iosignal 5.3.0 → 6.1.1

package/dist/node/iosignal.cjs

@@ -4,19 +4,19 @@ var require$$0 = require('stream');
 var net = require('net');
 var require$$0$3 = require('events');
 var require$$1$1 = require('https');
-var require$$2$2 = require('http');
+var require$$2$1 = require('http');
 var require$$4 = require('tls');
 var require$$1 = require('crypto');
 var require$$7 = require('url');
 var require$$0$1 = require('zlib');
-var fs = require('fs');
-var path = require('path');
-var require$$2 = require('os');
 var require$$0$2 = require('buffer');
-var require$$2$1 = require('util');
+var require$$2 = require('util');
+var os = require('os');
+var fs = require('fs');
 var process$1 = require('process');
+var path = require('path');
 
-var version$1 = "5.3.0";
+var version$1 = "6.1.1";
 var pkg = {
 	version: version$1};
 
@@ -667,6 +667,7 @@ const encoder$2 = new TextEncoder();
 function getSignalPack(tag, ...args) {
   if (typeof tag !== 'string') throw TypeError('tag should be string.')
   let tagEncoded = encoder$2.encode(tag);
+  if (tagEncoded.byteLength > SIZE_LIMIT.TAG_LEN1) throw TypeError('tag UTF-8 byte length exceeds 255')
   let payload = parsePayload(args);
 
   let sigPack;
@@ -774,6 +775,16 @@ const Buffer$1 = $$1.Buffer;
 const encoder$1 = new TextEncoder();
 const decoder$4 = new TextDecoder();
 
+// Wire tag lengths use one byte, regardless of JavaScript string length.
+function encodeTag(tag, allowEmpty = true) {
+  if (typeof tag !== 'string') throw TypeError('tag should be string.')
+  const encoded = encoder$1.encode(tag);
+  if ((!allowEmpty && encoded.byteLength === 0) || encoded.byteLength > SIZE_LIMIT.TAG_LEN1) {
+    throw TypeError('tag UTF-8 byte length must be ' + (allowEmpty ? '0' : '1') + '~255')
+  }
+  return encoded
+}
+
 function byteToUrl(buffer) {
   //ipv4(4bytes) , port(2bytes)
   if (buffer.byteLength != 6) return
@@ -823,6 +834,7 @@ class IOCore extends EventEmitter {
      * @type {string}
      */
     this.stateName = this.getStateName(); // String type
+    this._stateRevision = 0;
 
     /**
      * Transmitted message counter.
@@ -959,14 +971,14 @@ class IOCore extends EventEmitter {
    * If autoReconnect is false, it also clears the keep-alive timer.
    */
   close() {
-    if (this._closed) return;
-    this._closed = true;
     // console.log('####### IOCOre.js close() called')
     // If auto-reconnect is disabled, we must stop the keep-alive timer.
     if (this.autoReconnect === false) {
       clearInterval(this.connectionCheckerIntervalID);
       this.connectionCheckerIntervalID = null;
     }
+    if (this._closed) return;
+    this._closed = true;
 
     // socket clean
     if (this.socket) {
@@ -989,8 +1001,11 @@ class IOCore extends EventEmitter {
       this.socket = null;
     }
     this.promiseMap.clear();
-    this.emit('closed');
-    this.stateChange('closed');
+    this.cid = '';
+    if (this.boho) this.boho.isAuthorized = false;
+    if (this.state !== STATE.STOP && this.stateChange('closed')) {
+      this.emit('closed');
+    }
   }
   
   /**
@@ -1063,6 +1078,7 @@ class IOCore extends EventEmitter {
 
     // The actual connection is created here.
     this.createConnection(this.url);
+    if (this._closed) return; // A connecting listener may have stopped the client.
 
     // Ensure the keep-alive timer is running.
     if (!this.connectionCheckerIntervalID) {
@@ -1087,9 +1103,7 @@ class IOCore extends EventEmitter {
    * Handles the 'close' event of the WebSocket.
    */
   onClose() {
-    this.boho.isAuthorized = false;
-    this.cid = "";
-    this.stateChange('closed');
+    this.close();
   }
 
   /**
@@ -1100,11 +1114,11 @@ class IOCore extends EventEmitter {
    */
   login(id, key) {
     if( this.serverTimeNonce ){
-      console.log('iosignal.login serverTimeNonce', this.serverTimeNonce);
       this.auth(id, key);
       this.useAuth = true;
       let auth_pack = this.boho.auth_req(this.serverTimeNonce );
       this.send(auth_pack);
+      this.stateChange('auth_req', 'auth_req');
     }
     return this
   }
@@ -1250,14 +1264,13 @@ class IOCore extends EventEmitter {
         break;
 
       case it.BohoMsg.SERVER_TIME_NONCE: // SERVER_READY
-        this.stateChange('server_ready', 'server_ready');
+        buffer.copy(this.serverTimeNonce);
+        if (!this.stateChange('server_ready', 'server_ready')) break;
         if (this.useAuth) {
           this.send(this.boho.auth_req(buffer));
           this.stateChange('auth_req','auth_req');
           // CID_REQ will be called, after auth_res.
         } else {
-          // keep server_time_nonce for manual login()
-          buffer.copy( this.serverTimeNonce);
           // CID_REQ here, if not using auth.
           this.send(Buffer$1.from([IOMsg.CID_REQ]));
         }
@@ -1308,10 +1321,10 @@ class IOCore extends EventEmitter {
           switch (payloadType) {
 
             case PAYLOAD_TYPE.EMPTY:
-              if (tag.indexOf('@') === 0) this.emit('@', tag, null);
+              if (tag.indexOf('@') === 0) this.emit('@', tag);
               else {
-                this.emit(tag, tag, null);
-                this.emit('message', tag, null);
+                this.emit(tag, tag);
+                this.emit('message', tag);
               }
               break;
 
@@ -1382,14 +1395,16 @@ class IOCore extends EventEmitter {
         break;
 
       case it.BohoMsg.AUTH_FAIL:
+        this.boho.isAuthorized = false;
         this.stateChange('auth_fail', 'auth_fail from server.');
         break;
 
       case it.BohoMsg.AUTH_RES:
         if (this.boho.verify_auth_res(buffer)) {
-          this.stateChange('auth_res', 'server sent auth_res');
+          if (!this.stateChange('auth_res', 'server sent auth_res')) break;
           this.send(Buffer$1.from([IOMsg.CID_REQ]));
         } else {
+          this.boho.isAuthorized = false;
           this.stateChange('auth_fail', 'verify_auth_res() invalid server_hmac');
         }
         break;
@@ -1595,6 +1610,7 @@ class IOCore extends EventEmitter {
    */
   signal(tag, ...args) {
     if (typeof tag !== 'string') throw TypeError('tag should be string.')
+    if (tag.startsWith('@') && this.cid) encodeTag(this.cid + tag);
     let signalPack = getSignalPack(tag, ...args);
     this.send_enc_mode(signalPack);
   }
@@ -1618,9 +1634,9 @@ class IOCore extends EventEmitter {
    */
   signal_e2e(tag, data, key) {
 
+    const tagEncoded = encodeTag(tag);
+    if (tag.startsWith('@') && this.cid) encodeTag(this.cid + tag);
     if( !this.boho.isAuthorized ) return;
-    if (typeof tag !== 'string') throw TypeError('tag should be string.')
-    let tagEncoded = encoder$1.encode(tag);
     let dataPack = $$1.B8(data);
 
     //encrypt payload area with key
@@ -1705,39 +1721,37 @@ class IOCore extends EventEmitter {
    * @throws {TypeError} If tag is not a string or exceeds length limit.
    */
   subscribe(tag) {
-    if (typeof tag !== 'string') throw TypeError('tag should be string.')
-    if (tag.length > SIZE_LIMIT.TAG_LEN1) throw TypeError('please check tag string length limit:' + SIZE_LIMIT.TAG_LEN1)
-
-    try {
-      let tagEncoded = encoder$1.encode(tag);
-      this.send_enc_mode(
-        Buffer$1.concat([
-          $$1.NB('8', IOMsg.SUBSCRIBE),
-          $$1.NB('8', tagEncoded.byteLength),
-          tagEncoded]));
-    } catch (error) { }
-
+    const tagEncoded = encodeTag(tag);
+    this.send_enc_mode(Buffer$1.concat([
+      $$1.NB('8', IOMsg.SUBSCRIBE),
+      $$1.NB('8', tagEncoded.byteLength),
+      tagEncoded]));
   }
 
 
   /**
-   * Subscribes stored channels.
-   * called client state become 'ready'
+   * Sends subscriptions stored by listen()/link() on each CID-ready transition,
+   * including reconnection. This automates subscription setup for simple clients.
    */
   subscribe_channels() {
-    if (this.state !== STATE.READY) return
-    if (this.channels.size == 0) return
-    let tag = Array.from(this.channels).join(',');
-
-    try {
-      let tagEncoded = encoder$1.encode(tag);
-      this.send_enc_mode(
-        Buffer$1.concat([
-          $$1.NB('8', IOMsg.SUBSCRIBE),
-          $$1.NB('8', tagEncoded.byteLength),
-          tagEncoded]));
-    } catch (error) { }
-
+    if (this.state !== STATE.READY || this.channels.size === 0) return
+    // Validate the entire list first, then split only at tag boundaries.
+    // Preserve comma-separated entries accepted by existing registration APIs.
+    const tags = Array.from(this.channels).join(',').split(',');
+    const sizes = tags.map(tag => encodeTag(tag).byteLength);
+    const batches = [];
+    let batch = [], bytes = 0;
+    tags.forEach((tag, i) => {
+      if (batch.length && bytes + 1 + sizes[i] > SIZE_LIMIT.TAG_LEN1) {
+        batches.push(batch.join(','));
+        batch = [];
+        bytes = 0;
+      }
+      bytes += (batch.length ? 1 : 0) + sizes[i];
+      batch.push(tag);
+    });
+    if (batch.length) batches.push(batch.join(','));
+    batches.forEach(tag => this.subscribe(tag));
   }
 
   /**
@@ -1746,7 +1760,7 @@ class IOCore extends EventEmitter {
    * @throws {TypeError} If tag is not a string or exceeds length limit.
    */
   unsubscribe(tag = "") {
-    if (typeof tag !== 'string') throw TypeError('tag should be string.')
+    const tagEncoded = encodeTag(tag);
 
     if (tag == "") { // blank tag means unsubscribe all
       this.channels.clear();
@@ -1757,8 +1771,6 @@ class IOCore extends EventEmitter {
       });
     }
 
-    let tagEncoded = encoder$1.encode(tag);
-    if (tagEncoded.byteLength > SIZE_LIMIT.TAG_LEN1) throw TypeError('please use tag string bytelength below:' + SIZE_LIMIT.TAG_LEN1)
 
     this.send_enc_mode(Buffer$1.concat([
       $$1.NB('8', IOMsg.UNSUBSCRIBE),
@@ -1768,22 +1780,28 @@ class IOCore extends EventEmitter {
 
 
   /**
-   * Listens for signals on a specific tag.
+   * Convenience API for simple clients (for example, CLI tools): register a
+   * tag handler once and remember its subscription in channels. Register before
+   * connection readiness; the CID-ready flow subscribes on initial connection
+   * and again after reconnect, without application-level ready/subscribe code.
+   * This does not send a subscription immediately, even if already ready.
+   * For precise subscription/send ordering or dynamic subscriptions, use
+   * on() with subscribe() in a ready handler instead. Direct signals use on('@').
    * @param {string} tag - The tag to listen on.
    * @param {Function} handler - The callback function to handle the signal.
    * @throws {TypeError} If tag is not a string, handler is not a function, or tag length is invalid.
    */
   listen(tag, handler) {
     if (typeof tag !== 'string') throw TypeError('tag should be string.')
-    if (tag.length > 255 || tag.length == 0) throw TypeError('tag string length range: 1~255')
+    encodeTag(tag, false);
     if (typeof handler !== 'function') throw TypeError('handler is not a function.')
 
     if (tag.indexOf('@') !== 0) {
       this.channels.add(tag);
     }
     this.on(tag, handler);
-    // do not subscribe now.
-    // will subscribe when io state is 'ready'. (receive CID_RES from server)
+    // Subscribe from the CID-ready flow, initially and after reconnect.
+    // Keep registration separate from immediate subscription/send ordering.
 
   }
 
@@ -1799,7 +1817,7 @@ class IOCore extends EventEmitter {
   link(to, tag, handler) {
     if (typeof to !== 'string') throw TypeError('to(local link target) is not a string.')
     if (typeof tag !== 'string') throw TypeError('tag is not a string.')
-    if (tag.length > 255 || tag.length == 0) throw TypeError('tag string length range: 1~255')
+    encodeTag(tag, false);
     if (typeof handler !== 'function') throw TypeError('handler is not a function.')
 
     if (tag.indexOf('@') !== 0) {
@@ -1830,7 +1848,7 @@ class IOCore extends EventEmitter {
   unlink(to, tag) {
     if (typeof to !== 'string') throw TypeError('to(local link target) is not a string.')
     if (typeof tag !== 'string') throw TypeError('tag is not a string.')
-    if (tag.length > 255 || tag.length == 0) throw TypeError('tag string length range: 1~255')
+    encodeTag(tag, false);
 
     const linkSet = this.linkMap.get(to);
     if (!linkSet || !linkSet.has(tag)) return;
@@ -1923,6 +1941,9 @@ class IOCore extends EventEmitter {
    * 1. 상태가 변경 될 때만 'change' 이벤트 호출된다.
    * 2. emitEventAndMessage 옵션 값이 지정되야 해당 이벤트 이름이 호출된다.
    *   보통 이벤트 이름과 동일하게 적거나 이벤트 상황 안내문을 넣는다.
+   * 3. 두 상태값 갱신 후 change, 개별 이벤트 순서로 호출한다.
+   *    콜백에서 다른 상태로 전이하면 이전 상태의 개별 이벤트는 생략한다.
+   * @returns {boolean} Whether this transition is still current after callbacks.
    */
   stateChange(state, emitEventAndMessage) {
     // STATE constant name <string> upperCase
@@ -1930,16 +1951,19 @@ class IOCore extends EventEmitter {
     // .state <number>
     // console.log('### stateChange reason:', emitEventAndMessage )
     let eventName = state.toLowerCase();
-    this.state = STATE[state.toUpperCase()]; // state: number
-
-    if (emitEventAndMessage) {
-      this.emit(eventName, emitEventAndMessage);
-    }
-
-    if (this.stateName !== eventName) {
-      this.stateName = eventName;
+    const nextState = STATE[state.toUpperCase()];
+    if (typeof nextState !== 'number') throw new TypeError('Unknown state: ' + state);
+    const changed = this.state !== nextState;
+    this.state = nextState;
+    this.stateName = eventName;
+    if (changed) this._stateRevision++;
+    const revision = this._stateRevision;
+    if (changed) {
       this.emit('change', eventName);
     }
+    if (revision !== this._stateRevision) return false;
+    if (emitEventAndMessage) this.emit(eventName, emitEventAndMessage);
+    return revision === this._stateRevision;
   }
 
 }
@@ -2100,6 +2124,7 @@ class IOCongSocket extends IOCore {
         this.congRx = null;
       }
       this.socket.removeAllListeners();
+      this.socket.on('error', () => {});
       if (!this.socket.destroyed) {
         this.socket.destroy(); // destroy() is sufficient for forceful closing
       }
@@ -2124,23 +2149,29 @@ class IOCongSocket extends IOCore {
     if (urlObj.protocol != "cong:") {
       urlObj = new URL('cong://' + url);
     }
-    this.socket = net.createConnection(urlObj.port, urlObj.hostname);
-    this.stateChange('connecting','connecting');
+    const socket = this.socket = net.createConnection(urlObj.port, urlObj.hostname);
+    this._closed = false;
 
     this.socket.on('connect', () => {
+      if (this.socket !== socket) return;
       this.congRx = new CongRx();
       this.socket.pipe(this.congRx);
-      this.congRx.on("data", this.onTCPSocketMessage.bind(this));
+      this.congRx.on('data', data => {
+        if (this.socket === socket) this.onTCPSocketMessage(data);
+      });
       this.emit('open');
     });
 
     this.socket.on('error', e => {
+      if (this.socket !== socket) return;
       this.emit('error', e);
     });
 
     this.socket.on('close', () => {
+      if (this.socket !== socket) return;
       this.emit('close');
     });
+    this.stateChange('connecting','connecting');
 
   }
 
@@ -2195,300 +2226,6 @@ function requireConstants () {
 	return constants;
 }
 
-var bufferutil = {exports: {}};
-
-function commonjsRequire(path) {
-	throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.');
-}
-
-var nodeGypBuild$1 = {exports: {}};
-
-var nodeGypBuild;
-var hasRequiredNodeGypBuild$1;
-
-function requireNodeGypBuild$1 () {
-	if (hasRequiredNodeGypBuild$1) return nodeGypBuild;
-	hasRequiredNodeGypBuild$1 = 1;
-	var fs$1 = fs;
-	var path$1 = path;
-	var os = require$$2;
-
-	// Workaround to fix webpack's build warnings: 'the request of a dependency is an expression'
-	var runtimeRequire = typeof __webpack_require__ === 'function' ? __non_webpack_require__ : commonjsRequire; // eslint-disable-line
-
-	var vars = (process.config && process.config.variables) || {};
-	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
-	var abi = process.versions.modules; // TODO: support old node where this is undef
-	var runtime = isElectron() ? 'electron' : (isNwjs() ? 'node-webkit' : 'node');
-
-	var arch = process.env.npm_config_arch || os.arch();
-	var platform = process.env.npm_config_platform || os.platform();
-	var libc = process.env.LIBC || (isAlpine(platform) ? 'musl' : 'glibc');
-	var armv = process.env.ARM_VERSION || (arch === 'arm64' ? '8' : vars.arm_version) || '';
-	var uv = (process.versions.uv || '').split('.')[0];
-
-	nodeGypBuild = load;
-
-	function load (dir) {
-	  return runtimeRequire(load.resolve(dir))
-	}
-
-	load.resolve = load.path = function (dir) {
-	  dir = path$1.resolve(dir || '.');
-
-	  try {
-	    var name = runtimeRequire(path$1.join(dir, 'package.json')).name.toUpperCase().replace(/-/g, '_');
-	    if (process.env[name + '_PREBUILD']) dir = process.env[name + '_PREBUILD'];
-	  } catch (err) {}
-
-	  if (!prebuildsOnly) {
-	    var release = getFirst(path$1.join(dir, 'build/Release'), matchBuild);
-	    if (release) return release
-
-	    var debug = getFirst(path$1.join(dir, 'build/Debug'), matchBuild);
-	    if (debug) return debug
-	  }
-
-	  var prebuild = resolve(dir);
-	  if (prebuild) return prebuild
-
-	  var nearby = resolve(path$1.dirname(process.execPath));
-	  if (nearby) return nearby
-
-	  var target = [
-	    'platform=' + platform,
-	    'arch=' + arch,
-	    'runtime=' + runtime,
-	    'abi=' + abi,
-	    'uv=' + uv,
-	    armv ? 'armv=' + armv : '',
-	    'libc=' + libc,
-	    'node=' + process.versions.node,
-	    process.versions.electron ? 'electron=' + process.versions.electron : '',
-	    typeof __webpack_require__ === 'function' ? 'webpack=true' : '' // eslint-disable-line
-	  ].filter(Boolean).join(' ');
-
-	  throw new Error('No native build was found for ' + target + '\n    loaded from: ' + dir + '\n')
-
-	  function resolve (dir) {
-	    // Find matching "prebuilds/<platform>-<arch>" directory
-	    var tuples = readdirSync(path$1.join(dir, 'prebuilds')).map(parseTuple);
-	    var tuple = tuples.filter(matchTuple(platform, arch)).sort(compareTuples)[0];
-	    if (!tuple) return
-
-	    // Find most specific flavor first
-	    var prebuilds = path$1.join(dir, 'prebuilds', tuple.name);
-	    var parsed = readdirSync(prebuilds).map(parseTags);
-	    var candidates = parsed.filter(matchTags(runtime, abi));
-	    var winner = candidates.sort(compareTags(runtime))[0];
-	    if (winner) return path$1.join(prebuilds, winner.file)
-	  }
-	};
-
-	function readdirSync (dir) {
-	  try {
-	    return fs$1.readdirSync(dir)
-	  } catch (err) {
-	    return []
-	  }
-	}
-
-	function getFirst (dir, filter) {
-	  var files = readdirSync(dir).filter(filter);
-	  return files[0] && path$1.join(dir, files[0])
-	}
-
-	function matchBuild (name) {
-	  return /\.node$/.test(name)
-	}
-
-	function parseTuple (name) {
-	  // Example: darwin-x64+arm64
-	  var arr = name.split('-');
-	  if (arr.length !== 2) return
-
-	  var platform = arr[0];
-	  var architectures = arr[1].split('+');
-
-	  if (!platform) return
-	  if (!architectures.length) return
-	  if (!architectures.every(Boolean)) return
-
-	  return { name, platform, architectures }
-	}
-
-	function matchTuple (platform, arch) {
-	  return function (tuple) {
-	    if (tuple == null) return false
-	    if (tuple.platform !== platform) return false
-	    return tuple.architectures.includes(arch)
-	  }
-	}
-
-	function compareTuples (a, b) {
-	  // Prefer single-arch prebuilds over multi-arch
-	  return a.architectures.length - b.architectures.length
-	}
-
-	function parseTags (file) {
-	  var arr = file.split('.');
-	  var extension = arr.pop();
-	  var tags = { file: file, specificity: 0 };
-
-	  if (extension !== 'node') return
-
-	  for (var i = 0; i < arr.length; i++) {
-	    var tag = arr[i];
-
-	    if (tag === 'node' || tag === 'electron' || tag === 'node-webkit') {
-	      tags.runtime = tag;
-	    } else if (tag === 'napi') {
-	      tags.napi = true;
-	    } else if (tag.slice(0, 3) === 'abi') {
-	      tags.abi = tag.slice(3);
-	    } else if (tag.slice(0, 2) === 'uv') {
-	      tags.uv = tag.slice(2);
-	    } else if (tag.slice(0, 4) === 'armv') {
-	      tags.armv = tag.slice(4);
-	    } else if (tag === 'glibc' || tag === 'musl') {
-	      tags.libc = tag;
-	    } else {
-	      continue
-	    }
-
-	    tags.specificity++;
-	  }
-
-	  return tags
-	}
-
-	function matchTags (runtime, abi) {
-	  return function (tags) {
-	    if (tags == null) return false
-	    if (tags.runtime && tags.runtime !== runtime && !runtimeAgnostic(tags)) return false
-	    if (tags.abi && tags.abi !== abi && !tags.napi) return false
-	    if (tags.uv && tags.uv !== uv) return false
-	    if (tags.armv && tags.armv !== armv) return false
-	    if (tags.libc && tags.libc !== libc) return false
-
-	    return true
-	  }
-	}
-
-	function runtimeAgnostic (tags) {
-	  return tags.runtime === 'node' && tags.napi
-	}
-
-	function compareTags (runtime) {
-	  // Precedence: non-agnostic runtime, abi over napi, then by specificity.
-	  return function (a, b) {
-	    if (a.runtime !== b.runtime) {
-	      return a.runtime === runtime ? -1 : 1
-	    } else if (a.abi !== b.abi) {
-	      return a.abi ? -1 : 1
-	    } else if (a.specificity !== b.specificity) {
-	      return a.specificity > b.specificity ? -1 : 1
-	    } else {
-	      return 0
-	    }
-	  }
-	}
-
-	function isNwjs () {
-	  return !!(process.versions && process.versions.nw)
-	}
-
-	function isElectron () {
-	  if (process.versions && process.versions.electron) return true
-	  if (process.env.ELECTRON_RUN_AS_NODE) return true
-	  return typeof window !== 'undefined' && window.process && window.process.type === 'renderer'
-	}
-
-	function isAlpine (platform) {
-	  return platform === 'linux' && fs$1.existsSync('/etc/alpine-release')
-	}
-
-	// Exposed for unit tests
-	// TODO: move to lib
-	load.parseTags = parseTags;
-	load.matchTags = matchTags;
-	load.compareTags = compareTags;
-	load.parseTuple = parseTuple;
-	load.matchTuple = matchTuple;
-	load.compareTuples = compareTuples;
-	return nodeGypBuild;
-}
-
-var hasRequiredNodeGypBuild;
-
-function requireNodeGypBuild () {
-	if (hasRequiredNodeGypBuild) return nodeGypBuild$1.exports;
-	hasRequiredNodeGypBuild = 1;
-	const runtimeRequire = typeof __webpack_require__ === 'function' ? __non_webpack_require__ : commonjsRequire; // eslint-disable-line
-	if (typeof runtimeRequire.addon === 'function') { // if the platform supports native resolving prefer that
-	  nodeGypBuild$1.exports = runtimeRequire.addon.bind(runtimeRequire);
-	} else { // else use the runtime version here
-	  nodeGypBuild$1.exports = requireNodeGypBuild$1();
-	}
-	return nodeGypBuild$1.exports;
-}
-
-var fallback$1;
-var hasRequiredFallback$1;
-
-function requireFallback$1 () {
-	if (hasRequiredFallback$1) return fallback$1;
-	hasRequiredFallback$1 = 1;
-
-	/**
-	 * Masks a buffer using the given mask.
-	 *
-	 * @param {Buffer} source The buffer to mask
-	 * @param {Buffer} mask The mask to use
-	 * @param {Buffer} output The buffer where to store the result
-	 * @param {Number} offset The offset at which to start writing
-	 * @param {Number} length The number of bytes to mask.
-	 * @public
-	 */
-	const mask = (source, mask, output, offset, length) => {
-	  for (var i = 0; i < length; i++) {
-	    output[offset + i] = source[i] ^ mask[i & 3];
-	  }
-	};
-
-	/**
-	 * Unmasks a buffer using the given mask.
-	 *
-	 * @param {Buffer} buffer The buffer to unmask
-	 * @param {Buffer} mask The mask to use
-	 * @public
-	 */
-	const unmask = (buffer, mask) => {
-	  // Required until https://github.com/nodejs/node/issues/9006 is resolved.
-	  const length = buffer.length;
-	  for (var i = 0; i < length; i++) {
-	    buffer[i] ^= mask[i & 3];
-	  }
-	};
-
-	fallback$1 = { mask, unmask };
-	return fallback$1;
-}
-
-var hasRequiredBufferutil;
-
-function requireBufferutil () {
-	if (hasRequiredBufferutil) return bufferutil.exports;
-	hasRequiredBufferutil = 1;
-
-	try {
-	  bufferutil.exports = requireNodeGypBuild()(__dirname);
-	} catch (e) {
-	  bufferutil.exports = requireFallback$1();
-	}
-	return bufferutil.exports;
-}
-
 var hasRequiredBufferUtil;
 
 function requireBufferUtil () {
@@ -2609,7 +2346,7 @@ function requireBufferUtil () {
 	/* istanbul ignore else  */
 	if (!process.env.WS_NO_BUFFER_UTIL) {
 	  try {
-	    const bufferUtil$1 = requireBufferutil();
+	    const bufferUtil$1 = require('bufferutil');
 
 	    bufferUtil.exports.mask = function (source, mask, output, offset, length) {
 	      if (length < 48) _mask(source, mask, output, offset, length);
@@ -3230,92 +2967,6 @@ function requirePermessageDeflate () {
 
 var validation = {exports: {}};
 
-var utf8Validate = {exports: {}};
-
-var fallback;
-var hasRequiredFallback;
-
-function requireFallback () {
-	if (hasRequiredFallback) return fallback;
-	hasRequiredFallback = 1;
-
-	/**
-	 * Checks if a given buffer contains only correct UTF-8.
-	 * Ported from https://www.cl.cam.ac.uk/%7Emgk25/ucs/utf8_check.c by
-	 * Markus Kuhn.
-	 *
-	 * @param {Buffer} buf The buffer to check
-	 * @return {Boolean} `true` if `buf` contains only correct UTF-8, else `false`
-	 * @public
-	 */
-	function isValidUTF8(buf) {
-	  const len = buf.length;
-	  let i = 0;
-
-	  while (i < len) {
-	    if ((buf[i] & 0x80) === 0x00) {  // 0xxxxxxx
-	      i++;
-	    } else if ((buf[i] & 0xe0) === 0xc0) {  // 110xxxxx 10xxxxxx
-	      if (
-	        i + 1 === len ||
-	        (buf[i + 1] & 0xc0) !== 0x80 ||
-	        (buf[i] & 0xfe) === 0xc0  // overlong
-	      ) {
-	        return false;
-	      }
-
-	      i += 2;
-	    } else if ((buf[i] & 0xf0) === 0xe0) {  // 1110xxxx 10xxxxxx 10xxxxxx
-	      if (
-	        i + 2 >= len ||
-	        (buf[i + 1] & 0xc0) !== 0x80 ||
-	        (buf[i + 2] & 0xc0) !== 0x80 ||
-	        buf[i] === 0xe0 && (buf[i + 1] & 0xe0) === 0x80 ||  // overlong
-	        buf[i] === 0xed && (buf[i + 1] & 0xe0) === 0xa0  // surrogate (U+D800 - U+DFFF)
-	      ) {
-	        return false;
-	      }
-
-	      i += 3;
-	    } else if ((buf[i] & 0xf8) === 0xf0) {  // 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
-	      if (
-	        i + 3 >= len ||
-	        (buf[i + 1] & 0xc0) !== 0x80 ||
-	        (buf[i + 2] & 0xc0) !== 0x80 ||
-	        (buf[i + 3] & 0xc0) !== 0x80 ||
-	        buf[i] === 0xf0 && (buf[i + 1] & 0xf0) === 0x80 ||  // overlong
-	        buf[i] === 0xf4 && buf[i + 1] > 0x8f || buf[i] > 0xf4  // > U+10FFFF
-	      ) {
-	        return false;
-	      }
-
-	      i += 4;
-	    } else {
-	      return false;
-	    }
-	  }
-
-	  return true;
-	}
-
-	fallback = isValidUTF8;
-	return fallback;
-}
-
-var hasRequiredUtf8Validate;
-
-function requireUtf8Validate () {
-	if (hasRequiredUtf8Validate) return utf8Validate.exports;
-	hasRequiredUtf8Validate = 1;
-
-	try {
-	  utf8Validate.exports = requireNodeGypBuild()(__dirname);
-	} catch (e) {
-	  utf8Validate.exports = requireFallback();
-	}
-	return utf8Validate.exports;
-}
-
 var hasRequiredValidation;
 
 function requireValidation () {
@@ -3463,7 +3114,7 @@ function requireValidation () {
 	  };
 	} /* istanbul ignore else  */ else if (!process.env.WS_NO_UTF_8_VALIDATE) {
 	  try {
-	    const isValidUTF8 = requireUtf8Validate();
+	    const isValidUTF8 = require('utf-8-validate');
 
 	    validation.exports.isValidUTF8 = function (buf) {
 	      return buf.length < 32 ? _isValidUTF8(buf) : isValidUTF8(buf);
@@ -4239,7 +3890,7 @@ function requireSender () {
 	const { randomFillSync } = require$$1;
 	const {
 	  types: { isUint8Array }
-	} = require$$2$1;
+	} = require$$2;
 
 	const PerMessageDeflate = requirePermessageDeflate();
 	const { EMPTY_BUFFER, kWebSocket, NOOP } = requireConstants();
@@ -5363,7 +5014,7 @@ function requireWebsocket () {
 
 	const EventEmitter = require$$0$3;
 	const https = require$$1$1;
-	const http = require$$2$2;
+	const http = require$$2$1;
 	const net$1 = net;
 	const tls = require$$4;
 	const { randomBytes, createHash } = require$$1;
@@ -7032,7 +6683,7 @@ function requireWebsocketServer () {
 	hasRequiredWebsocketServer = 1;
 
 	const EventEmitter = require$$0$3;
-	const http = require$$2$2;
+	const http = require$$2$1;
 	const { Duplex } = require$$0;
 	const { createHash } = require$$1;
 
@@ -7610,6 +7261,8 @@ class IOWS extends IOCore {
   close() {
     if (this.socket) {
       this.socket.removeAllListeners();
+      // Closing a connecting ws can emit an asynchronous error after detachment.
+      this.socket.on('error', () => {});
       if (this.socket.readyState !== WebSocket.CLOSED) {
         this.socket.close();
       }
@@ -7629,21 +7282,27 @@ class IOWS extends IOCore {
 
   createConnection(url) {
     // node WebSocket
-    this.socket = new WebSocket(url);
-    this.stateChange('connecting','connecting');
+    const socket = this.socket = new WebSocket(url);
+    this._closed = false;
 
     this.socket.onopen = () => {
-      this.socket.on('message', this.onWebSocketMessage.bind(this));
+      if (this.socket !== socket) return;
+      socket.on('message', data => {
+        if (this.socket === socket) this.onWebSocketMessage(data);
+      });
       this.emit('open');
     };
 
     this.socket.onerror = (e) => {
+      if (this.socket !== socket) return;
       this.emit('error', e);
     };
 
     this.socket.onclose = () => {
+      if (this.socket !== socket) return;
       this.emit('close');
     };
+    this.stateChange('connecting','connecting');
   }
 
   onWebSocketMessage(data) {
@@ -7762,7 +7421,9 @@ class RemoteCore {
   static ssid = 1;
 
   setState(state) {
+    const previous = this.state;
     this.state = state;
+    if (previous !== state) this.manager.server?.emit('remote:state', this, previous);
     if (serverOption.debug.showAuthInfo) {
       this.stateLog.push(  state + ":" + STATE[ state]   );
       if( state == STATE.AUTH_RES){
@@ -7831,6 +7492,8 @@ class RemoteCore {
   // CongSocket or WebSocket
   onSocketMessage(message, isBinary = true) {
 
+    if (this._closing || this.state === STATE.CLOSED) return;
+
     this.receiveMonitor(); // rx-data, ping/pong and timeout check
     if (!this.rxQuotaChecker(message)) return
 
@@ -7884,10 +7547,11 @@ class RemoteCore {
           break;
 
         case IOMsg.CID_REQ:
-          if (this.state < STATE.SERVER_READY) {
+          if (![STATE.SERVER_READY, STATE.AUTH_RES, STATE.AUTH_FAIL, STATE.CID_RES].includes(this.state)) {
             // Protocol violation: CID_REQ was sent before receiving the SERVER_READY signal.
             console.log('CID_REQ before SERVER_READY');
             this.close();
+            return;
           }
 
           if (!this.cid) {
@@ -8007,9 +7671,12 @@ class RemoteCore {
         // client's auth requst
         case it.BohoMsg.AUTH_REQ:
           if (!this.manager.authManager) return
-          if (this.state < STATE.SERVER_READY) {
+          // Do not start overlapping verification on the same connection.
+          if (this.state === STATE.AUTH_REQ) return;
+          if (![STATE.SERVER_READY, STATE.AUTH_RES, STATE.AUTH_FAIL, STATE.CID_RES].includes(this.state)) {
             console.log('protocol error. must called auth_req after server_ready');
             this.close();
+            return;
           }
           this.setState(STATE.AUTH_REQ);
           //async
@@ -8171,7 +7838,7 @@ function getIPv4HexString(ipStr) {
 }
 
 function getLocalAddress() {
-  const nets = require$$2.networkInterfaces();
+  const nets = os.networkInterfaces();
   // console.log(nets)
   const results = Object.create(null); // Or just '{}', an empty object
   let localAddress = '';
@@ -8358,6 +8025,7 @@ class Remote extends RemoteCore {
   }
 
   close(terminateNow = false) {
+    this._closing = true;
     this.getTraffic();
     if (this.socketType === 'websocket') {
       if (terminateNow) this.socket.terminate();
@@ -8623,6 +8291,7 @@ class Manager {
         if (socket.isAlive === false) {
           console.log('## timeout. cid:', remo.cid);
           remo.close();
+          return;
         }
 
         socket.txCounter++;
@@ -8662,6 +8331,9 @@ class Manager {
 
   removeRemote(remote) {
 
+    remote._closing = true;
+    remote.setState(STATE.CLOSED);
+
     let remoteInfo = `- IP:${remote.ip} #${remote.ssid} cid:${remote.cid} ${remote?.socket.socketType === 'websocket' ? "WS" : "CS"} `;
     if (this.connectionLogger) this.connectionLogger.log(remoteInfo);
     this.deligateSignal(remote, '@state', 'close');
@@ -8699,7 +8371,7 @@ class Manager {
     }
 
     this.remotes.delete(remote);
-    this.cid2remote.delete(remote.cid);
+    if (this.cid2remote.get(remote.cid) === remote) this.cid2remote.delete(remote.cid);
     remote = null;
 
   }
@@ -8729,6 +8401,7 @@ class Manager {
     let tagLen = buffer.readUint8(1);
     let newTagBuf = encoder.encode(newTag);
     let newTagLen = newTagBuf.byteLength;
+    if (newTagLen > SIZE_LIMIT.TAG_LEN1) return null;
     let payloadCunk = buffer.subarray(2 + tagLen);
     let newBuffer = Buffer.concat([Buffer.from([msgType, newTagLen]), newTagBuf, payloadCunk]);
     return newBuffer
@@ -8766,6 +8439,7 @@ class Manager {
   }
 
   sender(tag, remote, message) {
+    if (encoder.encode(tag).byteLength > SIZE_LIMIT.TAG_LEN1) return ['err', 'Tag exceeds 255 UTF-8 bytes']
     if (serverOption.membersOnly && !remote.boho.isAuthorized) {
       // console.log("### server reject client signal reason: [membersOnly]" ,tag, remote.cid  )
       remote.send(Buffer.from([IOMsg.AUTH_CLEAR]));
@@ -8782,6 +8456,7 @@ class Manager {
       // modify signalpack with cid_appneded tag.
       tag = remote.cid + tag;
       message = this.getNewSignalTagMessage(message, tag);
+      if (!message) return ['err', 'CID-prefixed tag exceeds 255 UTF-8 bytes']
 
     } else if (cidIndex > 0) {
       // uni-cast.  
@@ -8791,6 +8466,7 @@ class Manager {
         let ommitCIdTag = '@' + tag.split('@')[1];
         // console.log('uni-cast tag change from', tag, 'to' , ommitCIdTag )
         message = this.getNewSignalTagMessage(message, ommitCIdTag);
+        if (!message) return ['err', 'Tag exceeds 255 UTF-8 bytes']
         // console.log(`origin tag: ${tag} omitTag: ${this.getSignalTag(message)}`)
         this.cid2remote.get(targetCId).send_enc_mode(message);
         return ['ok', 1]
@@ -9267,6 +8943,8 @@ class BohoAuth {
   }
 
   send_auth_fail(peer, reason) {
+    if (peer._closing || peer.state === STATE.CLOSED) return;
+    peer.boho.isAuthorized = false;
     if (this.authLogger) {
       let peerInfo = `FAIL #${peer.ssid} reason:${reason} `;
       this.authLogger.log(peerInfo);
@@ -9275,7 +8953,9 @@ class BohoAuth {
     peer.setState(STATE.AUTH_FAIL);
     // add some delay time.
     setTimeout(e => {
-      peer.send(Buffer.from([it.BohoMsg.AUTH_FAIL]));
+      if (!peer._closing && peer.state === STATE.AUTH_FAIL) {
+        peer.send(Buffer.from([it.BohoMsg.AUTH_FAIL]));
+      }
     }, serverOption.auth.delay_auth_fail);
   }
 
@@ -9298,6 +8978,7 @@ class BohoAuth {
 
       //2. get key of id from DB
       let authInfo = await this.keyProvider.getAuth(id);
+      if (peer._closing || peer.state === STATE.CLOSED) return;
       if (!authInfo) {
         this.send_auth_fail(peer, 'NO ID:' + id);
         return
@@ -9330,33 +9011,31 @@ class BohoAuth {
       //4. get info
 
       //5. check duplicate login.
-      if (peer.manager.cid2remote.has(authInfo.cid)) {
+      if (peer.manager.cid2remote.has(authInfo.cid) && peer.manager.cid2remote.get(authInfo.cid) !== peer) {
         let old = peer.manager.cid2remote.get(authInfo.cid);
         console.log('[WARN]DUPLICATE_LOGIN detected.', old.cid);
         old.ping(); // check the connection.
-        if (old == peer) {
-          console.log('## trying to RELOGIN after login.');
-          return
-        }
 
         let authClearSignal = $$1.pack(
           $$1.MB('#MsgType', '8', IOMsg.AUTH_CLEAR),
           $$1.MB('#reason', 'duplicate login.')
         );
         if (this.keepOldConnection) { // default true
+          peer.boho.isAuthorized = false;
           // keep old connection. reject new connection by sending auth_fail signal.
           // peer.send(authClearSignal)
           if( peer.socketType == 'websocket'){
             this.send_auth_fail(peer, 'duplicate login');
           }else {
+            peer.setState(STATE.AUTH_FAIL);
             peer.close(); //arduino 
           }
         } else {
           // accept new connection. stop the old connection by sending auth_clear signal.
           old.send(authClearSignal);
-          peer.close();
+          old.close();
         }
-        return
+        if (this.keepOldConnection) return
       }
 
       //6. delete current (or anonymouse)cid if exist.