@durable-streams/server 0.1.6 → 0.2.0

package/dist/index.cjs

@@ -1369,10 +1369,14 @@ const CURSOR_QUERY_PARAM = `cursor`;
 * Line terminators in the payload (CR, LF, or CRLF) become separate data: lines.
 * This prevents CRLF injection attacks where malicious payloads could inject
 * fake SSE events using CR-only line terminators.
+*
+* Note: We don't add a space after "data:" because clients strip exactly one
+* leading space per the SSE spec. Adding one would cause data starting with
+* spaces to lose an extra space character.
 */
 function encodeSSEData(payload) {
 	const lines = payload.split(/\r\n|\r|\n/);
-	return lines.map((line) => `data: ${line}`).join(`\n`) + `\n\n`;
+	return lines.map((line) => `data:${line}`).join(`\n`) + `\n\n`;
 }
 /**
 * Minimum response size to consider for compression.
@@ -1554,10 +1558,12 @@ var DurableStreamTestServer = class {
 		if (fault.truncateBodyBytes !== void 0 && modified.length > fault.truncateBodyBytes) modified = modified.slice(0, fault.truncateBodyBytes);
 		if (fault.corruptBody && modified.length > 0) {
 			modified = new Uint8Array(modified);
-			const numCorrupt = Math.max(1, Math.floor(modified.length * .03));
+			modified[0] = 88;
+			if (modified.length > 1) modified[1] = 89;
+			const numCorrupt = Math.max(1, Math.floor(modified.length * .1));
 			for (let i = 0; i < numCorrupt; i++) {
 				const pos = Math.floor(Math.random() * modified.length);
-				modified[pos] = modified[pos] ^ 1 << Math.floor(Math.random() * 8);
+				modified[pos] = 90;
 			}
 		}
 		return modified;
@@ -1595,7 +1601,7 @@ var DurableStreamTestServer = class {
 				res.end(`Injected error for testing`);
 				return;
 			}
-			if (fault.truncateBodyBytes !== void 0 || fault.corruptBody) res._injectedFault = fault;
+			if (fault.truncateBodyBytes !== void 0 || fault.corruptBody || fault.injectSseEvent) res._injectedFault = fault;
 		}
 		try {
 			switch (method) {
@@ -1836,6 +1842,11 @@ var DurableStreamTestServer = class {
 			"x-content-type-options": `nosniff`,
 			"cross-origin-resource-policy": `cross-origin`
 		});
+		const fault = res._injectedFault;
+		if (fault?.injectSseEvent) {
+			res.write(`event: ${fault.injectSseEvent.eventType}\n`);
+			res.write(`data: ${fault.injectSseEvent.data}\n\n`);
+		}
 		let currentOffset = initialOffset;
 		let isConnected = true;
 		const decoder = new TextDecoder();
@@ -2030,10 +2041,10 @@ var DurableStreamTestServer = class {
 					res.end(`Missing required field: path`);
 					return;
 				}
-				const hasFaultType = config.status !== void 0 || config.delayMs !== void 0 || config.dropConnection || config.truncateBodyBytes !== void 0 || config.corruptBody;
+				const hasFaultType = config.status !== void 0 || config.delayMs !== void 0 || config.dropConnection || config.truncateBodyBytes !== void 0 || config.corruptBody || config.injectSseEvent !== void 0;
 				if (!hasFaultType) {
 					res.writeHead(400, { "content-type": `text/plain` });
-					res.end(`Must specify at least one fault type: status, delayMs, dropConnection, truncateBodyBytes, or corruptBody`);
+					res.end(`Must specify at least one fault type: status, delayMs, dropConnection, truncateBodyBytes, corruptBody, or injectSseEvent`);
 					return;
 				}
 				this.injectFault(config.path, {
@@ -2046,7 +2057,8 @@ var DurableStreamTestServer = class {
 					probability: config.probability,
 					method: config.method,
 					corruptBody: config.corruptBody,
-					jitterMs: config.jitterMs
+					jitterMs: config.jitterMs,
+					injectSseEvent: config.injectSseEvent
 				});
 				res.writeHead(200, { "content-type": `application/json` });
 				res.end(JSON.stringify({ ok: true }));
@@ -2128,13 +2140,13 @@ function createRegistryHooks(store, serverUrl) {
 					createdAt: event.timestamp
 				}
 			});
-			await registryStream.append(changeEvent);
+			await registryStream.append(JSON.stringify(changeEvent));
 		},
 		onStreamDeleted: async (event) => {
 			await ensureRegistryExists();
 			const streamName = extractStreamName(event.path);
 			const changeEvent = registryStateSchema.streams.delete({ key: streamName });
-			await registryStream.append(changeEvent);
+			await registryStream.append(JSON.stringify(changeEvent));
 		}
 	};
 }

package/dist/index.d.cts

@@ -490,6 +490,13 @@ interface InjectedFault {
   corruptBody?: boolean;
   /** Add jitter to delay (random 0-jitterMs added to delayMs) */
   jitterMs?: number;
+  /** Inject an SSE event with custom type and data (for testing SSE parsing) */
+  injectSseEvent?: {
+    /** Event type (e.g., "unknown", "control", "data") */
+    eventType: string;
+    /** Event data (will be sent as-is) */
+    data: string;
+  };
 }
 declare class DurableStreamTestServer {
   readonly store: StreamStore | FileBackedStreamStore;

package/dist/index.d.ts

@@ -490,6 +490,13 @@ interface InjectedFault {
   corruptBody?: boolean;
   /** Add jitter to delay (random 0-jitterMs added to delayMs) */
   jitterMs?: number;
+  /** Inject an SSE event with custom type and data (for testing SSE parsing) */
+  injectSseEvent?: {
+    /** Event type (e.g., "unknown", "control", "data") */
+    eventType: string;
+    /** Event data (will be sent as-is) */
+    data: string;
+  };
 }
 declare class DurableStreamTestServer {
   readonly store: StreamStore | FileBackedStreamStore;

package/dist/index.js

@@ -1346,10 +1346,14 @@ const CURSOR_QUERY_PARAM = `cursor`;
 * Line terminators in the payload (CR, LF, or CRLF) become separate data: lines.
 * This prevents CRLF injection attacks where malicious payloads could inject
 * fake SSE events using CR-only line terminators.
+*
+* Note: We don't add a space after "data:" because clients strip exactly one
+* leading space per the SSE spec. Adding one would cause data starting with
+* spaces to lose an extra space character.
 */
 function encodeSSEData(payload) {
 	const lines = payload.split(/\r\n|\r|\n/);
-	return lines.map((line) => `data: ${line}`).join(`\n`) + `\n\n`;
+	return lines.map((line) => `data:${line}`).join(`\n`) + `\n\n`;
 }
 /**
 * Minimum response size to consider for compression.
@@ -1531,10 +1535,12 @@ var DurableStreamTestServer = class {
 		if (fault.truncateBodyBytes !== void 0 && modified.length > fault.truncateBodyBytes) modified = modified.slice(0, fault.truncateBodyBytes);
 		if (fault.corruptBody && modified.length > 0) {
 			modified = new Uint8Array(modified);
-			const numCorrupt = Math.max(1, Math.floor(modified.length * .03));
+			modified[0] = 88;
+			if (modified.length > 1) modified[1] = 89;
+			const numCorrupt = Math.max(1, Math.floor(modified.length * .1));
 			for (let i = 0; i < numCorrupt; i++) {
 				const pos = Math.floor(Math.random() * modified.length);
-				modified[pos] = modified[pos] ^ 1 << Math.floor(Math.random() * 8);
+				modified[pos] = 90;
 			}
 		}
 		return modified;
@@ -1572,7 +1578,7 @@ var DurableStreamTestServer = class {
 				res.end(`Injected error for testing`);
 				return;
 			}
-			if (fault.truncateBodyBytes !== void 0 || fault.corruptBody) res._injectedFault = fault;
+			if (fault.truncateBodyBytes !== void 0 || fault.corruptBody || fault.injectSseEvent) res._injectedFault = fault;
 		}
 		try {
 			switch (method) {
@@ -1813,6 +1819,11 @@ var DurableStreamTestServer = class {
 			"x-content-type-options": `nosniff`,
 			"cross-origin-resource-policy": `cross-origin`
 		});
+		const fault = res._injectedFault;
+		if (fault?.injectSseEvent) {
+			res.write(`event: ${fault.injectSseEvent.eventType}\n`);
+			res.write(`data: ${fault.injectSseEvent.data}\n\n`);
+		}
 		let currentOffset = initialOffset;
 		let isConnected = true;
 		const decoder = new TextDecoder();
@@ -2007,10 +2018,10 @@ var DurableStreamTestServer = class {
 					res.end(`Missing required field: path`);
 					return;
 				}
-				const hasFaultType = config.status !== void 0 || config.delayMs !== void 0 || config.dropConnection || config.truncateBodyBytes !== void 0 || config.corruptBody;
+				const hasFaultType = config.status !== void 0 || config.delayMs !== void 0 || config.dropConnection || config.truncateBodyBytes !== void 0 || config.corruptBody || config.injectSseEvent !== void 0;
 				if (!hasFaultType) {
 					res.writeHead(400, { "content-type": `text/plain` });
-					res.end(`Must specify at least one fault type: status, delayMs, dropConnection, truncateBodyBytes, or corruptBody`);
+					res.end(`Must specify at least one fault type: status, delayMs, dropConnection, truncateBodyBytes, corruptBody, or injectSseEvent`);
 					return;
 				}
 				this.injectFault(config.path, {
@@ -2023,7 +2034,8 @@ var DurableStreamTestServer = class {
 					probability: config.probability,
 					method: config.method,
 					corruptBody: config.corruptBody,
-					jitterMs: config.jitterMs
+					jitterMs: config.jitterMs,
+					injectSseEvent: config.injectSseEvent
 				});
 				res.writeHead(200, { "content-type": `application/json` });
 				res.end(JSON.stringify({ ok: true }));
@@ -2105,13 +2117,13 @@ function createRegistryHooks(store, serverUrl) {
 					createdAt: event.timestamp
 				}
 			});
-			await registryStream.append(changeEvent);
+			await registryStream.append(JSON.stringify(changeEvent));
 		},
 		onStreamDeleted: async (event) => {
 			await ensureRegistryExists();
 			const streamName = extractStreamName(event.path);
 			const changeEvent = registryStateSchema.streams.delete({ key: streamName });
-			await registryStream.append(changeEvent);
+			await registryStream.append(JSON.stringify(changeEvent));
 		}
 	};
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@durable-streams/server",
-  "version": "0.1.6",
+  "version": "0.2.0",
   "description": "Node.js reference server implementation for Durable Streams",
   "author": "Durable Stream contributors",
   "license": "Apache-2.0",
@@ -39,15 +39,15 @@
   "dependencies": {
     "@neophi/sieve-cache": "^1.0.0",
     "lmdb": "^3.3.0",
-    "@durable-streams/client": "0.1.5",
-    "@durable-streams/state": "0.1.5"
+    "@durable-streams/client": "0.2.0",
+    "@durable-streams/state": "0.2.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "tsdown": "^0.9.0",
     "typescript": "^5.0.0",
     "vitest": "^4.0.0",
-    "@durable-streams/server-conformance-tests": "0.1.8"
+    "@durable-streams/server-conformance-tests": "0.2.0"
   },
   "files": [
     "dist",

package/src/registry-hook.ts

@@ -100,7 +100,7 @@ export function createRegistryHooks(
         },
       })
 
-      await registryStream.append(changeEvent)
+      await registryStream.append(JSON.stringify(changeEvent))
     },
 
     onStreamDeleted: async (event) => {
@@ -112,7 +112,7 @@ export function createRegistryHooks(
         key: streamName,
       })
 
-      await registryStream.append(changeEvent)
+      await registryStream.append(JSON.stringify(changeEvent))
     },
   }
 }

package/src/server.ts

@@ -42,12 +42,16 @@ const CURSOR_QUERY_PARAM = `cursor`
  * Line terminators in the payload (CR, LF, or CRLF) become separate data: lines.
  * This prevents CRLF injection attacks where malicious payloads could inject
  * fake SSE events using CR-only line terminators.
+ *
+ * Note: We don't add a space after "data:" because clients strip exactly one
+ * leading space per the SSE spec. Adding one would cause data starting with
+ * spaces to lose an extra space character.
  */
 function encodeSSEData(payload: string): string {
   // Split on all SSE-valid line terminators: CRLF, CR, or LF
   // Order matters: \r\n must be matched before \r alone
   const lines = payload.split(/\r\n|\r|\n/)
-  return lines.map((line) => `data: ${line}`).join(`\n`) + `\n\n`
+  return lines.map((line) => `data:${line}`).join(`\n`) + `\n\n`
 }
 
 /**
@@ -127,6 +131,13 @@ interface InjectedFault {
   corruptBody?: boolean
   /** Add jitter to delay (random 0-jitterMs added to delayMs) */
   jitterMs?: number
+  /** Inject an SSE event with custom type and data (for testing SSE parsing) */
+  injectSseEvent?: {
+    /** Event type (e.g., "unknown", "control", "data") */
+    eventType: string
+    /** Event data (will be sent as-is) */
+    data: string
+  }
 }
 
 export class DurableStreamTestServer {
@@ -371,14 +382,20 @@ export class DurableStreamTestServer {
       modified = modified.slice(0, fault.truncateBodyBytes)
     }
 
-    // Corrupt body if configured (flip random bits)
+    // Corrupt body if configured - deterministically break JSON structure
     if (fault.corruptBody && modified.length > 0) {
       modified = new Uint8Array(modified) // Make a copy to avoid mutating original
-      // Flip 1-5% of bytes
-      const numCorrupt = Math.max(1, Math.floor(modified.length * 0.03))
+      // Always corrupt the first byte (breaks JSON structure - the opening [ or {)
+      // and add some random corruption for good measure
+      modified[0] = 0x58 // 'X' - makes JSON syntactically invalid
+      if (modified.length > 1) {
+        modified[1] = 0x59 // 'Y'
+      }
+      // Also corrupt some bytes in the middle to catch edge cases
+      const numCorrupt = Math.max(1, Math.floor(modified.length * 0.1))
       for (let i = 0; i < numCorrupt; i++) {
         const pos = Math.floor(Math.random() * modified.length)
-        modified[pos] = modified[pos]! ^ (1 << Math.floor(Math.random() * 8))
+        modified[pos] = 0x5a // 'Z' - valid UTF-8 but breaks JSON structure
       }
     }
 
@@ -454,8 +471,12 @@ export class DurableStreamTestServer {
         return
       }
 
-      // Store fault for response modification (truncation, corruption)
-      if (fault.truncateBodyBytes !== undefined || fault.corruptBody) {
+      // Store fault for response modification (truncation, corruption, SSE injection)
+      if (
+        fault.truncateBodyBytes !== undefined ||
+        fault.corruptBody ||
+        fault.injectSseEvent
+      ) {
         ;(
           res as ServerResponse & { _injectedFault?: InjectedFault }
         )._injectedFault = fault
@@ -868,6 +889,15 @@ export class DurableStreamTestServer {
       "cross-origin-resource-policy": `cross-origin`,
     })
 
+    // Check for injected SSE event (for testing SSE parsing)
+    const fault = (res as ServerResponse & { _injectedFault?: InjectedFault })
+      ._injectedFault
+    if (fault?.injectSseEvent) {
+      // Send the injected SSE event before normal stream
+      res.write(`event: ${fault.injectSseEvent.eventType}\n`)
+      res.write(`data: ${fault.injectSseEvent.data}\n\n`)
+    }
+
     let currentOffset = initialOffset
     let isConnected = true
     const decoder = new TextDecoder()
@@ -1208,6 +1238,11 @@ export class DurableStreamTestServer {
           method?: string
           corruptBody?: boolean
           jitterMs?: number
+          // SSE event injection (for testing SSE parsing)
+          injectSseEvent?: {
+            eventType: string
+            data: string
+          }
         }
 
         if (!config.path) {
@@ -1222,11 +1257,12 @@ export class DurableStreamTestServer {
           config.delayMs !== undefined ||
           config.dropConnection ||
           config.truncateBodyBytes !== undefined ||
-          config.corruptBody
+          config.corruptBody ||
+          config.injectSseEvent !== undefined
         if (!hasFaultType) {
           res.writeHead(400, { "content-type": `text/plain` })
           res.end(
-            `Must specify at least one fault type: status, delayMs, dropConnection, truncateBodyBytes, or corruptBody`
+            `Must specify at least one fault type: status, delayMs, dropConnection, truncateBodyBytes, corruptBody, or injectSseEvent`
           )
           return
         }
@@ -1242,6 +1278,7 @@ export class DurableStreamTestServer {
           method: config.method,
           corruptBody: config.corruptBody,
           jitterMs: config.jitterMs,
+          injectSseEvent: config.injectSseEvent,
         })
 
         res.writeHead(200, { "content-type": `application/json` })