@couch-kit/core 0.5.1 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @couch-kit/core
 
+## 0.6.0
+
+### Minor Changes
+
+- [#16](https://github.com/faluciano/react-native-couch-kit/pull/16) [`86b5ff3`](https://github.com/faluciano/react-native-couch-kit/commit/86b5ff353ce9baac0c48e6a8315bbb57eb155daf) Thanks [@faluciano](https://github.com/faluciano)! - ### Phase 1: Quick Wins — Bug Fixes, Security, and Cleanup
+
+  **Bug fixes:**
+  - Fix `simulate` command: add missing `secret` to JOIN payload so bots are no longer rejected with `INVALID_SECRET`
+  - Send `RECONNECTED` message (instead of `WELCOME`) when a player reconnects, enabling clients to distinguish reconnections
+  - Wire `ASSETS_LOADED` end-to-end: `usePreload` now accepts an optional `sendMessage` callback to notify the host when assets finish loading; host tracks per-player asset status
+  - Include dispatched action(s) in `STATE_UPDATE` broadcasts via an action queue, so clients receive the `action` field
+
+  **Security:**
+  - Replace `derivePlayerId` with SHA-256 (Web Crypto API) — the old implementation exposed the first 16 hex chars of the player secret
+  - Add dual-derivation migration: host tries SHA-256 first, falls back to legacy ID for existing players
+  - Add per-socket rate limiting (60 actions/second) with `RATE_LIMITED` error response
+  - Cache `socketId → playerId` mapping to avoid async derivation in hot paths
+
+  **Cleanup:**
+  - Remove dead code: `buffer-utils.ts`, `declarations.d.ts`, and their test file (TCP WebSocket remnants)
+  - Deprecate unused constants: `MAX_FRAME_SIZE`, `KEEPALIVE_INTERVAL`, `KEEPALIVE_TIMEOUT` (will be removed in next major)
+  - Extract `DEFAULT_DISCONNECT_TIMEOUT` constant (replaces hardcoded 5-minute magic number)
+  - Add configurable `disconnectTimeout` to `GameHostConfig`
+
+  **DX improvements:**
+  - Auto-detect package manager in `bundle` command (checks lock files instead of hardcoding `bun`)
+  - Show build output (`stdio: "inherit"` instead of `"ignore"`)
+  - Log bot WELCOME/ERROR responses in `simulate` command
+
 ## 0.5.1
 
 ### Patch Changes

package/dist/index.js

@@ -89,6 +89,7 @@ var DEFAULT_BASE_DELAY = 1000;
 var DEFAULT_MAX_DELAY = 1e4;
 var DEFAULT_SYNC_INTERVAL = 5000;
 var MAX_PENDING_PINGS = 50;
+var DEFAULT_DISCONNECT_TIMEOUT = 5 * 60 * 1000;
 var KEEPALIVE_INTERVAL = 30000;
 var KEEPALIVE_TIMEOUT = 1e4;
 function generateId() {
@@ -108,7 +109,12 @@ function isValidSecret(secret) {
   const hex = secret.replace(/-/g, "");
   return hex.length >= 32 && /^[0-9a-f]+$/i.test(hex);
 }
-function derivePlayerId(secret) {
+async function derivePlayerId(secret) {
+  const data = new TextEncoder().encode(secret);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 16);
+}
+function derivePlayerIdLegacy(secret) {
   return secret.replace(/-/g, "").slice(0, 16);
 }
 function toErrorMessage(error) {
@@ -120,6 +126,7 @@ export {
   toErrorMessage,
   isValidSecret,
   generateId,
+  derivePlayerIdLegacy,
   derivePlayerId,
   createGameReducer,
   MessageTypes,
@@ -133,5 +140,6 @@ export {
   DEFAULT_MAX_RETRIES,
   DEFAULT_MAX_DELAY,
   DEFAULT_HTTP_PORT,
+  DEFAULT_DISCONNECT_TIMEOUT,
   DEFAULT_BASE_DELAY
 };

package/lib/constants.d.ts

@@ -3,7 +3,7 @@
 export declare const DEFAULT_HTTP_PORT = 8080;
 /** Default WebSocket port offset from the HTTP port (skips Metro on +1). */
 export declare const DEFAULT_WS_PORT_OFFSET = 2;
-/** Maximum allowed WebSocket frame payload size (1 MB). */
+/** @deprecated Not used by Couch Kit internals. Will be removed in the next major version. */
 export declare const MAX_FRAME_SIZE: number;
 /** Default maximum reconnection attempts for the client. */
 export declare const DEFAULT_MAX_RETRIES = 5;
@@ -15,9 +15,11 @@ export declare const DEFAULT_MAX_DELAY = 10000;
 export declare const DEFAULT_SYNC_INTERVAL = 5000;
 /** Maximum number of outstanding pings before cleanup. */
 export declare const MAX_PENDING_PINGS = 50;
-/** Server-side keepalive ping interval (ms). */
+/** Default timeout (ms) before a disconnected player is removed from state. */
+export declare const DEFAULT_DISCONNECT_TIMEOUT: number;
+/** @deprecated Not used by Couch Kit internals. Will be removed in the next major version. */
 export declare const KEEPALIVE_INTERVAL = 30000;
-/** Keepalive timeout -- disconnect if no pong received (ms). */
+/** @deprecated Not used by Couch Kit internals. Will be removed in the next major version. */
 export declare const KEEPALIVE_TIMEOUT = 10000;
 /**
  * Generate a cryptographically random ID string.
@@ -31,13 +33,17 @@ export declare function generateId(): string;
  */
 export declare function isValidSecret(secret: string): boolean;
 /**
- * Derives a stable, public player ID from a secret UUID.
+ * Derives a stable, public player ID from a secret UUID using SHA-256.
  *
- * Strips dashes and takes the first 16 hex characters. This is NOT a
- * cryptographic hash — it simply avoids exposing the raw secret in
- * state that gets broadcast to all clients.
+ * Takes the first 16 hex characters of the SHA-256 hash, producing
+ * a deterministic ID that cannot be reversed to recover the secret.
  */
-export declare function derivePlayerId(secret: string): string;
+export declare function derivePlayerId(secret: string): Promise<string>;
+/**
+ * @deprecated Legacy player ID derivation. Insecure — exposes first 16 hex chars of secret.
+ * Kept temporarily for dual-derivation migration in the host. Will be removed in next major.
+ */
+export declare function derivePlayerIdLegacy(secret: string): string;
 /**
  * Safely extract an error message from an unknown caught value.
  * In JavaScript, anything can be thrown -- this normalizes it.

package/lib/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,2DAA2D;AAC3D,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,oEAAoE;AACpE,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,4CAA4C;AAC5C,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAwBnC;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGrD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGrD"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,8FAA8F;AAC9F,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,oEAAoE;AACpE,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,4CAA4C;AAC5C,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,QAAgB,CAAC;AAExD,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAwBnC;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGrD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOpE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGrD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@couch-kit/core",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "publishConfig": {
     "access": "public",
     "provenance": true

package/src/constants.ts

@@ -6,7 +6,7 @@ export const DEFAULT_HTTP_PORT = 8080;
 /** Default WebSocket port offset from the HTTP port (skips Metro on +1). */
 export const DEFAULT_WS_PORT_OFFSET = 2;
 
-/** Maximum allowed WebSocket frame payload size (1 MB). */
+/** @deprecated Not used by Couch Kit internals. Will be removed in the next major version. */
 export const MAX_FRAME_SIZE = 1024 * 1024;
 
 /** Default maximum reconnection attempts for the client. */
@@ -24,10 +24,13 @@ export const DEFAULT_SYNC_INTERVAL = 5000;
 /** Maximum number of outstanding pings before cleanup. */
 export const MAX_PENDING_PINGS = 50;
 
-/** Server-side keepalive ping interval (ms). */
+/** Default timeout (ms) before a disconnected player is removed from state. */
+export const DEFAULT_DISCONNECT_TIMEOUT = 5 * 60 * 1000;
+
+/** @deprecated Not used by Couch Kit internals. Will be removed in the next major version. */
 export const KEEPALIVE_INTERVAL = 30000;
 
-/** Keepalive timeout -- disconnect if no pong received (ms). */
+/** @deprecated Not used by Couch Kit internals. Will be removed in the next major version. */
 export const KEEPALIVE_TIMEOUT = 10000;
 
 /**
@@ -71,13 +74,25 @@ export function isValidSecret(secret: string): boolean {
 }
 
 /**
- * Derives a stable, public player ID from a secret UUID.
+ * Derives a stable, public player ID from a secret UUID using SHA-256.
  *
- * Strips dashes and takes the first 16 hex characters. This is NOT a
- * cryptographic hash — it simply avoids exposing the raw secret in
- * state that gets broadcast to all clients.
+ * Takes the first 16 hex characters of the SHA-256 hash, producing
+ * a deterministic ID that cannot be reversed to recover the secret.
+ */
+export async function derivePlayerId(secret: string): Promise<string> {
+  const data = new TextEncoder().encode(secret);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(hash))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("")
+    .slice(0, 16);
+}
+
+/**
+ * @deprecated Legacy player ID derivation. Insecure — exposes first 16 hex chars of secret.
+ * Kept temporarily for dual-derivation migration in the host. Will be removed in next major.
  */
-export function derivePlayerId(secret: string): string {
+export function derivePlayerIdLegacy(secret: string): string {
   return secret.replace(/-/g, "").slice(0, 16);
 }