@couch-kit/host 1.7.12 → 1.7.13

package/lib/message-validation.d.ts

@@ -1,4 +1,19 @@
 import { MessageTypes, type ClientMessage } from "@couch-kit/core";
+/**
+ * Default maximum size (in bytes) of an inbound client message. Frames larger
+ * than this are discarded before `JSON.parse`, bounding the memory a single
+ * malicious LAN client can force the host to allocate. Generous enough for
+ * data-URI avatars in JOIN payloads while blocking multi-megabyte abuse.
+ */
+export declare const DEFAULT_MAX_MESSAGE_BYTES: number;
+/**
+ * Compute the UTF-8 byte length of a raw WebSocket frame payload.
+ *
+ * For binary frames the `ArrayBuffer.byteLength` is exact. For text frames the
+ * UTF-8 size is counted directly from the JS string without allocating an
+ * encoder buffer, so an oversized frame can be rejected cheaply.
+ */
+export declare function frameByteLength(data: string | ArrayBuffer): number;
 type ClientMessageOf<TType extends ClientMessage["type"]> = Extract<ClientMessage, {
     type: TType;
 }>;

package/lib/message-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message-validation.d.ts","sourceRoot":"","sources":["../src/message-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEnE,KAAK,eAAe,CAAC,KAAK,SAAS,aAAa,CAAC,MAAM,CAAC,IAAI,OAAO,CACjE,aAAa,EACb;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,IAAI,EAAE,OAAO,YAAY,CAAC,IAAI,CAAC;IAC/B,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH,GACD,eAAe,CAAC,QAAQ,CAAC,GACzB,eAAe,CAAC,MAAM,CAAC,GACvB,eAAe,CAAC,eAAe,CAAC,CAAC;AAErC;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,GACX,GAAG,IAAI,sBAAsB,CA8B/B"}
+{"version":3,"file":"message-validation.d.ts","sourceRoot":"","sources":["../src/message-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAa,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAmBlE;AAED,KAAK,eAAe,CAAC,KAAK,SAAS,aAAa,CAAC,MAAM,CAAC,IAAI,OAAO,CACjE,aAAa,EACb;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,IAAI,EAAE,OAAO,YAAY,CAAC,IAAI,CAAC;IAC/B,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH,GACD,eAAe,CAAC,QAAQ,CAAC,GACzB,eAAe,CAAC,MAAM,CAAC,GACvB,eAAe,CAAC,eAAe,CAAC,CAAC;AAErC;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,GACX,GAAG,IAAI,sBAAsB,CA8B/B"}

package/lib/provider.d.ts

@@ -13,6 +13,11 @@ export interface GameHostConfig<S extends IGameState, A extends IAction> {
     disconnectTimeout?: number;
     /** State broadcast throttle interval in milliseconds (default: 33ms, ~30fps). */
     stateThrottleMs?: number;
+    /**
+     * Maximum size (in bytes) of an inbound client message. Frames larger than
+     * this are discarded before parsing (default: 256 KiB).
+     */
+    maxMessageBytes?: number;
     /** Called when a player successfully joins. */
     onPlayerJoined?: (playerId: string, name: string) => void;
     /** Called when a player disconnects. */

package/lib/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAQN,MAAM,OAAO,CAAC;AAGf,OAAO,EAQL,KAAK,UAAU,EACf,KAAK,OAAO,EAEb,MAAM,iBAAiB,CAAC;AAczB,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACrE,YAAY,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1D,wCAAwC;IACxC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,yCAAyC;IACzC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,UAAU,oBAAoB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACpE,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,KAAK,GAAG,IAAI,CAAC;CAC3B;AAQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EAAE,EACxE,QAAQ,EACR,MAAM,GACP,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC9B,qBAqWA;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,KAK/C,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC7C"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAQN,MAAM,OAAO,CAAC;AAGf,OAAO,EAQL,KAAK,UAAU,EACf,KAAK,OAAO,EAEb,MAAM,iBAAiB,CAAC;AAczB,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACrE,YAAY,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1D,wCAAwC;IACxC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,yCAAyC;IACzC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,UAAU,oBAAoB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACpE,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,KAAK,GAAG,IAAI,CAAC;CAC3B;AAQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EAAE,EACxE,QAAQ,EACR,MAAM,GACP,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC9B,qBAyWA;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,KAK/C,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC7C"}

package/lib/websocket.d.ts

@@ -8,6 +8,13 @@ import { EventEmitter } from "./event-emitter";
 export interface WebSocketConfig {
     port: number;
     debug?: boolean;
+    /**
+     * Maximum size (in bytes) of an inbound client message. Frames larger than
+     * this are discarded before parsing, bounding the memory a single client can
+     * force the host to allocate. Defaults to {@link DEFAULT_MAX_MESSAGE_BYTES}
+     * (256 KiB).
+     */
+    maxMessageBytes?: number;
     /**
      * @deprecated No effect. The underlying nitro-http WebSocket transport
      * manages frame sizing internally and this value is never read. This field
@@ -41,6 +48,7 @@ export declare class GameWebSocketServer extends EventEmitter<WebSocketServerEve
     private clients;
     private port;
     private debug;
+    private maxMessageBytes;
     constructor(config: WebSocketConfig);
     private log;
     start(): Promise<void>;

package/lib/websocket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../src/websocket.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,8CAA8C;AAC9C,MAAM,MAAM,qBAAqB,GAAG;IAClC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;CACvB,CAAC;AAOF,qBAAa,mBAAoB,SAAQ,YAAY,CAAC,qBAAqB,CAAC;IAC1E,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,OAAO,CAA2C;IAC1D,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,KAAK,CAAU;gBAEX,MAAM,EAAE,eAAe;IAUnC,OAAO,CAAC,GAAG;IAME,KAAK;IA6FL,IAAI;IAoBjB;;;OAGG;IACI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;IAsB3C;;;OAGG;IACI,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM;IAoBlD,yDAAyD;IACzD,IAAW,WAAW,IAAI,MAAM,CAE/B;CACF"}
+{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../src/websocket.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAO/C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,8CAA8C;AAC9C,MAAM,MAAM,qBAAqB,GAAG;IAClC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;CACvB,CAAC;AAOF,qBAAa,mBAAoB,SAAQ,YAAY,CAAC,qBAAqB,CAAC;IAC1E,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,OAAO,CAA2C;IAC1D,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,eAAe,CAAS;gBAEpB,MAAM,EAAE,eAAe;IAYnC,OAAO,CAAC,GAAG;IAME,KAAK;IAuGL,IAAI;IAoBjB;;;OAGG;IACI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;IAsB3C;;;OAGG;IACI,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM;IAoBlD,yDAAyD;IACzD,IAAW,WAAW,IAAI,MAAM,CAE/B;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@couch-kit/host",
-  "version": "1.7.12",
+  "version": "1.7.13",
   "publishConfig": {
     "access": "public",
     "provenance": true

package/src/message-validation.ts

@@ -1,5 +1,41 @@
 import { MessageTypes, type ClientMessage } from "@couch-kit/core";
 
+/**
+ * Default maximum size (in bytes) of an inbound client message. Frames larger
+ * than this are discarded before `JSON.parse`, bounding the memory a single
+ * malicious LAN client can force the host to allocate. Generous enough for
+ * data-URI avatars in JOIN payloads while blocking multi-megabyte abuse.
+ */
+export const DEFAULT_MAX_MESSAGE_BYTES = 256 * 1024;
+
+/**
+ * Compute the UTF-8 byte length of a raw WebSocket frame payload.
+ *
+ * For binary frames the `ArrayBuffer.byteLength` is exact. For text frames the
+ * UTF-8 size is counted directly from the JS string without allocating an
+ * encoder buffer, so an oversized frame can be rejected cheaply.
+ */
+export function frameByteLength(data: string | ArrayBuffer): number {
+  if (typeof data !== "string") return data.byteLength;
+
+  let bytes = 0;
+  for (let i = 0; i < data.length; i++) {
+    const code = data.charCodeAt(i);
+    if (code < 0x80) {
+      bytes += 1;
+    } else if (code < 0x800) {
+      bytes += 2;
+    } else if (code >= 0xd800 && code <= 0xdbff) {
+      // High surrogate: a full pair encodes to 4 UTF-8 bytes.
+      bytes += 4;
+      i++; // Skip the paired low surrogate.
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+
 type ClientMessageOf<TType extends ClientMessage["type"]> = Extract<
   ClientMessage,
   { type: TType }

package/src/provider.tsx

@@ -47,6 +47,11 @@ export interface GameHostConfig<S extends IGameState, A extends IAction> {
   disconnectTimeout?: number;
   /** State broadcast throttle interval in milliseconds (default: 33ms, ~30fps). */
   stateThrottleMs?: number;
+  /**
+   * Maximum size (in bytes) of an inbound client message. Frames larger than
+   * this are discarded before parsing (default: 256 KiB).
+   */
+  maxMessageBytes?: number;
   /** Called when a player successfully joins. */
   onPlayerJoined?: (playerId: string, name: string) => void;
   /** Called when a player disconnects. */
@@ -187,7 +192,11 @@ export function GameHostProvider<S extends IGameState, A extends IAction>({
 
   useEffect(() => {
     const port = config.wsPort || httpPort + DEFAULT_WS_PORT_OFFSET;
-    const server = new GameWebSocketServer({ port, debug: config.debug });
+    const server = new GameWebSocketServer({
+      port,
+      debug: config.debug,
+      maxMessageBytes: config.maxMessageBytes,
+    });
 
     // Start the WebSocket server asynchronously
     server.start().catch((error) => {

package/src/websocket.ts

@@ -12,10 +12,21 @@ import type {
 } from "react-native-nitro-http-server";
 import { EventEmitter } from "./event-emitter";
 import { generateId, DEFAULT_WS_PATH } from "@couch-kit/core";
+import {
+  DEFAULT_MAX_MESSAGE_BYTES,
+  frameByteLength,
+} from "./message-validation";
 
 export interface WebSocketConfig {
   port: number;
   debug?: boolean;
+  /**
+   * Maximum size (in bytes) of an inbound client message. Frames larger than
+   * this are discarded before parsing, bounding the memory a single client can
+   * force the host to allocate. Defaults to {@link DEFAULT_MAX_MESSAGE_BYTES}
+   * (256 KiB).
+   */
+  maxMessageBytes?: number;
   /**
    * @deprecated No effect. The underlying nitro-http WebSocket transport
    * manages frame sizing internally and this value is never read. This field
@@ -56,15 +67,18 @@ export class GameWebSocketServer extends EventEmitter<WebSocketServerEvents> {
   private clients: Map<string, WebSocketClient> = new Map();
   private port: number;
   private debug: boolean;
+  private maxMessageBytes: number;
 
   constructor(config: WebSocketConfig) {
     super();
     this.port = config.port;
     this.debug = !!config.debug;
-    // Only `port` and `debug` are honored. `maxFrameSize`, `keepaliveInterval`,
-    // and `keepaliveTimeout` are deprecated no-ops: the nitro-http WebSocket
-    // transport does not expose these knobs, so they are intentionally ignored
-    // (see the @deprecated tags on WebSocketConfig).
+    this.maxMessageBytes =
+      config.maxMessageBytes ?? DEFAULT_MAX_MESSAGE_BYTES;
+    // Only `port`, `debug`, and `maxMessageBytes` are honored. `maxFrameSize`,
+    // `keepaliveInterval`, and `keepaliveTimeout` are deprecated no-ops: the
+    // nitro-http WebSocket transport does not expose these knobs, so they are
+    // intentionally ignored (see the @deprecated tags on WebSocketConfig).
   }
 
   private log(...args: unknown[]) {
@@ -93,6 +107,16 @@ export class GameWebSocketServer extends EventEmitter<WebSocketServerEvents> {
 
         // Handle incoming messages
         ws.onmessage = (event: { data: string | ArrayBuffer }) => {
+          // Reject oversized frames before parsing to bound memory usage.
+          const size = frameByteLength(event.data);
+          if (size > this.maxMessageBytes) {
+            this.log(
+              `[WebSocket] Message from ${socketId} exceeds limit ` +
+                `(${size} > ${this.maxMessageBytes} bytes), discarding`,
+            );
+            return;
+          }
+
           try {
             const data =
               typeof event.data === "string"