@fieldnotes/sync-server 0.18.0 → 0.19.0

package/README.md

@@ -97,9 +97,11 @@ await server.close();
 ## Resource limits
 
 The reference server bounds work and memory per connection by default. Oversized WebSocket messages
-close with code `1009`; message-rate and pending-auth queue violations close with code `4408`.
-Messages with excessive JSON nesting are dropped. Presence sends immediately, then coalesces rapid
-updates so the latest state is forwarded at most once per throttle interval.
+close with code `1009`; message-rate, byte-rate and pending-auth queue violations close with code
+`4408`; a socket over the per-address or per-room connection cap closes with `4429`. Messages with
+excessive JSON nesting, and presence payloads over `maxPresenceBytes`, are dropped. Presence sends
+immediately, then coalesces rapid updates so the latest state is forwarded at most once per throttle
+interval.
 
 ```ts
 createSyncServer({
@@ -110,15 +112,27 @@ createSyncServer({
   maxPendingAuthBytes: 2 * 1024 * 1024,
   messagesPerSecond: 120,
   messageBurst: 240,
+  bytesPerSecond: 4 * 1024 * 1024,
+  byteBurst: 8 * 1024 * 1024,
   presenceThrottleMs: 50,
+  maxPresenceBytes: 4 * 1024,
+  maxConnectionsPerIp: 64,
+  maxConnectionsPerRoom: 256,
+  clientAddress: (req) => req.socket.remoteAddress,
 });
 ```
 
 These values are the defaults. Tune them to the largest legitimate board operation and expected
 client update rate. `maxMessageBytes` is enforced by the WebSocket parser before a complete message
 is allocated, including fragmented messages. The pending-auth limits bound messages held while an
-asynchronous `authenticate` hook is unresolved. Rate limits are per connection and use a token
-bucket: `messageBurst` is the short spike allowance and `messagesPerSecond` is the refill rate.
+asynchronous `authenticate` hook is unresolved. Rate limits are per connection and use token
+buckets: `messageBurst` / `byteBurst` are the short spike allowances and `messagesPerSecond` /
+`bytesPerSecond` the refill rates, so relay amplification is bounded in bytes, not just frames.
+Connection caps are taken at the upgrade, before `authenticate` runs, and count pending-auth
+sockets; behind a trusted proxy supply `clientAddress` to read the forwarded address, and return
+`undefined` to exempt a connection from the per-address cap. Rate and burst values must be positive
+finite numbers; connection caps must be positive safe integers, or `Infinity` to disable a cap.
+Invalid values throw during `createSyncServer` construction.
 
 ## Authentication
 
@@ -161,11 +175,42 @@ continues to use the authenticated `userId` and `role`, not this transport ident
 
 ### Passing a token
 
-A browser `WebSocket` can't set request headers, so pass the token as a URL query
-param (`ws://relay?room=R&token=…`) and read it from `req.url` in `authenticate`. URLs
-land in access/proxy logs, so prefer **short-lived / single-use** tokens. Non-browser
-clients can instead put the token in `req.headers` (e.g. `Authorization`), which
-`authenticate` reads directly.
+`authenticate` receives `token`, resolved by the exported `readBearerToken(req)` in this order:
+
+1. A `Sec-WebSocket-Protocol` entry `fieldnotes-bearer.<token>` — the browser-safe channel. A
+   browser `WebSocket` can't set request headers, but it can offer subprotocols; the relay reads
+   the token, selects the `fieldnotes-sync` subprotocol and never echoes the bearer entry. On the
+   client, `bearerSubprotocols(token)` from `@fieldnotes/sync` builds the offer:
+
+   ```ts
+   import {
+     WebSocketTransport,
+     bearerSubprotocols,
+     createManagedSyncConnection,
+   } from '@fieldnotes/sync';
+
+   new WebSocketTransport('wss://relay?room=R', { protocols: bearerSubprotocols(token) });
+   // or, managed:
+   createManagedSyncConnection({
+     store,
+     clientId,
+     resolveUrl: async () => ({
+       url: 'wss://relay?room=R',
+       protocols: bearerSubprotocols(await mint()),
+     }),
+   });
+   ```
+
+   The token must be a valid subprotocol token (JWT and base64url alphabets qualify; base64 `=`
+   padding does not).
+
+2. An `Authorization: Bearer <token>` header, for non-browser clients.
+3. The `token` URL query parameter (`ws://relay?room=R&token=…`). Still supported so existing
+   clients keep working, but URLs land in access/proxy logs: prefer the channels above, and use
+   **short-lived / single-use** tokens if you must stay on the URL.
+
+`req` is still passed, so an `authenticate` hook that reads `req.url` or `req.headers` itself
+keeps working unchanged.
 
 ## Authorization
 
@@ -198,8 +243,17 @@ authenticated creator; on edit the stored owner is **preserved**; a client-suppl
 `ownerId` is always **discarded**. A policy can therefore trust `currentElement.ownerId`
 to enforce "own elements only".
 
+**`ownerId` stays on the server.** It is stripped from every outbound frame (live ops,
+snapshots, corrections, legacy translations) so a viewer's save file never records who
+created what. Pass `canReadOwnerId({ userId, role, room }) => boolean` to reveal it to
+privileged viewers, e.g. `canReadOwnerId: ({ role }) => role === 'dm'`.
+
 With **no hook**, rooms are OPEN (allow-all — every op is accepted).
 
+When `canRead` filtering is in use, `op.element.audience` is what the sender asserted unless a
+`resolveAudience` hook is configured (see [Read filtering](#read-filtering)); an `authorize` policy
+without that hook must validate the audience itself.
+
 A copy-paste DM / player / display policy:
 
 ```ts
@@ -224,7 +278,8 @@ createSyncServer({
 
 - Ownership-based authz **requires `authenticate` to supply a STABLE `userId`**. The
   no-hook anonymous default is `userId = connId`, which changes on every reconnect — a
-  user would lose access to their own elements after reconnecting.
+  user would lose access to their own elements after reconnecting. `createSyncServer`
+  therefore **throws** when `authorize` is configured without `authenticate`.
 - The authz path adds one `backend.get` (a Redis `HGET`) per data op — negligible for
   low-write use.
 - Reads / visibility (a player not **receiving** hidden content) are a separate, upcoming
@@ -276,9 +331,17 @@ gets a synthetic **remove**, one who gains it gets an **add**.
   instance only), `canRead` runs on **every** instance — each re-filters fanned-out ops for its own
   local members — so all relay instances must inject the **same** `canRead`, alongside the existing
   shared-backend + shared-fanout requirement.
-- **Labeling integrity.** `audience` is client-asserted, so read secrecy is only as trustworthy as
-  the `authorize` (write) policy that stops a player from stamping `dm` on content they shouldn't
-  control.
+- **Labeling integrity.** `audience` arrives client-asserted. Without a `resolveAudience` hook a
+  player can tag an upsert `dm` to hide it from the table, or retag a hidden element `shared` to
+  reveal it, so **one of the two following hooks is required** for read secrecy:
+  - `resolveAudience({ userId, role, room, element, currentElement }) => string | undefined`
+    (recommended) makes the hub the authority: its return value replaces the client's tag
+    (`undefined` clears it) before `authorize`, storage and relay. A policy such as
+    `({ role, currentElement }) => currentElement?.audience ?? (role === 'dm' ? 'dm' : 'shared')`
+    keeps an element's audience stable and lets only a DM create hidden content.
+  - Otherwise `authorize` **must** enforce the audience contract itself: reject an `upsert` whose
+    `op.element.audience` the sender may not write to, and reject one whose audience differs from
+    `currentElement.audience` unless the sender may move it.
 
 A Redis `HubBackend` and cross-instance fan-out ship in [`@fieldnotes/sync-redis`](../sync-redis).
 

package/dist/index.cjs

@@ -22,8 +22,11 @@ var index_exports = {};
 __export(index_exports, {
   InMemoryHubFanout: () => InMemoryHubFanout,
   MemoryHubBackend: () => MemoryHubBackend,
+  ROOM_NAME_PATTERN: () => ROOM_NAME_PATTERN,
   SyncHub: () => SyncHub,
   createSyncServer: () => createSyncServer,
+  isValidRoomName: () => isValidRoomName,
+  readBearerToken: () => readBearerToken,
   startHeartbeat: () => startHeartbeat
 });
 module.exports = __toCommonJS(index_exports);
@@ -150,6 +153,11 @@ var DEFAULT_MAX_PENDING_AUTH_BYTES = 2 * 1024 * 1024;
 var DEFAULT_MESSAGES_PER_SECOND = 120;
 var DEFAULT_MESSAGE_BURST = 240;
 var DEFAULT_PRESENCE_THROTTLE_MS = 50;
+var DEFAULT_MAX_PRESENCE_BYTES = 4 * 1024;
+var DEFAULT_BYTES_PER_SECOND = 4 * 1024 * 1024;
+var DEFAULT_BYTE_BURST = 8 * 1024 * 1024;
+var DEFAULT_MAX_CONNECTIONS_PER_IP = 64;
+var DEFAULT_MAX_CONNECTIONS_PER_ROOM = 256;
 var DEFAULT_MAX_PRESENCE_LANES = 16;
 function hasJsonDepthAtMost(message, maxDepth) {
   let depth = 0;
@@ -182,29 +190,30 @@ var MessageRateLimiter = class {
   }
   tokens;
   updatedAt;
-  take(now = Date.now()) {
+  /** Charges `cost` tokens (frames or bytes); a cost above `burst` never fits. */
+  take(now = Date.now(), cost = 1) {
     const elapsedSeconds = Math.max(0, now - this.updatedAt) / 1e3;
     this.tokens = Math.min(this.burst, this.tokens + elapsedSeconds * this.ratePerSecond);
     this.updatedAt = now;
-    if (this.tokens < 1) return false;
-    this.tokens -= 1;
+    if (this.tokens < cost) return false;
+    this.tokens -= cost;
     return true;
   }
 };
 
 // src/sync-hub.ts
 var HUB_FROM = "hub";
+var utf8 = new TextEncoder();
+function utf8ByteLength(text) {
+  return utf8.encode(text).byteLength;
+}
 function generateInstanceId() {
   if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function")
     return crypto.randomUUID();
   return `i-${Math.random().toString(36).slice(2)}`;
 }
 function isFanoutOp(op) {
-  if (typeof op !== "object" || op === null) return false;
-  const o = op;
-  if (o.kind === "upsert") return (0, import_sync2.isValidWireElement)(o.element);
-  if (o.kind === "remove") return typeof o.id === "string";
-  return o.kind === "clear";
+  return op.kind === "upsert" || op.kind === "remove" || op.kind === "clear";
 }
 var FALLBACK_PRESENCE_LANE = "";
 var MAX_PRESENCE_LANE_LENGTH = 64;
@@ -217,9 +226,7 @@ function presenceLaneOf(data) {
   return kind;
 }
 function isLayerOp(op) {
-  if (typeof op !== "object" || op === null) return false;
-  const k = op.kind;
-  return k === "layer-upsert" || k === "layer-remove";
+  return op.kind === "layer-upsert" || op.kind === "layer-remove";
 }
 function layerOpToRecord(op) {
   return op.kind === "layer-upsert" ? { id: op.layer.id, version: op.version, editor: op.editor, definition: op.layer } : { id: op.id, version: op.version, editor: op.editor };
@@ -232,13 +239,22 @@ function layerRecordToOp(record) {
     editor: record.editor
   } : { kind: "layer-remove", id: record.id, version: record.version, editor: record.editor };
 }
-function capabilityProfile(capabilities) {
-  return JSON.stringify([capabilities.elementEnvelope, capabilities.extensionKinds]);
+function encodingProfile(capabilities, revealOwner) {
+  return JSON.stringify([capabilities.elementEnvelope, capabilities.extensionKinds, revealOwner]);
+}
+function withoutOwnerId(element) {
+  if (element.ownerId === void 0) return element;
+  const rest = { ...element };
+  delete rest.ownerId;
+  return rest;
+}
+function stripOwnerId(op) {
+  if (op.kind === "upsert") return { ...op, element: withoutOwnerId(op.element) };
+  if (op.kind === "snapshot") return { ...op, elements: op.elements.map(withoutOwnerId) };
+  return op;
 }
 function isPresenceOp(op) {
-  if (typeof op !== "object" || op === null) return false;
-  const k = op.kind;
-  return k === "presence" || k === "presence-leave";
+  return op.kind === "presence" || op.kind === "presence-leave";
 }
 var SyncHub = class {
   backend;
@@ -257,10 +273,13 @@ var SyncHub = class {
   elementRegistry;
   peerCapabilities = /* @__PURE__ */ new Map();
   canRead;
+  canReadOwnerId;
+  resolveAudience;
   memoryLayers = /* @__PURE__ */ new Map();
   maxJsonDepth;
   presenceThrottleMs;
   maxPresenceLanes;
+  maxPresenceBytes;
   /**
    * Presence throttle state keyed by connection, then by lane. A lane is the
    * payload's `kind` (a non-empty string of at most 64 chars) or the reserved
@@ -280,6 +299,8 @@ var SyncHub = class {
     this.authorize = options.authorize;
     this.authorizeLayer = options.authorizeLayer;
     this.canRead = options.canRead;
+    this.canReadOwnerId = options.canReadOwnerId;
+    this.resolveAudience = options.resolveAudience;
     this.maxJsonDepth = options.maxJsonDepth ?? DEFAULT_MAX_JSON_DEPTH;
     this.presenceThrottleMs = options.presenceThrottleMs ?? DEFAULT_PRESENCE_THROTTLE_MS;
     const maxPresenceLanes = options.maxPresenceLanes ?? DEFAULT_MAX_PRESENCE_LANES;
@@ -287,6 +308,11 @@ var SyncHub = class {
       throw new RangeError("maxPresenceLanes must be a finite number of at least 1");
     }
     this.maxPresenceLanes = Math.floor(maxPresenceLanes);
+    const maxPresenceBytes = options.maxPresenceBytes ?? DEFAULT_MAX_PRESENCE_BYTES;
+    if (!Number.isFinite(maxPresenceBytes) || maxPresenceBytes < 0) {
+      throw new RangeError("maxPresenceBytes must be a non-negative finite number");
+    }
+    this.maxPresenceBytes = maxPresenceBytes;
     this.fanoutUnsub = this.fanout.subscribe((payload) => this.onFanout(payload));
   }
   addConnection(conn) {
@@ -325,6 +351,7 @@ var SyncHub = class {
    * forwards the same event to other instances on a best-effort basis.
    */
   broadcastPresence(room, data) {
+    if (!this.isPresenceWithinLimit(data)) return 0;
     const op = { kind: "presence", data };
     const sent = this.relayToRoom(room, void 0, JSON.stringify({ from: HUB_FROM, op }));
     this.safePublish(JSON.stringify({ o: this.instanceId, room, from: HUB_FROM, op }));
@@ -345,6 +372,7 @@ var SyncHub = class {
       return Promise.resolve();
     }
     if (env.op.kind === "presence") {
+      if (!this.isPresenceWithinLimit(env.op.data)) return Promise.resolve();
       this.schedulePresence(conn, env.op.data);
       return Promise.resolve();
     }
@@ -404,9 +432,22 @@ var SyncHub = class {
       await this.deliverPluginResult(conn, result);
     } else if (op.kind === "upsert" || op.kind === "remove" || op.kind === "clear") {
       const id = op.kind === "upsert" ? op.element.id : op.kind === "remove" ? op.id : void 0;
-      const needCurrent = (this.authorize || this.canRead) && id !== void 0;
+      const needCurrent = (this.authorize || this.canRead || this.resolveAudience) && id !== void 0;
       const storedCurrent = needCurrent ? await this.backend.get(conn.room, id) : void 0;
       const current = storedCurrent ? this.normalizeElement(storedCurrent) ?? void 0 : void 0;
+      if (op.kind === "upsert" && this.resolveAudience) {
+        const audience = this.resolveAudience({
+          userId: conn.userId,
+          role: conn.role,
+          room: conn.room,
+          element: op.element,
+          currentElement: current
+        });
+        const element = { ...op.element };
+        if (audience === void 0) delete element.audience;
+        else element.audience = audience;
+        op = { kind: "upsert", element };
+      }
       let outboundOp = op;
       if (this.authorize) {
         const allowed = await this.authorize({
@@ -567,6 +608,10 @@ var SyncHub = class {
     }
     map.set(record.id, record);
   }
+  mayReadOwnerId(conn) {
+    if (!this.canReadOwnerId) return false;
+    return this.canReadOwnerId({ userId: conn.userId, role: conn.role, room: conn.room });
+  }
   mayRead(conn, audience) {
     if (!this.canRead) return true;
     return this.canRead({ userId: conn.userId, role: conn.role, room: conn.room, audience });
@@ -601,10 +646,11 @@ var SyncHub = class {
    */
   sendToConnection(conn, from, op, encoded) {
     const capabilities = this.peerCapabilities.get(conn.id) ?? (0, import_sync2.createLegacyCapabilities)();
-    const profile = encoded ? capabilityProfile(capabilities) : void 0;
+    const revealOwner = this.mayReadOwnerId(conn);
+    const profile = encoded ? encodingProfile(capabilities, revealOwner) : void 0;
     let message = profile === void 0 ? void 0 : encoded?.get(profile);
     if (message === void 0) {
-      message = this.encodeForPeer(from, op, capabilities);
+      message = this.encodeForPeer(from, op, capabilities, revealOwner);
       if (profile !== void 0) encoded?.set(profile, message);
     }
     if (message === null) return false;
@@ -615,11 +661,15 @@ var SyncHub = class {
       return false;
     }
   }
-  /** Returns the wire frame for `op` translated for `capabilities`, or null when lossy. */
-  encodeForPeer(from, op, capabilities) {
+  /**
+   * Returns the wire frame for `op` translated for `capabilities`, or null
+   * when lossy. The server-stamped `ownerId` is a server-side authorization
+   * fact: it leaves the hub only for peers `canReadOwnerId` admits.
+   */
+  encodeForPeer(from, op, capabilities, revealOwner) {
     try {
       const translated = (0, import_sync2.translateOpForPeer)(
-        op,
+        revealOwner ? op : stripOwnerId(op),
         capabilities,
         this.elementRegistry,
         this.pluginRegistry.extensionDefinitions
@@ -799,6 +849,7 @@ var SyncHub = class {
     if (correction) this.sendToConnection(conn, HUB_FROM, correction);
   }
   onFanout(payload) {
+    if (!hasJsonDepthAtMost(payload, this.maxJsonDepth)) return;
     let env;
     try {
       env = JSON.parse(payload);
@@ -808,8 +859,11 @@ var SyncHub = class {
     if (typeof env.o !== "string" || typeof env.room !== "string" || typeof env.from !== "string")
       return;
     if (env.o === this.instanceId) return;
-    const op = env.op;
+    const envelope = { from: env.from, op: env.op };
+    if (!(0, import_sync2.isValidEnvelope)(envelope)) return;
+    const op = envelope.op;
     if (isPresenceOp(op)) {
+      if (op.kind === "presence" && !this.isPresenceWithinLimit(op.data)) return;
       this.relayToRoom(env.room, void 0, JSON.stringify({ from: env.from, op }));
       return;
     }
@@ -819,8 +873,16 @@ var SyncHub = class {
       this.relayOpToRoom(env.room, void 0, env.from, op);
       return;
     }
-    const plugin = typeof op === "object" && op !== null && op.kind === "extension" ? this.pluginRegistry.extension(op.extensionKind ?? "")?.plugin : typeof op === "object" && op !== null && typeof op.kind === "string" ? this.pluginRegistry.ownerOf(op.kind) : void 0;
-    if (plugin && typeof op === "object" && op !== null) {
+    let plugin;
+    if (op.kind === "extension") {
+      const entry = this.pluginRegistry.extension(op.extensionKind);
+      if (!entry || !entry.kind.codec.validate(op.payload)) return;
+      plugin = entry.plugin;
+    } else {
+      plugin = this.pluginRegistry.ownerOf(op.kind);
+    }
+    if (plugin) {
+      const owner = plugin;
       const previous = this.roomQueues.get(env.room) ?? Promise.resolve();
       const operation = previous.then(async () => {
         const context = {
@@ -829,7 +891,7 @@ var SyncHub = class {
           backend: this.backend,
           backendPlugin: (key) => this.backend.getService?.(key)
         };
-        const accepted = plugin.applyFanout ? await plugin.applyFanout(op, context) : op;
+        const accepted = owner.applyFanout ? await owner.applyFanout(op, context) : op;
         if (accepted) {
           this.relayOpToRoom(env.room, void 0, env.from, accepted);
         }
@@ -851,6 +913,9 @@ var SyncHub = class {
     const prevExisted = env.existed === true;
     this.deliverToRoom(env.room, void 0, env.from, runtimeOp, prevAudience, prevExisted);
   }
+  isPresenceWithinLimit(data) {
+    return utf8ByteLength(JSON.stringify(data) ?? "") <= this.maxPresenceBytes;
+  }
   async applyFanoutLayerOp(room, op) {
     const record = layerOpToRecord(op);
     const current = await this.getLayerRecord(room, record.id);
@@ -866,6 +931,23 @@ var SyncHub = class {
 // src/create-sync-server.ts
 var import_ws = require("ws");
 
+// src/authenticate.ts
+var import_sync3 = require("@fieldnotes/sync");
+function readBearerToken(req) {
+  const fromProtocol = (0, import_sync3.readBearerSubprotocol)(headerValue(req.headers["sec-websocket-protocol"]));
+  if (fromProtocol) return fromProtocol;
+  const authorization = headerValue(req.headers["authorization"]);
+  if (authorization) {
+    const match = /^Bearer\s+(\S+)$/i.exec(authorization.trim());
+    if (match?.[1]) return match[1];
+  }
+  const query = new URL(req.url ?? "", "http://localhost").searchParams.get("token");
+  return query || void 0;
+}
+function headerValue(value) {
+  return Array.isArray(value) ? value.join(",") : value;
+}
+
 // src/heartbeat.ts
 function startHeartbeat(wss, intervalMs) {
   if (intervalMs <= 0) {
@@ -897,6 +979,9 @@ function startHeartbeat(wss, intervalMs) {
   return { track, stop: () => clearInterval(interval) };
 }
 
+// src/create-sync-server.ts
+var import_sync4 = require("@fieldnotes/sync");
+
 // src/shutdown.ts
 var DEFAULT_SHUTDOWN_GRACE_MS = 5e3;
 function drainWebSocketServer(wss, graceMs) {
@@ -931,16 +1016,78 @@ function drainWebSocketServer(wss, graceMs) {
   });
 }
 
+// src/room-name.ts
+var ROOM_NAME_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+function isValidRoomName(room) {
+  return typeof room === "string" && ROOM_NAME_PATTERN.test(room);
+}
+
 // src/create-sync-server.ts
+var ConcurrencyCounter = class {
+  constructor(limit) {
+    this.limit = limit;
+  }
+  counts = /* @__PURE__ */ new Map();
+  /** Reserves a slot for `key`; returns a release function, or null when the cap is reached. */
+  acquire(key) {
+    const current = this.counts.get(key) ?? 0;
+    if (current >= this.limit) return null;
+    this.counts.set(key, current + 1);
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      const remaining = (this.counts.get(key) ?? 1) - 1;
+      if (remaining <= 0) this.counts.delete(key);
+      else this.counts.set(key, remaining);
+    };
+  }
+};
 function rawDataByteLength(data) {
   if (Array.isArray(data)) return data.reduce((total, chunk) => total + chunk.byteLength, 0);
   return data.byteLength;
 }
+function requirePositiveFinite(name, value) {
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new RangeError(`${name} must be a positive finite number`);
+  }
+  return value;
+}
+function requirePositiveIntegerOrInfinity(name, value) {
+  if (value !== Infinity && (!Number.isSafeInteger(value) || value <= 0)) {
+    throw new RangeError(`${name} must be a positive safe integer or Infinity`);
+  }
+  return value;
+}
 function createSyncServer(options = {}) {
   const shutdownGraceMs = options.shutdownGraceMs ?? DEFAULT_SHUTDOWN_GRACE_MS;
   if (!Number.isFinite(shutdownGraceMs) || shutdownGraceMs < 0) {
     throw new RangeError("shutdownGraceMs must be a non-negative finite number");
   }
+  const messagesPerSecond = requirePositiveFinite(
+    "messagesPerSecond",
+    options.messagesPerSecond ?? DEFAULT_MESSAGES_PER_SECOND
+  );
+  const messageBurst = requirePositiveFinite(
+    "messageBurst",
+    options.messageBurst ?? DEFAULT_MESSAGE_BURST
+  );
+  const bytesPerSecond = requirePositiveFinite(
+    "bytesPerSecond",
+    options.bytesPerSecond ?? DEFAULT_BYTES_PER_SECOND
+  );
+  const byteBurst = requirePositiveFinite("byteBurst", options.byteBurst ?? DEFAULT_BYTE_BURST);
+  const maxConnectionsPerIp = requirePositiveIntegerOrInfinity(
+    "maxConnectionsPerIp",
+    options.maxConnectionsPerIp ?? DEFAULT_MAX_CONNECTIONS_PER_IP
+  );
+  const maxConnectionsPerRoom = requirePositiveIntegerOrInfinity(
+    "maxConnectionsPerRoom",
+    options.maxConnectionsPerRoom ?? DEFAULT_MAX_CONNECTIONS_PER_ROOM
+  );
+  if (options.authorize && !options.authenticate) {
+    throw new Error("createSyncServer: `authorize` requires an `authenticate` hook");
+  }
   const hub = new SyncHub({
     backend: options.backend,
     fanout: options.fanout,
@@ -949,17 +1096,34 @@ function createSyncServer(options = {}) {
     authorizeLayer: options.authorizeLayer,
     plugins: options.plugins,
     canRead: options.canRead,
+    canReadOwnerId: options.canReadOwnerId,
+    resolveAudience: options.resolveAudience,
     maxJsonDepth: options.maxJsonDepth ?? DEFAULT_MAX_JSON_DEPTH,
     presenceThrottleMs: options.presenceThrottleMs ?? DEFAULT_PRESENCE_THROTTLE_MS,
     maxPresenceLanes: options.maxPresenceLanes,
+    maxPresenceBytes: options.maxPresenceBytes,
     elementRegistry: options.elementRegistry
   });
   const maxMessageBytes = options.maxMessageBytes ?? DEFAULT_MAX_MESSAGE_BYTES;
-  const wss = options.server ? new import_ws.WebSocketServer({ server: options.server, maxPayload: maxMessageBytes }) : new import_ws.WebSocketServer({ port: options.port ?? 0, maxPayload: maxMessageBytes });
+  const handleProtocols = (protocols) => {
+    if (protocols.has(import_sync4.SYNC_WS_SUBPROTOCOL)) return import_sync4.SYNC_WS_SUBPROTOCOL;
+    for (const protocol of protocols) {
+      if (!protocol.startsWith(import_sync4.BEARER_SUBPROTOCOL_PREFIX)) return protocol;
+    }
+    return false;
+  };
+  const wss = options.server ? new import_ws.WebSocketServer({ server: options.server, maxPayload: maxMessageBytes, handleProtocols }) : new import_ws.WebSocketServer({
+    port: options.port ?? 0,
+    maxPayload: maxMessageBytes,
+    handleProtocols
+  });
   const heartbeat = startHeartbeat(wss, options.heartbeatIntervalMs ?? 3e4);
   let shuttingDown = false;
   let closePromise;
   let counter = 0;
+  const perIp = new ConcurrencyCounter(maxConnectionsPerIp);
+  const perRoom = new ConcurrencyCounter(maxConnectionsPerRoom);
+  const clientAddress = options.clientAddress ?? ((req) => req.socket.remoteAddress);
   wss.on("connection", (ws, req) => {
     if (shuttingDown) {
       ws.close(1001, "server shutting down");
@@ -973,6 +1137,22 @@ function createSyncServer(options = {}) {
       ws.close(4400, "room required");
       return;
     }
+    if (!isValidRoomName(room)) {
+      ws.close(4400, "invalid room");
+      return;
+    }
+    const address = clientAddress(req);
+    const releaseIp = address ? perIp.acquire(address) : () => void 0;
+    if (!releaseIp) {
+      ws.close(4429, "too many connections");
+      return;
+    }
+    const releaseRoom = perRoom.acquire(room);
+    if (!releaseRoom) {
+      releaseIp();
+      ws.close(4429, "too many connections");
+      return;
+    }
     const connId = `c${++counter}-${Math.random().toString(36).slice(2, 8)}`;
     let state = "pending";
     let closed = false;
@@ -981,10 +1161,8 @@ function createSyncServer(options = {}) {
     let queuedBytes = 0;
     const maxPendingAuthMessages = options.maxPendingAuthMessages ?? DEFAULT_MAX_PENDING_AUTH_MESSAGES;
     const maxPendingAuthBytes = options.maxPendingAuthBytes ?? DEFAULT_MAX_PENDING_AUTH_BYTES;
-    const limiter = new MessageRateLimiter(
-      options.messagesPerSecond ?? DEFAULT_MESSAGES_PER_SECOND,
-      options.messageBurst ?? DEFAULT_MESSAGE_BURST
-    );
+    const limiter = new MessageRateLimiter(messagesPerSecond, messageBurst);
+    const byteLimiter = new MessageRateLimiter(bytesPerSecond, byteBurst);
     const send = (m) => {
       try {
         ws.send(m);
@@ -999,7 +1177,8 @@ function createSyncServer(options = {}) {
         ws.close(1009, "message too large");
         return;
       }
-      if (!limiter.take()) {
+      const now = Date.now();
+      if (!limiter.take(now) || !byteLimiter.take(now, messageBytes)) {
         state = "rejected";
         ws.close(4408, "rate limit exceeded");
         return;
@@ -1019,9 +1198,13 @@ function createSyncServer(options = {}) {
     });
     ws.on("close", () => {
       closed = true;
+      releaseIp();
+      releaseRoom();
       if (admitted) hub.removeConnection(connId);
     });
-    Promise.resolve(options.authenticate ? options.authenticate({ req, room }) : { userId: connId }).then((result) => {
+    Promise.resolve(
+      options.authenticate ? options.authenticate({ req, room, token: readBearerToken(req) }) : { userId: connId }
+    ).then((result) => {
       if (closed || state === "rejected" || shuttingDown) return;
       if (!result) {
         state = "rejected";
@@ -1062,8 +1245,11 @@ function createSyncServer(options = {}) {
 0 && (module.exports = {
   InMemoryHubFanout,
   MemoryHubBackend,
+  ROOM_NAME_PATTERN,
   SyncHub,
   createSyncServer,
+  isValidRoomName,
+  readBearerToken,
   startHeartbeat
 });
 //# sourceMappingURL=index.cjs.map