@fieldnotes/sync-server 0.17.1 → 0.19.0

package/dist/index.js

@@ -1,12 +1,19 @@
 // src/sync-hub.ts
 import {
+  createCurrentCapabilities,
+  createLegacyCapabilities,
   parseEnvelope,
+  isValidEnvelope,
   isValidElement,
-  isNewerLayerRecord
+  isNewerLayerRecord,
+  translateOpForPeer
 } from "@fieldnotes/sync";
+import { getDefaultElementRegistry } from "@fieldnotes/core";
 
 // src/memory-hub-backend.ts
-import { applyOpToMap } from "@fieldnotes/sync";
+import {
+  applyOpToMap
+} from "@fieldnotes/sync";
 var MemoryHubBackend = class {
   rooms = /* @__PURE__ */ new Map();
   roomLayers = /* @__PURE__ */ new Map();
@@ -72,8 +79,10 @@ var ServerPluginRegistry = class {
   byName = /* @__PURE__ */ new Map();
   legacyOwners = /* @__PURE__ */ new Map();
   extensions = /* @__PURE__ */ new Map();
+  definitions;
   constructor(plugins) {
     for (const plugin of plugins) this.register(plugin);
+    this.definitions = new Map([...this.extensions].map(([name, entry]) => [name, entry.kind]));
   }
   register(plugin) {
     if (this.byName.has(plugin.name))
@@ -105,6 +114,12 @@ var ServerPluginRegistry = class {
   extension(extensionKind) {
     return this.extensions.get(extensionKind);
   }
+  get extensionKinds() {
+    return [...this.extensions.keys()];
+  }
+  get extensionDefinitions() {
+    return this.definitions;
+  }
 };
 
 // src/resource-limits.ts
@@ -115,6 +130,11 @@ var DEFAULT_MAX_PENDING_AUTH_BYTES = 2 * 1024 * 1024;
 var DEFAULT_MESSAGES_PER_SECOND = 120;
 var DEFAULT_MESSAGE_BURST = 240;
 var DEFAULT_PRESENCE_THROTTLE_MS = 50;
+var DEFAULT_MAX_PRESENCE_BYTES = 4 * 1024;
+var DEFAULT_BYTES_PER_SECOND = 4 * 1024 * 1024;
+var DEFAULT_BYTE_BURST = 8 * 1024 * 1024;
+var DEFAULT_MAX_CONNECTIONS_PER_IP = 64;
+var DEFAULT_MAX_CONNECTIONS_PER_ROOM = 256;
 var DEFAULT_MAX_PRESENCE_LANES = 16;
 function hasJsonDepthAtMost(message, maxDepth) {
   let depth = 0;
@@ -147,29 +167,30 @@ var MessageRateLimiter = class {
   }
   tokens;
   updatedAt;
-  take(now = Date.now()) {
+  /** Charges `cost` tokens (frames or bytes); a cost above `burst` never fits. */
+  take(now = Date.now(), cost = 1) {
     const elapsedSeconds = Math.max(0, now - this.updatedAt) / 1e3;
     this.tokens = Math.min(this.burst, this.tokens + elapsedSeconds * this.ratePerSecond);
     this.updatedAt = now;
-    if (this.tokens < 1) return false;
-    this.tokens -= 1;
+    if (this.tokens < cost) return false;
+    this.tokens -= cost;
     return true;
   }
 };
 
 // src/sync-hub.ts
 var HUB_FROM = "hub";
+var utf8 = new TextEncoder();
+function utf8ByteLength(text) {
+  return utf8.encode(text).byteLength;
+}
 function generateInstanceId() {
   if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function")
     return crypto.randomUUID();
   return `i-${Math.random().toString(36).slice(2)}`;
 }
 function isFanoutOp(op) {
-  if (typeof op !== "object" || op === null) return false;
-  const o = op;
-  if (o.kind === "upsert") return isValidElement(o.element);
-  if (o.kind === "remove") return typeof o.id === "string";
-  return o.kind === "clear";
+  return op.kind === "upsert" || op.kind === "remove" || op.kind === "clear";
 }
 var FALLBACK_PRESENCE_LANE = "";
 var MAX_PRESENCE_LANE_LENGTH = 64;
@@ -182,9 +203,7 @@ function presenceLaneOf(data) {
   return kind;
 }
 function isLayerOp(op) {
-  if (typeof op !== "object" || op === null) return false;
-  const k = op.kind;
-  return k === "layer-upsert" || k === "layer-remove";
+  return op.kind === "layer-upsert" || op.kind === "layer-remove";
 }
 function layerOpToRecord(op) {
   return op.kind === "layer-upsert" ? { id: op.layer.id, version: op.version, editor: op.editor, definition: op.layer } : { id: op.id, version: op.version, editor: op.editor };
@@ -197,10 +216,22 @@ function layerRecordToOp(record) {
     editor: record.editor
   } : { kind: "layer-remove", id: record.id, version: record.version, editor: record.editor };
 }
+function encodingProfile(capabilities, revealOwner) {
+  return JSON.stringify([capabilities.elementEnvelope, capabilities.extensionKinds, revealOwner]);
+}
+function withoutOwnerId(element) {
+  if (element.ownerId === void 0) return element;
+  const rest = { ...element };
+  delete rest.ownerId;
+  return rest;
+}
+function stripOwnerId(op) {
+  if (op.kind === "upsert") return { ...op, element: withoutOwnerId(op.element) };
+  if (op.kind === "snapshot") return { ...op, elements: op.elements.map(withoutOwnerId) };
+  return op;
+}
 function isPresenceOp(op) {
-  if (typeof op !== "object" || op === null) return false;
-  const k = op.kind;
-  return k === "presence" || k === "presence-leave";
+  return op.kind === "presence" || op.kind === "presence-leave";
 }
 var SyncHub = class {
   backend;
@@ -216,11 +247,16 @@ var SyncHub = class {
   authorize;
   authorizeLayer;
   pluginRegistry;
+  elementRegistry;
+  peerCapabilities = /* @__PURE__ */ new Map();
   canRead;
+  canReadOwnerId;
+  resolveAudience;
   memoryLayers = /* @__PURE__ */ new Map();
   maxJsonDepth;
   presenceThrottleMs;
   maxPresenceLanes;
+  maxPresenceBytes;
   /**
    * Presence throttle state keyed by connection, then by lane. A lane is the
    * payload's `kind` (a non-empty string of at most 64 chars) or the reserved
@@ -234,11 +270,14 @@ var SyncHub = class {
   constructor(options = {}) {
     this.backend = options.backend ?? new MemoryHubBackend();
     this.pluginRegistry = new ServerPluginRegistry(options.plugins ?? []);
+    this.elementRegistry = options.elementRegistry ?? getDefaultElementRegistry();
     this.instanceId = options.instanceId ?? generateInstanceId();
     this.fanout = options.fanout ?? new InMemoryHubFanout();
     this.authorize = options.authorize;
     this.authorizeLayer = options.authorizeLayer;
     this.canRead = options.canRead;
+    this.canReadOwnerId = options.canReadOwnerId;
+    this.resolveAudience = options.resolveAudience;
     this.maxJsonDepth = options.maxJsonDepth ?? DEFAULT_MAX_JSON_DEPTH;
     this.presenceThrottleMs = options.presenceThrottleMs ?? DEFAULT_PRESENCE_THROTTLE_MS;
     const maxPresenceLanes = options.maxPresenceLanes ?? DEFAULT_MAX_PRESENCE_LANES;
@@ -246,6 +285,11 @@ var SyncHub = class {
       throw new RangeError("maxPresenceLanes must be a finite number of at least 1");
     }
     this.maxPresenceLanes = Math.floor(maxPresenceLanes);
+    const maxPresenceBytes = options.maxPresenceBytes ?? DEFAULT_MAX_PRESENCE_BYTES;
+    if (!Number.isFinite(maxPresenceBytes) || maxPresenceBytes < 0) {
+      throw new RangeError("maxPresenceBytes must be a non-negative finite number");
+    }
+    this.maxPresenceBytes = maxPresenceBytes;
     this.fanoutUnsub = this.fanout.subscribe((payload) => this.onFanout(payload));
   }
   addConnection(conn) {
@@ -261,6 +305,7 @@ var SyncHub = class {
     const conn = this.conns.get(connId);
     if (!conn) return;
     this.conns.delete(connId);
+    this.peerCapabilities.delete(connId);
     const room = conn.room;
     const hadPresence = this.presenceConnections.delete(connId);
     this.clearPresenceLanes(connId);
@@ -283,6 +328,7 @@ var SyncHub = class {
    * forwards the same event to other instances on a best-effort basis.
    */
   broadcastPresence(room, data) {
+    if (!this.isPresenceWithinLimit(data)) return 0;
     const op = { kind: "presence", data };
     const sent = this.relayToRoom(room, void 0, JSON.stringify({ from: HUB_FROM, op }));
     this.safePublish(JSON.stringify({ o: this.instanceId, room, from: HUB_FROM, op }));
@@ -294,7 +340,16 @@ var SyncHub = class {
     if (!hasJsonDepthAtMost(message, this.maxJsonDepth)) return Promise.resolve();
     const env = parseEnvelope(message);
     if (!env) return Promise.resolve();
+    if (env.op.kind === "capabilities") {
+      this.peerCapabilities.set(conn.id, env.op.capabilities);
+      this.sendToConnection(conn, HUB_FROM, {
+        kind: "capabilities",
+        capabilities: createCurrentCapabilities(this.pluginRegistry.extensionKinds)
+      });
+      return Promise.resolve();
+    }
     if (env.op.kind === "presence") {
+      if (!this.isPresenceWithinLimit(env.op.data)) return Promise.resolve();
       this.schedulePresence(conn, env.op.data);
       return Promise.resolve();
     }
@@ -309,9 +364,14 @@ var SyncHub = class {
     return operation;
   }
   async process(conn, env) {
-    const op = env.op;
+    let op = env.op;
+    if (op.kind === "upsert") {
+      const element = this.normalizeElement(op.element);
+      if (!element) return;
+      op = { ...op, element };
+    }
     if (op.kind === "request-snapshot") {
-      const all = await this.backend.snapshot(conn.room);
+      const all = this.normalizeElements(await this.backend.snapshot(conn.room));
       const elements = this.canRead ? all.filter((el) => this.mayRead(conn, el.audience)) : all;
       const layers = await this.getLayerRecords(conn.room);
       const snapshotOp = {
@@ -332,7 +392,7 @@ var SyncHub = class {
         else extensions[plugin.name] = snapshot;
       }
       if (Object.keys(extensions).length > 0) snapshotOp["extensions"] = extensions;
-      conn.send(JSON.stringify({ from: HUB_FROM, op: snapshotOp }));
+      this.sendToConnection(conn, HUB_FROM, snapshotOp);
     } else if (op.kind === "layer-upsert" || op.kind === "layer-remove") {
       await this.processLayerOp(conn, op);
     } else if (op.kind === "extension") {
@@ -349,8 +409,22 @@ var SyncHub = class {
       await this.deliverPluginResult(conn, result);
     } else if (op.kind === "upsert" || op.kind === "remove" || op.kind === "clear") {
       const id = op.kind === "upsert" ? op.element.id : op.kind === "remove" ? op.id : void 0;
-      const needCurrent = (this.authorize || this.canRead) && id !== void 0;
-      const current = needCurrent ? await this.backend.get(conn.room, id) : void 0;
+      const needCurrent = (this.authorize || this.canRead || this.resolveAudience) && id !== void 0;
+      const storedCurrent = needCurrent ? await this.backend.get(conn.room, id) : void 0;
+      const current = storedCurrent ? this.normalizeElement(storedCurrent) ?? void 0 : void 0;
+      if (op.kind === "upsert" && this.resolveAudience) {
+        const audience = this.resolveAudience({
+          userId: conn.userId,
+          role: conn.role,
+          room: conn.room,
+          element: op.element,
+          currentElement: current
+        });
+        const element = { ...op.element };
+        if (audience === void 0) delete element.audience;
+        else element.audience = audience;
+        op = { kind: "upsert", element };
+      }
       let outboundOp = op;
       if (this.authorize) {
         const allowed = await this.authorize({
@@ -374,7 +448,7 @@ var SyncHub = class {
       const prevAudience = current?.audience;
       const result = await this.runCorePlugins(conn, outboundOp);
       for (const correction of result.corrections) {
-        conn.send(JSON.stringify({ from: HUB_FROM, op: correction }));
+        this.sendToConnection(conn, HUB_FROM, correction);
       }
       const accepted = result.accepted;
       if (accepted && (accepted.kind === "upsert" || accepted.kind === "remove" || accepted.kind === "clear")) {
@@ -430,7 +504,7 @@ var SyncHub = class {
   }
   async deliverPluginResult(conn, result) {
     for (const correction of result.corrections) {
-      conn.send(JSON.stringify({ from: HUB_FROM, op: correction }));
+      this.sendToConnection(conn, HUB_FROM, correction);
     }
     if (result.accepted) await this.publishPluginOp(conn, result.accepted, result.locality);
     for (const broadcast of result.broadcast ?? []) {
@@ -443,7 +517,7 @@ var SyncHub = class {
         JSON.stringify({ o: this.instanceId, room: conn.room, from: conn.id, op })
       );
     }
-    this.relayToRoom(conn.room, conn.id, JSON.stringify({ from: conn.id, op }));
+    this.relayOpToRoom(conn.room, conn.id, conn.id, op);
   }
   /**
    * Applies a layer-definition edit on the room's serial queue. Convergence is
@@ -465,19 +539,19 @@ var SyncHub = class {
       });
       if (!allowed) {
         const correction = current ?? { id: record.id, version: record.version, editor: HUB_FROM };
-        conn.send(JSON.stringify({ from: HUB_FROM, op: layerRecordToOp(correction) }));
+        this.sendToConnection(conn, HUB_FROM, layerRecordToOp(correction));
         return;
       }
     }
     if (current && !isNewerLayerRecord(record, current)) {
-      conn.send(JSON.stringify({ from: HUB_FROM, op: layerRecordToOp(current) }));
+      this.sendToConnection(conn, HUB_FROM, layerRecordToOp(current));
       return;
     }
     await this.applyLayerRecord(conn.room, record);
     await this.fanout.publish(
       JSON.stringify({ o: this.instanceId, room: conn.room, from: conn.id, op })
     );
-    this.relayToRoom(conn.room, conn.id, JSON.stringify({ from: conn.id, op }));
+    this.relayOpToRoom(conn.room, conn.id, conn.id, op);
   }
   layerBackend() {
     const { layerRecords, getLayerRecord, applyLayerRecord } = this.backend;
@@ -511,6 +585,10 @@ var SyncHub = class {
     }
     map.set(record.id, record);
   }
+  mayReadOwnerId(conn) {
+    if (!this.canReadOwnerId) return false;
+    return this.canReadOwnerId({ userId: conn.userId, role: conn.role, room: conn.room });
+  }
   mayRead(conn, audience) {
     if (!this.canRead) return true;
     return this.canRead({ userId: conn.userId, role: conn.role, room: conn.room, audience });
@@ -538,6 +616,91 @@ var SyncHub = class {
     }
     return sent;
   }
+  /**
+   * Translates `op` for the peer and sends it. Returns false when the op is
+   * lossy for this peer (no legacy encoding) or the socket throws; neither
+   * may reject the room operation that produced it.
+   */
+  sendToConnection(conn, from, op, encoded) {
+    const capabilities = this.peerCapabilities.get(conn.id) ?? createLegacyCapabilities();
+    const revealOwner = this.mayReadOwnerId(conn);
+    const profile = encoded ? encodingProfile(capabilities, revealOwner) : void 0;
+    let message = profile === void 0 ? void 0 : encoded?.get(profile);
+    if (message === void 0) {
+      message = this.encodeForPeer(from, op, capabilities, revealOwner);
+      if (profile !== void 0) encoded?.set(profile, message);
+    }
+    if (message === null) return false;
+    try {
+      conn.send(message);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Returns the wire frame for `op` translated for `capabilities`, or null
+   * when lossy. The server-stamped `ownerId` is a server-side authorization
+   * fact: it leaves the hub only for peers `canReadOwnerId` admits.
+   */
+  encodeForPeer(from, op, capabilities, revealOwner) {
+    try {
+      const translated = translateOpForPeer(
+        revealOwner ? op : stripOwnerId(op),
+        capabilities,
+        this.elementRegistry,
+        this.pluginRegistry.extensionDefinitions
+      );
+      return JSON.stringify({ from, op: translated });
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Normalize registered legacy wire elements before authorization, storage,
+   * and relay. A legacy type this hub has no adapter for is forwarded and
+   * stored verbatim — the hub is a relay, and the peers decide whether they
+   * understand it — so a hub deployed without domain adapters never erases
+   * the room's existing elements. Only a malformed registered element is dropped.
+   */
+  normalizeElement(element) {
+    if (isValidElement(element)) return element;
+    const adapter = this.elementRegistry.getAdapterByLegacyType(element.type);
+    if (!adapter) return element;
+    try {
+      const raw = Object.fromEntries(Object.entries(element));
+      const envelope = adapter.decodeLegacy(raw);
+      if (!adapter.validateEnvelope(envelope)) return null;
+      return {
+        ...envelope,
+        ...typeof raw["audience"] === "string" ? { audience: raw["audience"] } : {},
+        ...typeof raw["ownerId"] === "string" ? { ownerId: raw["ownerId"] } : {}
+      };
+    } catch {
+      return null;
+    }
+  }
+  normalizeElements(elements) {
+    const normalized = [];
+    for (const element of elements) {
+      const runtime = this.normalizeElement(element);
+      if (runtime) normalized.push(runtime);
+    }
+    return normalized;
+  }
+  relayOpToRoom(room, excludeId, from, op) {
+    const members = this.rooms.get(room);
+    if (!members) return 0;
+    let sent = 0;
+    const encoded = /* @__PURE__ */ new Map();
+    for (const connectionId of members) {
+      if (connectionId === excludeId) continue;
+      const conn = this.conns.get(connectionId);
+      if (!conn) continue;
+      if (this.sendToConnection(conn, from, op, encoded)) sent += 1;
+    }
+    return sent;
+  }
   broadcastClientPresence(conn, data) {
     this.presenceConnections.add(conn.id);
     const message = JSON.stringify({ from: conn.id, op: { kind: "presence", data } });
@@ -619,41 +782,33 @@ var SyncHub = class {
   deliverToRoom(room, excludeId, from, op, prevAudience, prevExisted) {
     const members = this.rooms.get(room);
     if (!members) return;
-    const send = (conn, msg) => {
-      try {
-        conn.send(msg);
-      } catch {
-      }
-    };
+    const encoded = /* @__PURE__ */ new Map();
     if (op.kind === "upsert") {
       const audience = op.element.audience;
-      const upsertMsg = JSON.stringify({ from, op });
-      const removeMsg = JSON.stringify({
-        from: HUB_FROM,
-        op: { kind: "remove", id: op.element.id }
-      });
+      const removeOp = { kind: "remove", id: op.element.id };
+      const encodedRemove = /* @__PURE__ */ new Map();
       for (const cid of members) {
         if (cid === excludeId) continue;
         const conn = this.conns.get(cid);
         if (!conn) continue;
-        if (this.mayRead(conn, audience)) send(conn, upsertMsg);
-        else if (prevExisted && this.mayRead(conn, prevAudience)) send(conn, removeMsg);
+        if (this.mayRead(conn, audience)) this.sendToConnection(conn, from, op, encoded);
+        else if (prevExisted && this.mayRead(conn, prevAudience)) {
+          this.sendToConnection(conn, HUB_FROM, removeOp, encodedRemove);
+        }
       }
     } else if (op.kind === "remove") {
-      const removeMsg = JSON.stringify({ from, op });
       for (const cid of members) {
         if (cid === excludeId) continue;
         const conn = this.conns.get(cid);
         if (!conn) continue;
         const wasVisible = !this.canRead || prevExisted && this.mayRead(conn, prevAudience);
-        if (wasVisible) send(conn, removeMsg);
+        if (wasVisible) this.sendToConnection(conn, from, op, encoded);
       }
     } else if (op.kind === "clear") {
-      const clearMsg = JSON.stringify({ from, op });
       for (const cid of members) {
         if (cid === excludeId) continue;
         const conn = this.conns.get(cid);
-        if (conn) send(conn, clearMsg);
+        if (conn) this.sendToConnection(conn, from, op, encoded);
       }
     }
   }
@@ -664,13 +819,14 @@ var SyncHub = class {
     } else if (op.kind === "remove") {
       correction = current ? this.mayRead(conn, current.audience) ? { kind: "upsert", element: current } : { kind: "remove", id: current.id } : void 0;
     } else if (op.kind === "clear") {
-      const all = await this.backend.snapshot(conn.room);
+      const all = this.normalizeElements(await this.backend.snapshot(conn.room));
       const elements = this.canRead ? all.filter((el) => this.mayRead(conn, el.audience)) : all;
       correction = { kind: "snapshot", to: from, elements };
     }
-    if (correction) conn.send(JSON.stringify({ from: HUB_FROM, op: correction }));
+    if (correction) this.sendToConnection(conn, HUB_FROM, correction);
   }
   onFanout(payload) {
+    if (!hasJsonDepthAtMost(payload, this.maxJsonDepth)) return;
     let env;
     try {
       env = JSON.parse(payload);
@@ -680,19 +836,30 @@ var SyncHub = class {
     if (typeof env.o !== "string" || typeof env.room !== "string" || typeof env.from !== "string")
       return;
     if (env.o === this.instanceId) return;
-    const op = env.op;
+    const envelope = { from: env.from, op: env.op };
+    if (!isValidEnvelope(envelope)) return;
+    const op = envelope.op;
     if (isPresenceOp(op)) {
+      if (op.kind === "presence" && !this.isPresenceWithinLimit(op.data)) return;
       this.relayToRoom(env.room, void 0, JSON.stringify({ from: env.from, op }));
       return;
     }
     if (isLayerOp(op)) {
       void this.applyFanoutLayerOp(env.room, op).catch(() => {
       });
-      this.relayToRoom(env.room, void 0, JSON.stringify({ from: env.from, op }));
+      this.relayOpToRoom(env.room, void 0, env.from, op);
       return;
     }
-    const plugin = typeof op === "object" && op !== null && op.kind === "extension" ? this.pluginRegistry.extension(op.extensionKind ?? "")?.plugin : typeof op === "object" && op !== null && typeof op.kind === "string" ? this.pluginRegistry.ownerOf(op.kind) : void 0;
-    if (plugin && typeof op === "object" && op !== null) {
+    let plugin;
+    if (op.kind === "extension") {
+      const entry = this.pluginRegistry.extension(op.extensionKind);
+      if (!entry || !entry.kind.codec.validate(op.payload)) return;
+      plugin = entry.plugin;
+    } else {
+      plugin = this.pluginRegistry.ownerOf(op.kind);
+    }
+    if (plugin) {
+      const owner = plugin;
       const previous = this.roomQueues.get(env.room) ?? Promise.resolve();
       const operation = previous.then(async () => {
         const context = {
@@ -701,13 +868,9 @@ var SyncHub = class {
           backend: this.backend,
           backendPlugin: (key) => this.backend.getService?.(key)
         };
-        const accepted = plugin.applyFanout ? await plugin.applyFanout(op, context) : op;
+        const accepted = owner.applyFanout ? await owner.applyFanout(op, context) : op;
         if (accepted) {
-          this.relayToRoom(
-            env.room,
-            void 0,
-            JSON.stringify({ from: env.from, op: accepted })
-          );
+          this.relayOpToRoom(env.room, void 0, env.from, accepted);
         }
       });
       this.roomQueues.set(
@@ -718,9 +881,17 @@ var SyncHub = class {
       return;
     }
     if (!isFanoutOp(op)) return;
+    const runtimeOp = op.kind === "upsert" ? (() => {
+      const element = this.normalizeElement(op.element);
+      return element ? { ...op, element } : null;
+    })() : op;
+    if (!runtimeOp) return;
     const prevAudience = typeof env.prev === "string" ? env.prev : void 0;
     const prevExisted = env.existed === true;
-    this.deliverToRoom(env.room, void 0, env.from, op, prevAudience, prevExisted);
+    this.deliverToRoom(env.room, void 0, env.from, runtimeOp, prevAudience, prevExisted);
+  }
+  isPresenceWithinLimit(data) {
+    return utf8ByteLength(JSON.stringify(data) ?? "") <= this.maxPresenceBytes;
   }
   async applyFanoutLayerOp(room, op) {
     const record = layerOpToRecord(op);
@@ -737,6 +908,23 @@ var SyncHub = class {
 // src/create-sync-server.ts
 import { WebSocketServer } from "ws";
 
+// src/authenticate.ts
+import { readBearerSubprotocol } from "@fieldnotes/sync";
+function readBearerToken(req) {
+  const fromProtocol = readBearerSubprotocol(headerValue(req.headers["sec-websocket-protocol"]));
+  if (fromProtocol) return fromProtocol;
+  const authorization = headerValue(req.headers["authorization"]);
+  if (authorization) {
+    const match = /^Bearer\s+(\S+)$/i.exec(authorization.trim());
+    if (match?.[1]) return match[1];
+  }
+  const query = new URL(req.url ?? "", "http://localhost").searchParams.get("token");
+  return query || void 0;
+}
+function headerValue(value) {
+  return Array.isArray(value) ? value.join(",") : value;
+}
+
 // src/heartbeat.ts
 function startHeartbeat(wss, intervalMs) {
   if (intervalMs <= 0) {
@@ -768,6 +956,9 @@ function startHeartbeat(wss, intervalMs) {
   return { track, stop: () => clearInterval(interval) };
 }
 
+// src/create-sync-server.ts
+import { BEARER_SUBPROTOCOL_PREFIX, SYNC_WS_SUBPROTOCOL } from "@fieldnotes/sync";
+
 // src/shutdown.ts
 var DEFAULT_SHUTDOWN_GRACE_MS = 5e3;
 function drainWebSocketServer(wss, graceMs) {
@@ -802,16 +993,78 @@ function drainWebSocketServer(wss, graceMs) {
   });
 }
 
+// src/room-name.ts
+var ROOM_NAME_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+function isValidRoomName(room) {
+  return typeof room === "string" && ROOM_NAME_PATTERN.test(room);
+}
+
 // src/create-sync-server.ts
+var ConcurrencyCounter = class {
+  constructor(limit) {
+    this.limit = limit;
+  }
+  counts = /* @__PURE__ */ new Map();
+  /** Reserves a slot for `key`; returns a release function, or null when the cap is reached. */
+  acquire(key) {
+    const current = this.counts.get(key) ?? 0;
+    if (current >= this.limit) return null;
+    this.counts.set(key, current + 1);
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      const remaining = (this.counts.get(key) ?? 1) - 1;
+      if (remaining <= 0) this.counts.delete(key);
+      else this.counts.set(key, remaining);
+    };
+  }
+};
 function rawDataByteLength(data) {
   if (Array.isArray(data)) return data.reduce((total, chunk) => total + chunk.byteLength, 0);
   return data.byteLength;
 }
+function requirePositiveFinite(name, value) {
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new RangeError(`${name} must be a positive finite number`);
+  }
+  return value;
+}
+function requirePositiveIntegerOrInfinity(name, value) {
+  if (value !== Infinity && (!Number.isSafeInteger(value) || value <= 0)) {
+    throw new RangeError(`${name} must be a positive safe integer or Infinity`);
+  }
+  return value;
+}
 function createSyncServer(options = {}) {
   const shutdownGraceMs = options.shutdownGraceMs ?? DEFAULT_SHUTDOWN_GRACE_MS;
   if (!Number.isFinite(shutdownGraceMs) || shutdownGraceMs < 0) {
     throw new RangeError("shutdownGraceMs must be a non-negative finite number");
   }
+  const messagesPerSecond = requirePositiveFinite(
+    "messagesPerSecond",
+    options.messagesPerSecond ?? DEFAULT_MESSAGES_PER_SECOND
+  );
+  const messageBurst = requirePositiveFinite(
+    "messageBurst",
+    options.messageBurst ?? DEFAULT_MESSAGE_BURST
+  );
+  const bytesPerSecond = requirePositiveFinite(
+    "bytesPerSecond",
+    options.bytesPerSecond ?? DEFAULT_BYTES_PER_SECOND
+  );
+  const byteBurst = requirePositiveFinite("byteBurst", options.byteBurst ?? DEFAULT_BYTE_BURST);
+  const maxConnectionsPerIp = requirePositiveIntegerOrInfinity(
+    "maxConnectionsPerIp",
+    options.maxConnectionsPerIp ?? DEFAULT_MAX_CONNECTIONS_PER_IP
+  );
+  const maxConnectionsPerRoom = requirePositiveIntegerOrInfinity(
+    "maxConnectionsPerRoom",
+    options.maxConnectionsPerRoom ?? DEFAULT_MAX_CONNECTIONS_PER_ROOM
+  );
+  if (options.authorize && !options.authenticate) {
+    throw new Error("createSyncServer: `authorize` requires an `authenticate` hook");
+  }
   const hub = new SyncHub({
     backend: options.backend,
     fanout: options.fanout,
@@ -820,16 +1073,34 @@ function createSyncServer(options = {}) {
     authorizeLayer: options.authorizeLayer,
     plugins: options.plugins,
     canRead: options.canRead,
+    canReadOwnerId: options.canReadOwnerId,
+    resolveAudience: options.resolveAudience,
     maxJsonDepth: options.maxJsonDepth ?? DEFAULT_MAX_JSON_DEPTH,
     presenceThrottleMs: options.presenceThrottleMs ?? DEFAULT_PRESENCE_THROTTLE_MS,
-    maxPresenceLanes: options.maxPresenceLanes
+    maxPresenceLanes: options.maxPresenceLanes,
+    maxPresenceBytes: options.maxPresenceBytes,
+    elementRegistry: options.elementRegistry
   });
   const maxMessageBytes = options.maxMessageBytes ?? DEFAULT_MAX_MESSAGE_BYTES;
-  const wss = options.server ? new WebSocketServer({ server: options.server, maxPayload: maxMessageBytes }) : new WebSocketServer({ port: options.port ?? 0, maxPayload: maxMessageBytes });
+  const handleProtocols = (protocols) => {
+    if (protocols.has(SYNC_WS_SUBPROTOCOL)) return SYNC_WS_SUBPROTOCOL;
+    for (const protocol of protocols) {
+      if (!protocol.startsWith(BEARER_SUBPROTOCOL_PREFIX)) return protocol;
+    }
+    return false;
+  };
+  const wss = options.server ? new WebSocketServer({ server: options.server, maxPayload: maxMessageBytes, handleProtocols }) : new WebSocketServer({
+    port: options.port ?? 0,
+    maxPayload: maxMessageBytes,
+    handleProtocols
+  });
   const heartbeat = startHeartbeat(wss, options.heartbeatIntervalMs ?? 3e4);
   let shuttingDown = false;
   let closePromise;
   let counter = 0;
+  const perIp = new ConcurrencyCounter(maxConnectionsPerIp);
+  const perRoom = new ConcurrencyCounter(maxConnectionsPerRoom);
+  const clientAddress = options.clientAddress ?? ((req) => req.socket.remoteAddress);
   wss.on("connection", (ws, req) => {
     if (shuttingDown) {
       ws.close(1001, "server shutting down");
@@ -843,6 +1114,22 @@ function createSyncServer(options = {}) {
       ws.close(4400, "room required");
       return;
     }
+    if (!isValidRoomName(room)) {
+      ws.close(4400, "invalid room");
+      return;
+    }
+    const address = clientAddress(req);
+    const releaseIp = address ? perIp.acquire(address) : () => void 0;
+    if (!releaseIp) {
+      ws.close(4429, "too many connections");
+      return;
+    }
+    const releaseRoom = perRoom.acquire(room);
+    if (!releaseRoom) {
+      releaseIp();
+      ws.close(4429, "too many connections");
+      return;
+    }
     const connId = `c${++counter}-${Math.random().toString(36).slice(2, 8)}`;
     let state = "pending";
     let closed = false;
@@ -851,10 +1138,8 @@ function createSyncServer(options = {}) {
     let queuedBytes = 0;
     const maxPendingAuthMessages = options.maxPendingAuthMessages ?? DEFAULT_MAX_PENDING_AUTH_MESSAGES;
     const maxPendingAuthBytes = options.maxPendingAuthBytes ?? DEFAULT_MAX_PENDING_AUTH_BYTES;
-    const limiter = new MessageRateLimiter(
-      options.messagesPerSecond ?? DEFAULT_MESSAGES_PER_SECOND,
-      options.messageBurst ?? DEFAULT_MESSAGE_BURST
-    );
+    const limiter = new MessageRateLimiter(messagesPerSecond, messageBurst);
+    const byteLimiter = new MessageRateLimiter(bytesPerSecond, byteBurst);
     const send = (m) => {
       try {
         ws.send(m);
@@ -869,7 +1154,8 @@ function createSyncServer(options = {}) {
         ws.close(1009, "message too large");
         return;
       }
-      if (!limiter.take()) {
+      const now = Date.now();
+      if (!limiter.take(now) || !byteLimiter.take(now, messageBytes)) {
         state = "rejected";
         ws.close(4408, "rate limit exceeded");
         return;
@@ -889,9 +1175,13 @@ function createSyncServer(options = {}) {
     });
     ws.on("close", () => {
       closed = true;
+      releaseIp();
+      releaseRoom();
       if (admitted) hub.removeConnection(connId);
     });
-    Promise.resolve(options.authenticate ? options.authenticate({ req, room }) : { userId: connId }).then((result) => {
+    Promise.resolve(
+      options.authenticate ? options.authenticate({ req, room, token: readBearerToken(req) }) : { userId: connId }
+    ).then((result) => {
       if (closed || state === "rejected" || shuttingDown) return;
       if (!result) {
         state = "rejected";
@@ -931,8 +1221,11 @@ function createSyncServer(options = {}) {
 export {
   InMemoryHubFanout,
   MemoryHubBackend,
+  ROOM_NAME_PATTERN,
   SyncHub,
   createSyncServer,
+  isValidRoomName,
+  readBearerToken,
   startHeartbeat
 };
 //# sourceMappingURL=index.js.map