@couch-kit/runtime 0.0.0

package/dist/index.js

@@ -0,0 +1,570 @@
+// src/action-authorization.ts
+import { InternalActionTypes } from "@couch-kit/core";
+var INTERNAL_ACTION_TYPES = new Set([
+  InternalActionTypes.HYDRATE,
+  InternalActionTypes.PLAYER_JOINED,
+  InternalActionTypes.PLAYER_LEFT,
+  InternalActionTypes.PLAYER_RECONNECTED,
+  InternalActionTypes.PLAYER_REMOVED
+]);
+function authorizeClientAction(actionType, resolvedPlayerId) {
+  if (INTERNAL_ACTION_TYPES.has(actionType)) {
+    return {
+      kind: "reject",
+      code: "FORBIDDEN_ACTION",
+      message: "Internal action types cannot be dispatched by clients"
+    };
+  }
+  if (!resolvedPlayerId) {
+    return {
+      kind: "reject",
+      code: "NOT_JOINED",
+      message: "You must JOIN before dispatching actions"
+    };
+  }
+  return { kind: "allow", playerId: resolvedPlayerId };
+}
+// src/broadcast-scheduler.ts
+import { MessageTypes } from "@couch-kit/core";
+var DEFAULT_STATE_THROTTLE_MS = 33;
+var defaultTimerScheduler = {
+  setTimeout: (callback, delayMs) => setTimeout(callback, delayMs),
+  clearTimeout: (timer) => clearTimeout(timer)
+};
+
+class BroadcastScheduler {
+  stateThrottleMs;
+  scheduler;
+  timer = null;
+  constructor(options = {}) {
+    this.stateThrottleMs = options.stateThrottleMs ?? DEFAULT_STATE_THROTTLE_MS;
+    this.scheduler = options.scheduler ?? defaultTimerScheduler;
+  }
+  schedule(callback) {
+    this.cancel();
+    this.timer = this.scheduler.setTimeout(() => {
+      this.timer = null;
+      callback();
+    }, this.stateThrottleMs);
+  }
+  cancel() {
+    if (this.timer) {
+      this.scheduler.clearTimeout(this.timer);
+      this.timer = null;
+    }
+  }
+  setStateThrottleMs(stateThrottleMs) {
+    this.stateThrottleMs = stateThrottleMs;
+  }
+  hasPendingBroadcast() {
+    return this.timer !== null;
+  }
+}
+function createStateUpdateMessage(newState, actions, timestamp = Date.now()) {
+  return {
+    type: MessageTypes.STATE_UPDATE,
+    payload: {
+      newState,
+      timestamp,
+      ...actions.length === 1 ? { action: actions[0] } : actions.length > 1 ? { action: actions } : {}
+    }
+  };
+}
+// src/message-validation.ts
+import { MessageTypes as MessageTypes2 } from "@couch-kit/core";
+var DEFAULT_MAX_MESSAGE_BYTES = 256 * 1024;
+function frameByteLength(data) {
+  if (typeof data !== "string")
+    return data.byteLength;
+  let bytes = 0;
+  for (let i = 0;i < data.length; i++) {
+    const code = data.charCodeAt(i);
+    if (code < 128) {
+      bytes += 1;
+    } else if (code < 2048) {
+      bytes += 2;
+    } else if (code >= 55296 && code <= 56319) {
+      bytes += 4;
+      i++;
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+function isValidClientMessage(msg) {
+  if (typeof msg !== "object" || msg === null)
+    return false;
+  const m = msg;
+  if (typeof m.type !== "string")
+    return false;
+  switch (m.type) {
+    case MessageTypes2.JOIN:
+      return typeof m.payload === "object" && m.payload !== null && typeof m.payload.name === "string";
+    case MessageTypes2.ACTION:
+      return typeof m.payload === "object" && m.payload !== null && typeof m.payload.type === "string";
+    case MessageTypes2.PING:
+      return typeof m.payload === "object" && m.payload !== null && typeof m.payload.id === "string" && typeof m.payload.timestamp === "number";
+    case MessageTypes2.ASSETS_LOADED:
+      return m.payload === true;
+    default:
+      return false;
+  }
+}
+// src/rate-limiter.ts
+var RATE_LIMIT_MAX = 60;
+var RATE_LIMIT_WINDOW = 1000;
+
+class ActionRateLimiter {
+  maxActions;
+  windowMs;
+  now;
+  limits = new Map;
+  constructor(options = {}) {
+    this.maxActions = options.maxActions ?? RATE_LIMIT_MAX;
+    this.windowMs = options.windowMs ?? RATE_LIMIT_WINDOW;
+    this.now = options.now ?? Date.now;
+  }
+  record(socketId) {
+    const now = this.now();
+    let rateInfo = this.limits.get(socketId);
+    if (!rateInfo || now - rateInfo.windowStart > this.windowMs) {
+      rateInfo = { count: 0, windowStart: now };
+      this.limits.set(socketId, rateInfo);
+    }
+    rateInfo.count++;
+    return {
+      ...rateInfo,
+      allowed: rateInfo.count <= this.maxActions
+    };
+  }
+  reset(socketId) {
+    this.limits.delete(socketId);
+  }
+  clear() {
+    this.limits.clear();
+  }
+  get(socketId) {
+    return this.limits.get(socketId);
+  }
+}
+// src/runtime.ts
+import {
+  DEFAULT_DISCONNECT_TIMEOUT as DEFAULT_DISCONNECT_TIMEOUT2,
+  InternalActionTypes as InternalActionTypes3,
+  MessageTypes as MessageTypes3,
+  createGameReducer,
+  isValidSecret
+} from "@couch-kit/core";
+
+// src/session-manager.ts
+import {
+  DEFAULT_DISCONNECT_TIMEOUT,
+  InternalActionTypes as InternalActionTypes2,
+  derivePlayerId,
+  derivePlayerIdLegacy
+} from "@couch-kit/core";
+var defaultSessionTimerScheduler = {
+  setTimeout: (callback, delayMs) => setTimeout(callback, delayMs),
+  clearTimeout: (timer) => clearTimeout(timer)
+};
+
+class HostSessionManager {
+  sessions = new Map;
+  reverseMap = new Map;
+  cleanupTimers = new Map;
+  socketIdToPlayerId = new Map;
+  scheduler;
+  getDisconnectTimeout;
+  derivePlayerIdFn;
+  derivePlayerIdLegacyFn;
+  constructor(options = {}) {
+    this.scheduler = options.scheduler ?? defaultSessionTimerScheduler;
+    this.getDisconnectTimeout = options.getDisconnectTimeout ?? (() => options.disconnectTimeout ?? DEFAULT_DISCONNECT_TIMEOUT);
+    this.derivePlayerIdFn = options.derivePlayerId ?? derivePlayerId;
+    this.derivePlayerIdLegacyFn = options.derivePlayerIdLegacy ?? derivePlayerIdLegacy;
+  }
+  async handleJoin(socketId, payload, playersSource) {
+    const hashedId = await this.derivePlayerIdFn(payload.secret);
+    const players = typeof playersSource === "function" ? playersSource() : playersSource;
+    let playerId = hashedId;
+    const legacyId = this.derivePlayerIdLegacyFn(payload.secret);
+    if (!players[playerId] && players[legacyId]) {
+      playerId = legacyId;
+    }
+    this.socketIdToPlayerId.set(socketId, playerId);
+    this.sessions.set(payload.secret, socketId);
+    this.reverseMap.set(socketId, payload.secret);
+    this.cancelRemoval(playerId);
+    const isReconnect = !!players[playerId];
+    const action = isReconnect ? {
+      type: InternalActionTypes2.PLAYER_RECONNECTED,
+      payload: { playerId }
+    } : {
+      type: InternalActionTypes2.PLAYER_JOINED,
+      payload: { id: playerId, name: payload.name, avatar: payload.avatar }
+    };
+    return {
+      playerId,
+      socketId,
+      secret: payload.secret,
+      isReconnect,
+      action
+    };
+  }
+  handleDisconnect(socketId) {
+    const playerId = this.socketIdToPlayerId.get(socketId);
+    this.socketIdToPlayerId.delete(socketId);
+    const secret = this.reverseMap.get(socketId);
+    this.reverseMap.delete(socketId);
+    if (!playerId || !secret)
+      return { kind: "unknown" };
+    if (this.sessions.get(secret) !== socketId) {
+      return { kind: "stale", playerId, secret };
+    }
+    return {
+      kind: "left",
+      playerId,
+      secret,
+      action: {
+        type: InternalActionTypes2.PLAYER_LEFT,
+        payload: { playerId }
+      }
+    };
+  }
+  scheduleRemoval(playerId, secret, onRemove) {
+    const timer = this.scheduler.setTimeout(() => {
+      this.cleanupTimers.delete(playerId);
+      this.sessions.delete(secret);
+      onRemove(playerId);
+    }, this.getDisconnectTimeout());
+    this.cleanupTimers.set(playerId, timer);
+  }
+  cancelRemoval(playerId) {
+    const existingTimer = this.cleanupTimers.get(playerId);
+    if (existingTimer) {
+      this.scheduler.clearTimeout(existingTimer);
+      this.cleanupTimers.delete(playerId);
+    }
+  }
+  clearRemovalTimers() {
+    for (const timer of this.cleanupTimers.values()) {
+      this.scheduler.clearTimeout(timer);
+    }
+    this.cleanupTimers.clear();
+  }
+  getPlayerIdForSocket(socketId) {
+    const secret = this.reverseMap.get(socketId);
+    if (!secret || this.sessions.get(secret) !== socketId) {
+      return;
+    }
+    return this.socketIdToPlayerId.get(socketId);
+  }
+  abandonConnection(socketId) {
+    const secret = this.reverseMap.get(socketId);
+    this.socketIdToPlayerId.delete(socketId);
+    this.reverseMap.delete(socketId);
+    if (secret && this.sessions.get(secret) === socketId) {
+      this.sessions.delete(secret);
+    }
+  }
+  getSocketIdForSecret(secret) {
+    return this.sessions.get(secret);
+  }
+  hasPendingRemoval(playerId) {
+    return this.cleanupTimers.has(playerId);
+  }
+}
+
+// src/runtime.ts
+class GameHostRuntime {
+  config;
+  reducer;
+  state;
+  transport;
+  listeners = new Set;
+  sessionManager;
+  rateLimiter = new ActionRateLimiter;
+  broadcastScheduler;
+  assetsLoaded = new Map;
+  activeConnections = new Map;
+  joinedConnections = new Set;
+  pendingJoins = new Set;
+  actionQueue = [];
+  stateDirty = false;
+  nextConnectionGeneration = 1;
+  constructor(config, transport = null) {
+    this.config = config;
+    this.state = config.initialState;
+    this.reducer = createGameReducer(config.reducer);
+    this.transport = transport;
+    this.sessionManager = new HostSessionManager({
+      getDisconnectTimeout: () => this.config.disconnectTimeout ?? DEFAULT_DISCONNECT_TIMEOUT2
+    });
+    this.broadcastScheduler = new BroadcastScheduler({
+      stateThrottleMs: config.stateThrottleMs ?? DEFAULT_STATE_THROTTLE_MS
+    });
+  }
+  getState = () => this.state;
+  subscribe = (listener) => {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  };
+  setTransport(transport) {
+    this.transport = transport;
+    if (transport && this.stateDirty) {
+      this.broadcastScheduler.schedule(this.broadcastState);
+    }
+  }
+  updateConfig(config) {
+    this.config = config;
+    this.broadcastScheduler.setStateThrottleMs(config.stateThrottleMs ?? DEFAULT_STATE_THROTTLE_MS);
+  }
+  dispatch = (action) => {
+    this.applyAction(action);
+  };
+  handleConnection(connectionId) {
+    this.activeConnections.set(connectionId, this.nextConnectionGeneration++);
+    this.log(`[GameRuntime] Client connected: ${connectionId}`);
+  }
+  async handleMessage(connectionId, rawMessage) {
+    const connectionGeneration = this.activeConnections.get(connectionId);
+    if (connectionGeneration === undefined) {
+      this.log(`[GameRuntime] Ignoring message from inactive connection: ${connectionId}`);
+      return;
+    }
+    if (!isValidClientMessage(rawMessage)) {
+      this.log(`[GameRuntime] Invalid message from ${connectionId}:`, rawMessage);
+      this.send(connectionId, {
+        type: MessageTypes3.ERROR,
+        payload: {
+          code: "INVALID_MESSAGE",
+          message: "Malformed message"
+        }
+      });
+      return;
+    }
+    const message = rawMessage;
+    this.log(`[GameRuntime] Msg from ${connectionId}:`, message);
+    switch (message.type) {
+      case MessageTypes3.JOIN: {
+        const { secret, ...payload } = message.payload;
+        if (!secret || typeof secret !== "string" || !isValidSecret(secret)) {
+          this.send(connectionId, {
+            type: MessageTypes3.ERROR,
+            payload: {
+              code: "INVALID_SECRET",
+              message: "Invalid or missing session secret"
+            }
+          });
+          return;
+        }
+        if (this.joinedConnections.has(connectionId) || this.pendingJoins.has(connectionId)) {
+          this.send(connectionId, {
+            type: MessageTypes3.ERROR,
+            payload: {
+              code: "ALREADY_JOINED",
+              message: "This connection has already joined the game"
+            }
+          });
+          return;
+        }
+        this.pendingJoins.add(connectionId);
+        try {
+          const { playerId, isReconnect, action } = await this.sessionManager.handleJoin(connectionId, message.payload, () => this.state.players);
+          if (this.activeConnections.get(connectionId) !== connectionGeneration) {
+            this.sessionManager.abandonConnection(connectionId);
+            return;
+          }
+          this.applyAction(action);
+          this.joinedConnections.add(connectionId);
+          this.assetsLoaded.set(playerId, false);
+          this.invokeLifecycleCallback("onPlayerJoined", this.config.onPlayerJoined ? () => {
+            this.config.onPlayerJoined?.(playerId, payload.name);
+          } : undefined);
+          if (isReconnect) {
+            this.send(connectionId, {
+              type: MessageTypes3.RECONNECTED,
+              payload: {
+                playerId,
+                state: this.state
+              }
+            });
+          } else {
+            this.send(connectionId, {
+              type: MessageTypes3.WELCOME,
+              payload: {
+                playerId,
+                state: this.state,
+                serverTime: Date.now()
+              }
+            });
+          }
+        } catch (error) {
+          this.log("[GameRuntime] Failed to derive player ID:", error);
+          this.send(connectionId, {
+            type: MessageTypes3.ERROR,
+            payload: {
+              code: "JOIN_FAILED",
+              message: "Failed to process join request"
+            }
+          });
+        } finally {
+          this.pendingJoins.delete(connectionId);
+        }
+        break;
+      }
+      case MessageTypes3.ACTION: {
+        const actionPayload = message.payload;
+        const playerId = this.sessionManager.getPlayerIdForSocket(connectionId);
+        const authorization = authorizeClientAction(actionPayload.type, playerId);
+        if (authorization.kind === "reject") {
+          this.log(`[GameRuntime] Rejected action from ${connectionId} ` + `(${authorization.code}):`, actionPayload.type);
+          this.send(connectionId, {
+            type: MessageTypes3.ERROR,
+            payload: {
+              code: authorization.code,
+              message: authorization.message
+            }
+          });
+          return;
+        }
+        if (!this.rateLimiter.record(connectionId).allowed) {
+          this.log(`[GameRuntime] Rate limited ${connectionId}`);
+          this.send(connectionId, {
+            type: MessageTypes3.ERROR,
+            payload: {
+              code: "RATE_LIMITED",
+              message: "Too many actions, slow down"
+            }
+          });
+          return;
+        }
+        this.applyAction({
+          ...actionPayload,
+          playerId: authorization.playerId
+        });
+        this.actionQueue.push(actionPayload);
+        break;
+      }
+      case MessageTypes3.PING:
+        this.send(connectionId, {
+          type: MessageTypes3.PONG,
+          payload: {
+            id: message.payload.id,
+            origTimestamp: message.payload.timestamp,
+            serverTime: Date.now()
+          }
+        });
+        break;
+      case MessageTypes3.ASSETS_LOADED: {
+        const playerId = this.sessionManager.getPlayerIdForSocket(connectionId);
+        if (playerId) {
+          this.assetsLoaded.set(playerId, true);
+          this.log(`[GameRuntime] Assets loaded for ${playerId}`);
+        }
+        break;
+      }
+    }
+  }
+  handleDisconnect(connectionId) {
+    this.log(`[GameRuntime] Client disconnected: ${connectionId}`);
+    this.activeConnections.delete(connectionId);
+    this.joinedConnections.delete(connectionId);
+    this.rateLimiter.reset(connectionId);
+    const result = this.sessionManager.handleDisconnect(connectionId);
+    if (result.kind === "unknown")
+      return;
+    this.assetsLoaded.delete(result.playerId);
+    if (result.kind === "stale")
+      return;
+    this.applyAction(result.action);
+    this.invokeLifecycleCallback("onPlayerLeft", this.config.onPlayerLeft ? () => {
+      this.config.onPlayerLeft?.(result.playerId);
+    } : undefined);
+    this.sessionManager.scheduleRemoval(result.playerId, result.secret, (playerId) => {
+      this.applyAction({
+        type: InternalActionTypes3.PLAYER_REMOVED,
+        payload: { playerId }
+      });
+    });
+  }
+  handleError(error) {
+    this.log("[GameRuntime] Transport error:", error);
+    this.notifyError(error);
+  }
+  stop() {
+    this.broadcastScheduler.cancel();
+    this.sessionManager.clearRemovalTimers();
+    this.rateLimiter.clear();
+    this.activeConnections.clear();
+    this.joinedConnections.clear();
+    this.pendingJoins.clear();
+    this.transport = null;
+  }
+  applyAction(action) {
+    const nextState = this.reducer(this.state, action);
+    if (Object.is(nextState, this.state))
+      return;
+    this.state = nextState;
+    this.stateDirty = true;
+    for (const listener of this.listeners) {
+      listener();
+    }
+    this.broadcastScheduler.schedule(this.broadcastState);
+  }
+  broadcastState = () => {
+    if (!this.transport)
+      return;
+    const actions = this.actionQueue;
+    this.actionQueue = [];
+    this.stateDirty = false;
+    this.transport.broadcast(createStateUpdateMessage(this.state, actions));
+  };
+  send(connectionId, message) {
+    this.transport?.send(connectionId, message);
+  }
+  invokeLifecycleCallback(name, callback) {
+    if (!callback)
+      return;
+    try {
+      callback();
+    } catch (error) {
+      const cause = error instanceof Error ? error : new Error(String(error));
+      this.notifyError(new Error(`${name} callback failed: ${cause.message}`, { cause }));
+    }
+  }
+  notifyError(error) {
+    const onError = this.config.onError;
+    if (!onError) {
+      console.error("[GameRuntime] Unhandled error:", error);
+      return;
+    }
+    try {
+      onError(error);
+    } catch (callbackError) {
+      console.error("[GameRuntime] onError callback failed:", callbackError);
+    }
+  }
+  log(...args) {
+    if (this.config.debug) {
+      console.log(...args);
+    }
+  }
+}
+export {
+  isValidClientMessage,
+  frameByteLength,
+  createStateUpdateMessage,
+  authorizeClientAction,
+  RATE_LIMIT_WINDOW,
+  RATE_LIMIT_MAX,
+  HostSessionManager,
+  GameHostRuntime,
+  DEFAULT_STATE_THROTTLE_MS,
+  DEFAULT_MAX_MESSAGE_BYTES,
+  BroadcastScheduler,
+  ActionRateLimiter
+};

package/lib/action-authorization.d.ts

@@ -0,0 +1,28 @@
+/** Error codes surfaced when a client ACTION is rejected before dispatch. */
+export type ActionRejectionCode = "FORBIDDEN_ACTION" | "NOT_JOINED";
+/** Outcome of authorizing an inbound client ACTION message. */
+export type ActionAuthorization = {
+    kind: "allow";
+    playerId: string;
+} | {
+    kind: "reject";
+    code: ActionRejectionCode;
+    message: string;
+};
+/**
+ * Decide whether an inbound client ACTION may be dispatched by the runtime.
+ *
+ * Rejects, in order:
+ * - **Internal action types** — clients must not be able to inject framework
+ *   actions (`__HYDRATE__`, `__PLAYER_JOINED__`, etc.) to forge state.
+ * - **Un-joined sockets** — a socket with no resolved player ID never completed
+ *   a JOIN, so its actions have no owner and must not mutate state.
+ *
+ * The decision is pure so it can be unit-tested without a WebSocket or React.
+ *
+ * @param actionType - The `type` field of the client's action payload.
+ * @param resolvedPlayerId - The player ID cached for the socket at JOIN time, or
+ *   `undefined` if the socket has not joined.
+ */
+export declare function authorizeClientAction(actionType: string, resolvedPlayerId: string | undefined): ActionAuthorization;
+//# sourceMappingURL=action-authorization.d.ts.map

package/lib/action-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-authorization.d.ts","sourceRoot":"","sources":["../src/action-authorization.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,YAAY,CAAC;AAEpE,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAUnE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,mBAAmB,CAkBrB"}

package/lib/broadcast-scheduler.d.ts

@@ -0,0 +1,30 @@
+import { MessageTypes, type HostMessage } from "@couch-kit/core";
+/** Default state broadcast throttle (~30fps). */
+export declare const DEFAULT_STATE_THROTTLE_MS = 33;
+export type StateUpdateMessage = Extract<HostMessage, {
+    type: typeof MessageTypes.STATE_UPDATE;
+}>;
+export interface TimerScheduler<TTimer> {
+    setTimeout(callback: () => void, delayMs: number): TTimer;
+    clearTimeout(timer: TTimer): void;
+}
+export interface BroadcastSchedulerOptions<TTimer> {
+    stateThrottleMs?: number;
+    scheduler?: TimerScheduler<TTimer>;
+}
+/**
+ * Debounced state-broadcast scheduler used by the authoritative runtime.
+ * Rapid state changes are coalesced into one broadcast after the latest change.
+ */
+export declare class BroadcastScheduler<TTimer = ReturnType<typeof setTimeout>> {
+    private stateThrottleMs;
+    private readonly scheduler;
+    private timer;
+    constructor(options?: BroadcastSchedulerOptions<TTimer>);
+    schedule(callback: () => void): void;
+    cancel(): void;
+    setStateThrottleMs(stateThrottleMs: number): void;
+    hasPendingBroadcast(): boolean;
+}
+export declare function createStateUpdateMessage(newState: unknown, actions: readonly unknown[], timestamp?: number): StateUpdateMessage;
+//# sourceMappingURL=broadcast-scheduler.d.ts.map

package/lib/broadcast-scheduler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broadcast-scheduler.d.ts","sourceRoot":"","sources":["../src/broadcast-scheduler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEjE,iDAAiD;AACjD,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,MAAM,MAAM,kBAAkB,GAAG,OAAO,CACtC,WAAW,EACX;IAAE,IAAI,EAAE,OAAO,YAAY,CAAC,YAAY,CAAA;CAAE,CAC3C,CAAC;AAEF,MAAM,WAAW,cAAc,CAAC,MAAM;IACpC,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1D,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAOD,MAAM,WAAW,yBAAyB,CAAC,MAAM;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,qBAAa,kBAAkB,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC;IACpE,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,KAAK,CAAuB;gBAExB,OAAO,GAAE,yBAAyB,CAAC,MAAM,CAAM;IAO3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI;IAQpC,MAAM,IAAI,IAAI;IAOd,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI;IAIjD,mBAAmB,IAAI,OAAO;CAG/B;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,OAAO,EAAE,SAAS,OAAO,EAAE,EAC3B,SAAS,GAAE,MAAmB,GAC7B,kBAAkB,CAapB"}

package/lib/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./action-authorization.js";
+export * from "./broadcast-scheduler.js";
+export * from "./message-validation.js";
+export * from "./rate-limiter.js";
+export * from "./runtime.js";
+export * from "./session-manager.js";
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC"}

package/lib/message-validation.d.ts

@@ -0,0 +1,35 @@
+import { MessageTypes, type ClientMessage } from "@couch-kit/core";
+/**
+ * Default maximum size (in bytes) of an inbound client message. Frames larger
+ * than this are discarded before `JSON.parse`, bounding the memory a single
+ * malicious LAN client can force the runtime to allocate. Generous enough for
+ * data-URI avatars in JOIN payloads while blocking multi-megabyte abuse.
+ */
+export declare const DEFAULT_MAX_MESSAGE_BYTES: number;
+/**
+ * Compute the UTF-8 byte length of a raw WebSocket frame payload.
+ *
+ * For binary frames the `ArrayBuffer.byteLength` is exact. For text frames the
+ * UTF-8 size is counted directly from the JS string without allocating an
+ * encoder buffer, so an oversized frame can be rejected cheaply.
+ */
+export declare function frameByteLength(data: string | ArrayBuffer): number;
+type ClientMessageOf<TType extends ClientMessage["type"]> = Extract<ClientMessage, {
+    type: TType;
+}>;
+export type ValidatedClientMessage = {
+    type: typeof MessageTypes.JOIN;
+    payload: {
+        name: string;
+        secret?: unknown;
+        avatar?: unknown;
+        [key: string]: unknown;
+    };
+} | ClientMessageOf<"ACTION"> | ClientMessageOf<"PING"> | ClientMessageOf<"ASSETS_LOADED">;
+/**
+ * Validates that an incoming message has the expected shape.
+ * Returns true if the message has a processable client-message shape.
+ */
+export declare function isValidClientMessage(msg: unknown): msg is ValidatedClientMessage;
+export {};
+//# sourceMappingURL=message-validation.d.ts.map

package/lib/message-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-validation.d.ts","sourceRoot":"","sources":["../src/message-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAa,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAmBlE;AAED,KAAK,eAAe,CAAC,KAAK,SAAS,aAAa,CAAC,MAAM,CAAC,IAAI,OAAO,CACjE,aAAa,EACb;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,IAAI,EAAE,OAAO,YAAY,CAAC,IAAI,CAAC;IAC/B,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH,GACD,eAAe,CAAC,QAAQ,CAAC,GACzB,eAAe,CAAC,MAAM,CAAC,GACvB,eAAe,CAAC,eAAe,CAAC,CAAC;AAErC;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,GACX,GAAG,IAAI,sBAAsB,CA8B/B"}