@fieldnotes/sync-server 0.3.0 → 0.5.0

package/README.md

@@ -14,9 +14,13 @@ applies and forwards.
   concurrent edits to the same room never race, while different rooms run
   independently.
 - **`MemoryHubBackend`** — in-memory `HubBackend` (the default). Redis-backed and
-  authenticated backends are planned.
+  authenticated backends are planned. It reclaims a room's memory on `clear`, but
+  **retains** state for uncleared / abandoned rooms — fine for dev / single-instance
+  use. For a long-lived production process, use a Redis backend with a key TTL, or
+  `clear` rooms you're done with.
 - **`createSyncServer`** — a runnable `ws` reference server. Connect with
-  `?room=<id>` in the query string; missing room closes the socket.
+  `?room=<id>` in the query string; a missing room closes the socket with WS code
+  `4400`.
 - **`HubFanout`** — cross-instance live fan-out seam. `SyncHub` publishes each live
   op to the fanout and forwards ops it receives from other instances to its local
   connections. The default `InMemoryHubFanout` is in-process (a no-op for a single
@@ -34,6 +38,19 @@ const { close } = createSyncServer({ port: 8080 });
 // ws://localhost:8080?room=my-room
 ```
 
+## Heartbeat
+
+The server pings every client on an interval and **terminates** any that miss a pong,
+so half-open sockets (a backgrounded iPad, dropped WiFi) are reaped instead of silently
+leaking room membership. Configure via `heartbeatIntervalMs` (default `30000`; `0`
+disables):
+
+```ts
+createSyncServer({ port: 8080, heartbeatIntervalMs: 30000 });
+```
+
+Browsers auto-pong at the protocol level, so **no client change** is needed.
+
 ## Authentication
 
 Pass an `authenticate` hook to gate connections:
@@ -73,4 +90,69 @@ land in access/proxy logs, so prefer **short-lived / single-use** tokens. Non-br
 clients can instead put the token in `req.headers` (e.g. `Authorization`), which
 `authenticate` reads directly.
 
+## Authorization
+
+Pass an `authorize` hook to gate **writes**. The hub calls it before applying each data
+op (`upsert` / `remove` / `clear`) and **drops denied ops** — a denied op is not applied
+to room state and not forwarded to any other connection:
+
+```ts
+authorize(ctx) => boolean | Promise<boolean>
+```
+
+`ctx` is an `AuthorizeContext`:
+
+```ts
+{
+  userId?: string;          // the connection's authenticated user (from authenticate)
+  role?: string;            // the connection's role (from authenticate)
+  room: string;
+  op: SyncOp;               // the incoming upsert / remove / clear
+  currentElement?: OwnedElement; // the STORED element, if this id already exists
+}
+```
+
+`currentElement` is the element currently in room state for an `upsert`/`remove` of an
+**existing** id (typed `OwnedElement = CanvasElement & { ownerId?: string }`), and
+`undefined` for a new/absent id.
+
+**Ownership is server-stamped and un-forgeable.** A new element's `ownerId` is set to the
+authenticated creator; on edit the stored owner is **preserved**; a client-supplied
+`ownerId` is always **discarded**. A policy can therefore trust `currentElement.ownerId`
+to enforce "own elements only".
+
+With **no hook**, rooms are OPEN (allow-all — every op is accepted).
+
+A copy-paste DM / player / display policy:
+
+```ts
+createSyncServer({
+  port: 8080,
+  authenticate: /* … supplies userId + role … */,
+  authorize: ({ role, op, currentElement, userId }) => {
+    if (role === 'dm') return true;
+    if (role === 'display') return false;              // read-only monitor
+    if (role === 'player') {                            // own elements only, never destructive
+      if (op.kind === 'clear') return false;
+      if (op.kind === 'upsert') return !currentElement || currentElement.ownerId === userId;
+      if (op.kind === 'remove') return currentElement?.ownerId === userId;
+      return false;
+    }
+    return false;
+  },
+});
+```
+
+**Important:**
+
+- Ownership-based authz **requires `authenticate` to supply a STABLE `userId`**. The
+  no-hook anonymous default is `userId = connId`, which changes on every reconnect — a
+  user would lose access to their own elements after reconnecting.
+- The authz path adds one `backend.get` (a Redis `HGET`) per data op — negligible for
+  low-write use.
+- Reads / visibility (a player not **receiving** hidden content) are a separate, upcoming
+  concern (D3). `authorize` gates writes only.
+- Denied ops are dropped **silently** — the client's optimistic local edit self-corrects
+  on its next reconnect/resync.
+
 A Redis `HubBackend` and cross-instance fan-out ship in [`@fieldnotes/sync-redis`](../sync-redis).

package/dist/index.cjs

@@ -23,7 +23,8 @@ __export(index_exports, {
   InMemoryHubFanout: () => InMemoryHubFanout,
   MemoryHubBackend: () => MemoryHubBackend,
   SyncHub: () => SyncHub,
-  createSyncServer: () => createSyncServer
+  createSyncServer: () => createSyncServer,
+  startHeartbeat: () => startHeartbeat
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -45,7 +46,14 @@ var MemoryHubBackend = class {
   async snapshot(room) {
     return [...this.room(room).values()];
   }
+  async get(room, id) {
+    return this.room(room).get(id);
+  }
   async apply(room, op) {
+    if (op.kind === "clear") {
+      this.rooms.delete(room);
+      return;
+    }
     (0, import_sync.applyOpToMap)(this.room(room), op);
   }
 };
@@ -84,10 +92,12 @@ var SyncHub = class {
   instanceId;
   fanout;
   fanoutUnsub;
+  authorize;
   constructor(options = {}) {
     this.backend = options.backend ?? new MemoryHubBackend();
     this.instanceId = options.instanceId ?? generateInstanceId();
     this.fanout = options.fanout ?? new InMemoryHubFanout();
+    this.authorize = options.authorize;
     this.fanoutUnsub = this.fanout.subscribe((payload) => this.onFanout(payload));
   }
   addConnection(conn) {
@@ -135,15 +145,37 @@ var SyncHub = class {
         JSON.stringify({ from: HUB_FROM, op: { kind: "snapshot", to: env.from, elements } })
       );
     } else if (op.kind === "upsert" || op.kind === "remove" || op.kind === "clear") {
-      await this.backend.apply(conn.room, op);
+      let outboundOp = op;
+      let outboundMessage = message;
+      if (this.authorize) {
+        const id = op.kind === "upsert" ? op.element.id : op.kind === "remove" ? op.id : void 0;
+        const current = id !== void 0 ? await this.backend.get(conn.room, id) : void 0;
+        const allowed = await this.authorize({
+          userId: conn.userId,
+          role: conn.role,
+          room: conn.room,
+          op,
+          currentElement: current
+        });
+        if (!allowed) return;
+        if (op.kind === "upsert") {
+          const ownerId = current?.ownerId ?? conn.userId;
+          const stampedElement = { ...op.element, ownerId };
+          outboundOp = { kind: "upsert", element: stampedElement };
+          outboundMessage = JSON.stringify({ from: env.from, op: outboundOp });
+        }
+      }
+      await this.backend.apply(conn.room, outboundOp);
       const members = this.rooms.get(conn.room);
       if (members) {
         for (const id of members) {
           if (id === conn.id) continue;
-          this.conns.get(id)?.send(message);
+          this.conns.get(id)?.send(outboundMessage);
         }
       }
-      this.fanout.publish(JSON.stringify({ o: this.instanceId, room: conn.room, m: message }));
+      this.fanout.publish(
+        JSON.stringify({ o: this.instanceId, room: conn.room, m: outboundMessage })
+      );
     }
   }
   onFanout(payload) {
@@ -173,19 +205,55 @@ var SyncHub = class {
 
 // src/create-sync-server.ts
 var import_ws = require("ws");
+
+// src/heartbeat.ts
+function startHeartbeat(wss, intervalMs) {
+  if (intervalMs <= 0) {
+    return {
+      track: () => {
+      },
+      stop: () => {
+      }
+    };
+  }
+  const alive = /* @__PURE__ */ new WeakMap();
+  const track = (ws) => {
+    alive.set(ws, true);
+    ws.on("pong", () => alive.set(ws, true));
+  };
+  const interval = setInterval(() => {
+    for (const ws of wss.clients) {
+      try {
+        if (alive.get(ws) === false) {
+          ws.terminate();
+          continue;
+        }
+        alive.set(ws, false);
+        ws.ping();
+      } catch {
+      }
+    }
+  }, intervalMs);
+  return { track, stop: () => clearInterval(interval) };
+}
+
+// src/create-sync-server.ts
 function createSyncServer(options = {}) {
   const hub = new SyncHub({
     backend: options.backend,
     fanout: options.fanout,
-    instanceId: options.instanceId
+    instanceId: options.instanceId,
+    authorize: options.authorize
   });
   const wss = options.server ? new import_ws.WebSocketServer({ server: options.server }) : new import_ws.WebSocketServer({ port: options.port ?? 0 });
+  const heartbeat = startHeartbeat(wss, options.heartbeatIntervalMs ?? 3e4);
   let counter = 0;
   wss.on("connection", (ws, req) => {
+    heartbeat.track(ws);
     const url = new URL(req.url ?? "", "http://localhost");
     const room = url.searchParams.get("room");
     if (!room) {
-      ws.close(1008, "room required");
+      ws.close(4400, "room required");
       return;
     }
     const connId = `c${++counter}-${Math.random().toString(36).slice(2, 8)}`;
@@ -236,6 +304,7 @@ function createSyncServer(options = {}) {
     hub,
     wss,
     close: () => new Promise((resolve) => {
+      heartbeat.stop();
       hub.close();
       wss.close(() => resolve());
     })
@@ -246,6 +315,7 @@ function createSyncServer(options = {}) {
   InMemoryHubFanout,
   MemoryHubBackend,
   SyncHub,
-  createSyncServer
+  createSyncServer,
+  startHeartbeat
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/sync-hub.ts","../src/memory-hub-backend.ts","../src/hub-fanout.ts","../src/create-sync-server.ts"],"sourcesContent":["export { SyncHub } from './sync-hub';\nexport type { SyncHubOptions, Connection } from './sync-hub';\nexport { MemoryHubBackend } from './memory-hub-backend';\nexport type { HubBackend } from './hub-backend';\nexport { createSyncServer } from './create-sync-server';\nexport type { CreateSyncServerOptions } from './create-sync-server';\nexport { InMemoryHubFanout } from './hub-fanout';\nexport type { HubFanout } from './hub-fanout';\nexport type { AuthInfo, AuthResult, Authenticate } from './authenticate';\n","import { parseEnvelope } from '@fieldnotes/sync';\nimport { MemoryHubBackend } from './memory-hub-backend';\nimport { InMemoryHubFanout, type HubFanout } from './hub-fanout';\nimport type { HubBackend } from './hub-backend';\n\nexport interface Connection {\n  id: string;\n  room: string;\n  userId?: string;\n  role?: string;\n  send(message: string): void;\n}\n\nexport interface SyncHubOptions {\n  backend?: HubBackend;\n  fanout?: HubFanout;\n  instanceId?: string;\n}\n\nconst HUB_FROM = 'hub';\n\nfunction generateInstanceId(): string {\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function')\n    return crypto.randomUUID();\n  return `i-${Math.random().toString(36).slice(2)}`;\n}\n\nexport class SyncHub {\n  private readonly backend: HubBackend;\n  private readonly conns = new Map<string, Connection>();\n  private readonly rooms = new Map<string, Set<string>>(); // room → connIds\n  private readonly roomQueues = new Map<string, Promise<void>>(); // room → serial tail\n  private readonly instanceId: string;\n  private readonly fanout: HubFanout;\n  private readonly fanoutUnsub: () => void;\n\n  constructor(options: SyncHubOptions = {}) {\n    this.backend = options.backend ?? new MemoryHubBackend();\n    this.instanceId = options.instanceId ?? generateInstanceId();\n    this.fanout = options.fanout ?? new InMemoryHubFanout();\n    this.fanoutUnsub = this.fanout.subscribe((payload) => this.onFanout(payload));\n  }\n\n  addConnection(conn: Connection): void {\n    this.conns.set(conn.id, conn);\n    let set = this.rooms.get(conn.room);\n    if (!set) {\n      set = new Set();\n      this.rooms.set(conn.room, set);\n    }\n    set.add(conn.id);\n  }\n\n  removeConnection(connId: string): void {\n    const conn = this.conns.get(connId);\n    if (!conn) return;\n    this.conns.delete(connId);\n    const members = this.rooms.get(conn.room);\n    if (members) {\n      members.delete(connId);\n      if (members.size === 0) {\n        this.rooms.delete(conn.room);\n        this.roomQueues.delete(conn.room);\n      }\n    }\n  }\n\n  roomCount(): number {\n    return this.rooms.size;\n  }\n\n  handleMessage(connId: string, message: string): Promise<void> {\n    const conn = this.conns.get(connId);\n    if (!conn) return Promise.resolve();\n    const room = conn.room;\n    const prev = this.roomQueues.get(room) ?? Promise.resolve();\n    const next = prev\n      .then(() => this.process(conn, message))\n      .catch(() => {\n        // swallow so one failed message never wedges the room's serial queue\n      });\n    this.roomQueues.set(room, next);\n    return next;\n  }\n\n  private async process(conn: Connection, message: string): Promise<void> {\n    const env = parseEnvelope(message);\n    if (!env) return;\n    const op = env.op;\n    if (op.kind === 'request-snapshot') {\n      const elements = await this.backend.snapshot(conn.room);\n      conn.send(\n        JSON.stringify({ from: HUB_FROM, op: { kind: 'snapshot', to: env.from, elements } }),\n      );\n    } else if (op.kind === 'upsert' || op.kind === 'remove' || op.kind === 'clear') {\n      await this.backend.apply(conn.room, op);\n      const members = this.rooms.get(conn.room);\n      if (members) {\n        for (const id of members) {\n          if (id === conn.id) continue;\n          this.conns.get(id)?.send(message);\n        }\n      }\n      this.fanout.publish(JSON.stringify({ o: this.instanceId, room: conn.room, m: message }));\n    }\n    // 'snapshot' from a client → ignored\n  }\n\n  private onFanout(payload: string): void {\n    // Off the serial queue on purpose: forward-only (no backend re-apply — the origin already applied to the\n    // SHARED backend), and delivery is already ordered. Do not wrap this in roomQueues.\n    let env: { o?: unknown; room?: unknown; m?: unknown };\n    try {\n      env = JSON.parse(payload);\n    } catch {\n      return;\n    }\n    if (typeof env.o !== 'string' || typeof env.room !== 'string' || typeof env.m !== 'string')\n      return;\n    if (env.o === this.instanceId) return; // our own publish — already forwarded locally\n    const members = this.rooms.get(env.room);\n    if (!members) return;\n    const m = env.m;\n    for (const id of members) {\n      try {\n        this.conns.get(id)?.send(m);\n      } catch {\n        /* a throwing socket must not break the fanout loop */\n      }\n    }\n  }\n\n  close(): void {\n    this.fanoutUnsub();\n  }\n}\n","import { applyOpToMap, type SyncOp } from '@fieldnotes/sync';\r\nimport type { CanvasElement } from '@fieldnotes/core';\r\nimport type { HubBackend } from './hub-backend';\r\n\r\nexport class MemoryHubBackend implements HubBackend {\r\n  private rooms = new Map<string, Map<string, CanvasElement>>();\r\n\r\n  private room(id: string): Map<string, CanvasElement> {\r\n    let r = this.rooms.get(id);\r\n    if (!r) {\r\n      r = new Map();\r\n      this.rooms.set(id, r);\r\n    }\r\n    return r;\r\n  }\r\n\r\n  async snapshot(room: string): Promise<CanvasElement[]> {\r\n    return [...this.room(room).values()];\r\n  }\r\n\r\n  async apply(room: string, op: SyncOp): Promise<void> {\r\n    applyOpToMap(this.room(room), op);\r\n  }\r\n}\r\n","export interface HubFanout {\r\n  publish(payload: string): void;\r\n  subscribe(handler: (payload: string) => void): () => void;\r\n  close?(): void;\r\n}\r\n\r\nexport class InMemoryHubFanout implements HubFanout {\r\n  private readonly handlers = new Set<(payload: string) => void>();\r\n\r\n  publish(payload: string): void {\r\n    for (const h of this.handlers) {\r\n      try {\r\n        h(payload);\r\n      } catch {\r\n        /* one throwing subscriber must not break the publish loop */\r\n      }\r\n    }\r\n  }\r\n\r\n  subscribe(handler: (payload: string) => void): () => void {\r\n    this.handlers.add(handler);\r\n    return () => this.handlers.delete(handler);\r\n  }\r\n}\r\n","import { WebSocketServer } from 'ws';\nimport type { Server } from 'http';\nimport { SyncHub } from './sync-hub';\nimport type { HubBackend } from './hub-backend';\nimport type { HubFanout } from './hub-fanout';\nimport type { Authenticate } from './authenticate';\n\nexport interface CreateSyncServerOptions {\n  port?: number;\n  server?: Server;\n  backend?: HubBackend;\n  fanout?: HubFanout;\n  instanceId?: string;\n  authenticate?: Authenticate;\n}\n\nexport function createSyncServer(options: CreateSyncServerOptions = {}): {\n  hub: SyncHub;\n  wss: WebSocketServer;\n  close: () => Promise<void>;\n} {\n  const hub = new SyncHub({\n    backend: options.backend,\n    fanout: options.fanout,\n    instanceId: options.instanceId,\n  });\n  const wss = options.server\n    ? new WebSocketServer({ server: options.server })\n    : new WebSocketServer({ port: options.port ?? 0 });\n  let counter = 0;\n  wss.on('connection', (ws, req) => {\n    const url = new URL(req.url ?? '', 'http://localhost');\n    const room = url.searchParams.get('room');\n    if (!room) {\n      ws.close(1008, 'room required');\n      return;\n    }\n    const connId = `c${++counter}-${Math.random().toString(36).slice(2, 8)}`;\n\n    let state: 'pending' | 'ready' | 'rejected' = 'pending';\n    let closed = false;\n    const queue: string[] = [];\n    const MAX_QUEUE = 100;\n\n    const send = (m: string) => {\n      try {\n        ws.send(m);\n      } catch {\n        /* socket closed mid-send */\n      }\n    };\n\n    ws.on('message', (data) => {\n      const msg = String(data);\n      if (state === 'rejected') return;\n      if (state === 'pending') {\n        if (queue.length < MAX_QUEUE) queue.push(msg);\n        return;\n      }\n      void hub.handleMessage(connId, msg).catch((err) => console.error('[sync-server]', err));\n    });\n    ws.on('close', () => {\n      closed = true;\n      if (state === 'ready') hub.removeConnection(connId);\n    });\n\n    Promise.resolve(options.authenticate ? options.authenticate({ req, room }) : { userId: connId })\n      .then((result) => {\n        if (closed) return;\n        if (!result) {\n          state = 'rejected';\n          ws.close(4401, 'unauthorized');\n          return;\n        }\n        state = 'ready';\n        hub.addConnection({ id: connId, room, userId: result.userId, role: result.role, send });\n        for (const m of queue) {\n          void hub.handleMessage(connId, m).catch((err) => console.error('[sync-server]', err));\n        }\n        queue.length = 0;\n      })\n      .catch(() => {\n        if (!closed) {\n          state = 'rejected';\n          ws.close(4401, 'unauthorized');\n        }\n      });\n  });\n  return {\n    hub,\n    wss,\n    close: () =>\n      new Promise<void>((resolve) => {\n        hub.close();\n        wss.close(() => resolve());\n      }),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,eAA8B;;;ACA9B,kBAA0C;AAInC,IAAM,mBAAN,MAA6C;AAAA,EAC1C,QAAQ,oBAAI,IAAwC;AAAA,EAEpD,KAAK,IAAwC;AACnD,QAAI,IAAI,KAAK,MAAM,IAAI,EAAE;AACzB,QAAI,CAAC,GAAG;AACN,UAAI,oBAAI,IAAI;AACZ,WAAK,MAAM,IAAI,IAAI,CAAC;AAAA,IACtB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,MAAwC;AACrD,WAAO,CAAC,GAAG,KAAK,KAAK,IAAI,EAAE,OAAO,CAAC;AAAA,EACrC;AAAA,EAEA,MAAM,MAAM,MAAc,IAA2B;AACnD,kCAAa,KAAK,KAAK,IAAI,GAAG,EAAE;AAAA,EAClC;AACF;;;ACjBO,IAAM,oBAAN,MAA6C;AAAA,EACjC,WAAW,oBAAI,IAA+B;AAAA,EAE/D,QAAQ,SAAuB;AAC7B,eAAW,KAAK,KAAK,UAAU;AAC7B,UAAI;AACF,UAAE,OAAO;AAAA,MACX,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,UAAU,SAAgD;AACxD,SAAK,SAAS,IAAI,OAAO;AACzB,WAAO,MAAM,KAAK,SAAS,OAAO,OAAO;AAAA,EAC3C;AACF;;;AFJA,IAAM,WAAW;AAEjB,SAAS,qBAA6B;AACpC,MAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe;AAChE,WAAO,OAAO,WAAW;AAC3B,SAAO,KAAK,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACjD;AAEO,IAAM,UAAN,MAAc;AAAA,EACF;AAAA,EACA,QAAQ,oBAAI,IAAwB;AAAA,EACpC,QAAQ,oBAAI,IAAyB;AAAA;AAAA,EACrC,aAAa,oBAAI,IAA2B;AAAA;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,UAA0B,CAAC,GAAG;AACxC,SAAK,UAAU,QAAQ,WAAW,IAAI,iBAAiB;AACvD,SAAK,aAAa,QAAQ,cAAc,mBAAmB;AAC3D,SAAK,SAAS,QAAQ,UAAU,IAAI,kBAAkB;AACtD,SAAK,cAAc,KAAK,OAAO,UAAU,CAAC,YAAY,KAAK,SAAS,OAAO,CAAC;AAAA,EAC9E;AAAA,EAEA,cAAc,MAAwB;AACpC,SAAK,MAAM,IAAI,KAAK,IAAI,IAAI;AAC5B,QAAI,MAAM,KAAK,MAAM,IAAI,KAAK,IAAI;AAClC,QAAI,CAAC,KAAK;AACR,YAAM,oBAAI,IAAI;AACd,WAAK,MAAM,IAAI,KAAK,MAAM,GAAG;AAAA,IAC/B;AACA,QAAI,IAAI,KAAK,EAAE;AAAA,EACjB;AAAA,EAEA,iBAAiB,QAAsB;AACrC,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,QAAI,CAAC,KAAM;AACX,SAAK,MAAM,OAAO,MAAM;AACxB,UAAM,UAAU,KAAK,MAAM,IAAI,KAAK,IAAI;AACxC,QAAI,SAAS;AACX,cAAQ,OAAO,MAAM;AACrB,UAAI,QAAQ,SAAS,GAAG;AACtB,aAAK,MAAM,OAAO,KAAK,IAAI;AAC3B,aAAK,WAAW,OAAO,KAAK,IAAI;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YAAoB;AAClB,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEA,cAAc,QAAgB,SAAgC;AAC5D,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,QAAI,CAAC,KAAM,QAAO,QAAQ,QAAQ;AAClC,UAAM,OAAO,KAAK;AAClB,UAAM,OAAO,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,QAAQ;AAC1D,UAAM,OAAO,KACV,KAAK,MAAM,KAAK,QAAQ,MAAM,OAAO,CAAC,EACtC,MAAM,MAAM;AAAA,IAEb,CAAC;AACH,SAAK,WAAW,IAAI,MAAM,IAAI;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,QAAQ,MAAkB,SAAgC;AACtE,UAAM,UAAM,4BAAc,OAAO;AACjC,QAAI,CAAC,IAAK;AACV,UAAM,KAAK,IAAI;AACf,QAAI,GAAG,SAAS,oBAAoB;AAClC,YAAM,WAAW,MAAM,KAAK,QAAQ,SAAS,KAAK,IAAI;AACtD,WAAK;AAAA,QACH,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,EAAE,MAAM,YAAY,IAAI,IAAI,MAAM,SAAS,EAAE,CAAC;AAAA,MACrF;AAAA,IACF,WAAW,GAAG,SAAS,YAAY,GAAG,SAAS,YAAY,GAAG,SAAS,SAAS;AAC9E,YAAM,KAAK,QAAQ,MAAM,KAAK,MAAM,EAAE;AACtC,YAAM,UAAU,KAAK,MAAM,IAAI,KAAK,IAAI;AACxC,UAAI,SAAS;AACX,mBAAW,MAAM,SAAS;AACxB,cAAI,OAAO,KAAK,GAAI;AACpB,eAAK,MAAM,IAAI,EAAE,GAAG,KAAK,OAAO;AAAA,QAClC;AAAA,MACF;AACA,WAAK,OAAO,QAAQ,KAAK,UAAU,EAAE,GAAG,KAAK,YAAY,MAAM,KAAK,MAAM,GAAG,QAAQ,CAAC,CAAC;AAAA,IACzF;AAAA,EAEF;AAAA,EAEQ,SAAS,SAAuB;AAGtC,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,OAAO;AAAA,IAC1B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO,IAAI,MAAM,YAAY,OAAO,IAAI,SAAS,YAAY,OAAO,IAAI,MAAM;AAChF;AACF,QAAI,IAAI,MAAM,KAAK,WAAY;AAC/B,UAAM,UAAU,KAAK,MAAM,IAAI,IAAI,IAAI;AACvC,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,IAAI;AACd,eAAW,MAAM,SAAS;AACxB,UAAI;AACF,aAAK,MAAM,IAAI,EAAE,GAAG,KAAK,CAAC;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,YAAY;AAAA,EACnB;AACF;;;AGvIA,gBAAgC;AAgBzB,SAAS,iBAAiB,UAAmC,CAAC,GAInE;AACA,QAAM,MAAM,IAAI,QAAQ;AAAA,IACtB,SAAS,QAAQ;AAAA,IACjB,QAAQ,QAAQ;AAAA,IAChB,YAAY,QAAQ;AAAA,EACtB,CAAC;AACD,QAAM,MAAM,QAAQ,SAChB,IAAI,0BAAgB,EAAE,QAAQ,QAAQ,OAAO,CAAC,IAC9C,IAAI,0BAAgB,EAAE,MAAM,QAAQ,QAAQ,EAAE,CAAC;AACnD,MAAI,UAAU;AACd,MAAI,GAAG,cAAc,CAAC,IAAI,QAAQ;AAChC,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,kBAAkB;AACrD,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,QAAI,CAAC,MAAM;AACT,SAAG,MAAM,MAAM,eAAe;AAC9B;AAAA,IACF;AACA,UAAM,SAAS,IAAI,EAAE,OAAO,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAEtE,QAAI,QAA0C;AAC9C,QAAI,SAAS;AACb,UAAM,QAAkB,CAAC;AACzB,UAAM,YAAY;AAElB,UAAM,OAAO,CAAC,MAAc;AAC1B,UAAI;AACF,WAAG,KAAK,CAAC;AAAA,MACX,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,OAAG,GAAG,WAAW,CAAC,SAAS;AACzB,YAAM,MAAM,OAAO,IAAI;AACvB,UAAI,UAAU,WAAY;AAC1B,UAAI,UAAU,WAAW;AACvB,YAAI,MAAM,SAAS,UAAW,OAAM,KAAK,GAAG;AAC5C;AAAA,MACF;AACA,WAAK,IAAI,cAAc,QAAQ,GAAG,EAAE,MAAM,CAAC,QAAQ,QAAQ,MAAM,iBAAiB,GAAG,CAAC;AAAA,IACxF,CAAC;AACD,OAAG,GAAG,SAAS,MAAM;AACnB,eAAS;AACT,UAAI,UAAU,QAAS,KAAI,iBAAiB,MAAM;AAAA,IACpD,CAAC;AAED,YAAQ,QAAQ,QAAQ,eAAe,QAAQ,aAAa,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,QAAQ,OAAO,CAAC,EAC5F,KAAK,CAAC,WAAW;AAChB,UAAI,OAAQ;AACZ,UAAI,CAAC,QAAQ;AACX,gBAAQ;AACR,WAAG,MAAM,MAAM,cAAc;AAC7B;AAAA,MACF;AACA,cAAQ;AACR,UAAI,cAAc,EAAE,IAAI,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO,MAAM,KAAK,CAAC;AACtF,iBAAW,KAAK,OAAO;AACrB,aAAK,IAAI,cAAc,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,QAAQ,MAAM,iBAAiB,GAAG,CAAC;AAAA,MACtF;AACA,YAAM,SAAS;AAAA,IACjB,CAAC,EACA,MAAM,MAAM;AACX,UAAI,CAAC,QAAQ;AACX,gBAAQ;AACR,WAAG,MAAM,MAAM,cAAc;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,MACL,IAAI,QAAc,CAAC,YAAY;AAC7B,UAAI,MAAM;AACV,UAAI,MAAM,MAAM,QAAQ,CAAC;AAAA,IAC3B,CAAC;AAAA,EACL;AACF;","names":["import_sync"]}
+{"version":3,"sources":["../src/index.ts","../src/sync-hub.ts","../src/memory-hub-backend.ts","../src/hub-fanout.ts","../src/create-sync-server.ts","../src/heartbeat.ts"],"sourcesContent":["export { SyncHub } from './sync-hub';\nexport type { SyncHubOptions, Connection } from './sync-hub';\nexport { MemoryHubBackend } from './memory-hub-backend';\nexport type { HubBackend } from './hub-backend';\nexport { createSyncServer } from './create-sync-server';\nexport type { CreateSyncServerOptions } from './create-sync-server';\nexport { InMemoryHubFanout } from './hub-fanout';\nexport type { HubFanout } from './hub-fanout';\nexport type { AuthInfo, AuthResult, Authenticate } from './authenticate';\nexport type { Authorize, AuthorizeContext, OwnedElement } from './authorize';\nexport { startHeartbeat } from './heartbeat';\nexport type { Heartbeat, HeartbeatSocket, HeartbeatServer } from './heartbeat';\n","import { parseEnvelope, type SyncOp } from '@fieldnotes/sync';\r\nimport { MemoryHubBackend } from './memory-hub-backend';\r\nimport { InMemoryHubFanout, type HubFanout } from './hub-fanout';\r\nimport type { HubBackend } from './hub-backend';\r\nimport type { Authorize, OwnedElement } from './authorize';\r\n\r\nexport interface Connection {\r\n  id: string;\r\n  room: string;\r\n  userId?: string;\r\n  role?: string;\r\n  send(message: string): void;\r\n}\r\n\r\nexport interface SyncHubOptions {\r\n  backend?: HubBackend;\r\n  fanout?: HubFanout;\r\n  instanceId?: string;\r\n  authorize?: Authorize;\r\n}\r\n\r\nconst HUB_FROM = 'hub';\r\n\r\nfunction generateInstanceId(): string {\r\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function')\r\n    return crypto.randomUUID();\r\n  return `i-${Math.random().toString(36).slice(2)}`;\r\n}\r\n\r\nexport class SyncHub {\r\n  private readonly backend: HubBackend;\r\n  private readonly conns = new Map<string, Connection>();\r\n  private readonly rooms = new Map<string, Set<string>>(); // room → connIds\r\n  private readonly roomQueues = new Map<string, Promise<void>>(); // room → serial tail\r\n  private readonly instanceId: string;\r\n  private readonly fanout: HubFanout;\r\n  private readonly fanoutUnsub: () => void;\r\n  private readonly authorize?: Authorize;\r\n\r\n  constructor(options: SyncHubOptions = {}) {\r\n    this.backend = options.backend ?? new MemoryHubBackend();\r\n    this.instanceId = options.instanceId ?? generateInstanceId();\r\n    this.fanout = options.fanout ?? new InMemoryHubFanout();\r\n    this.authorize = options.authorize;\r\n    this.fanoutUnsub = this.fanout.subscribe((payload) => this.onFanout(payload));\r\n  }\r\n\r\n  addConnection(conn: Connection): void {\r\n    this.conns.set(conn.id, conn);\r\n    let set = this.rooms.get(conn.room);\r\n    if (!set) {\r\n      set = new Set();\r\n      this.rooms.set(conn.room, set);\r\n    }\r\n    set.add(conn.id);\r\n  }\r\n\r\n  removeConnection(connId: string): void {\r\n    const conn = this.conns.get(connId);\r\n    if (!conn) return;\r\n    this.conns.delete(connId);\r\n    const members = this.rooms.get(conn.room);\r\n    if (members) {\r\n      members.delete(connId);\r\n      if (members.size === 0) {\r\n        this.rooms.delete(conn.room);\r\n        this.roomQueues.delete(conn.room);\r\n      }\r\n    }\r\n  }\r\n\r\n  roomCount(): number {\r\n    return this.rooms.size;\r\n  }\r\n\r\n  handleMessage(connId: string, message: string): Promise<void> {\r\n    const conn = this.conns.get(connId);\r\n    if (!conn) return Promise.resolve();\r\n    const room = conn.room;\r\n    const prev = this.roomQueues.get(room) ?? Promise.resolve();\r\n    const next = prev\r\n      .then(() => this.process(conn, message))\r\n      .catch(() => {\r\n        // swallow so one failed message never wedges the room's serial queue\r\n      });\r\n    this.roomQueues.set(room, next);\r\n    return next;\r\n  }\r\n\r\n  private async process(conn: Connection, message: string): Promise<void> {\r\n    const env = parseEnvelope(message);\r\n    if (!env) return;\r\n    const op = env.op;\r\n    if (op.kind === 'request-snapshot') {\r\n      const elements = await this.backend.snapshot(conn.room);\r\n      conn.send(\r\n        JSON.stringify({ from: HUB_FROM, op: { kind: 'snapshot', to: env.from, elements } }),\r\n      );\r\n    } else if (op.kind === 'upsert' || op.kind === 'remove' || op.kind === 'clear') {\r\n      let outboundOp: SyncOp = op;\r\n      let outboundMessage = message;\r\n      if (this.authorize) {\r\n        const id = op.kind === 'upsert' ? op.element.id : op.kind === 'remove' ? op.id : undefined;\r\n        const current: OwnedElement | undefined =\r\n          id !== undefined ? await this.backend.get(conn.room, id) : undefined;\r\n        const allowed = await this.authorize({\r\n          userId: conn.userId,\r\n          role: conn.role,\r\n          room: conn.room,\r\n          op,\r\n          currentElement: current,\r\n        });\r\n        if (!allowed) return;\r\n        if (op.kind === 'upsert') {\r\n          const ownerId = current?.ownerId ?? conn.userId;\r\n          const stampedElement: OwnedElement = { ...op.element, ownerId };\r\n          outboundOp = { kind: 'upsert', element: stampedElement };\r\n          outboundMessage = JSON.stringify({ from: env.from, op: outboundOp });\r\n        }\r\n      }\r\n      await this.backend.apply(conn.room, outboundOp);\r\n      const members = this.rooms.get(conn.room);\r\n      if (members) {\r\n        for (const id of members) {\r\n          if (id === conn.id) continue;\r\n          this.conns.get(id)?.send(outboundMessage);\r\n        }\r\n      }\r\n      this.fanout.publish(\r\n        JSON.stringify({ o: this.instanceId, room: conn.room, m: outboundMessage }),\r\n      );\r\n    }\r\n    // 'snapshot' from a client → ignored\r\n  }\r\n\r\n  private onFanout(payload: string): void {\r\n    // Off the serial queue on purpose: forward-only (no backend re-apply — the origin already applied to the\r\n    // SHARED backend), and delivery is already ordered. Do not wrap this in roomQueues.\r\n    let env: { o?: unknown; room?: unknown; m?: unknown };\r\n    try {\r\n      env = JSON.parse(payload);\r\n    } catch {\r\n      return;\r\n    }\r\n    if (typeof env.o !== 'string' || typeof env.room !== 'string' || typeof env.m !== 'string')\r\n      return;\r\n    if (env.o === this.instanceId) return; // our own publish — already forwarded locally\r\n    const members = this.rooms.get(env.room);\r\n    if (!members) return;\r\n    const m = env.m;\r\n    for (const id of members) {\r\n      try {\r\n        this.conns.get(id)?.send(m);\r\n      } catch {\r\n        /* a throwing socket must not break the fanout loop */\r\n      }\r\n    }\r\n  }\r\n\r\n  close(): void {\r\n    this.fanoutUnsub();\r\n  }\r\n}\r\n","import { applyOpToMap, type SyncOp } from '@fieldnotes/sync';\nimport type { CanvasElement } from '@fieldnotes/core';\nimport type { HubBackend } from './hub-backend';\n\nexport class MemoryHubBackend implements HubBackend {\n  private rooms = new Map<string, Map<string, CanvasElement>>();\n\n  private room(id: string): Map<string, CanvasElement> {\n    let r = this.rooms.get(id);\n    if (!r) {\n      r = new Map();\n      this.rooms.set(id, r);\n    }\n    return r;\n  }\n\n  async snapshot(room: string): Promise<CanvasElement[]> {\n    return [...this.room(room).values()];\n  }\n\n  async get(room: string, id: string): Promise<CanvasElement | undefined> {\n    return this.room(room).get(id);\n  }\n\n  async apply(room: string, op: SyncOp): Promise<void> {\n    if (op.kind === 'clear') {\n      this.rooms.delete(room);\n      return;\n    }\n    applyOpToMap(this.room(room), op);\n  }\n}\n","export interface HubFanout {\r\n  publish(payload: string): void;\r\n  subscribe(handler: (payload: string) => void): () => void;\r\n  close?(): void;\r\n}\r\n\r\nexport class InMemoryHubFanout implements HubFanout {\r\n  private readonly handlers = new Set<(payload: string) => void>();\r\n\r\n  publish(payload: string): void {\r\n    for (const h of this.handlers) {\r\n      try {\r\n        h(payload);\r\n      } catch {\r\n        /* one throwing subscriber must not break the publish loop */\r\n      }\r\n    }\r\n  }\r\n\r\n  subscribe(handler: (payload: string) => void): () => void {\r\n    this.handlers.add(handler);\r\n    return () => this.handlers.delete(handler);\r\n  }\r\n}\r\n","import { WebSocketServer } from 'ws';\nimport type { Server } from 'http';\nimport { SyncHub } from './sync-hub';\nimport type { HubBackend } from './hub-backend';\nimport type { HubFanout } from './hub-fanout';\nimport type { Authenticate } from './authenticate';\nimport type { Authorize } from './authorize';\nimport { startHeartbeat } from './heartbeat';\n\nexport interface CreateSyncServerOptions {\n  port?: number;\n  server?: Server;\n  backend?: HubBackend;\n  fanout?: HubFanout;\n  instanceId?: string;\n  authenticate?: Authenticate;\n  authorize?: Authorize;\n  heartbeatIntervalMs?: number;\n}\n\nexport function createSyncServer(options: CreateSyncServerOptions = {}): {\n  hub: SyncHub;\n  wss: WebSocketServer;\n  close: () => Promise<void>;\n} {\n  const hub = new SyncHub({\n    backend: options.backend,\n    fanout: options.fanout,\n    instanceId: options.instanceId,\n    authorize: options.authorize,\n  });\n  const wss = options.server\n    ? new WebSocketServer({ server: options.server })\n    : new WebSocketServer({ port: options.port ?? 0 });\n  const heartbeat = startHeartbeat(wss, options.heartbeatIntervalMs ?? 30000);\n  let counter = 0;\n  wss.on('connection', (ws, req) => {\n    heartbeat.track(ws);\n    const url = new URL(req.url ?? '', 'http://localhost');\n    const room = url.searchParams.get('room');\n    if (!room) {\n      ws.close(4400, 'room required');\n      return;\n    }\n    const connId = `c${++counter}-${Math.random().toString(36).slice(2, 8)}`;\n\n    let state: 'pending' | 'ready' | 'rejected' = 'pending';\n    let closed = false;\n    const queue: string[] = [];\n    const MAX_QUEUE = 100;\n\n    const send = (m: string) => {\n      try {\n        ws.send(m);\n      } catch {\n        /* socket closed mid-send */\n      }\n    };\n\n    ws.on('message', (data) => {\n      const msg = String(data);\n      if (state === 'rejected') return;\n      if (state === 'pending') {\n        if (queue.length < MAX_QUEUE) queue.push(msg);\n        return;\n      }\n      void hub.handleMessage(connId, msg).catch((err) => console.error('[sync-server]', err));\n    });\n    ws.on('close', () => {\n      closed = true;\n      if (state === 'ready') hub.removeConnection(connId);\n    });\n\n    Promise.resolve(options.authenticate ? options.authenticate({ req, room }) : { userId: connId })\n      .then((result) => {\n        if (closed) return;\n        if (!result) {\n          state = 'rejected';\n          ws.close(4401, 'unauthorized');\n          return;\n        }\n        state = 'ready';\n        hub.addConnection({ id: connId, room, userId: result.userId, role: result.role, send });\n        for (const m of queue) {\n          void hub.handleMessage(connId, m).catch((err) => console.error('[sync-server]', err));\n        }\n        queue.length = 0;\n      })\n      .catch(() => {\n        if (!closed) {\n          state = 'rejected';\n          ws.close(4401, 'unauthorized');\n        }\n      });\n  });\n  return {\n    hub,\n    wss,\n    close: () =>\n      new Promise<void>((resolve) => {\n        heartbeat.stop();\n        hub.close();\n        wss.close(() => resolve());\n      }),\n  };\n}\n","export interface HeartbeatSocket {\n  ping(): void;\n  terminate(): void;\n  on(event: 'pong', listener: () => void): void;\n}\nexport interface HeartbeatServer {\n  clients: Set<HeartbeatSocket>;\n}\nexport interface Heartbeat {\n  track(ws: HeartbeatSocket): void;\n  stop(): void;\n}\n\nexport function startHeartbeat(wss: HeartbeatServer, intervalMs: number): Heartbeat {\n  if (intervalMs <= 0) {\n    return {\n      track: () => {\n        /* disabled */\n      },\n      stop: () => {\n        /* disabled */\n      },\n    };\n  }\n  const alive = new WeakMap<HeartbeatSocket, boolean>();\n  const track = (ws: HeartbeatSocket): void => {\n    alive.set(ws, true);\n    ws.on('pong', () => alive.set(ws, true));\n  };\n  const interval = setInterval(() => {\n    for (const ws of wss.clients) {\n      try {\n        if (alive.get(ws) === false) {\n          ws.terminate();\n          continue;\n        }\n        alive.set(ws, false);\n        ws.ping();\n      } catch {\n        /* socket dying mid-tick — skip it */\n      }\n    }\n  }, intervalMs);\n  return { track, stop: () => clearInterval(interval) };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,eAA2C;;;ACA3C,kBAA0C;AAInC,IAAM,mBAAN,MAA6C;AAAA,EAC1C,QAAQ,oBAAI,IAAwC;AAAA,EAEpD,KAAK,IAAwC;AACnD,QAAI,IAAI,KAAK,MAAM,IAAI,EAAE;AACzB,QAAI,CAAC,GAAG;AACN,UAAI,oBAAI,IAAI;AACZ,WAAK,MAAM,IAAI,IAAI,CAAC;AAAA,IACtB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,MAAwC;AACrD,WAAO,CAAC,GAAG,KAAK,KAAK,IAAI,EAAE,OAAO,CAAC;AAAA,EACrC;AAAA,EAEA,MAAM,IAAI,MAAc,IAAgD;AACtE,WAAO,KAAK,KAAK,IAAI,EAAE,IAAI,EAAE;AAAA,EAC/B;AAAA,EAEA,MAAM,MAAM,MAAc,IAA2B;AACnD,QAAI,GAAG,SAAS,SAAS;AACvB,WAAK,MAAM,OAAO,IAAI;AACtB;AAAA,IACF;AACA,kCAAa,KAAK,KAAK,IAAI,GAAG,EAAE;AAAA,EAClC;AACF;;;ACzBO,IAAM,oBAAN,MAA6C;AAAA,EACjC,WAAW,oBAAI,IAA+B;AAAA,EAE/D,QAAQ,SAAuB;AAC7B,eAAW,KAAK,KAAK,UAAU;AAC7B,UAAI;AACF,UAAE,OAAO;AAAA,MACX,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,UAAU,SAAgD;AACxD,SAAK,SAAS,IAAI,OAAO;AACzB,WAAO,MAAM,KAAK,SAAS,OAAO,OAAO;AAAA,EAC3C;AACF;;;AFFA,IAAM,WAAW;AAEjB,SAAS,qBAA6B;AACpC,MAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe;AAChE,WAAO,OAAO,WAAW;AAC3B,SAAO,KAAK,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACjD;AAEO,IAAM,UAAN,MAAc;AAAA,EACF;AAAA,EACA,QAAQ,oBAAI,IAAwB;AAAA,EACpC,QAAQ,oBAAI,IAAyB;AAAA;AAAA,EACrC,aAAa,oBAAI,IAA2B;AAAA;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,UAA0B,CAAC,GAAG;AACxC,SAAK,UAAU,QAAQ,WAAW,IAAI,iBAAiB;AACvD,SAAK,aAAa,QAAQ,cAAc,mBAAmB;AAC3D,SAAK,SAAS,QAAQ,UAAU,IAAI,kBAAkB;AACtD,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,KAAK,OAAO,UAAU,CAAC,YAAY,KAAK,SAAS,OAAO,CAAC;AAAA,EAC9E;AAAA,EAEA,cAAc,MAAwB;AACpC,SAAK,MAAM,IAAI,KAAK,IAAI,IAAI;AAC5B,QAAI,MAAM,KAAK,MAAM,IAAI,KAAK,IAAI;AAClC,QAAI,CAAC,KAAK;AACR,YAAM,oBAAI,IAAI;AACd,WAAK,MAAM,IAAI,KAAK,MAAM,GAAG;AAAA,IAC/B;AACA,QAAI,IAAI,KAAK,EAAE;AAAA,EACjB;AAAA,EAEA,iBAAiB,QAAsB;AACrC,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,QAAI,CAAC,KAAM;AACX,SAAK,MAAM,OAAO,MAAM;AACxB,UAAM,UAAU,KAAK,MAAM,IAAI,KAAK,IAAI;AACxC,QAAI,SAAS;AACX,cAAQ,OAAO,MAAM;AACrB,UAAI,QAAQ,SAAS,GAAG;AACtB,aAAK,MAAM,OAAO,KAAK,IAAI;AAC3B,aAAK,WAAW,OAAO,KAAK,IAAI;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YAAoB;AAClB,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEA,cAAc,QAAgB,SAAgC;AAC5D,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,QAAI,CAAC,KAAM,QAAO,QAAQ,QAAQ;AAClC,UAAM,OAAO,KAAK;AAClB,UAAM,OAAO,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,QAAQ;AAC1D,UAAM,OAAO,KACV,KAAK,MAAM,KAAK,QAAQ,MAAM,OAAO,CAAC,EACtC,MAAM,MAAM;AAAA,IAEb,CAAC;AACH,SAAK,WAAW,IAAI,MAAM,IAAI;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,QAAQ,MAAkB,SAAgC;AACtE,UAAM,UAAM,4BAAc,OAAO;AACjC,QAAI,CAAC,IAAK;AACV,UAAM,KAAK,IAAI;AACf,QAAI,GAAG,SAAS,oBAAoB;AAClC,YAAM,WAAW,MAAM,KAAK,QAAQ,SAAS,KAAK,IAAI;AACtD,WAAK;AAAA,QACH,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,EAAE,MAAM,YAAY,IAAI,IAAI,MAAM,SAAS,EAAE,CAAC;AAAA,MACrF;AAAA,IACF,WAAW,GAAG,SAAS,YAAY,GAAG,SAAS,YAAY,GAAG,SAAS,SAAS;AAC9E,UAAI,aAAqB;AACzB,UAAI,kBAAkB;AACtB,UAAI,KAAK,WAAW;AAClB,cAAM,KAAK,GAAG,SAAS,WAAW,GAAG,QAAQ,KAAK,GAAG,SAAS,WAAW,GAAG,KAAK;AACjF,cAAM,UACJ,OAAO,SAAY,MAAM,KAAK,QAAQ,IAAI,KAAK,MAAM,EAAE,IAAI;AAC7D,cAAM,UAAU,MAAM,KAAK,UAAU;AAAA,UACnC,QAAQ,KAAK;AAAA,UACb,MAAM,KAAK;AAAA,UACX,MAAM,KAAK;AAAA,UACX;AAAA,UACA,gBAAgB;AAAA,QAClB,CAAC;AACD,YAAI,CAAC,QAAS;AACd,YAAI,GAAG,SAAS,UAAU;AACxB,gBAAM,UAAU,SAAS,WAAW,KAAK;AACzC,gBAAM,iBAA+B,EAAE,GAAG,GAAG,SAAS,QAAQ;AAC9D,uBAAa,EAAE,MAAM,UAAU,SAAS,eAAe;AACvD,4BAAkB,KAAK,UAAU,EAAE,MAAM,IAAI,MAAM,IAAI,WAAW,CAAC;AAAA,QACrE;AAAA,MACF;AACA,YAAM,KAAK,QAAQ,MAAM,KAAK,MAAM,UAAU;AAC9C,YAAM,UAAU,KAAK,MAAM,IAAI,KAAK,IAAI;AACxC,UAAI,SAAS;AACX,mBAAW,MAAM,SAAS;AACxB,cAAI,OAAO,KAAK,GAAI;AACpB,eAAK,MAAM,IAAI,EAAE,GAAG,KAAK,eAAe;AAAA,QAC1C;AAAA,MACF;AACA,WAAK,OAAO;AAAA,QACV,KAAK,UAAU,EAAE,GAAG,KAAK,YAAY,MAAM,KAAK,MAAM,GAAG,gBAAgB,CAAC;AAAA,MAC5E;AAAA,IACF;AAAA,EAEF;AAAA,EAEQ,SAAS,SAAuB;AAGtC,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,OAAO;AAAA,IAC1B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO,IAAI,MAAM,YAAY,OAAO,IAAI,SAAS,YAAY,OAAO,IAAI,MAAM;AAChF;AACF,QAAI,IAAI,MAAM,KAAK,WAAY;AAC/B,UAAM,UAAU,KAAK,MAAM,IAAI,IAAI,IAAI;AACvC,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,IAAI;AACd,eAAW,MAAM,SAAS;AACxB,UAAI;AACF,aAAK,MAAM,IAAI,EAAE,GAAG,KAAK,CAAC;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,YAAY;AAAA,EACnB;AACF;;;AGlKA,gBAAgC;;;ACazB,SAAS,eAAe,KAAsB,YAA+B;AAClF,MAAI,cAAc,GAAG;AACnB,WAAO;AAAA,MACL,OAAO,MAAM;AAAA,MAEb;AAAA,MACA,MAAM,MAAM;AAAA,MAEZ;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,oBAAI,QAAkC;AACpD,QAAM,QAAQ,CAAC,OAA8B;AAC3C,UAAM,IAAI,IAAI,IAAI;AAClB,OAAG,GAAG,QAAQ,MAAM,MAAM,IAAI,IAAI,IAAI,CAAC;AAAA,EACzC;AACA,QAAM,WAAW,YAAY,MAAM;AACjC,eAAW,MAAM,IAAI,SAAS;AAC5B,UAAI;AACF,YAAI,MAAM,IAAI,EAAE,MAAM,OAAO;AAC3B,aAAG,UAAU;AACb;AAAA,QACF;AACA,cAAM,IAAI,IAAI,KAAK;AACnB,WAAG,KAAK;AAAA,MACV,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,GAAG,UAAU;AACb,SAAO,EAAE,OAAO,MAAM,MAAM,cAAc,QAAQ,EAAE;AACtD;;;ADxBO,SAAS,iBAAiB,UAAmC,CAAC,GAInE;AACA,QAAM,MAAM,IAAI,QAAQ;AAAA,IACtB,SAAS,QAAQ;AAAA,IACjB,QAAQ,QAAQ;AAAA,IAChB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,EACrB,CAAC;AACD,QAAM,MAAM,QAAQ,SAChB,IAAI,0BAAgB,EAAE,QAAQ,QAAQ,OAAO,CAAC,IAC9C,IAAI,0BAAgB,EAAE,MAAM,QAAQ,QAAQ,EAAE,CAAC;AACnD,QAAM,YAAY,eAAe,KAAK,QAAQ,uBAAuB,GAAK;AAC1E,MAAI,UAAU;AACd,MAAI,GAAG,cAAc,CAAC,IAAI,QAAQ;AAChC,cAAU,MAAM,EAAE;AAClB,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,kBAAkB;AACrD,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,QAAI,CAAC,MAAM;AACT,SAAG,MAAM,MAAM,eAAe;AAC9B;AAAA,IACF;AACA,UAAM,SAAS,IAAI,EAAE,OAAO,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAEtE,QAAI,QAA0C;AAC9C,QAAI,SAAS;AACb,UAAM,QAAkB,CAAC;AACzB,UAAM,YAAY;AAElB,UAAM,OAAO,CAAC,MAAc;AAC1B,UAAI;AACF,WAAG,KAAK,CAAC;AAAA,MACX,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,OAAG,GAAG,WAAW,CAAC,SAAS;AACzB,YAAM,MAAM,OAAO,IAAI;AACvB,UAAI,UAAU,WAAY;AAC1B,UAAI,UAAU,WAAW;AACvB,YAAI,MAAM,SAAS,UAAW,OAAM,KAAK,GAAG;AAC5C;AAAA,MACF;AACA,WAAK,IAAI,cAAc,QAAQ,GAAG,EAAE,MAAM,CAAC,QAAQ,QAAQ,MAAM,iBAAiB,GAAG,CAAC;AAAA,IACxF,CAAC;AACD,OAAG,GAAG,SAAS,MAAM;AACnB,eAAS;AACT,UAAI,UAAU,QAAS,KAAI,iBAAiB,MAAM;AAAA,IACpD,CAAC;AAED,YAAQ,QAAQ,QAAQ,eAAe,QAAQ,aAAa,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,QAAQ,OAAO,CAAC,EAC5F,KAAK,CAAC,WAAW;AAChB,UAAI,OAAQ;AACZ,UAAI,CAAC,QAAQ;AACX,gBAAQ;AACR,WAAG,MAAM,MAAM,cAAc;AAC7B;AAAA,MACF;AACA,cAAQ;AACR,UAAI,cAAc,EAAE,IAAI,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO,MAAM,KAAK,CAAC;AACtF,iBAAW,KAAK,OAAO;AACrB,aAAK,IAAI,cAAc,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,QAAQ,MAAM,iBAAiB,GAAG,CAAC;AAAA,MACtF;AACA,YAAM,SAAS;AAAA,IACjB,CAAC,EACA,MAAM,MAAM;AACX,UAAI,CAAC,QAAQ;AACX,gBAAQ;AACR,WAAG,MAAM,MAAM,cAAc;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,MACL,IAAI,QAAc,CAAC,YAAY;AAC7B,gBAAU,KAAK;AACf,UAAI,MAAM;AACV,UAAI,MAAM,MAAM,QAAQ,CAAC;AAAA,IAC3B,CAAC;AAAA,EACL;AACF;","names":["import_sync"]}

package/dist/index.d.cts

@@ -16,9 +16,22 @@ declare class InMemoryHubFanout implements HubFanout {
 
 interface HubBackend {
     snapshot(room: string): Promise<CanvasElement[]>;
+    get(room: string, id: string): Promise<CanvasElement | undefined>;
     apply(room: string, op: SyncOp): Promise<void>;
 }
 
+type OwnedElement = CanvasElement & {
+    ownerId?: string;
+};
+interface AuthorizeContext {
+    userId?: string;
+    role?: string;
+    room: string;
+    op: SyncOp;
+    currentElement?: OwnedElement;
+}
+type Authorize = (ctx: AuthorizeContext) => boolean | Promise<boolean>;
+
 interface Connection {
     id: string;
     room: string;
@@ -30,6 +43,7 @@ interface SyncHubOptions {
     backend?: HubBackend;
     fanout?: HubFanout;
     instanceId?: string;
+    authorize?: Authorize;
 }
 declare class SyncHub {
     private readonly backend;
@@ -39,6 +53,7 @@ declare class SyncHub {
     private readonly instanceId;
     private readonly fanout;
     private readonly fanoutUnsub;
+    private readonly authorize?;
     constructor(options?: SyncHubOptions);
     addConnection(conn: Connection): void;
     removeConnection(connId: string): void;
@@ -53,6 +68,7 @@ declare class MemoryHubBackend implements HubBackend {
     private rooms;
     private room;
     snapshot(room: string): Promise<CanvasElement[]>;
+    get(room: string, id: string): Promise<CanvasElement | undefined>;
     apply(room: string, op: SyncOp): Promise<void>;
 }
 
@@ -73,6 +89,8 @@ interface CreateSyncServerOptions {
     fanout?: HubFanout;
     instanceId?: string;
     authenticate?: Authenticate;
+    authorize?: Authorize;
+    heartbeatIntervalMs?: number;
 }
 declare function createSyncServer(options?: CreateSyncServerOptions): {
     hub: SyncHub;
@@ -80,4 +98,18 @@ declare function createSyncServer(options?: CreateSyncServerOptions): {
     close: () => Promise<void>;
 };
 
-export { type AuthInfo, type AuthResult, type Authenticate, type Connection, type CreateSyncServerOptions, type HubBackend, type HubFanout, InMemoryHubFanout, MemoryHubBackend, SyncHub, type SyncHubOptions, createSyncServer };
+interface HeartbeatSocket {
+    ping(): void;
+    terminate(): void;
+    on(event: 'pong', listener: () => void): void;
+}
+interface HeartbeatServer {
+    clients: Set<HeartbeatSocket>;
+}
+interface Heartbeat {
+    track(ws: HeartbeatSocket): void;
+    stop(): void;
+}
+declare function startHeartbeat(wss: HeartbeatServer, intervalMs: number): Heartbeat;
+
+export { type AuthInfo, type AuthResult, type Authenticate, type Authorize, type AuthorizeContext, type Connection, type CreateSyncServerOptions, type Heartbeat, type HeartbeatServer, type HeartbeatSocket, type HubBackend, type HubFanout, InMemoryHubFanout, MemoryHubBackend, type OwnedElement, SyncHub, type SyncHubOptions, createSyncServer, startHeartbeat };

package/dist/index.d.ts

@@ -16,9 +16,22 @@ declare class InMemoryHubFanout implements HubFanout {
 
 interface HubBackend {
     snapshot(room: string): Promise<CanvasElement[]>;
+    get(room: string, id: string): Promise<CanvasElement | undefined>;
     apply(room: string, op: SyncOp): Promise<void>;
 }
 
+type OwnedElement = CanvasElement & {
+    ownerId?: string;
+};
+interface AuthorizeContext {
+    userId?: string;
+    role?: string;
+    room: string;
+    op: SyncOp;
+    currentElement?: OwnedElement;
+}
+type Authorize = (ctx: AuthorizeContext) => boolean | Promise<boolean>;
+
 interface Connection {
     id: string;
     room: string;
@@ -30,6 +43,7 @@ interface SyncHubOptions {
     backend?: HubBackend;
     fanout?: HubFanout;
     instanceId?: string;
+    authorize?: Authorize;
 }
 declare class SyncHub {
     private readonly backend;
@@ -39,6 +53,7 @@ declare class SyncHub {
     private readonly instanceId;
     private readonly fanout;
     private readonly fanoutUnsub;
+    private readonly authorize?;
     constructor(options?: SyncHubOptions);
     addConnection(conn: Connection): void;
     removeConnection(connId: string): void;
@@ -53,6 +68,7 @@ declare class MemoryHubBackend implements HubBackend {
     private rooms;
     private room;
     snapshot(room: string): Promise<CanvasElement[]>;
+    get(room: string, id: string): Promise<CanvasElement | undefined>;
     apply(room: string, op: SyncOp): Promise<void>;
 }
 
@@ -73,6 +89,8 @@ interface CreateSyncServerOptions {
     fanout?: HubFanout;
     instanceId?: string;
     authenticate?: Authenticate;
+    authorize?: Authorize;
+    heartbeatIntervalMs?: number;
 }
 declare function createSyncServer(options?: CreateSyncServerOptions): {
     hub: SyncHub;
@@ -80,4 +98,18 @@ declare function createSyncServer(options?: CreateSyncServerOptions): {
     close: () => Promise<void>;
 };
 
-export { type AuthInfo, type AuthResult, type Authenticate, type Connection, type CreateSyncServerOptions, type HubBackend, type HubFanout, InMemoryHubFanout, MemoryHubBackend, SyncHub, type SyncHubOptions, createSyncServer };
+interface HeartbeatSocket {
+    ping(): void;
+    terminate(): void;
+    on(event: 'pong', listener: () => void): void;
+}
+interface HeartbeatServer {
+    clients: Set<HeartbeatSocket>;
+}
+interface Heartbeat {
+    track(ws: HeartbeatSocket): void;
+    stop(): void;
+}
+declare function startHeartbeat(wss: HeartbeatServer, intervalMs: number): Heartbeat;
+
+export { type AuthInfo, type AuthResult, type Authenticate, type Authorize, type AuthorizeContext, type Connection, type CreateSyncServerOptions, type Heartbeat, type HeartbeatServer, type HeartbeatSocket, type HubBackend, type HubFanout, InMemoryHubFanout, MemoryHubBackend, type OwnedElement, SyncHub, type SyncHubOptions, createSyncServer, startHeartbeat };

package/dist/index.js

@@ -16,7 +16,14 @@ var MemoryHubBackend = class {
   async snapshot(room) {
     return [...this.room(room).values()];
   }
+  async get(room, id) {
+    return this.room(room).get(id);
+  }
   async apply(room, op) {
+    if (op.kind === "clear") {
+      this.rooms.delete(room);
+      return;
+    }
     applyOpToMap(this.room(room), op);
   }
 };
@@ -55,10 +62,12 @@ var SyncHub = class {
   instanceId;
   fanout;
   fanoutUnsub;
+  authorize;
   constructor(options = {}) {
     this.backend = options.backend ?? new MemoryHubBackend();
     this.instanceId = options.instanceId ?? generateInstanceId();
     this.fanout = options.fanout ?? new InMemoryHubFanout();
+    this.authorize = options.authorize;
     this.fanoutUnsub = this.fanout.subscribe((payload) => this.onFanout(payload));
   }
   addConnection(conn) {
@@ -106,15 +115,37 @@ var SyncHub = class {
         JSON.stringify({ from: HUB_FROM, op: { kind: "snapshot", to: env.from, elements } })
       );
     } else if (op.kind === "upsert" || op.kind === "remove" || op.kind === "clear") {
-      await this.backend.apply(conn.room, op);
+      let outboundOp = op;
+      let outboundMessage = message;
+      if (this.authorize) {
+        const id = op.kind === "upsert" ? op.element.id : op.kind === "remove" ? op.id : void 0;
+        const current = id !== void 0 ? await this.backend.get(conn.room, id) : void 0;
+        const allowed = await this.authorize({
+          userId: conn.userId,
+          role: conn.role,
+          room: conn.room,
+          op,
+          currentElement: current
+        });
+        if (!allowed) return;
+        if (op.kind === "upsert") {
+          const ownerId = current?.ownerId ?? conn.userId;
+          const stampedElement = { ...op.element, ownerId };
+          outboundOp = { kind: "upsert", element: stampedElement };
+          outboundMessage = JSON.stringify({ from: env.from, op: outboundOp });
+        }
+      }
+      await this.backend.apply(conn.room, outboundOp);
       const members = this.rooms.get(conn.room);
       if (members) {
         for (const id of members) {
           if (id === conn.id) continue;
-          this.conns.get(id)?.send(message);
+          this.conns.get(id)?.send(outboundMessage);
         }
       }
-      this.fanout.publish(JSON.stringify({ o: this.instanceId, room: conn.room, m: message }));
+      this.fanout.publish(
+        JSON.stringify({ o: this.instanceId, room: conn.room, m: outboundMessage })
+      );
     }
   }
   onFanout(payload) {
@@ -144,19 +175,55 @@ var SyncHub = class {
 
 // src/create-sync-server.ts
 import { WebSocketServer } from "ws";
+
+// src/heartbeat.ts
+function startHeartbeat(wss, intervalMs) {
+  if (intervalMs <= 0) {
+    return {
+      track: () => {
+      },
+      stop: () => {
+      }
+    };
+  }
+  const alive = /* @__PURE__ */ new WeakMap();
+  const track = (ws) => {
+    alive.set(ws, true);
+    ws.on("pong", () => alive.set(ws, true));
+  };
+  const interval = setInterval(() => {
+    for (const ws of wss.clients) {
+      try {
+        if (alive.get(ws) === false) {
+          ws.terminate();
+          continue;
+        }
+        alive.set(ws, false);
+        ws.ping();
+      } catch {
+      }
+    }
+  }, intervalMs);
+  return { track, stop: () => clearInterval(interval) };
+}
+
+// src/create-sync-server.ts
 function createSyncServer(options = {}) {
   const hub = new SyncHub({
     backend: options.backend,
     fanout: options.fanout,
-    instanceId: options.instanceId
+    instanceId: options.instanceId,
+    authorize: options.authorize
   });
   const wss = options.server ? new WebSocketServer({ server: options.server }) : new WebSocketServer({ port: options.port ?? 0 });
+  const heartbeat = startHeartbeat(wss, options.heartbeatIntervalMs ?? 3e4);
   let counter = 0;
   wss.on("connection", (ws, req) => {
+    heartbeat.track(ws);
     const url = new URL(req.url ?? "", "http://localhost");
     const room = url.searchParams.get("room");
     if (!room) {
-      ws.close(1008, "room required");
+      ws.close(4400, "room required");
       return;
     }
     const connId = `c${++counter}-${Math.random().toString(36).slice(2, 8)}`;
@@ -207,6 +274,7 @@ function createSyncServer(options = {}) {
     hub,
     wss,
     close: () => new Promise((resolve) => {
+      heartbeat.stop();
       hub.close();
       wss.close(() => resolve());
     })
@@ -216,6 +284,7 @@ export {
   InMemoryHubFanout,
   MemoryHubBackend,
   SyncHub,
-  createSyncServer
+  createSyncServer,
+  startHeartbeat
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/sync-hub.ts","../src/memory-hub-backend.ts","../src/hub-fanout.ts","../src/create-sync-server.ts"],"sourcesContent":["import { parseEnvelope } from '@fieldnotes/sync';\nimport { MemoryHubBackend } from './memory-hub-backend';\nimport { InMemoryHubFanout, type HubFanout } from './hub-fanout';\nimport type { HubBackend } from './hub-backend';\n\nexport interface Connection {\n  id: string;\n  room: string;\n  userId?: string;\n  role?: string;\n  send(message: string): void;\n}\n\nexport interface SyncHubOptions {\n  backend?: HubBackend;\n  fanout?: HubFanout;\n  instanceId?: string;\n}\n\nconst HUB_FROM = 'hub';\n\nfunction generateInstanceId(): string {\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function')\n    return crypto.randomUUID();\n  return `i-${Math.random().toString(36).slice(2)}`;\n}\n\nexport class SyncHub {\n  private readonly backend: HubBackend;\n  private readonly conns = new Map<string, Connection>();\n  private readonly rooms = new Map<string, Set<string>>(); // room → connIds\n  private readonly roomQueues = new Map<string, Promise<void>>(); // room → serial tail\n  private readonly instanceId: string;\n  private readonly fanout: HubFanout;\n  private readonly fanoutUnsub: () => void;\n\n  constructor(options: SyncHubOptions = {}) {\n    this.backend = options.backend ?? new MemoryHubBackend();\n    this.instanceId = options.instanceId ?? generateInstanceId();\n    this.fanout = options.fanout ?? new InMemoryHubFanout();\n    this.fanoutUnsub = this.fanout.subscribe((payload) => this.onFanout(payload));\n  }\n\n  addConnection(conn: Connection): void {\n    this.conns.set(conn.id, conn);\n    let set = this.rooms.get(conn.room);\n    if (!set) {\n      set = new Set();\n      this.rooms.set(conn.room, set);\n    }\n    set.add(conn.id);\n  }\n\n  removeConnection(connId: string): void {\n    const conn = this.conns.get(connId);\n    if (!conn) return;\n    this.conns.delete(connId);\n    const members = this.rooms.get(conn.room);\n    if (members) {\n      members.delete(connId);\n      if (members.size === 0) {\n        this.rooms.delete(conn.room);\n        this.roomQueues.delete(conn.room);\n      }\n    }\n  }\n\n  roomCount(): number {\n    return this.rooms.size;\n  }\n\n  handleMessage(connId: string, message: string): Promise<void> {\n    const conn = this.conns.get(connId);\n    if (!conn) return Promise.resolve();\n    const room = conn.room;\n    const prev = this.roomQueues.get(room) ?? Promise.resolve();\n    const next = prev\n      .then(() => this.process(conn, message))\n      .catch(() => {\n        // swallow so one failed message never wedges the room's serial queue\n      });\n    this.roomQueues.set(room, next);\n    return next;\n  }\n\n  private async process(conn: Connection, message: string): Promise<void> {\n    const env = parseEnvelope(message);\n    if (!env) return;\n    const op = env.op;\n    if (op.kind === 'request-snapshot') {\n      const elements = await this.backend.snapshot(conn.room);\n      conn.send(\n        JSON.stringify({ from: HUB_FROM, op: { kind: 'snapshot', to: env.from, elements } }),\n      );\n    } else if (op.kind === 'upsert' || op.kind === 'remove' || op.kind === 'clear') {\n      await this.backend.apply(conn.room, op);\n      const members = this.rooms.get(conn.room);\n      if (members) {\n        for (const id of members) {\n          if (id === conn.id) continue;\n          this.conns.get(id)?.send(message);\n        }\n      }\n      this.fanout.publish(JSON.stringify({ o: this.instanceId, room: conn.room, m: message }));\n    }\n    // 'snapshot' from a client → ignored\n  }\n\n  private onFanout(payload: string): void {\n    // Off the serial queue on purpose: forward-only (no backend re-apply — the origin already applied to the\n    // SHARED backend), and delivery is already ordered. Do not wrap this in roomQueues.\n    let env: { o?: unknown; room?: unknown; m?: unknown };\n    try {\n      env = JSON.parse(payload);\n    } catch {\n      return;\n    }\n    if (typeof env.o !== 'string' || typeof env.room !== 'string' || typeof env.m !== 'string')\n      return;\n    if (env.o === this.instanceId) return; // our own publish — already forwarded locally\n    const members = this.rooms.get(env.room);\n    if (!members) return;\n    const m = env.m;\n    for (const id of members) {\n      try {\n        this.conns.get(id)?.send(m);\n      } catch {\n        /* a throwing socket must not break the fanout loop */\n      }\n    }\n  }\n\n  close(): void {\n    this.fanoutUnsub();\n  }\n}\n","import { applyOpToMap, type SyncOp } from '@fieldnotes/sync';\r\nimport type { CanvasElement } from '@fieldnotes/core';\r\nimport type { HubBackend } from './hub-backend';\r\n\r\nexport class MemoryHubBackend implements HubBackend {\r\n  private rooms = new Map<string, Map<string, CanvasElement>>();\r\n\r\n  private room(id: string): Map<string, CanvasElement> {\r\n    let r = this.rooms.get(id);\r\n    if (!r) {\r\n      r = new Map();\r\n      this.rooms.set(id, r);\r\n    }\r\n    return r;\r\n  }\r\n\r\n  async snapshot(room: string): Promise<CanvasElement[]> {\r\n    return [...this.room(room).values()];\r\n  }\r\n\r\n  async apply(room: string, op: SyncOp): Promise<void> {\r\n    applyOpToMap(this.room(room), op);\r\n  }\r\n}\r\n","export interface HubFanout {\r\n  publish(payload: string): void;\r\n  subscribe(handler: (payload: string) => void): () => void;\r\n  close?(): void;\r\n}\r\n\r\nexport class InMemoryHubFanout implements HubFanout {\r\n  private readonly handlers = new Set<(payload: string) => void>();\r\n\r\n  publish(payload: string): void {\r\n    for (const h of this.handlers) {\r\n      try {\r\n        h(payload);\r\n      } catch {\r\n        /* one throwing subscriber must not break the publish loop */\r\n      }\r\n    }\r\n  }\r\n\r\n  subscribe(handler: (payload: string) => void): () => void {\r\n    this.handlers.add(handler);\r\n    return () => this.handlers.delete(handler);\r\n  }\r\n}\r\n","import { WebSocketServer } from 'ws';\nimport type { Server } from 'http';\nimport { SyncHub } from './sync-hub';\nimport type { HubBackend } from './hub-backend';\nimport type { HubFanout } from './hub-fanout';\nimport type { Authenticate } from './authenticate';\n\nexport interface CreateSyncServerOptions {\n  port?: number;\n  server?: Server;\n  backend?: HubBackend;\n  fanout?: HubFanout;\n  instanceId?: string;\n  authenticate?: Authenticate;\n}\n\nexport function createSyncServer(options: CreateSyncServerOptions = {}): {\n  hub: SyncHub;\n  wss: WebSocketServer;\n  close: () => Promise<void>;\n} {\n  const hub = new SyncHub({\n    backend: options.backend,\n    fanout: options.fanout,\n    instanceId: options.instanceId,\n  });\n  const wss = options.server\n    ? new WebSocketServer({ server: options.server })\n    : new WebSocketServer({ port: options.port ?? 0 });\n  let counter = 0;\n  wss.on('connection', (ws, req) => {\n    const url = new URL(req.url ?? '', 'http://localhost');\n    const room = url.searchParams.get('room');\n    if (!room) {\n      ws.close(1008, 'room required');\n      return;\n    }\n    const connId = `c${++counter}-${Math.random().toString(36).slice(2, 8)}`;\n\n    let state: 'pending' | 'ready' | 'rejected' = 'pending';\n    let closed = false;\n    const queue: string[] = [];\n    const MAX_QUEUE = 100;\n\n    const send = (m: string) => {\n      try {\n        ws.send(m);\n      } catch {\n        /* socket closed mid-send */\n      }\n    };\n\n    ws.on('message', (data) => {\n      const msg = String(data);\n      if (state === 'rejected') return;\n      if (state === 'pending') {\n        if (queue.length < MAX_QUEUE) queue.push(msg);\n        return;\n      }\n      void hub.handleMessage(connId, msg).catch((err) => console.error('[sync-server]', err));\n    });\n    ws.on('close', () => {\n      closed = true;\n      if (state === 'ready') hub.removeConnection(connId);\n    });\n\n    Promise.resolve(options.authenticate ? options.authenticate({ req, room }) : { userId: connId })\n      .then((result) => {\n        if (closed) return;\n        if (!result) {\n          state = 'rejected';\n          ws.close(4401, 'unauthorized');\n          return;\n        }\n        state = 'ready';\n        hub.addConnection({ id: connId, room, userId: result.userId, role: result.role, send });\n        for (const m of queue) {\n          void hub.handleMessage(connId, m).catch((err) => console.error('[sync-server]', err));\n        }\n        queue.length = 0;\n      })\n      .catch(() => {\n        if (!closed) {\n          state = 'rejected';\n          ws.close(4401, 'unauthorized');\n        }\n      });\n  });\n  return {\n    hub,\n    wss,\n    close: () =>\n      new Promise<void>((resolve) => {\n        hub.close();\n        wss.close(() => resolve());\n      }),\n  };\n}\n"],"mappings":";AAAA,SAAS,qBAAqB;;;ACA9B,SAAS,oBAAiC;AAInC,IAAM,mBAAN,MAA6C;AAAA,EAC1C,QAAQ,oBAAI,IAAwC;AAAA,EAEpD,KAAK,IAAwC;AACnD,QAAI,IAAI,KAAK,MAAM,IAAI,EAAE;AACzB,QAAI,CAAC,GAAG;AACN,UAAI,oBAAI,IAAI;AACZ,WAAK,MAAM,IAAI,IAAI,CAAC;AAAA,IACtB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,MAAwC;AACrD,WAAO,CAAC,GAAG,KAAK,KAAK,IAAI,EAAE,OAAO,CAAC;AAAA,EACrC;AAAA,EAEA,MAAM,MAAM,MAAc,IAA2B;AACnD,iBAAa,KAAK,KAAK,IAAI,GAAG,EAAE;AAAA,EAClC;AACF;;;ACjBO,IAAM,oBAAN,MAA6C;AAAA,EACjC,WAAW,oBAAI,IAA+B;AAAA,EAE/D,QAAQ,SAAuB;AAC7B,eAAW,KAAK,KAAK,UAAU;AAC7B,UAAI;AACF,UAAE,OAAO;AAAA,MACX,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,UAAU,SAAgD;AACxD,SAAK,SAAS,IAAI,OAAO;AACzB,WAAO,MAAM,KAAK,SAAS,OAAO,OAAO;AAAA,EAC3C;AACF;;;AFJA,IAAM,WAAW;AAEjB,SAAS,qBAA6B;AACpC,MAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe;AAChE,WAAO,OAAO,WAAW;AAC3B,SAAO,KAAK,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACjD;AAEO,IAAM,UAAN,MAAc;AAAA,EACF;AAAA,EACA,QAAQ,oBAAI,IAAwB;AAAA,EACpC,QAAQ,oBAAI,IAAyB;AAAA;AAAA,EACrC,aAAa,oBAAI,IAA2B;AAAA;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,UAA0B,CAAC,GAAG;AACxC,SAAK,UAAU,QAAQ,WAAW,IAAI,iBAAiB;AACvD,SAAK,aAAa,QAAQ,cAAc,mBAAmB;AAC3D,SAAK,SAAS,QAAQ,UAAU,IAAI,kBAAkB;AACtD,SAAK,cAAc,KAAK,OAAO,UAAU,CAAC,YAAY,KAAK,SAAS,OAAO,CAAC;AAAA,EAC9E;AAAA,EAEA,cAAc,MAAwB;AACpC,SAAK,MAAM,IAAI,KAAK,IAAI,IAAI;AAC5B,QAAI,MAAM,KAAK,MAAM,IAAI,KAAK,IAAI;AAClC,QAAI,CAAC,KAAK;AACR,YAAM,oBAAI,IAAI;AACd,WAAK,MAAM,IAAI,KAAK,MAAM,GAAG;AAAA,IAC/B;AACA,QAAI,IAAI,KAAK,EAAE;AAAA,EACjB;AAAA,EAEA,iBAAiB,QAAsB;AACrC,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,QAAI,CAAC,KAAM;AACX,SAAK,MAAM,OAAO,MAAM;AACxB,UAAM,UAAU,KAAK,MAAM,IAAI,KAAK,IAAI;AACxC,QAAI,SAAS;AACX,cAAQ,OAAO,MAAM;AACrB,UAAI,QAAQ,SAAS,GAAG;AACtB,aAAK,MAAM,OAAO,KAAK,IAAI;AAC3B,aAAK,WAAW,OAAO,KAAK,IAAI;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YAAoB;AAClB,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEA,cAAc,QAAgB,SAAgC;AAC5D,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,QAAI,CAAC,KAAM,QAAO,QAAQ,QAAQ;AAClC,UAAM,OAAO,KAAK;AAClB,UAAM,OAAO,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,QAAQ;AAC1D,UAAM,OAAO,KACV,KAAK,MAAM,KAAK,QAAQ,MAAM,OAAO,CAAC,EACtC,MAAM,MAAM;AAAA,IAEb,CAAC;AACH,SAAK,WAAW,IAAI,MAAM,IAAI;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,QAAQ,MAAkB,SAAgC;AACtE,UAAM,MAAM,cAAc,OAAO;AACjC,QAAI,CAAC,IAAK;AACV,UAAM,KAAK,IAAI;AACf,QAAI,GAAG,SAAS,oBAAoB;AAClC,YAAM,WAAW,MAAM,KAAK,QAAQ,SAAS,KAAK,IAAI;AACtD,WAAK;AAAA,QACH,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,EAAE,MAAM,YAAY,IAAI,IAAI,MAAM,SAAS,EAAE,CAAC;AAAA,MACrF;AAAA,IACF,WAAW,GAAG,SAAS,YAAY,GAAG,SAAS,YAAY,GAAG,SAAS,SAAS;AAC9E,YAAM,KAAK,QAAQ,MAAM,KAAK,MAAM,EAAE;AACtC,YAAM,UAAU,KAAK,MAAM,IAAI,KAAK,IAAI;AACxC,UAAI,SAAS;AACX,mBAAW,MAAM,SAAS;AACxB,cAAI,OAAO,KAAK,GAAI;AACpB,eAAK,MAAM,IAAI,EAAE,GAAG,KAAK,OAAO;AAAA,QAClC;AAAA,MACF;AACA,WAAK,OAAO,QAAQ,KAAK,UAAU,EAAE,GAAG,KAAK,YAAY,MAAM,KAAK,MAAM,GAAG,QAAQ,CAAC,CAAC;AAAA,IACzF;AAAA,EAEF;AAAA,EAEQ,SAAS,SAAuB;AAGtC,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,OAAO;AAAA,IAC1B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO,IAAI,MAAM,YAAY,OAAO,IAAI,SAAS,YAAY,OAAO,IAAI,MAAM;AAChF;AACF,QAAI,IAAI,MAAM,KAAK,WAAY;AAC/B,UAAM,UAAU,KAAK,MAAM,IAAI,IAAI,IAAI;AACvC,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,IAAI;AACd,eAAW,MAAM,SAAS;AACxB,UAAI;AACF,aAAK,MAAM,IAAI,EAAE,GAAG,KAAK,CAAC;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,YAAY;AAAA,EACnB;AACF;;;AGvIA,SAAS,uBAAuB;AAgBzB,SAAS,iBAAiB,UAAmC,CAAC,GAInE;AACA,QAAM,MAAM,IAAI,QAAQ;AAAA,IACtB,SAAS,QAAQ;AAAA,IACjB,QAAQ,QAAQ;AAAA,IAChB,YAAY,QAAQ;AAAA,EACtB,CAAC;AACD,QAAM,MAAM,QAAQ,SAChB,IAAI,gBAAgB,EAAE,QAAQ,QAAQ,OAAO,CAAC,IAC9C,IAAI,gBAAgB,EAAE,MAAM,QAAQ,QAAQ,EAAE,CAAC;AACnD,MAAI,UAAU;AACd,MAAI,GAAG,cAAc,CAAC,IAAI,QAAQ;AAChC,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,kBAAkB;AACrD,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,QAAI,CAAC,MAAM;AACT,SAAG,MAAM,MAAM,eAAe;AAC9B;AAAA,IACF;AACA,UAAM,SAAS,IAAI,EAAE,OAAO,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAEtE,QAAI,QAA0C;AAC9C,QAAI,SAAS;AACb,UAAM,QAAkB,CAAC;AACzB,UAAM,YAAY;AAElB,UAAM,OAAO,CAAC,MAAc;AAC1B,UAAI;AACF,WAAG,KAAK,CAAC;AAAA,MACX,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,OAAG,GAAG,WAAW,CAAC,SAAS;AACzB,YAAM,MAAM,OAAO,IAAI;AACvB,UAAI,UAAU,WAAY;AAC1B,UAAI,UAAU,WAAW;AACvB,YAAI,MAAM,SAAS,UAAW,OAAM,KAAK,GAAG;AAC5C;AAAA,MACF;AACA,WAAK,IAAI,cAAc,QAAQ,GAAG,EAAE,MAAM,CAAC,QAAQ,QAAQ,MAAM,iBAAiB,GAAG,CAAC;AAAA,IACxF,CAAC;AACD,OAAG,GAAG,SAAS,MAAM;AACnB,eAAS;AACT,UAAI,UAAU,QAAS,KAAI,iBAAiB,MAAM;AAAA,IACpD,CAAC;AAED,YAAQ,QAAQ,QAAQ,eAAe,QAAQ,aAAa,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,QAAQ,OAAO,CAAC,EAC5F,KAAK,CAAC,WAAW;AAChB,UAAI,OAAQ;AACZ,UAAI,CAAC,QAAQ;AACX,gBAAQ;AACR,WAAG,MAAM,MAAM,cAAc;AAC7B;AAAA,MACF;AACA,cAAQ;AACR,UAAI,cAAc,EAAE,IAAI,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO,MAAM,KAAK,CAAC;AACtF,iBAAW,KAAK,OAAO;AACrB,aAAK,IAAI,cAAc,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,QAAQ,MAAM,iBAAiB,GAAG,CAAC;AAAA,MACtF;AACA,YAAM,SAAS;AAAA,IACjB,CAAC,EACA,MAAM,MAAM;AACX,UAAI,CAAC,QAAQ;AACX,gBAAQ;AACR,WAAG,MAAM,MAAM,cAAc;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,MACL,IAAI,QAAc,CAAC,YAAY;AAC7B,UAAI,MAAM;AACV,UAAI,MAAM,MAAM,QAAQ,CAAC;AAAA,IAC3B,CAAC;AAAA,EACL;AACF;","names":[]}
+{"version":3,"sources":["../src/sync-hub.ts","../src/memory-hub-backend.ts","../src/hub-fanout.ts","../src/create-sync-server.ts","../src/heartbeat.ts"],"sourcesContent":["import { parseEnvelope, type SyncOp } from '@fieldnotes/sync';\r\nimport { MemoryHubBackend } from './memory-hub-backend';\r\nimport { InMemoryHubFanout, type HubFanout } from './hub-fanout';\r\nimport type { HubBackend } from './hub-backend';\r\nimport type { Authorize, OwnedElement } from './authorize';\r\n\r\nexport interface Connection {\r\n  id: string;\r\n  room: string;\r\n  userId?: string;\r\n  role?: string;\r\n  send(message: string): void;\r\n}\r\n\r\nexport interface SyncHubOptions {\r\n  backend?: HubBackend;\r\n  fanout?: HubFanout;\r\n  instanceId?: string;\r\n  authorize?: Authorize;\r\n}\r\n\r\nconst HUB_FROM = 'hub';\r\n\r\nfunction generateInstanceId(): string {\r\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function')\r\n    return crypto.randomUUID();\r\n  return `i-${Math.random().toString(36).slice(2)}`;\r\n}\r\n\r\nexport class SyncHub {\r\n  private readonly backend: HubBackend;\r\n  private readonly conns = new Map<string, Connection>();\r\n  private readonly rooms = new Map<string, Set<string>>(); // room → connIds\r\n  private readonly roomQueues = new Map<string, Promise<void>>(); // room → serial tail\r\n  private readonly instanceId: string;\r\n  private readonly fanout: HubFanout;\r\n  private readonly fanoutUnsub: () => void;\r\n  private readonly authorize?: Authorize;\r\n\r\n  constructor(options: SyncHubOptions = {}) {\r\n    this.backend = options.backend ?? new MemoryHubBackend();\r\n    this.instanceId = options.instanceId ?? generateInstanceId();\r\n    this.fanout = options.fanout ?? new InMemoryHubFanout();\r\n    this.authorize = options.authorize;\r\n    this.fanoutUnsub = this.fanout.subscribe((payload) => this.onFanout(payload));\r\n  }\r\n\r\n  addConnection(conn: Connection): void {\r\n    this.conns.set(conn.id, conn);\r\n    let set = this.rooms.get(conn.room);\r\n    if (!set) {\r\n      set = new Set();\r\n      this.rooms.set(conn.room, set);\r\n    }\r\n    set.add(conn.id);\r\n  }\r\n\r\n  removeConnection(connId: string): void {\r\n    const conn = this.conns.get(connId);\r\n    if (!conn) return;\r\n    this.conns.delete(connId);\r\n    const members = this.rooms.get(conn.room);\r\n    if (members) {\r\n      members.delete(connId);\r\n      if (members.size === 0) {\r\n        this.rooms.delete(conn.room);\r\n        this.roomQueues.delete(conn.room);\r\n      }\r\n    }\r\n  }\r\n\r\n  roomCount(): number {\r\n    return this.rooms.size;\r\n  }\r\n\r\n  handleMessage(connId: string, message: string): Promise<void> {\r\n    const conn = this.conns.get(connId);\r\n    if (!conn) return Promise.resolve();\r\n    const room = conn.room;\r\n    const prev = this.roomQueues.get(room) ?? Promise.resolve();\r\n    const next = prev\r\n      .then(() => this.process(conn, message))\r\n      .catch(() => {\r\n        // swallow so one failed message never wedges the room's serial queue\r\n      });\r\n    this.roomQueues.set(room, next);\r\n    return next;\r\n  }\r\n\r\n  private async process(conn: Connection, message: string): Promise<void> {\r\n    const env = parseEnvelope(message);\r\n    if (!env) return;\r\n    const op = env.op;\r\n    if (op.kind === 'request-snapshot') {\r\n      const elements = await this.backend.snapshot(conn.room);\r\n      conn.send(\r\n        JSON.stringify({ from: HUB_FROM, op: { kind: 'snapshot', to: env.from, elements } }),\r\n      );\r\n    } else if (op.kind === 'upsert' || op.kind === 'remove' || op.kind === 'clear') {\r\n      let outboundOp: SyncOp = op;\r\n      let outboundMessage = message;\r\n      if (this.authorize) {\r\n        const id = op.kind === 'upsert' ? op.element.id : op.kind === 'remove' ? op.id : undefined;\r\n        const current: OwnedElement | undefined =\r\n          id !== undefined ? await this.backend.get(conn.room, id) : undefined;\r\n        const allowed = await this.authorize({\r\n          userId: conn.userId,\r\n          role: conn.role,\r\n          room: conn.room,\r\n          op,\r\n          currentElement: current,\r\n        });\r\n        if (!allowed) return;\r\n        if (op.kind === 'upsert') {\r\n          const ownerId = current?.ownerId ?? conn.userId;\r\n          const stampedElement: OwnedElement = { ...op.element, ownerId };\r\n          outboundOp = { kind: 'upsert', element: stampedElement };\r\n          outboundMessage = JSON.stringify({ from: env.from, op: outboundOp });\r\n        }\r\n      }\r\n      await this.backend.apply(conn.room, outboundOp);\r\n      const members = this.rooms.get(conn.room);\r\n      if (members) {\r\n        for (const id of members) {\r\n          if (id === conn.id) continue;\r\n          this.conns.get(id)?.send(outboundMessage);\r\n        }\r\n      }\r\n      this.fanout.publish(\r\n        JSON.stringify({ o: this.instanceId, room: conn.room, m: outboundMessage }),\r\n      );\r\n    }\r\n    // 'snapshot' from a client → ignored\r\n  }\r\n\r\n  private onFanout(payload: string): void {\r\n    // Off the serial queue on purpose: forward-only (no backend re-apply — the origin already applied to the\r\n    // SHARED backend), and delivery is already ordered. Do not wrap this in roomQueues.\r\n    let env: { o?: unknown; room?: unknown; m?: unknown };\r\n    try {\r\n      env = JSON.parse(payload);\r\n    } catch {\r\n      return;\r\n    }\r\n    if (typeof env.o !== 'string' || typeof env.room !== 'string' || typeof env.m !== 'string')\r\n      return;\r\n    if (env.o === this.instanceId) return; // our own publish — already forwarded locally\r\n    const members = this.rooms.get(env.room);\r\n    if (!members) return;\r\n    const m = env.m;\r\n    for (const id of members) {\r\n      try {\r\n        this.conns.get(id)?.send(m);\r\n      } catch {\r\n        /* a throwing socket must not break the fanout loop */\r\n      }\r\n    }\r\n  }\r\n\r\n  close(): void {\r\n    this.fanoutUnsub();\r\n  }\r\n}\r\n","import { applyOpToMap, type SyncOp } from '@fieldnotes/sync';\nimport type { CanvasElement } from '@fieldnotes/core';\nimport type { HubBackend } from './hub-backend';\n\nexport class MemoryHubBackend implements HubBackend {\n  private rooms = new Map<string, Map<string, CanvasElement>>();\n\n  private room(id: string): Map<string, CanvasElement> {\n    let r = this.rooms.get(id);\n    if (!r) {\n      r = new Map();\n      this.rooms.set(id, r);\n    }\n    return r;\n  }\n\n  async snapshot(room: string): Promise<CanvasElement[]> {\n    return [...this.room(room).values()];\n  }\n\n  async get(room: string, id: string): Promise<CanvasElement | undefined> {\n    return this.room(room).get(id);\n  }\n\n  async apply(room: string, op: SyncOp): Promise<void> {\n    if (op.kind === 'clear') {\n      this.rooms.delete(room);\n      return;\n    }\n    applyOpToMap(this.room(room), op);\n  }\n}\n","export interface HubFanout {\r\n  publish(payload: string): void;\r\n  subscribe(handler: (payload: string) => void): () => void;\r\n  close?(): void;\r\n}\r\n\r\nexport class InMemoryHubFanout implements HubFanout {\r\n  private readonly handlers = new Set<(payload: string) => void>();\r\n\r\n  publish(payload: string): void {\r\n    for (const h of this.handlers) {\r\n      try {\r\n        h(payload);\r\n      } catch {\r\n        /* one throwing subscriber must not break the publish loop */\r\n      }\r\n    }\r\n  }\r\n\r\n  subscribe(handler: (payload: string) => void): () => void {\r\n    this.handlers.add(handler);\r\n    return () => this.handlers.delete(handler);\r\n  }\r\n}\r\n","import { WebSocketServer } from 'ws';\nimport type { Server } from 'http';\nimport { SyncHub } from './sync-hub';\nimport type { HubBackend } from './hub-backend';\nimport type { HubFanout } from './hub-fanout';\nimport type { Authenticate } from './authenticate';\nimport type { Authorize } from './authorize';\nimport { startHeartbeat } from './heartbeat';\n\nexport interface CreateSyncServerOptions {\n  port?: number;\n  server?: Server;\n  backend?: HubBackend;\n  fanout?: HubFanout;\n  instanceId?: string;\n  authenticate?: Authenticate;\n  authorize?: Authorize;\n  heartbeatIntervalMs?: number;\n}\n\nexport function createSyncServer(options: CreateSyncServerOptions = {}): {\n  hub: SyncHub;\n  wss: WebSocketServer;\n  close: () => Promise<void>;\n} {\n  const hub = new SyncHub({\n    backend: options.backend,\n    fanout: options.fanout,\n    instanceId: options.instanceId,\n    authorize: options.authorize,\n  });\n  const wss = options.server\n    ? new WebSocketServer({ server: options.server })\n    : new WebSocketServer({ port: options.port ?? 0 });\n  const heartbeat = startHeartbeat(wss, options.heartbeatIntervalMs ?? 30000);\n  let counter = 0;\n  wss.on('connection', (ws, req) => {\n    heartbeat.track(ws);\n    const url = new URL(req.url ?? '', 'http://localhost');\n    const room = url.searchParams.get('room');\n    if (!room) {\n      ws.close(4400, 'room required');\n      return;\n    }\n    const connId = `c${++counter}-${Math.random().toString(36).slice(2, 8)}`;\n\n    let state: 'pending' | 'ready' | 'rejected' = 'pending';\n    let closed = false;\n    const queue: string[] = [];\n    const MAX_QUEUE = 100;\n\n    const send = (m: string) => {\n      try {\n        ws.send(m);\n      } catch {\n        /* socket closed mid-send */\n      }\n    };\n\n    ws.on('message', (data) => {\n      const msg = String(data);\n      if (state === 'rejected') return;\n      if (state === 'pending') {\n        if (queue.length < MAX_QUEUE) queue.push(msg);\n        return;\n      }\n      void hub.handleMessage(connId, msg).catch((err) => console.error('[sync-server]', err));\n    });\n    ws.on('close', () => {\n      closed = true;\n      if (state === 'ready') hub.removeConnection(connId);\n    });\n\n    Promise.resolve(options.authenticate ? options.authenticate({ req, room }) : { userId: connId })\n      .then((result) => {\n        if (closed) return;\n        if (!result) {\n          state = 'rejected';\n          ws.close(4401, 'unauthorized');\n          return;\n        }\n        state = 'ready';\n        hub.addConnection({ id: connId, room, userId: result.userId, role: result.role, send });\n        for (const m of queue) {\n          void hub.handleMessage(connId, m).catch((err) => console.error('[sync-server]', err));\n        }\n        queue.length = 0;\n      })\n      .catch(() => {\n        if (!closed) {\n          state = 'rejected';\n          ws.close(4401, 'unauthorized');\n        }\n      });\n  });\n  return {\n    hub,\n    wss,\n    close: () =>\n      new Promise<void>((resolve) => {\n        heartbeat.stop();\n        hub.close();\n        wss.close(() => resolve());\n      }),\n  };\n}\n","export interface HeartbeatSocket {\n  ping(): void;\n  terminate(): void;\n  on(event: 'pong', listener: () => void): void;\n}\nexport interface HeartbeatServer {\n  clients: Set<HeartbeatSocket>;\n}\nexport interface Heartbeat {\n  track(ws: HeartbeatSocket): void;\n  stop(): void;\n}\n\nexport function startHeartbeat(wss: HeartbeatServer, intervalMs: number): Heartbeat {\n  if (intervalMs <= 0) {\n    return {\n      track: () => {\n        /* disabled */\n      },\n      stop: () => {\n        /* disabled */\n      },\n    };\n  }\n  const alive = new WeakMap<HeartbeatSocket, boolean>();\n  const track = (ws: HeartbeatSocket): void => {\n    alive.set(ws, true);\n    ws.on('pong', () => alive.set(ws, true));\n  };\n  const interval = setInterval(() => {\n    for (const ws of wss.clients) {\n      try {\n        if (alive.get(ws) === false) {\n          ws.terminate();\n          continue;\n        }\n        alive.set(ws, false);\n        ws.ping();\n      } catch {\n        /* socket dying mid-tick — skip it */\n      }\n    }\n  }, intervalMs);\n  return { track, stop: () => clearInterval(interval) };\n}\n"],"mappings":";AAAA,SAAS,qBAAkC;;;ACA3C,SAAS,oBAAiC;AAInC,IAAM,mBAAN,MAA6C;AAAA,EAC1C,QAAQ,oBAAI,IAAwC;AAAA,EAEpD,KAAK,IAAwC;AACnD,QAAI,IAAI,KAAK,MAAM,IAAI,EAAE;AACzB,QAAI,CAAC,GAAG;AACN,UAAI,oBAAI,IAAI;AACZ,WAAK,MAAM,IAAI,IAAI,CAAC;AAAA,IACtB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,MAAwC;AACrD,WAAO,CAAC,GAAG,KAAK,KAAK,IAAI,EAAE,OAAO,CAAC;AAAA,EACrC;AAAA,EAEA,MAAM,IAAI,MAAc,IAAgD;AACtE,WAAO,KAAK,KAAK,IAAI,EAAE,IAAI,EAAE;AAAA,EAC/B;AAAA,EAEA,MAAM,MAAM,MAAc,IAA2B;AACnD,QAAI,GAAG,SAAS,SAAS;AACvB,WAAK,MAAM,OAAO,IAAI;AACtB;AAAA,IACF;AACA,iBAAa,KAAK,KAAK,IAAI,GAAG,EAAE;AAAA,EAClC;AACF;;;ACzBO,IAAM,oBAAN,MAA6C;AAAA,EACjC,WAAW,oBAAI,IAA+B;AAAA,EAE/D,QAAQ,SAAuB;AAC7B,eAAW,KAAK,KAAK,UAAU;AAC7B,UAAI;AACF,UAAE,OAAO;AAAA,MACX,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,UAAU,SAAgD;AACxD,SAAK,SAAS,IAAI,OAAO;AACzB,WAAO,MAAM,KAAK,SAAS,OAAO,OAAO;AAAA,EAC3C;AACF;;;AFFA,IAAM,WAAW;AAEjB,SAAS,qBAA6B;AACpC,MAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe;AAChE,WAAO,OAAO,WAAW;AAC3B,SAAO,KAAK,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACjD;AAEO,IAAM,UAAN,MAAc;AAAA,EACF;AAAA,EACA,QAAQ,oBAAI,IAAwB;AAAA,EACpC,QAAQ,oBAAI,IAAyB;AAAA;AAAA,EACrC,aAAa,oBAAI,IAA2B;AAAA;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,UAA0B,CAAC,GAAG;AACxC,SAAK,UAAU,QAAQ,WAAW,IAAI,iBAAiB;AACvD,SAAK,aAAa,QAAQ,cAAc,mBAAmB;AAC3D,SAAK,SAAS,QAAQ,UAAU,IAAI,kBAAkB;AACtD,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,KAAK,OAAO,UAAU,CAAC,YAAY,KAAK,SAAS,OAAO,CAAC;AAAA,EAC9E;AAAA,EAEA,cAAc,MAAwB;AACpC,SAAK,MAAM,IAAI,KAAK,IAAI,IAAI;AAC5B,QAAI,MAAM,KAAK,MAAM,IAAI,KAAK,IAAI;AAClC,QAAI,CAAC,KAAK;AACR,YAAM,oBAAI,IAAI;AACd,WAAK,MAAM,IAAI,KAAK,MAAM,GAAG;AAAA,IAC/B;AACA,QAAI,IAAI,KAAK,EAAE;AAAA,EACjB;AAAA,EAEA,iBAAiB,QAAsB;AACrC,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,QAAI,CAAC,KAAM;AACX,SAAK,MAAM,OAAO,MAAM;AACxB,UAAM,UAAU,KAAK,MAAM,IAAI,KAAK,IAAI;AACxC,QAAI,SAAS;AACX,cAAQ,OAAO,MAAM;AACrB,UAAI,QAAQ,SAAS,GAAG;AACtB,aAAK,MAAM,OAAO,KAAK,IAAI;AAC3B,aAAK,WAAW,OAAO,KAAK,IAAI;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YAAoB;AAClB,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEA,cAAc,QAAgB,SAAgC;AAC5D,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,QAAI,CAAC,KAAM,QAAO,QAAQ,QAAQ;AAClC,UAAM,OAAO,KAAK;AAClB,UAAM,OAAO,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,QAAQ;AAC1D,UAAM,OAAO,KACV,KAAK,MAAM,KAAK,QAAQ,MAAM,OAAO,CAAC,EACtC,MAAM,MAAM;AAAA,IAEb,CAAC;AACH,SAAK,WAAW,IAAI,MAAM,IAAI;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,QAAQ,MAAkB,SAAgC;AACtE,UAAM,MAAM,cAAc,OAAO;AACjC,QAAI,CAAC,IAAK;AACV,UAAM,KAAK,IAAI;AACf,QAAI,GAAG,SAAS,oBAAoB;AAClC,YAAM,WAAW,MAAM,KAAK,QAAQ,SAAS,KAAK,IAAI;AACtD,WAAK;AAAA,QACH,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,EAAE,MAAM,YAAY,IAAI,IAAI,MAAM,SAAS,EAAE,CAAC;AAAA,MACrF;AAAA,IACF,WAAW,GAAG,SAAS,YAAY,GAAG,SAAS,YAAY,GAAG,SAAS,SAAS;AAC9E,UAAI,aAAqB;AACzB,UAAI,kBAAkB;AACtB,UAAI,KAAK,WAAW;AAClB,cAAM,KAAK,GAAG,SAAS,WAAW,GAAG,QAAQ,KAAK,GAAG,SAAS,WAAW,GAAG,KAAK;AACjF,cAAM,UACJ,OAAO,SAAY,MAAM,KAAK,QAAQ,IAAI,KAAK,MAAM,EAAE,IAAI;AAC7D,cAAM,UAAU,MAAM,KAAK,UAAU;AAAA,UACnC,QAAQ,KAAK;AAAA,UACb,MAAM,KAAK;AAAA,UACX,MAAM,KAAK;AAAA,UACX;AAAA,UACA,gBAAgB;AAAA,QAClB,CAAC;AACD,YAAI,CAAC,QAAS;AACd,YAAI,GAAG,SAAS,UAAU;AACxB,gBAAM,UAAU,SAAS,WAAW,KAAK;AACzC,gBAAM,iBAA+B,EAAE,GAAG,GAAG,SAAS,QAAQ;AAC9D,uBAAa,EAAE,MAAM,UAAU,SAAS,eAAe;AACvD,4BAAkB,KAAK,UAAU,EAAE,MAAM,IAAI,MAAM,IAAI,WAAW,CAAC;AAAA,QACrE;AAAA,MACF;AACA,YAAM,KAAK,QAAQ,MAAM,KAAK,MAAM,UAAU;AAC9C,YAAM,UAAU,KAAK,MAAM,IAAI,KAAK,IAAI;AACxC,UAAI,SAAS;AACX,mBAAW,MAAM,SAAS;AACxB,cAAI,OAAO,KAAK,GAAI;AACpB,eAAK,MAAM,IAAI,EAAE,GAAG,KAAK,eAAe;AAAA,QAC1C;AAAA,MACF;AACA,WAAK,OAAO;AAAA,QACV,KAAK,UAAU,EAAE,GAAG,KAAK,YAAY,MAAM,KAAK,MAAM,GAAG,gBAAgB,CAAC;AAAA,MAC5E;AAAA,IACF;AAAA,EAEF;AAAA,EAEQ,SAAS,SAAuB;AAGtC,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,OAAO;AAAA,IAC1B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO,IAAI,MAAM,YAAY,OAAO,IAAI,SAAS,YAAY,OAAO,IAAI,MAAM;AAChF;AACF,QAAI,IAAI,MAAM,KAAK,WAAY;AAC/B,UAAM,UAAU,KAAK,MAAM,IAAI,IAAI,IAAI;AACvC,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,IAAI;AACd,eAAW,MAAM,SAAS;AACxB,UAAI;AACF,aAAK,MAAM,IAAI,EAAE,GAAG,KAAK,CAAC;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,YAAY;AAAA,EACnB;AACF;;;AGlKA,SAAS,uBAAuB;;;ACazB,SAAS,eAAe,KAAsB,YAA+B;AAClF,MAAI,cAAc,GAAG;AACnB,WAAO;AAAA,MACL,OAAO,MAAM;AAAA,MAEb;AAAA,MACA,MAAM,MAAM;AAAA,MAEZ;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,oBAAI,QAAkC;AACpD,QAAM,QAAQ,CAAC,OAA8B;AAC3C,UAAM,IAAI,IAAI,IAAI;AAClB,OAAG,GAAG,QAAQ,MAAM,MAAM,IAAI,IAAI,IAAI,CAAC;AAAA,EACzC;AACA,QAAM,WAAW,YAAY,MAAM;AACjC,eAAW,MAAM,IAAI,SAAS;AAC5B,UAAI;AACF,YAAI,MAAM,IAAI,EAAE,MAAM,OAAO;AAC3B,aAAG,UAAU;AACb;AAAA,QACF;AACA,cAAM,IAAI,IAAI,KAAK;AACnB,WAAG,KAAK;AAAA,MACV,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,GAAG,UAAU;AACb,SAAO,EAAE,OAAO,MAAM,MAAM,cAAc,QAAQ,EAAE;AACtD;;;ADxBO,SAAS,iBAAiB,UAAmC,CAAC,GAInE;AACA,QAAM,MAAM,IAAI,QAAQ;AAAA,IACtB,SAAS,QAAQ;AAAA,IACjB,QAAQ,QAAQ;AAAA,IAChB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,EACrB,CAAC;AACD,QAAM,MAAM,QAAQ,SAChB,IAAI,gBAAgB,EAAE,QAAQ,QAAQ,OAAO,CAAC,IAC9C,IAAI,gBAAgB,EAAE,MAAM,QAAQ,QAAQ,EAAE,CAAC;AACnD,QAAM,YAAY,eAAe,KAAK,QAAQ,uBAAuB,GAAK;AAC1E,MAAI,UAAU;AACd,MAAI,GAAG,cAAc,CAAC,IAAI,QAAQ;AAChC,cAAU,MAAM,EAAE;AAClB,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,kBAAkB;AACrD,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,QAAI,CAAC,MAAM;AACT,SAAG,MAAM,MAAM,eAAe;AAC9B;AAAA,IACF;AACA,UAAM,SAAS,IAAI,EAAE,OAAO,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAEtE,QAAI,QAA0C;AAC9C,QAAI,SAAS;AACb,UAAM,QAAkB,CAAC;AACzB,UAAM,YAAY;AAElB,UAAM,OAAO,CAAC,MAAc;AAC1B,UAAI;AACF,WAAG,KAAK,CAAC;AAAA,MACX,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,OAAG,GAAG,WAAW,CAAC,SAAS;AACzB,YAAM,MAAM,OAAO,IAAI;AACvB,UAAI,UAAU,WAAY;AAC1B,UAAI,UAAU,WAAW;AACvB,YAAI,MAAM,SAAS,UAAW,OAAM,KAAK,GAAG;AAC5C;AAAA,MACF;AACA,WAAK,IAAI,cAAc,QAAQ,GAAG,EAAE,MAAM,CAAC,QAAQ,QAAQ,MAAM,iBAAiB,GAAG,CAAC;AAAA,IACxF,CAAC;AACD,OAAG,GAAG,SAAS,MAAM;AACnB,eAAS;AACT,UAAI,UAAU,QAAS,KAAI,iBAAiB,MAAM;AAAA,IACpD,CAAC;AAED,YAAQ,QAAQ,QAAQ,eAAe,QAAQ,aAAa,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,QAAQ,OAAO,CAAC,EAC5F,KAAK,CAAC,WAAW;AAChB,UAAI,OAAQ;AACZ,UAAI,CAAC,QAAQ;AACX,gBAAQ;AACR,WAAG,MAAM,MAAM,cAAc;AAC7B;AAAA,MACF;AACA,cAAQ;AACR,UAAI,cAAc,EAAE,IAAI,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO,MAAM,KAAK,CAAC;AACtF,iBAAW,KAAK,OAAO;AACrB,aAAK,IAAI,cAAc,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,QAAQ,MAAM,iBAAiB,GAAG,CAAC;AAAA,MACtF;AACA,YAAM,SAAS;AAAA,IACjB,CAAC,EACA,MAAM,MAAM;AACX,UAAI,CAAC,QAAQ;AACX,gBAAQ;AACR,WAAG,MAAM,MAAM,cAAc;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,MACL,IAAI,QAAc,CAAC,YAAY;AAC7B,gBAAU,KAAK;AACf,UAAI,MAAM;AACV,UAAI,MAAM,MAAM,QAAQ,CAAC;AAAA,IAC3B,CAAC;AAAA,EACL;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fieldnotes/sync-server",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Authoritative WebSocket relay server for Field Notes real-time sync",
   "type": "module",
   "sideEffects": false,
@@ -38,7 +38,7 @@
   ],
   "dependencies": {
     "ws": "^8.18.0",
-    "@fieldnotes/sync": "0.4.0"
+    "@fieldnotes/sync": "0.5.1"
   },
   "devDependencies": {
     "@types/ws": "^8.5.12",