@irtio/protocol 0.2.0 → 0.4.0

package/dist/index.d.ts

@@ -257,19 +257,31 @@ declare function deltaPayload(codecBytes: Uint8Array): Uint8Array;
 declare function writePayload(codecBytes: Uint8Array): Uint8Array;
 /**
  * The CORRECT frame payload: the schema-codec delta bytes with the judged client write tick
- * (u32) appended (week 8, D19). Additive: the codec's delta decoder never reads past the delta
- * body, so a decoder that does not know about the suffix ignores it; a reader that does
- * (`decodeDeltaFrom`) is left positioned exactly at it.
+ * (u32) appended (week 8, D19), and after it the server tick that write was *applied* at (u32,
+ * bug 1). Additive in both steps: the codec's delta decoder never reads past the delta body, so
+ * a decoder that does not know about a suffix ignores it; a reader that does (`decodeDeltaFrom`)
+ * is left positioned exactly at the first one.
+ *
+ * The two ticks are on different clocks and that is the point. `clientTick` is the client's own
+ * stamp, opaque to the server and echoed verbatim; `appliedTick` is the room's tick counter when
+ * the write landed. A predicting client stamps on its *predicted* clock, which leads authority,
+ * so without the second number it has no way to learn where on the server's clock its intent
+ * actually took effect, and its replay puts it a whole prediction lead too late.
  */
-declare function correctPayload(codecBytes: Uint8Array, clientTick: number): Uint8Array;
+declare function correctPayload(codecBytes: Uint8Array, clientTick: number, appliedTick?: number): Uint8Array;
 /**
  * Reads the `clientTick` suffix a reader is positioned at after `decodeDeltaFrom`, or
  * `undefined` for a pre-week-8 CORRECT payload with no suffix.
  */
 declare function readCorrectClientTick(r: ByteReader): number | undefined;
+/**
+ * Reads the `appliedTick` suffix that follows `clientTick`, or `undefined` from a server that
+ * does not send one. Call only after `readCorrectClientTick`, which leaves the reader on it.
+ */
+declare function readCorrectAppliedTick(r: ByteReader): number | undefined;
 declare function encodeDeltaFrame(codecBytes: Uint8Array): Uint8Array;
 declare function encodeWriteFrame(codecBytes: Uint8Array): Uint8Array;
-declare function encodeCorrectFrame(codecBytes: Uint8Array, clientTick: number): Uint8Array;
+declare function encodeCorrectFrame(codecBytes: Uint8Array, clientTick: number, appliedTick?: number): Uint8Array;
 
 interface Call {
     readonly reqId: number;
@@ -372,4 +384,52 @@ declare const relaySchema: Schema<{
 declare const RELAY_HASH8: Uint8Array;
 declare function isRelayHash8(hash8: Uint8Array): boolean;
 
-export { type Call, type ClientCallable, type Credential, ERROR_CATALOGUE, type ErrorCatalogueEntry, ErrorCode, type ErrorCodeDef, type ErrorCodeName, type ErrorPayload, type Frame, FrameType, type Hello, type Msg, type MsgTarget, PRESENCE_COLLECTION, PROTOCOL_VERSION, type Ping, type Pong, type PresenceRecord, RELAY_HASH8, type Reply, type Welcome, builtinRpcs, correctPayload, decodeCall, decodeErrorPayload, decodeFrame, decodeHello, decodeMsg, decodePing, decodePong, decodeReply, decodeWelcome, deltaPayload, encodeCall, encodeCorrectFrame, encodeDeltaFrame, encodeErrorPayload, encodeFrame, encodeHello, encodeMsg, encodePing, encodePong, encodeReply, encodeWelcome, encodeWriteFrame, errorByCode, formatError, isFrameType, isRelayHash8, presenceEntity, readCorrectClientTick, relaySchema, requestOwnership, rpcByIdOf, rpcIdOf, rpcTable, withBuiltins, writePayload };
+/**
+ * Browser-origin policy, shared by every component that has to answer "may this page connect?"
+ *
+ * Three components ask that question about the same project and must answer it identically: the
+ * router (from the control plane's fresh list), the guest supervisor (from the list frozen into
+ * its boot env), and `irtio dev` (from `IRT_ORIGINS`). It lived only in the supervisor until the
+ * router was given the list it had been fetching and discarding, at which point one copy of the
+ * rules became the only honest arrangement.
+ *
+ * The rules, in the order they are applied:
+ *
+ *   1. No `Origin` header at all — bots, native clients, tests, `curl` — is NOT a browser and is
+ *      allowed unless the caller opts out. Origin locking is a same-origin-policy backstop; it
+ *      protects a browser user from a page they did not open, and there is no such user here.
+ *   2. `*` in the list allows every origin.
+ *   3. Localhost is ALWAYS allowed, on any port and any scheme. A project's list starts blank,
+ *      and a developer running `vite dev` against hosted rooms must not have to register a port
+ *      number before anything works. Nothing is protected by refusing it: an attacker who can
+ *      serve the victim a page from their own machine has already won.
+ *   4. Otherwise the origin must appear in the list verbatim.
+ */
+/**
+ * Is `origin` a page served from the connecting developer's own machine?
+ *
+ * Matches on the HOSTNAME only, so every port passes — a dev server's port is an implementation
+ * detail that changes per tool and per run. `*.localhost` (which resolves to loopback in every
+ * current browser) counts too. A `file://` page sends the literal `null`, which does not parse
+ * as a URL and is therefore not local: it is indistinguishable from a sandboxed iframe on a
+ * hostile site, and lumping the two together would silently widen rule 3 to the open internet.
+ */
+declare function isLocalhostOrigin(origin: string): boolean;
+/**
+ * `origins: ['*']` allows every browser origin; an empty list allows only localhost. A missing
+ * `Origin` (bots, native clients, tests) is allowed unless `allowNoOrigin` is explicitly `false`.
+ */
+declare function originAllowed(origins: readonly string[], allowNoOrigin: boolean, origin: string | undefined): boolean;
+/**
+ * Splits an `IRT_ORIGINS`-shaped value into a list. The distinction that matters is UNSET vs
+ * EMPTY, and it is the caller's to make: unset means "no policy configured, allow everything"
+ * (`['*']`, what a hand-run supervisor and every pre-blank-default deployment expect), while an
+ * empty string means "a policy IS configured and it lists nothing" — localhost only.
+ *
+ * Getting that backwards fails OPEN, which is why it is one function with one test rather than a
+ * `?? '*'` at each call site. `deploy/host/rootfs/tenant-init` has the same trap in shell:
+ * `${IRT_ORIGINS:-*}` treats empty as unset, `${IRT_ORIGINS-*}` does not.
+ */
+declare function parseOriginList(raw: string | undefined): readonly string[];
+
+export { type Call, type ClientCallable, type Credential, ERROR_CATALOGUE, type ErrorCatalogueEntry, ErrorCode, type ErrorCodeDef, type ErrorCodeName, type ErrorPayload, type Frame, FrameType, type Hello, type Msg, type MsgTarget, PRESENCE_COLLECTION, PROTOCOL_VERSION, type Ping, type Pong, type PresenceRecord, RELAY_HASH8, type Reply, type Welcome, builtinRpcs, correctPayload, decodeCall, decodeErrorPayload, decodeFrame, decodeHello, decodeMsg, decodePing, decodePong, decodeReply, decodeWelcome, deltaPayload, encodeCall, encodeCorrectFrame, encodeDeltaFrame, encodeErrorPayload, encodeFrame, encodeHello, encodeMsg, encodePing, encodePong, encodeReply, encodeWelcome, encodeWriteFrame, errorByCode, formatError, isFrameType, isLocalhostOrigin, isRelayHash8, originAllowed, parseOriginList, presenceEntity, readCorrectAppliedTick, readCorrectClientTick, relaySchema, requestOwnership, rpcByIdOf, rpcIdOf, rpcTable, withBuiltins, writePayload };

package/dist/index.js

@@ -222,23 +222,28 @@ function deltaPayload(codecBytes) {
 function writePayload(codecBytes) {
   return codecBytes;
 }
-function correctPayload(codecBytes, clientTick) {
-  const w = new ByteWriter(codecBytes.length + 4);
+function correctPayload(codecBytes, clientTick, appliedTick) {
+  const extra = appliedTick === void 0 ? 4 : 8;
+  const w = new ByteWriter(codecBytes.length + extra);
   w.bytes(codecBytes);
   w.u32(clientTick);
+  if (appliedTick !== void 0) w.u32(appliedTick);
   return w.finish();
 }
 function readCorrectClientTick(r) {
   return r.remaining >= 4 ? r.u32() : void 0;
 }
+function readCorrectAppliedTick(r) {
+  return r.remaining >= 4 ? r.u32() : void 0;
+}
 function encodeDeltaFrame(codecBytes) {
   return encodeFrame(FrameType.DELTA, deltaPayload(codecBytes));
 }
 function encodeWriteFrame(codecBytes) {
   return encodeFrame(FrameType.WRITE, writePayload(codecBytes));
 }
-function encodeCorrectFrame(codecBytes, clientTick) {
-  return encodeFrame(FrameType.CORRECT, correctPayload(codecBytes, clientTick));
+function encodeCorrectFrame(codecBytes, clientTick, appliedTick) {
+  return encodeFrame(FrameType.CORRECT, correctPayload(codecBytes, clientTick, appliedTick));
 }
 
 // src/rpc.ts
@@ -400,6 +405,29 @@ function isRelayHash8(hash8) {
   for (const b of hash8) if (b !== 0) return false;
   return true;
 }
+
+// src/origin.ts
+var LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]", "0.0.0.0"]);
+function isLocalhostOrigin(origin) {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
+    return false;
+  }
+  const host = url.hostname.toLowerCase();
+  return LOCAL_HOSTNAMES.has(host) || host.endsWith(".localhost");
+}
+function originAllowed(origins, allowNoOrigin, origin) {
+  if (origin === void 0 || origin === "") return allowNoOrigin;
+  if (origins.includes("*")) return true;
+  if (isLocalhostOrigin(origin)) return true;
+  return origins.includes(origin);
+}
+function parseOriginList(raw) {
+  if (raw === void 0) return ["*"];
+  return raw.split(",").map((o) => o.trim()).filter((o) => o.length > 0);
+}
 export {
   ERROR_CATALOGUE,
   ErrorCode,
@@ -434,8 +462,12 @@ export {
   errorByCode,
   formatError,
   isFrameType,
+  isLocalhostOrigin,
   isRelayHash8,
+  originAllowed,
+  parseOriginList,
   presenceEntity,
+  readCorrectAppliedTick,
   readCorrectClientTick,
   relaySchema,
   requestOwnership,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@irtio/protocol",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "irtio wire protocol: frames, framing, session payloads, error codes, built-in presence",
   "license": "MIT",
   "publishConfig": {
@@ -20,7 +20,7 @@
     "dist"
   ],
   "dependencies": {
-    "@irtio/schema": "0.2.0"
+    "@irtio/schema": "0.4.0"
   },
   "scripts": {
     "build": "tsup",