@fitzzero/quickdraw-core 3.6.0 → 3.8.0

package/dist/server/index.js

@@ -2,11 +2,15 @@ import express from 'express';
 import { createServer } from 'http';
 import { Server } from 'socket.io';
 import * as jose from 'jose';
+import { randomBytes, createCipheriv, createDecipheriv } from 'crypto';
 import * as readline from 'readline';
 import * as fs from 'fs';
 import * as path from 'path';
 
 // src/shared/types.ts
+function channelEventName(serviceName, channelName) {
+  return `channel:${serviceName}:${channelName}`;
+}
 var consoleLogger = {
   info: (message, meta) => console.log(`[INFO] ${message}`, meta ?? ""),
   warn: (message, meta) => console.warn(`[WARN] ${message}`, meta ?? ""),
@@ -16,18 +20,8 @@ var consoleLogger = {
 };
 
 // src/server/utils/zodToAdminFields.ts
-var NON_EDITABLE_FIELDS = /* @__PURE__ */ new Set([
-  "id",
-  "createdAt",
-  "updatedAt",
-  "created_at",
-  "updated_at"
-]);
-var DEFAULT_HIDDEN_FIELDS = /* @__PURE__ */ new Set([
-  "acl",
-  "serviceAccess",
-  "service_access"
-]);
+var NON_EDITABLE_FIELDS = /* @__PURE__ */ new Set(["id", "createdAt", "updatedAt", "created_at", "updated_at"]);
+var DEFAULT_HIDDEN_FIELDS = /* @__PURE__ */ new Set(["acl", "serviceAccess", "service_access"]);
 function toLabel(fieldName) {
   return fieldName.replace(/([a-z])([A-Z])/g, "$1 $2").replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 }
@@ -68,9 +62,7 @@ function getEnumValues(zodType) {
   }
   if (typeName === "ZodNativeEnum") {
     const enumObj = zodType._def.values;
-    return Object.values(enumObj).filter(
-      (v) => typeof v === "string"
-    );
+    return Object.values(enumObj).filter((v) => typeof v === "string");
   }
   return void 0;
 }
@@ -167,13 +159,9 @@ function getDefaultEntityFields() {
 }
 function mergeWithDefaultFields(schemaFields, options = {}) {
   const { includeDefaults = ["id", "createdAt"] } = options;
-  const defaultFields = getDefaultEntityFields().filter(
-    (f) => includeDefaults.includes(f.name)
-  );
+  const defaultFields = getDefaultEntityFields().filter((f) => includeDefaults.includes(f.name));
   const defaultNames = new Set(defaultFields.map((f) => f.name));
-  const filteredSchemaFields = schemaFields.filter(
-    (f) => !defaultNames.has(f.name)
-  );
+  const filteredSchemaFields = schemaFields.filter((f) => !defaultNames.has(f.name));
   return [...defaultFields, ...filteredSchemaFields];
 }
 
@@ -191,6 +179,8 @@ var BaseService = class {
   io = null;
   // Collection of public methods for registry discovery
   publicMethods = /* @__PURE__ */ new Map();
+  // Collection of channels for registry discovery
+  publicChannels = /* @__PURE__ */ new Map();
   // Admin metadata configuration (set by installAdminMethods)
   adminMeta = null;
   constructor(options) {
@@ -258,9 +248,7 @@ var BaseService = class {
     this.subscribers.get(entryId).add(socket);
     const roomName = this.getRoomName(entryId);
     void socket.join(roomName);
-    this.logger.debug(
-      `User ${socket.userId} subscribed to ${entryId} (room: ${roomName})`
-    );
+    this.logger.debug(`User ${socket.userId} subscribed to ${entryId} (room: ${roomName})`);
     const entity = await this.findById(entryId);
     if (!entity) return null;
     return this.filterEntityForSubscriber(entity, socket, entryId);
@@ -303,11 +291,7 @@ var BaseService = class {
         results[entryId] = null;
         continue;
       }
-      results[entryId] = this.filterEntityForSubscriber(
-        entity,
-        socket,
-        entryId
-      );
+      results[entryId] = this.filterEntityForSubscriber(entity, socket, entryId);
     }
     this.logger.debug(
       `User ${socket.userId} batch-subscribed to ${allowedIds.length}/${entryIds.length} entities`
@@ -325,12 +309,7 @@ var BaseService = class {
     const results = /* @__PURE__ */ new Map();
     await Promise.all(
       entryIds.map(async (id) => {
-        const allowed = await this.checkSubscriptionAccess(
-          userId,
-          id,
-          requiredLevel,
-          socket
-        );
+        const allowed = await this.checkSubscriptionAccess(userId, id, requiredLevel, socket);
         results.set(id, allowed);
       })
     );
@@ -344,9 +323,7 @@ var BaseService = class {
    * Default: fetches each entity individually in parallel.
    */
   async findByIds(ids) {
-    const results = await Promise.all(
-      ids.map((id) => this.findById(id))
-    );
+    const results = await Promise.all(ids.map((id) => this.findById(id)));
     return results.filter((e) => e !== null);
   }
   /**
@@ -410,9 +387,37 @@ var BaseService = class {
       return;
     }
     anySocket.to(roomName).emit(eventName, data);
-    this.logger.debug(
-      `Emitted ${eventName} to room ${roomName} (via socket fallback)`
-    );
+    this.logger.debug(`Emitted ${eventName} to room ${roomName} (via socket fallback)`);
+  }
+  /**
+   * Emit a custom event to a room using Socket.io's volatile flag.
+   *
+   * Volatile events are dropped for clients whose connection is backpressured
+   * instead of being buffered — exactly what you want for high-frequency state
+   * that is superseded by the next emit (game snapshots, cursor positions).
+   * Never use this for events a client must not miss.
+   *
+   * Intentionally does no per-call logging: this is a hot path, typically
+   * called at tick rate (10–60Hz).
+   *
+   * @example
+   * ```typescript
+   * // In a 20Hz game loop
+   * this.emitToRoomVolatile(
+   *   this.getRoomName(worldId),
+   *   'game:snapshot',
+   *   snapshot
+   * );
+   * ```
+   */
+  emitToRoomVolatile(roomName, eventName, data) {
+    if (this.io) {
+      this.io.to(roomName).volatile.emit(eventName, data);
+      return;
+    }
+    const anySocket = this.getAnySubscriberSocket();
+    if (!anySocket) return;
+    anySocket.to(roomName).volatile.emit(eventName, data);
   }
   /**
    * Emit a custom event to a specific user's room.
@@ -689,10 +694,7 @@ var BaseService = class {
       schema: options?.schema,
       resolveEntryId: options?.resolveEntryId
     };
-    this.publicMethods.set(
-      name,
-      definition
-    );
+    this.publicMethods.set(name, definition);
     return definition;
   }
   /**
@@ -701,6 +703,78 @@ var BaseService = class {
   getPublicMethods() {
     return Array.from(this.publicMethods.values());
   }
+  // ===========================================================================
+  // Channel Definition (high-frequency, fire-and-forget events)
+  // ===========================================================================
+  /**
+   * Define a channel: a fire-and-forget event for high-frequency traffic
+   * (game input, cursor positions, typing indicators).
+   *
+   * Channels differ from methods:
+   * - No ack, no response — the handler returns void and errors are logged,
+   *   never sent to the client.
+   * - Exempt from the global rate limiter; each channel enforces its own
+   *   per-socket token bucket (`ratePerSecond`/`burst`). Excess messages are
+   *   silently dropped; sustained extreme abuse disconnects the socket.
+   * - Access checks are fully synchronous and in-memory: authentication is
+   *   always required; "Moderate"/"Admin" check the socket's serviceAccess;
+   *   entry-level access is expressed via `requireRoom` (the socket must
+   *   already be in that room, which was ACL-gated at subscribe time).
+   * - `schema` is required — channel payloads are untrusted input arriving
+   *   at tick rate.
+   *
+   * Routes as the Socket.io event `channel:<serviceName>:<name>`.
+   *
+   * @example
+   * ```typescript
+   * this.defineChannel(
+   *   "input",
+   *   "Read",
+   *   (payload, ctx) => this.sim.applyInput(ctx.userId, payload),
+   *   {
+   *     schema: gameInputSchema,
+   *     ratePerSecond: 30,
+   *     requireRoom: () => this.getRoomName(GLOBAL_WORLD_ID),
+   *   },
+   * );
+   * ```
+   */
+  defineChannel(name, access, handler, options) {
+    const ratePerSecond = options.ratePerSecond ?? 30;
+    const definition = {
+      name,
+      access,
+      handler,
+      schema: options.schema,
+      ratePerSecond,
+      burst: options.burst ?? ratePerSecond * 2,
+      requireRoom: options.requireRoom
+    };
+    this.publicChannels.set(name, definition);
+    return definition;
+  }
+  /**
+   * Get all channels for registry discovery.
+   */
+  getPublicChannels() {
+    return Array.from(this.publicChannels.values());
+  }
+  /**
+   * Synchronous, in-memory access check for a channel message.
+   * Called by the registry on the hot path — must not touch the database.
+   * Returns false to silently drop the message.
+   */
+  checkChannelAccess(channel, socket, payload) {
+    if (!socket.userId) return false;
+    if (channel.access !== "Public" && channel.access !== "Read" && !this.hasServiceAccess(socket, channel.access)) {
+      return false;
+    }
+    if (channel.requireRoom) {
+      const roomName = channel.requireRoom(payload);
+      if (roomName && !socket.rooms.has(roomName)) return false;
+    }
+    return true;
+  }
   /**
    * Verify that all expected service methods have been defined via defineMethod().
    * Call at the end of initMethods() to catch missing implementations at boot time.
@@ -725,9 +799,7 @@ var BaseService = class {
       }
     }
     if (missing.length > 0) {
-      throw new Error(
-        `${this.serviceName}: Missing method implementations: ${missing.join(", ")}`
-      );
+      throw new Error(`${this.serviceName}: Missing method implementations: ${missing.join(", ")}`);
     }
   }
   // ===========================================================================
@@ -758,15 +830,7 @@ var BaseService = class {
    * ```
    */
   installAdminMethods(options) {
-    const {
-      expose,
-      access,
-      schema,
-      displayName,
-      tableColumns,
-      hiddenFields,
-      fieldOverrides
-    } = options;
+    const { expose, access, schema, displayName, tableColumns, hiddenFields, fieldOverrides } = options;
     if (schema) {
       const schemaFields = zodToAdminFields(schema, {
         hiddenFields,
@@ -820,9 +884,7 @@ var BaseService = class {
         name: "adminCreate",
         access: access.create,
         handler: async (payload, _context) => {
-          return await this.adminCreate(
-            payload.data
-          );
+          return await this.adminCreate(payload.data);
         }
       });
     }
@@ -862,9 +924,7 @@ var BaseService = class {
         name: "adminGetSubscribers",
         access: access.getSubscribers,
         handler: async (payload, _context) => {
-          return this.adminGetSubscribers(
-            payload.entryId
-          );
+          return this.adminGetSubscribers(payload.entryId);
         },
         resolveEntryId: (payload) => payload.entryId
       });
@@ -874,9 +934,7 @@ var BaseService = class {
         name: "adminReemit",
         access: access.reemit,
         handler: async (payload, _context) => {
-          return await this.adminReemit(
-            payload.entryId
-          );
+          return await this.adminReemit(payload.entryId);
         },
         resolveEntryId: (payload) => payload.entryId
       });
@@ -886,16 +944,12 @@ var BaseService = class {
         name: "adminUnsubscribeAll",
         access: access.unsubscribeAll,
         handler: async (payload, _context) => {
-          return this.adminUnsubscribeAll(
-            payload.entryId
-          );
+          return this.adminUnsubscribeAll(payload.entryId);
         },
         resolveEntryId: (payload) => payload.entryId
       });
     }
-    const installedMethods = Object.keys(expose).filter(
-      (k) => expose[k]
-    );
+    const installedMethods = Object.keys(expose).filter((k) => expose[k]);
     if (shouldExposeMeta) installedMethods.push("meta");
     this.logger.info(`Installed admin methods: ${installedMethods.join(", ")}`);
   }
@@ -1047,6 +1101,8 @@ var BaseService = class {
 };
 
 // src/server/ServiceRegistry.ts
+var CHANNEL_ABUSE_WINDOW_MS = 1e4;
+var CHANNEL_ABUSE_MULTIPLIER = 100;
 var ServiceRegistry = class {
   io;
   services = /* @__PURE__ */ new Map();
@@ -1057,6 +1113,8 @@ var ServiceRegistry = class {
   connectionHandlerInstalled = false;
   // Store method metadata for deferred registration
   methodRegistry = /* @__PURE__ */ new Map();
+  // Store channel metadata for deferred registration
+  channelRegistry = /* @__PURE__ */ new Map();
   constructor(io, options) {
     this.io = io;
     this.logger = options?.logger?.child({ service: "ServiceRegistry" }) ?? consoleLogger.child({ service: "ServiceRegistry" });
@@ -1090,22 +1148,13 @@ var ServiceRegistry = class {
     for (const [eventName, { method, service }] of this.methodRegistry) {
       this.registerMethodListener(socket, eventName, method, service);
     }
+    for (const [eventName, { channel, service }] of this.channelRegistry) {
+      this.registerChannelListener(socket, eventName, channel, service);
+    }
     for (const [serviceName, service] of this.services) {
-      this.registerSubscriptionListener(
-        socket,
-        `${serviceName}:subscribe`,
-        service
-      );
-      this.registerBatchSubscriptionListener(
-        socket,
-        `${serviceName}:batchSubscribe`,
-        service
-      );
-      this.registerUnsubscriptionListener(
-        socket,
-        `${serviceName}:unsubscribe`,
-        service
-      );
+      this.registerSubscriptionListener(socket, `${serviceName}:subscribe`, service);
+      this.registerBatchSubscriptionListener(socket, `${serviceName}:batchSubscribe`, service);
+      this.registerUnsubscriptionListener(socket, `${serviceName}:unsubscribe`, service);
     }
   }
   /**
@@ -1118,6 +1167,7 @@ var ServiceRegistry = class {
     }
     this.logger.info(`Registered service: ${serviceName}`);
     this.discoverServiceMethods(serviceName, service);
+    this.discoverServiceChannels(serviceName, service);
     this.installConnectionHandler();
   }
   /**
@@ -1135,6 +1185,77 @@ var ServiceRegistry = class {
       });
     }
   }
+  /**
+   * Discover and store all channels from a service.
+   */
+  discoverServiceChannels(serviceName, service) {
+    const channels = service.getPublicChannels?.() ?? [];
+    for (const channel of channels) {
+      const eventName = channelEventName(serviceName, channel.name);
+      this.logger.info(
+        `Registering channel event: ${eventName} (${channel.ratePerSecond}/s, burst ${channel.burst})`
+      );
+      this.channelRegistry.set(eventName, {
+        serviceName,
+        channel,
+        service
+      });
+    }
+  }
+  /**
+   * Register a channel as a socket event listener.
+   *
+   * This is the hot path for high-frequency traffic: no ack, no async access
+   * checks, no per-message logging. Order of operations per message:
+   * token bucket → schema validation → in-memory access check → handler.
+   * Any failure silently drops the message; sustained extreme flooding
+   * disconnects the socket.
+   */
+  registerChannelListener(socket, eventName, channel, service) {
+    let tokens = channel.burst;
+    let lastRefillAt = Date.now();
+    let abuseWindowStart = lastRefillAt;
+    let droppedInWindow = 0;
+    socket.on(eventName, (payload) => {
+      const now = Date.now();
+      tokens = Math.min(
+        channel.burst,
+        tokens + (now - lastRefillAt) / 1e3 * channel.ratePerSecond
+      );
+      lastRefillAt = now;
+      if (tokens < 1) {
+        if (now - abuseWindowStart > CHANNEL_ABUSE_WINDOW_MS) {
+          abuseWindowStart = now;
+          droppedInWindow = 0;
+        }
+        droppedInWindow++;
+        if (droppedInWindow > channel.ratePerSecond * CHANNEL_ABUSE_MULTIPLIER) {
+          this.logger.warn(
+            `Disconnecting socket ${socket.id} for sustained channel flooding on ${eventName}`,
+            { userId: socket.userId, droppedInWindow }
+          );
+          socket.disconnect(true);
+        }
+        return;
+      }
+      tokens -= 1;
+      const parsed = channel.schema.safeParse(payload);
+      if (!parsed.success) return;
+      if (!service.checkChannelAccess?.(channel, socket, parsed.data)) return;
+      try {
+        channel.handler(parsed.data, {
+          userId: socket.userId,
+          socketId: socket.id,
+          serviceAccess: socket.serviceAccess ?? {}
+        });
+      } catch (error) {
+        this.logger.error(`Channel handler error for ${eventName}`, {
+          userId: socket.userId,
+          error: error instanceof Error ? error.message : "Unknown error"
+        });
+      }
+    });
+  }
   /**
    * Register a method as a socket event listener.
    */
@@ -1238,10 +1359,7 @@ var ServiceRegistry = class {
           if (this.logPayloads) {
             logContext.payload = payload;
           }
-          this.logger.error(
-            `User ${userIdShort} ${serviceName}.${methodName} -> fail`,
-            logContext
-          );
+          this.logger.error(`User ${userIdShort} ${serviceName}.${methodName} -> fail`, logContext);
           const errorResponse = {
             success: false,
             error: error instanceof Error ? error.message : "Internal error",
@@ -1437,9 +1555,7 @@ function createQuickdrawServer(options) {
   });
   httpServer.listen(options.port, "0.0.0.0", () => {
     serverLogger.info(`Server listening on port ${options.port}`);
-    serverLogger.info(
-      `Registered services: ${registry.getServices().join(", ")}`
-    );
+    serverLogger.info(`Registered services: ${registry.getServices().join(", ")}`);
   });
   const shutdown = async (signal) => {
     serverLogger.info(`Received ${signal}, starting graceful shutdown...`);
@@ -1475,13 +1591,7 @@ function createQuickdrawServer(options) {
 // src/server/redis.ts
 async function setupRedisAdapter(io, options = {}) {
   const logger = options.logger?.child({ service: "RedisAdapter" }) ?? consoleLogger.child({ service: "RedisAdapter" });
-  const {
-    host = "localhost",
-    port = 6379,
-    password,
-    db = 0,
-    keyPrefix = "socket.io"
-  } = options;
+  const { host = "localhost", port = 6379, password, db = 0, keyPrefix = "socket.io" } = options;
   try {
     const dynamicImport = new Function("specifier", "return import(specifier)");
     const [redisAdapterModule, redisModule] = await Promise.all([
@@ -1497,7 +1607,9 @@ async function setupRedisAdapter(io, options = {}) {
     });
     const subClient = pubClient.duplicate();
     await Promise.all([pubClient.connect(), subClient.connect()]);
-    io.adapter(createAdapter(pubClient, subClient, { key: keyPrefix }));
+    io.adapter(
+      createAdapter(pubClient, subClient, { key: keyPrefix })
+    );
     logger.info(`Redis adapter connected to ${host}:${port}`);
     const cleanup = async () => {
       try {
@@ -1529,10 +1641,7 @@ async function setupRedisAdapter(io, options = {}) {
 async function isRedisAdapterAvailable() {
   try {
     const dynamicImport = new Function("specifier", "return import(specifier)");
-    await Promise.all([
-      dynamicImport("@socket.io/redis-adapter"),
-      dynamicImport("redis")
-    ]);
+    await Promise.all([dynamicImport("@socket.io/redis-adapter"), dynamicImport("redis")]);
     return true;
   } catch {
     return false;
@@ -1541,11 +1650,7 @@ async function isRedisAdapterAvailable() {
 
 // src/server/rateLimit.ts
 function createRateLimiter(options = {}) {
-  const {
-    windowMs = 6e4,
-    maxRequests = 100,
-    excludeEvents = []
-  } = options;
+  const { windowMs = 6e4, maxRequests = 100, excludeEvents = [], excludePrefixes = [] } = options;
   const entries = /* @__PURE__ */ new Map();
   const cleanupInterval = setInterval(() => {
     const now = Date.now();
@@ -1597,7 +1702,8 @@ function createRateLimiter(options = {}) {
     options: {
       windowMs,
       maxRequests,
-      excludeEvents
+      excludeEvents,
+      excludePrefixes
     }
   };
 }
@@ -1611,13 +1717,17 @@ function applyRateLimitMiddleware(io, rateLimiter, options = {}) {
       retryAfter: rateLimiter.getResetTime(keyGenerator(socket, eventName))
     });
   });
-  const { excludeEvents } = rateLimiter.options;
+  const { excludeEvents, excludePrefixes } = rateLimiter.options;
   io.on("connection", (socket) => {
     socket.use(([eventName, ...args], next) => {
       if (excludeEvents.includes(eventName)) {
         next();
         return;
       }
+      if (excludePrefixes.some((prefix) => eventName.startsWith(prefix))) {
+        next();
+        return;
+      }
       if (eventName.startsWith("$")) {
         next();
         return;
@@ -1769,6 +1879,13 @@ var discordProvider = {
     };
   }
 };
+function getDiscordAvatarUrl(user) {
+  if (user.avatar) {
+    return `https://cdn.discordapp.com/avatars/${user.id}/${user.avatar}.png`;
+  }
+  const index = user.discriminator !== "0" ? parseInt(user.discriminator, 10) % 5 : (BigInt(user.id) >> BigInt(22)) % BigInt(6);
+  return `https://cdn.discordapp.com/embed/avatars/${index}.png`;
+}
 
 // src/server/auth/google.ts
 var googleProvider = {
@@ -1789,6 +1906,306 @@ var googleProvider = {
   }
 };
 
+// src/server/auth/validateOrigin.ts
+var OAUTH_RETURN_ORIGIN_COOKIE = "oauth_return_origin";
+var CODESPACE_REGEX = /^https:\/\/[a-z0-9-]+-[a-z0-9-]+-\d+\.app\.github\.dev$/;
+var LOCALHOST_REGEX = /^http:\/\/localhost:\d+$/;
+function envExtraOrigins() {
+  const raw = process.env.EXTRA_ALLOWED_ORIGINS;
+  if (!raw) return [];
+  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function validateRedirectOrigin(origin, options = {}) {
+  if (!origin) return null;
+  const clientUrl = options.clientUrl ?? process.env.CLIENT_URL;
+  let parsedOrigin;
+  try {
+    parsedOrigin = new URL(origin);
+  } catch {
+    return null;
+  }
+  const cleanOrigin = parsedOrigin.origin;
+  if (clientUrl && cleanOrigin === clientUrl) {
+    return cleanOrigin;
+  }
+  const extra = options.extraAllowedOrigins ?? envExtraOrigins();
+  if (extra.includes(cleanOrigin)) {
+    return cleanOrigin;
+  }
+  if (options.allowedPatterns?.some((pattern) => pattern.test(cleanOrigin))) {
+    return cleanOrigin;
+  }
+  if ((options.allowCodespaces ?? true) && CODESPACE_REGEX.test(cleanOrigin)) {
+    return cleanOrigin;
+  }
+  if ((options.allowLocalhostInDev ?? true) && process.env.NODE_ENV !== "production" && LOCALHOST_REGEX.test(cleanOrigin)) {
+    return cleanOrigin;
+  }
+  return null;
+}
+
+// src/server/auth/mock.ts
+var DEFAULT_MOCK_PATH_PREFIX = "/auth/mock/provider";
+var CODE_TTL_MS = 5 * 60 * 1e3;
+var TOKEN_TTL_MS = 60 * 60 * 1e3;
+var DEV_PRIVATE_ORIGIN_REGEX = /^http:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}):\d+$/;
+function isMockOAuthEnabled() {
+  return process.env.ENABLE_MOCK_OAUTH === "true" && process.env.NODE_ENV !== "production";
+}
+function createMockOAuthProvider(apiBaseUrl, options = {}) {
+  const prefix = options.pathPrefix ?? DEFAULT_MOCK_PATH_PREFIX;
+  const publicBase = apiBaseUrl.replace(/\/$/, "");
+  const internalBase = (options.internalBaseUrl ?? apiBaseUrl).replace(/\/$/, "");
+  return {
+    name: "mock",
+    authorizationUrl: `${publicBase}${prefix}/authorize`,
+    tokenUrl: `${internalBase}${prefix}/token`,
+    userInfoUrl: `${internalBase}${prefix}/userinfo`,
+    scopes: ["openid", "email", "profile"],
+    parseUserInfo: (data) => {
+      const d = data;
+      return {
+        id: String(d.id),
+        email: String(d.email),
+        name: String(d.name),
+        picture: d.picture ? String(d.picture) : null,
+        verified_email: true
+      };
+    }
+  };
+}
+function getQueryParam(req, name) {
+  const fromQuery = req.query?.[name];
+  if (typeof fromQuery === "string") return fromQuery;
+  const url = req.originalUrl ?? req.url;
+  if (!url) return null;
+  const idx = url.indexOf("?");
+  if (idx === -1) return null;
+  return new URLSearchParams(url.slice(idx + 1)).get(name);
+}
+async function readBodyParams(req) {
+  if (typeof req.body === "string") return new URLSearchParams(req.body);
+  if (req.body && typeof req.body === "object" && Object.keys(req.body).length > 0) {
+    return new URLSearchParams(req.body);
+  }
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return new URLSearchParams(Buffer.concat(chunks).toString("utf8"));
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function isAllowedRedirectUri(uri, allowedOrigins) {
+  let parsed;
+  try {
+    parsed = new URL(uri);
+  } catch {
+    return false;
+  }
+  const origin = parsed.origin;
+  if (allowedOrigins.includes(origin)) return true;
+  if (DEV_PRIVATE_ORIGIN_REGEX.test(origin)) return true;
+  return validateRedirectOrigin(origin) !== null;
+}
+function renderPickerPage(users, authorizePath, redirectUri, state) {
+  const links = users.map((user) => {
+    const params = new URLSearchParams({ redirect_uri: redirectUri, email: user.email });
+    if (state) params.set("state", state);
+    const href = `${authorizePath}?${params.toString()}`;
+    return `<li><a href="${escapeHtml(href)}"><strong>${escapeHtml(user.name)}</strong><span>${escapeHtml(user.email)}</span></a></li>`;
+  }).join("\n");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Mock sign-in</title>
+<style>
+  body { font-family: system-ui, sans-serif; background: #111; color: #eee; display: flex; min-height: 100vh; align-items: center; justify-content: center; margin: 0; }
+  main { max-width: 420px; width: 100%; padding: 2rem; }
+  h1 { font-size: 1.25rem; }
+  p { color: #999; font-size: 0.875rem; }
+  ul { list-style: none; padding: 0; display: flex; flex-direction: column; gap: 0.5rem; }
+  a { display: flex; flex-direction: column; gap: 0.125rem; padding: 0.75rem 1rem; border: 1px solid #333; border-radius: 8px; text-decoration: none; color: inherit; }
+  a:hover { border-color: #888; background: #1a1a1a; }
+  a span { color: #999; font-size: 0.8125rem; }
+</style>
+</head>
+<body>
+<main>
+<h1>Mock sign-in</h1>
+<p>Development only \u2014 pick an account to continue. Run your seed script if this list is empty.</p>
+<ul>
+${links || "<li><em>No users found.</em></li>"}
+</ul>
+</main>
+</body>
+</html>`;
+}
+function registerMockOAuthProvider(router, options) {
+  const logger = options.logger ?? consoleLogger;
+  if (!isMockOAuthEnabled()) {
+    if (process.env.ENABLE_MOCK_OAUTH === "true") {
+      logger.error("Mock OAuth is enabled but NODE_ENV is production \u2014 refusing to mount routes");
+    }
+    return false;
+  }
+  const prefix = options.pathPrefix ?? DEFAULT_MOCK_PATH_PREFIX;
+  const allowedOrigins = options.allowedRedirectOrigins ?? [];
+  const codes = /* @__PURE__ */ new Map();
+  const tokens = /* @__PURE__ */ new Map();
+  function sweep(store) {
+    const now = Date.now();
+    for (const [key, entry] of store) {
+      if (entry.expiresAt < now) store.delete(key);
+    }
+  }
+  function guard(res) {
+    if (process.env.NODE_ENV === "production") {
+      res.status(404).json({ error: "Not found" });
+      return false;
+    }
+    return true;
+  }
+  router.get(`${prefix}/authorize`, async (req, res) => {
+    if (!guard(res)) return;
+    const redirectUri = getQueryParam(req, "redirect_uri");
+    const state = getQueryParam(req, "state");
+    const email = getQueryParam(req, "email");
+    if (!redirectUri || !isAllowedRedirectUri(redirectUri, allowedOrigins)) {
+      res.status(400).json({ error: "Invalid redirect_uri" });
+      return;
+    }
+    const users = await options.listUsers();
+    if (!email) {
+      res.status(200).send(renderPickerPage(users, `${prefix}/authorize`, redirectUri, state));
+      return;
+    }
+    const user = users.find((u) => u.email === email);
+    if (!user) {
+      res.status(400).json({ error: "Unknown mock user" });
+      return;
+    }
+    sweep(codes);
+    const code = randomBytes(24).toString("hex");
+    codes.set(code, { email: user.email, expiresAt: Date.now() + CODE_TTL_MS });
+    const params = new URLSearchParams({ code });
+    if (state) params.set("state", state);
+    res.redirect(`${redirectUri}${redirectUri.includes("?") ? "&" : "?"}${params.toString()}`);
+  });
+  router.post(`${prefix}/token`, async (req, res) => {
+    if (!guard(res)) return;
+    const body = await readBodyParams(req);
+    const code = body.get("code");
+    const entry = code ? codes.get(code) : void 0;
+    if (code) codes.delete(code);
+    if (!entry || entry.expiresAt < Date.now()) {
+      res.status(400).json({ error: "invalid_grant" });
+      return;
+    }
+    sweep(tokens);
+    const accessToken = randomBytes(24).toString("hex");
+    tokens.set(accessToken, { email: entry.email, expiresAt: Date.now() + TOKEN_TTL_MS });
+    res.status(200).json({
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: Math.floor(TOKEN_TTL_MS / 1e3),
+      scope: "openid email profile"
+    });
+  });
+  router.get(`${prefix}/userinfo`, async (req, res) => {
+    if (!guard(res)) return;
+    const auth = req.headers.authorization;
+    const accessToken = typeof auth === "string" && auth.startsWith("Bearer ") ? auth.slice(7) : null;
+    const entry = accessToken ? tokens.get(accessToken) : void 0;
+    if (!entry || entry.expiresAt < Date.now()) {
+      res.status(401).json({ error: "invalid_token" });
+      return;
+    }
+    const users = await options.listUsers();
+    const user = users.find((u) => u.email === entry.email);
+    if (!user) {
+      res.status(401).json({ error: "invalid_token" });
+      return;
+    }
+    res.status(200).json({
+      // providerAccountId = email: stable across re-seeds, unlike row ids.
+      id: user.email,
+      email: user.email,
+      name: user.name,
+      picture: user.picture ?? null,
+      verified_email: true
+    });
+  });
+  logger.info(`Mock OAuth provider mounted at ${prefix} (development only)`);
+  return true;
+}
+
+// src/server/auth/sessionCookie.ts
+var SESSION_COOKIE = "session";
+var DEFAULT_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
+function cookieOptions(options) {
+  const isProd = process.env.NODE_ENV === "production";
+  const domain = options.domain ?? process.env.COOKIE_DOMAIN;
+  return {
+    httpOnly: true,
+    secure: isProd,
+    // SameSite=None (with Secure) lets the session cookie ride cross-site
+    // fetches, so a secondary web origin can hit the primary API host. The
+    // CORS allowlist (validateRedirectOrigin) is the actual origin gate. Dev
+    // keeps Lax — localhost is http-only and SameSite=None requires Secure.
+    sameSite: isProd ? "none" : "lax",
+    path: "/",
+    ...domain && { domain }
+  };
+}
+function setSessionCookie(res, jwt, options = {}) {
+  res.cookie(options.cookieName ?? SESSION_COOKIE, jwt, {
+    ...cookieOptions(options),
+    maxAge: options.maxAgeMs ?? DEFAULT_MAX_AGE_MS
+  });
+}
+function clearSessionCookie(res, options = {}) {
+  res.clearCookie(options.cookieName ?? SESSION_COOKIE, cookieOptions(options));
+}
+
+// src/server/auth/restMiddleware.ts
+function extractBearerOrCookieToken(req, cookieName = SESSION_COOKIE) {
+  const cookieToken = req.cookies?.[cookieName];
+  if (cookieToken) return cookieToken;
+  const authHeader = req.headers.authorization;
+  if (authHeader?.startsWith("Bearer ")) return authHeader.slice(7);
+  return null;
+}
+function createRequireAuth(options) {
+  return async (req, res, next) => {
+    const token = extractBearerOrCookieToken(req, options.cookieName);
+    if (!token) {
+      res.status(401).json({ error: "Missing or invalid authorization" });
+      return;
+    }
+    const secret = options.jwtSecret ?? process.env.JWT_SECRET;
+    if (!secret) {
+      res.status(401).json({ error: "Authentication is not configured" });
+      return;
+    }
+    const payload = await verifyJWT(token, secret);
+    if (!payload?.userId) {
+      res.status(401).json({ error: "Invalid or expired token" });
+      return;
+    }
+    const session = await options.getSession(token);
+    if (!session || session.expiresAt < /* @__PURE__ */ new Date()) {
+      res.status(401).json({ error: "Session expired or revoked" });
+      return;
+    }
+    req.userId = payload.userId;
+    next();
+  };
+}
+
 // src/server/utils/env.ts
 function validateEnv(options) {
   const result = checkEnv(options);
@@ -1797,7 +2214,11 @@ function validateEnv(options) {
   }
 }
 function checkEnv(options) {
-  const { required, productionOnly = true, errorPrefix = "Missing required environment variables" } = options;
+  const {
+    required,
+    productionOnly = true,
+    errorPrefix = "Missing required environment variables"
+  } = options;
   if (productionOnly && process.env.NODE_ENV !== "production") {
     return { success: true, missing: [] };
   }
@@ -1827,6 +2248,54 @@ function requireEnv(name, defaultValue) {
   }
   return value;
 }
+var ALGORITHM = "aes-256-gcm";
+var IV_LENGTH = 12;
+var AUTH_TAG_LENGTH = 16;
+function getKey() {
+  const hex = process.env.ENCRYPTION_KEY;
+  if (!hex || hex.length !== 64) {
+    throw new Error(
+      "ENCRYPTION_KEY must be set as a 64-character hex string (32 bytes). Check your environment configuration."
+    );
+  }
+  return Buffer.from(hex, "hex");
+}
+function encrypt(plaintext) {
+  const key = getKey();
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted.toString("hex")}`;
+}
+function decrypt(ciphertext) {
+  const key = getKey();
+  const [ivHex, authTagHex, encryptedHex] = ciphertext.split(":");
+  if (!ivHex || !authTagHex || !encryptedHex) {
+    throw new Error("Invalid ciphertext format");
+  }
+  const iv = Buffer.from(ivHex, "hex");
+  const authTag = Buffer.from(authTagHex, "hex");
+  const encrypted = Buffer.from(encryptedHex, "hex");
+  const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+  decipher.setAuthTag(authTag);
+  return decipher.update(encrypted) + decipher.final("utf8");
+}
+function isEncrypted(value) {
+  const parts = value.split(":");
+  return parts.length === 3 && parts.every((p) => /^[0-9a-f]+$/.test(p));
+}
+function decryptIfEncrypted(value) {
+  return isEncrypted(value) ? decrypt(value) : value;
+}
+function tryDecrypt(ciphertext, logger = consoleLogger) {
+  try {
+    return decryptIfEncrypted(ciphertext);
+  } catch {
+    logger.warn("Failed to decrypt stored token \u2014 likely stale or re-keyed");
+    return null;
+  }
+}
 
 // src/server/mcp/McpRegistry.ts
 var McpRegistry = class {
@@ -1863,7 +2332,9 @@ var McpRegistry = class {
   listTools(options) {
     const hasDefaultUser = !!options?.defaultUserId;
     if (this.customToolSpecs) {
-      return this.customToolSpecs.filter((s) => this.services.has(s.name)).map((svc) => this.buildToolDefinition(svc.name, svc.description, svc.methodNames, hasDefaultUser));
+      return this.customToolSpecs.filter((s) => this.services.has(s.name)).map(
+        (svc) => this.buildToolDefinition(svc.name, svc.description, svc.methodNames, hasDefaultUser)
+      );
     }
     const tools = [];
     for (const [serviceName] of this.services) {
@@ -1898,11 +2369,7 @@ var McpRegistry = class {
     const startTime = Date.now();
     try {
       const validatedPayload = this.validatePayload(method, payload);
-      await instance.ensureAccessForMethod(
-        method.access,
-        ctx,
-        entryId
-      );
+      await instance.ensureAccessForMethod(method.access, ctx, entryId);
       const result = await method.handler(validatedPayload, {
         userId,
         socketId: ctx.id,
@@ -1954,9 +2421,7 @@ var McpRegistry = class {
     if (method.schema) {
       const result = method.schema.safeParse(payload);
       if (!result.success) {
-        throw new Error(
-          `Validation error: ${result.error?.message ?? "invalid payload"}`
-        );
+        throw new Error(`Validation error: ${result.error?.message ?? "invalid payload"}`);
       }
       return result.data;
     }
@@ -2053,12 +2518,7 @@ function createMcpStdioServer(options) {
           }
           const userId = args?.userId ?? defaultUserId ?? process.env.MCP_USER_ID ?? "mcp-anonymous";
           const payload = args?.payload;
-          const result = await registry.invoke(
-            serviceName,
-            methodName,
-            payload,
-            userId
-          );
+          const result = await registry.invoke(serviceName, methodName, payload, userId);
           return {
             jsonrpc: "2.0",
             id,
@@ -2181,12 +2641,7 @@ function createMcpRoutes(router, options) {
         res.status(400).json({ error: "Missing service or method" });
         return;
       }
-      const result = await registry.invoke(
-        service,
-        method,
-        toolPayload,
-        tokenPayload.userId
-      );
+      const result = await registry.invoke(service, method, toolPayload, tokenPayload.userId);
       res.json({ success: true, data: result });
     } catch (error) {
       const message = error instanceof Error ? error.message : "Internal error";
@@ -2464,10 +2919,7 @@ function generateToolMetadata(options) {
     allServices.push(serviceInfo);
     if (docsOutputDir) {
       const doc = generateServiceDoc(serviceInfo);
-      const outputPath = path.join(
-        docsOutputDir,
-        `${serviceInfo.className}.md`
-      );
+      const outputPath = path.join(docsOutputDir, `${serviceInfo.className}.md`);
       fs.writeFileSync(outputPath, doc);
     }
   }
@@ -2488,15 +2940,12 @@ Auto-generated documentation for all services.
   }
   const toolsContent = generateToolsFileContent(allServices);
   fs.writeFileSync(toolsOutputPath, toolsContent);
-  const totalMethods = allServices.reduce(
-    (sum, s) => sum + s.methods.length,
-    0
-  );
+  const totalMethods = allServices.reduce((sum, s) => sum + s.methods.length, 0);
   console.log(
     `Generated ${allServices.length} service tools (${totalMethods} methods) -> ${toolsOutputPath}`
   );
 }
 
-export { BaseService, McpRegistry, ServiceRegistry, applyRateLimitMiddleware, bootstrapMcpServer, checkEnv, createJWT, createMcpRoutes, createMcpStdioServer, createOAuthURL, createQuickdrawServer, createRateLimiter, createTieredRateLimiter, discordProvider, exchangeOAuthCode, generateToolMetadata, getDefaultEntityFields, googleProvider, isRedisAdapterAvailable, mergeWithDefaultFields, requireEnv, setupRedisAdapter, validateEnv, verifyJWT, zodToAdminFields };
+export { BaseService, DEFAULT_MOCK_PATH_PREFIX, McpRegistry, OAUTH_RETURN_ORIGIN_COOKIE, SESSION_COOKIE, ServiceRegistry, applyRateLimitMiddleware, bootstrapMcpServer, checkEnv, clearSessionCookie, createJWT, createMcpRoutes, createMcpStdioServer, createMockOAuthProvider, createOAuthURL, createQuickdrawServer, createRateLimiter, createRequireAuth, createTieredRateLimiter, decrypt, decryptIfEncrypted, discordProvider, encrypt, exchangeOAuthCode, extractBearerOrCookieToken, generateToolMetadata, getDefaultEntityFields, getDiscordAvatarUrl, googleProvider, isEncrypted, isMockOAuthEnabled, isRedisAdapterAvailable, mergeWithDefaultFields, registerMockOAuthProvider, requireEnv, setSessionCookie, setupRedisAdapter, tryDecrypt, validateEnv, validateRedirectOrigin, verifyJWT, zodToAdminFields };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map