOCore extends EventEmitter {
   link(to, tag, handler) {
     if (typeof to !== 'string') throw TypeError('to(local link target) is not a string.')
     if (typeof tag !== 'string') throw TypeError('tag is not a string.')
-    if (tag.length > 255 || tag.length == 0) throw TypeError('tag string length range: 1~255')
+    encodeTag(tag, false);
     if (typeof handler !== 'function') throw TypeError('handler is not a function.')
 
     if (tag.indexOf('@') !== 0) {
@@ -1828,7 +1842,7 @@ class IOCore extends EventEmitter {
   unlink(to, tag) {
     if (typeof to !== 'string') throw TypeError('to(local link target) is not a string.')
     if (typeof tag !== 'string') throw TypeError('tag is not a string.')
-    if (tag.length > 255 || tag.length == 0) throw TypeError('tag string length range: 1~255')
+    encodeTag(tag, false);
 
     const linkSet = this.linkMap.get(to);
     if (!linkSet || !linkSet.has(tag)) return;
@@ -2193,300 +2207,6 @@ function requireConstants () {
 	return constants;
 }
 
-var bufferutil = {exports: {}};
-
-function commonjsRequire(path) {
-	throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.');
-}
-
-var nodeGypBuild$1 = {exports: {}};
-
-var nodeGypBuild;
-var hasRequiredNodeGypBuild$1;
-
-function requireNodeGypBuild$1 () {
-	if (hasRequiredNodeGypBuild$1) return nodeGypBuild;
-	hasRequiredNodeGypBuild$1 = 1;
-	var fs$1 = fs;
-	var path$1 = path;
-	var os = require$$2;
-
-	// Workaround to fix webpack's build warnings: 'the request of a dependency is an expression'
-	var runtimeRequire = typeof __webpack_require__ === 'function' ? __non_webpack_require__ : commonjsRequire; // eslint-disable-line
-
-	var vars = (process.config && process.config.variables) || {};
-	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
-	var abi = process.versions.modules; // TODO: support old node where this is undef
-	var runtime = isElectron() ? 'electron' : (isNwjs() ? 'node-webkit' : 'node');
-
-	var arch = process.env.npm_config_arch || os.arch();
-	var platform = process.env.npm_config_platform || os.platform();
-	var libc = process.env.LIBC || (isAlpine(platform) ? 'musl' : 'glibc');
-	var armv = process.env.ARM_VERSION || (arch === 'arm64' ? '8' : vars.arm_version) || '';
-	var uv = (process.versions.uv || '').split('.')[0];
-
-	nodeGypBuild = load;
-
-	function load (dir) {
-	  return runtimeRequire(load.resolve(dir))
-	}
-
-	load.resolve = load.path = function (dir) {
-	  dir = path$1.resolve(dir || '.');
-
-	  try {
-	    var name = runtimeRequire(path$1.join(dir, 'package.json')).name.toUpperCase().replace(/-/g, '_');
-	    if (process.env[name + '_PREBUILD']) dir = process.env[name + '_PREBUILD'];
-	  } catch (err) {}
-
-	  if (!prebuildsOnly) {
-	    var release = getFirst(path$1.join(dir, 'build/Release'), matchBuild);
-	    if (release) return release
-
-	    var debug = getFirst(path$1.join(dir, 'build/Debug'), matchBuild);
-	    if (debug) return debug
-	  }
-
-	  var prebuild = resolve(dir);
-	  if (prebuild) return prebuild
-
-	  var nearby = resolve(path$1.dirname(process.execPath));
-	  if (nearby) return nearby
-
-	  var target = [
-	    'platform=' + platform,
-	    'arch=' + arch,
-	    'runtime=' + runtime,
-	    'abi=' + abi,
-	    'uv=' + uv,
-	    armv ? 'armv=' + armv : '',
-	    'libc=' + libc,
-	    'node=' + process.versions.node,
-	    process.versions.electron ? 'electron=' + process.versions.electron : '',
-	    typeof __webpack_require__ === 'function' ? 'webpack=true' : '' // eslint-disable-line
-	  ].filter(Boolean).join(' ');
-
-	  throw new Error('No native build was found for ' + target + '\n    loaded from: ' + dir + '\n')
-
-	  function resolve (dir) {
-	    // Find matching "prebuilds/<platform>-<arch>" directory
-	    var tuples = readdirSync(path$1.join(dir, 'prebuilds')).map(parseTuple);
-	    var tuple = tuples.filter(matchTuple(platform, arch)).sort(compareTuples)[0];
-	    if (!tuple) return
-
-	    // Find most specific flavor first
-	    var prebuilds = path$1.join(dir, 'prebuilds', tuple.name);
-	    var parsed = readdirSync(prebuilds).map(parseTags);
-	    var candidates = parsed.filter(matchTags(runtime, abi));
-	    var winner = candidates.sort(compareTags(runtime))[0];
-	    if (winner) return path$1.join(prebuilds, winner.file)
-	  }
-	};
-
-	function readdirSync (dir) {
-	  try {
-	    return fs$1.readdirSync(dir)
-	  } catch (err) {
-	    return []
-	  }
-	}
-
-	function getFirst (dir, filter) {
-	  var files = readdirSync(dir).filter(filter);
-	  return files[0] && path$1.join(dir, files[0])
-	}
-
-	function matchBuild (name) {
-	  return /\.node$/.test(name)
-	}
-
-	function parseTuple (name) {
-	  // Example: darwin-x64+arm64
-	  var arr = name.split('-');
-	  if (arr.length !== 2) return
-
-	  var platform = arr[0];
-	  var architectures = arr[1].split('+');
-
-	  if (!platform) return
-	  if (!architectures.length) return
-	  if (!architectures.every(Boolean)) return
-
-	  return { name, platform, architectures }
-	}
-
-	function matchTuple (platform, arch) {
-	  return function (tuple) {
-	    if (tuple == null) return false
-	    if (tuple.platform !== platform) return false
-	    return tuple.architectures.includes(arch)
-	  }
-	}
-
-	function compareTuples (a, b) {
-	  // Prefer single-arch prebuilds over multi-arch
-	  return a.architectures.length - b.architectures.length
-	}
-
-	function parseTags (file) {
-	  var arr = file.split('.');
-	  var extension = arr.pop();
-	  var tags = { file: file, specificity: 0 };
-
-	  if (extension !== 'node') return
-
-	  for (var i = 0; i < arr.length; i++) {
-	    var tag = arr[i];
-
-	    if (tag === 'node' || tag === 'electron' || tag === 'node-webkit') {
-	      tags.runtime = tag;
-	    } else if (tag === 'napi') {
-	      tags.napi = true;
-	    } else if (tag.slice(0, 3) === 'abi') {
-	      tags.abi = tag.slice(3);
-	    } else if (tag.slice(0, 2) === 'uv') {
-	      tags.uv = tag.slice(2);
-	    } else if (tag.slice(0, 4) === 'armv') {
-	      tags.armv = tag.slice(4);
-	    } else if (tag === 'glibc' || tag === 'musl') {
-	      tags.libc = tag;
-	    } else {
-	      continue
-	    }
-
-	    tags.specificity++;
-	  }
-
-	  return tags
-	}
-
-	function matchTags (runtime, abi) {
-	  return function (tags) {
-	    if (tags == null) return false
-	    if (tags.runtime && tags.runtime !== runtime && !runtimeAgnostic(tags)) return false
-	    if (tags.abi && tags.abi !== abi && !tags.napi) return false
-	    if (tags.uv && tags.uv !== uv) return false
-	    if (tags.armv && tags.armv !== armv) return false
-	    if (tags.libc && tags.libc !== libc) return false
-
-	    return true
-	  }
-	}
-
-	function runtimeAgnostic (tags) {
-	  return tags.runtime === 'node' && tags.napi
-	}
-
-	function compareTags (runtime) {
-	  // Precedence: non-agnostic runtime, abi over napi, then by specificity.
-	  return function (a, b) {
-	    if (a.runtime !== b.runtime) {
-	      return a.runtime === runtime ? -1 : 1
-	    } else if (a.abi !== b.abi) {
-	      return a.abi ? -1 : 1
-	    } else if (a.specificity !== b.specificity) {
-	      return a.specificity > b.specificity ? -1 : 1
-	    } else {
-	      return 0
-	    }
-	  }
-	}
-
-	function isNwjs () {
-	  return !!(process.versions && process.versions.nw)
-	}
-
-	function isElectron () {
-	  if (process.versions && process.versions.electron) return true
-	  if (process.env.ELECTRON_RUN_AS_NODE) return true
-	  return typeof window !== 'undefined' && window.process && window.process.type === 'renderer'
-	}
-
-	function isAlpine (platform) {
-	  return platform === 'linux' && fs$1.existsSync('/etc/alpine-release')
-	}
-
-	// Exposed for unit tests
-	// TODO: move to lib
-	load.parseTags = parseTags;
-	load.matchTags = matchTags;
-	load.compareTags = compareTags;
-	load.parseTuple = parseTuple;
-	load.matchTuple = matchTuple;
-	load.compareTuples = compareTuples;
-	return nodeGypBuild;
-}
-
-var hasRequiredNodeGypBuild;
-
-function requireNodeGypBuild () {
-	if (hasRequiredNodeGypBuild) return nodeGypBuild$1.exports;
-	hasRequiredNodeGypBuild = 1;
-	const runtimeRequire = typeof __webpack_require__ === 'function' ? __non_webpack_require__ : commonjsRequire; // eslint-disable-line
-	if (typeof runtimeRequire.addon === 'function') { // if the platform supports native resolving prefer that
-	  nodeGypBuild$1.exports = runtimeRequire.addon.bind(runtimeRequire);
-	} else { // else use the runtime version here
-	  nodeGypBuild$1.exports = requireNodeGypBuild$1();
-	}
-	return nodeGypBuild$1.exports;
-}
-
-var fallback$1;
-var hasRequiredFallback$1;
-
-function requireFallback$1 () {
-	if (hasRequiredFallback$1) return fallback$1;
-	hasRequiredFallback$1 = 1;
-
-	/**
-	 * Masks a buffer using the given mask.
-	 *
-	 * @param {Buffer} source The buffer to mask
-	 * @param {Buffer} mask The mask to use
-	 * @param {Buffer} output The buffer where to store the result
-	 * @param {Number} offset The offset at which to start writing
-	 * @param {Number} length The number of bytes to mask.
-	 * @public
-	 */
-	const mask = (source, mask, output, offset, length) => {
-	  for (var i = 0; i < length; i++) {
-	    output[offset + i] = source[i] ^ mask[i & 3];
-	  }
-	};
-
-	/**
-	 * Unmasks a buffer using the given mask.
-	 *
-	 * @param {Buffer} buffer The buffer to unmask
-	 * @param {Buffer} mask The mask to use
-	 * @public
-	 */
-	const unmask = (buffer, mask) => {
-	  // Required until https://github.com/nodejs/node/issues/9006 is resolved.
-	  const length = buffer.length;
-	  for (var i = 0; i < length; i++) {
-	    buffer[i] ^= mask[i & 3];
-	  }
-	};
-
-	fallback$1 = { mask, unmask };
-	return fallback$1;
-}
-
-var hasRequiredBufferutil;
-
-function requireBufferutil () {
-	if (hasRequiredBufferutil) return bufferutil.exports;
-	hasRequiredBufferutil = 1;
-
-	try {
-	  bufferutil.exports = requireNodeGypBuild()(__dirname);
-	} catch (e) {
-	  bufferutil.exports = requireFallback$1();
-	}
-	return bufferutil.exports;
-}
-
 var hasRequiredBufferUtil;
 
 function requireBufferUtil () {
@@ -2607,7 +2327,7 @@ function requireBufferUtil () {
 	/* istanbul ignore else  */
 	if (!process.env.WS_NO_BUFFER_UTIL) {
 	  try {
-	    const bufferUtil$1 = requireBufferutil();
+	    const bufferUtil$1 = require('bufferutil');
 
 	    bufferUtil.exports.mask = function (source, mask, output, offset, length) {
 	      if (length < 48) _mask(source, mask, output, offset, length);
@@ -3228,92 +2948,6 @@ function requirePermessageDeflate () {
 
 var validation = {exports: {}};
 
-var utf8Validate = {exports: {}};
-
-var fallback;
-var hasRequiredFallback;
-
-function requireFallback () {
-	if (hasRequiredFallback) return fallback;
-	hasRequiredFallback = 1;
-
-	/**
-	 * Checks if a given buffer contains only correct UTF-8.
-	 * Ported from https://www.cl.cam.ac.uk/%7Emgk25/ucs/utf8_check.c by
-	 * Markus Kuhn.
-	 *
-	 * @param {Buffer} buf The buffer to check
-	 * @return {Boolean} `true` if `buf` contains only correct UTF-8, else `false`
-	 * @public
-	 */
-	function isValidUTF8(buf) {
-	  const len = buf.length;
-	  let i = 0;
-
-	  while (i < len) {
-	    if ((buf[i] & 0x80) === 0x00) {  // 0xxxxxxx
-	      i++;
-	    } else if ((buf[i] & 0xe0) === 0xc0) {  // 110xxxxx 10xxxxxx
-	      if (
-	        i + 1 === len ||
-	        (buf[i + 1] & 0xc0) !== 0x80 ||
-	        (buf[i] & 0xfe) === 0xc0  // overlong
-	      ) {
-	        return false;
-	      }
-
-	      i += 2;
-	    } else if ((buf[i] & 0xf0) === 0xe0) {  // 1110xxxx 10xxxxxx 10xxxxxx
-	      if (
-	        i + 2 >= len ||
-	        (buf[i + 1] & 0xc0) !== 0x80 ||
-	        (buf[i + 2] & 0xc0) !== 0x80 ||
-	        buf[i] === 0xe0 && (buf[i + 1] & 0xe0) === 0x80 ||  // overlong
-	        buf[i] === 0xed && (buf[i + 1] & 0xe0) === 0xa0  // surrogate (U+D800 - U+DFFF)
-	      ) {
-	        return false;
-	      }
-
-	      i += 3;
-	    } else if ((buf[i] & 0xf8) === 0xf0) {  // 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
-	      if (
-	        i + 3 >= len ||
-	        (buf[i + 1] & 0xc0) !== 0x80 ||
-	        (buf[i + 2] & 0xc0) !== 0x80 ||
-	        (buf[i + 3] & 0xc0) !== 0x80 ||
-	        buf[i] === 0xf0 && (buf[i + 1] & 0xf0) === 0x80 ||  // overlong
-	        buf[i] === 0xf4 && buf[i + 1] > 0x8f || buf[i] > 0xf4  // > U+10FFFF
-	      ) {
-	        return false;
-	      }
-
-	      i += 4;
-	    } else {
-	      return false;
-	    }
-	  }
-
-	  return true;
-	}
-
-	fallback = isValidUTF8;
-	return fallback;
-}
-
-var hasRequiredUtf8Validate;
-
-function requireUtf8Validate () {
-	if (hasRequiredUtf8Validate) return utf8Validate.exports;
-	hasRequiredUtf8Validate = 1;
-
-	try {
-	  utf8Validate.exports = requireNodeGypBuild()(__dirname);
-	} catch (e) {
-	  utf8Validate.exports = requireFallback();
-	}
-	return utf8Validate.exports;
-}
-
 var hasRequiredValidation;
 
 function requireValidation () {
@@ -3461,7 +3095,7 @@ function requireValidation () {
 	  };
 	} /* istanbul ignore else  */ else if (!process.env.WS_NO_UTF_8_VALIDATE) {
 	  try {
-	    const isValidUTF8 = requireUtf8Validate();
+	    const isValidUTF8 = require('utf-8-validate');
 
 	    validation.exports.isValidUTF8 = function (buf) {
 	      return buf.length < 32 ? _isValidUTF8(buf) : isValidUTF8(buf);
@@ -4237,7 +3871,7 @@ function requireSender () {
 	const { randomFillSync } = require$$1;
 	const {
 	  types: { isUint8Array }
-	} = require$$2$1;
+	} = require$$2;
 
 	const PerMessageDeflate = requirePermessageDeflate();
 	const { EMPTY_BUFFER, kWebSocket, NOOP } = requireConstants();
@@ -5361,7 +4995,7 @@ function requireWebsocket () {
 
 	const EventEmitter = require$$0$3;
 	const https = require$$1$1;
-	const http = require$$2$2;
+	const http = require$$2$1;
 	const net$1 = net;
 	const tls = require$$4;
 	const { randomBytes, createHash } = require$$1;
@@ -7030,7 +6664,7 @@ function requireWebsocketServer () {
 	hasRequiredWebsocketServer = 1;
 
 	const EventEmitter = require$$0$3;
-	const http = require$$2$2;
+	const http = require$$2$1;
 	const { Duplex } = require$$0$2;
 	const { createHash } = require$$1;
 
@@ -8697,7 +8331,7 @@ class Manager {
     }
 
     this.remotes.delete(remote);
-    this.cid2remote.delete(remote.cid);
+    if (this.cid2remote.get(remote.cid) === remote) this.cid2remote.delete(remote.cid);
     remote = null;
 
   }
@@ -8727,6 +8361,7 @@ class Manager {
     let tagLen = buffer.readUint8(1);
     let newTagBuf = encoder.encode(newTag);
     let newTagLen = newTagBuf.byteLength;
+    if (newTagLen > SIZE_LIMIT.TAG_LEN1) return null;
     let payloadCunk = buffer.subarray(2 + tagLen);
     let newBuffer = Buffer.concat([Buffer.from([msgType, newTagLen]), newTagBuf, payloadCunk]);
     return newBuffer
@@ -8764,6 +8399,7 @@ class Manager {
   }
 
   sender(tag, remote, message) {
+    if (encoder.encode(tag).byteLength > SIZE_LIMIT.TAG_LEN1) return ['err', 'Tag exceeds 255 UTF-8 bytes']
     if (serverOption.membersOnly && !remote.boho.isAuthorized) {
       // console.log("### server reject client signal reason: [membersOnly]" ,tag, remote.cid  )
       remote.send(Buffer.from([IOMsg.AUTH_CLEAR]));
@@ -8780,6 +8416,7 @@ class Manager {
       // modify signalpack with cid_appneded tag.
       tag = remote.cid + tag;
       message = this.getNewSignalTagMessage(message, tag);
+      if (!message) return ['err', 'CID-prefixed tag exceeds 255 UTF-8 bytes']
 
     } else if (cidIndex > 0) {
       // uni-cast.  
@@ -8789,6 +8426,7 @@ class Manager {
         let ommitCIdTag = '@' + tag.split('@')[1];
         // console.log('uni-cast tag change from', tag, 'to' , ommitCIdTag )
         message = this.getNewSignalTagMessage(message, ommitCIdTag);
+        if (!message) return ['err', 'Tag exceeds 255 UTF-8 bytes']
         // console.log(`origin tag: ${tag} omitTag: ${this.getSignalTag(message)}`)
         this.cid2remote.get(targetCId).send_enc_mode(message);
         return ['ok', 1]
@@ -9265,6 +8903,7 @@ class BohoAuth {
   }
 
   send_auth_fail(peer, reason) {
+    peer.boho.isAuthorized = false;
     if (this.authLogger) {
       let peerInfo = `FAIL #${peer.ssid} reason:${reason} `;
       this.authLogger.log(peerInfo);
@@ -9342,6 +8981,7 @@ class BohoAuth {
           $$1.MB('#reason', 'duplicate login.')
         );
         if (this.keepOldConnection) { // default true
+          peer.boho.isAuthorized = false;
           // keep old connection. reject new connection by sending auth_fail signal.
           // peer.send(authClearSignal)
           if( peer.socketType == 'websocket'){
@@ -9352,9 +8992,9 @@ class BohoAuth {
         } else {
           // accept new connection. stop the old connection by sending auth_clear signal.
           old.send(authClearSignal);
-          peer.close();
+          old.close();
         }
-        return
+        if (this.keepOldConnection) return
       }
 
       //6. delete current (or anonymouse)cid if exist.