@luckystack/server 0.14.0 → 0.15.0

package/dist/index.js

@@ -9,7 +9,7 @@ import {
 
 // src/createServer.ts
 import http from "http";
-import { registerBindAddress, registerBoundAddress, writeBootUuid, startBootUuidHeartbeat, getLogger as getLogger14, getProjectConfig as getProjectConfig15, tryCatch as tryCatch11, tryCatchSync as tryCatchSync3, resolveRuntimeMode, dispatchHook as dispatchHook8 } from "@luckystack/core";
+import { registerBindAddress, registerBoundAddress, writeBootUuid, startBootUuidHeartbeat, getLogger as getLogger14, getProjectConfig as getProjectConfig16, tryCatch as tryCatch12, tryCatchSync as tryCatchSync3, resolveRuntimeMode, dispatchHook as dispatchHook8 } from "@luckystack/core";
 
 // src/httpHandler.ts
 import { randomUUID } from "crypto";
@@ -17,9 +17,10 @@ import {
   allowedOrigin,
   dispatchHook as dispatchHook5,
   extractTokenFromRequest as extractTokenFromRequest3,
+  getCsrfConfig as getCsrfConfig3,
   getLogger as getLogger7,
   getParams,
-  getProjectConfig as getProjectConfig12,
+  getProjectConfig as getProjectConfig13,
   hasCookie,
   normalizeOrigin,
   readSession as readSession3,
@@ -494,18 +495,42 @@ import {
   checkRateLimit,
   dispatchHook as dispatchHook2,
   getLogger,
-  getProjectConfig as getProjectConfig5,
+  getProjectConfig as getProjectConfig6,
   resolveClientIp,
   resolveDevCallbackUrl
 } from "@luckystack/core";
 
+// src/httpRoutes/clientSession.ts
+var toClientSession = (session) => {
+  if (typeof session !== "object" || session === null) return session;
+  const { token: _token, csrfToken: _csrfToken, ...clientSession } = session;
+  return clientSession;
+};
+
 // src/httpRoutes/sessionCookie.ts
-import { isProductionRuntime } from "@luckystack/core";
+import { applyCookiePrefixConstraints, getProjectConfig as getProjectConfig5, isProductionRuntime } from "@luckystack/core";
 var resolveCookieSecure = (sessionCookieSecure, secureEnv) => {
   if (sessionCookieSecure !== void 0) return sessionCookieSecure;
   if (secureEnv === "true") return true;
   return isProductionRuntime();
 };
+var resolveSessionCookieName = () => {
+  const { http: http2 } = getProjectConfig5();
+  return applyCookiePrefixConstraints(http2.sessionCookieName, http2.sessionCookiePrefix).name;
+};
+var buildSessionCookieOptions = (maxAgeSeconds) => {
+  const { http: http2 } = getProjectConfig5();
+  const constraints = applyCookiePrefixConstraints(
+    http2.sessionCookieName,
+    http2.sessionCookiePrefix,
+    resolveCookieSecure(http2.sessionCookieSecure, process.env.SECURE)
+  );
+  const path4 = constraints.forcePathRoot ? "/" : http2.sessionCookiePath;
+  const domain = http2.sessionCookieDomain && !constraints.forbidDomain ? `Domain=${http2.sessionCookieDomain}; ` : "";
+  return `HttpOnly; SameSite=${http2.sessionCookieSameSite}; Path=${path4}; Max-Age=${maxAgeSeconds}; ${domain}${constraints.secure ? "Secure;" : ""}`;
+};
+var buildSessionCookie = (token, cookieOptions) => `${resolveSessionCookieName()}=${token}; ${cookieOptions}`;
+var buildClearedSessionCookie = () => buildSessionCookie("", buildSessionCookieOptions(0));
 
 // src/httpRoutes/authApiRoute.ts
 var parseSessionBasedTokenHeader = (headerValue) => {
@@ -528,6 +553,7 @@ var handleAuthApiRoute = async ({
   req,
   res,
   routePath,
+  method,
   token,
   params,
   sessionCookieOptions
@@ -539,8 +565,7 @@ var handleAuthApiRoute = async ({
     res.end(JSON.stringify({ status: false, reason: "auth.disabled" }));
     return true;
   }
-  const config = getProjectConfig5();
-  const sessionCookieName = config.http.sessionCookieName;
+  const config = getProjectConfig6();
   const shouldLogDev = config.logging.devLogs;
   const providerName = routePath.split("/")[3];
   const provider = login.getOAuthProviders().find((p) => p.name === providerName);
@@ -624,6 +649,12 @@ var handleAuthApiRoute = async ({
     res.end();
     return true;
   }
+  if (method !== "POST") {
+    res.statusCode = 405;
+    res.setHeader("Allow", "POST");
+    res.end();
+    return true;
+  }
   const rateLimiting = config.rateLimiting;
   const requesterIp = resolveClientIp({
     rawAddress: req.socket.remoteAddress,
@@ -685,21 +716,21 @@ var handleAuthApiRoute = async ({
     if (useSessionBasedToken) {
       res.setHeader("X-Session-Token", result.newToken);
     } else {
-      res.setHeader("Set-Cookie", `${sessionCookieName}=${result.newToken}; ${sessionCookieOptions}`);
+      res.setHeader("Set-Cookie", buildSessionCookie(result.newToken, sessionCookieOptions));
     }
   }
   res.setHeader("content-type", "application/json; charset=utf-8");
   res.end(JSON.stringify({
     status: result.status,
     reason: result.reason,
-    session: result.session,
+    session: toClientSession(result.session),
     authenticated: Boolean(result.newToken)
   }));
   return true;
 };
 
 // src/httpRoutes/authSecondFactorRoutes.ts
-import { checkRateLimit as checkRateLimit2, getProjectConfig as getProjectConfig6, resolveClientIp as resolveClientIp2 } from "@luckystack/core";
+import { checkRateLimit as checkRateLimit2, getProjectConfig as getProjectConfig7, resolveClientIp as resolveClientIp2 } from "@luckystack/core";
 var json = (ctx, statusCode, body) => {
   ctx.res.statusCode = statusCode;
   ctx.res.setHeader("content-type", "application/json; charset=utf-8");
@@ -713,7 +744,7 @@ var methodNotAllowed = (ctx) => {
   return true;
 };
 var requesterIpOf = (ctx) => {
-  const config = getProjectConfig6();
+  const config = getProjectConfig7();
   return resolveClientIp2({
     rawAddress: ctx.req.socket.remoteAddress,
     headers: ctx.req.headers,
@@ -744,7 +775,7 @@ var sendLoginResult = async (ctx, login, result) => {
   }
   if (result.newToken) {
     if (ctx.token) await login.deleteSession(ctx.token, { skipSocketLogout: true });
-    const config = getProjectConfig6();
+    const config = getProjectConfig7();
     const headerValue = ctx.req.headers["x-session-based-token"];
     const raw = Array.isArray(headerValue) ? headerValue[0] : headerValue;
     const requestedSessionMode = raw === "true" ? true : raw === "false" ? false : null;
@@ -752,13 +783,13 @@ var sendLoginResult = async (ctx, login, result) => {
     if (useSessionBasedToken) {
       ctx.res.setHeader("X-Session-Token", result.newToken);
     } else {
-      ctx.res.setHeader("Set-Cookie", `${config.http.sessionCookieName}=${result.newToken}; ${ctx.sessionCookieOptions}`);
+      ctx.res.setHeader("Set-Cookie", buildSessionCookie(result.newToken, ctx.sessionCookieOptions));
     }
   }
   return json(ctx, 200, {
     status: true,
     reason: result.reason,
-    session: result.session,
+    session: toClientSession(result.session),
     authenticated: Boolean(result.newToken)
   });
 };
@@ -841,7 +872,7 @@ var handleAuthTwoFactorRoute = async (ctx) => {
 };
 
 // src/httpRoutes/authLogoutRoute.ts
-import { getLogger as getLogger2, getProjectConfig as getProjectConfig7, tryCatch as tryCatch3 } from "@luckystack/core";
+import { getLogger as getLogger2, getProjectConfig as getProjectConfig8, tryCatch as tryCatch3 } from "@luckystack/core";
 var warnedNonStrictSameSite = false;
 var handleAuthLogoutRoute = async ({ res, routePath, method, token }) => {
   if (routePath !== "/auth/logout") return false;
@@ -861,18 +892,14 @@ var handleAuthLogoutRoute = async ({ res, routePath, method, token }) => {
       }
     }
   }
-  const http2 = getProjectConfig7().http;
+  const http2 = getProjectConfig8().http;
   if (http2.sessionCookieSameSite !== "Strict" && !warnedNonStrictSameSite) {
     warnedNonStrictSameSite = true;
     getLogger2().warn(
       `/auth/logout is exempt from CSRF middleware and relies on SameSite=Strict. Current sessionCookieSameSite="${http2.sessionCookieSameSite}" weakens this protection.`
     );
   }
-  const secure = resolveCookieSecure(http2.sessionCookieSecure, process.env.SECURE);
-  res.setHeader(
-    "Set-Cookie",
-    `${http2.sessionCookieName}=; HttpOnly; SameSite=${http2.sessionCookieSameSite}; Path=${http2.sessionCookiePath}; Max-Age=0; ${secure ? "Secure;" : ""}`
-  );
+  res.setHeader("Set-Cookie", buildClearedSessionCookie());
   res.statusCode = 200;
   res.setHeader("Content-Type", "application/json");
   res.end(JSON.stringify({ status: "success", result: true }));
@@ -880,19 +907,19 @@ var handleAuthLogoutRoute = async ({ res, routePath, method, token }) => {
 };
 
 // src/httpRoutes/authProvidersRoute.ts
-import { getProjectConfig as getProjectConfig8 } from "@luckystack/core";
+import { getProjectConfig as getProjectConfig9 } from "@luckystack/core";
 var handleAuthProvidersRoute = async ({ req, res, routePath }) => {
   if (routePath !== "/auth/providers" || req.method !== "GET") return false;
   const login = await getLogin();
   const providers = login ? login.getOAuthProviders().map((provider) => provider.name) : [];
-  const emailCodeLogin = Boolean(login) && getProjectConfig8().auth.emailCodeLogin;
+  const emailCodeLogin = Boolean(login) && getProjectConfig9().auth.emailCodeLogin;
   res.setHeader("Content-Type", "application/json");
   res.end(JSON.stringify({ providers, emailCodeLogin }));
   return true;
 };
 
 // src/httpRoutes/authCallbackRoute.ts
-import { getLogger as getLogger3, getProjectConfig as getProjectConfig9 } from "@luckystack/core";
+import { getLogger as getLogger3, getProjectConfig as getProjectConfig10 } from "@luckystack/core";
 var handleAuthCallbackRoute = async ({
   req,
   res,
@@ -907,8 +934,7 @@ var handleAuthCallbackRoute = async ({
     res.end("Auth is not enabled");
     return true;
   }
-  const config = getProjectConfig9();
-  const sessionCookieName = config.http.sessionCookieName;
+  const config = getProjectConfig10();
   const shouldLogDev = config.logging.devLogs;
   const publicOrigin = (config.app.publicUrl || "").replace(/\/+$/, "");
   const loginRedirect = config.loginRedirectUrl || "/";
@@ -933,7 +959,7 @@ var handleAuthCallbackRoute = async ({
     res.setHeader("Set-Cookie", clearStateCookie);
     res.writeHead(302, { Location: `${baseUrl}#token=${newToken}` });
   } else {
-    res.setHeader("Set-Cookie", [clearStateCookie, `${sessionCookieName}=${newToken}; ${sessionCookieOptions}`]);
+    res.setHeader("Set-Cookie", [clearStateCookie, buildSessionCookie(newToken, sessionCookieOptions)]);
     res.writeHead(302, { Location: redirectUrl });
   }
   res.end();
@@ -952,7 +978,7 @@ import {
 import { handleHttpApiRequest } from "@luckystack/api";
 
 // src/sse.ts
-import { getProjectConfig as getProjectConfig10 } from "@luckystack/core";
+import { getProjectConfig as getProjectConfig11 } from "@luckystack/core";
 var isExpectingEventStream = (acceptHeader) => {
   if (!acceptHeader) return false;
   const value = Array.isArray(acceptHeader) ? acceptHeader.join(",") : acceptHeader;
@@ -960,7 +986,7 @@ var isExpectingEventStream = (acceptHeader) => {
 };
 var queryRequestsStream = (queryString) => {
   if (!queryString) return false;
-  const { queryParam, enabledValue } = getProjectConfig10().http.stream;
+  const { queryParam, enabledValue } = getProjectConfig11().http.stream;
   const params = new URLSearchParams(queryString);
   const value = params.get(queryParam);
   return value === enabledValue || value === "1";
@@ -976,7 +1002,7 @@ var initSseResponse = (res) => {
     Connection: "keep-alive",
     "X-Accel-Buffering": "no"
   });
-  const connectedComment = getProjectConfig10().http.stream.connectedComment;
+  const connectedComment = getProjectConfig11().http.stream.connectedComment;
   if (connectedComment) {
     res.write(`${connectedComment}
 
@@ -999,10 +1025,10 @@ var sendSseEvent = ({
 };
 
 // src/httpRoutes/resolveRequesterIp.ts
-import { getProjectConfig as getProjectConfig11, resolveClientIp as resolveClientIp3 } from "@luckystack/core";
+import { getProjectConfig as getProjectConfig12, resolveClientIp as resolveClientIp3 } from "@luckystack/core";
 var resolveRequesterIp = (req) => {
-  const trustProxy = getProjectConfig11().http.trustProxy;
-  const trustedProxyHopCount = getProjectConfig11().http.trustedProxyHopCount;
+  const trustProxy = getProjectConfig12().http.trustProxy;
+  const trustedProxyHopCount = getProjectConfig12().http.trustedProxyHopCount;
   const rawRemoteAddress = req.socket.remoteAddress;
   return rawRemoteAddress || trustProxy && (req.headers["x-forwarded-for"] || req.headers["x-real-ip"]) ? resolveClientIp3({ rawAddress: rawRemoteAddress, headers: req.headers, trustProxy, trustedProxyHopCount }) : void 0;
 };
@@ -1065,7 +1091,7 @@ var handleApiRoute = async ({
       return true;
     }
     let apiData = typeof params === "object" ? { ...params } : {};
-    delete apiData.stream;
+    if (method === "GET") delete apiData.stream;
     const routedData = apiData.__luckystack_data;
     if (typeof routedData === "string") {
       const [parseError, parsed] = tryCatchSync(() => JSON.parse(routedData));
@@ -1399,7 +1425,7 @@ var handleStaticAndSpaFallback = async ({
       res.end("Not Found");
       return true;
     }
-    await options.serveFile(req, res);
+    await serveWithRewrittenUrl(options.serveFile, req, res, routePath);
     return true;
   }
   if (path.extname(routePath)) {
@@ -1417,9 +1443,17 @@ var handleStaticAndSpaFallback = async ({
 };
 
 // src/httpHandler.ts
-var buildSessionCookieOptions = (sessionExpiryDays, secure, http2) => `HttpOnly; SameSite=${http2.sessionCookieSameSite}; Path=${http2.sessionCookiePath}; Max-Age=${60 * 60 * 24 * sessionExpiryDays}; ${secure ? "Secure;" : ""}`;
+var buildHookSafeHeaders = (headers) => {
+  const csrfHeaderName = getCsrfConfig3().headerName.toLowerCase();
+  const safeHeaders = {};
+  for (const [k, v] of Object.entries(headers)) {
+    if (k === "authorization" || k === "proxy-authorization" || k === "cookie" || k === "set-cookie" || k === "x-csrf-token" || k === csrfHeaderName || k === "x-test-reset-token" || k === "x-session-based-token") continue;
+    safeHeaders[k] = Array.isArray(v) ? v.join(", ") : v ?? "";
+  }
+  return safeHeaders;
+};
 var setSecurityHeaders = (req, res, origin) => {
-  const { cors, securityHeaders } = getProjectConfig12().http;
+  const { cors, securityHeaders } = getProjectConfig13().http;
   res.setHeader("Access-Control-Allow-Origin", origin);
   res.setHeader("Access-Control-Allow-Methods", cors.allowedMethods);
   res.setHeader("Access-Control-Allow-Headers", cors.allowedHeaders);
@@ -1503,14 +1537,13 @@ var refreshSessionCookieIfPresent = async ({
   req,
   res,
   token,
-  sessionCookieName,
   sessionCookieOptions
 }) => {
-  const hasTokenCookie = hasCookie(req.headers.cookie, sessionCookieName);
+  const hasTokenCookie = hasCookie(req.headers.cookie, resolveSessionCookieName());
   if (!hasTokenCookie || !token) return;
   const currentSession = await readSession3(token);
   if (currentSession?.id) {
-    res.setHeader("Set-Cookie", `${sessionCookieName}=${token}; ${sessionCookieOptions}`);
+    res.setHeader("Set-Cookie", buildSessionCookie(token, sessionCookieOptions));
   }
 };
 var parseRequestParams = async ({
@@ -1539,17 +1572,9 @@ var parseRequestParams = async ({
   return params;
 };
 var handleHttpRequestInner = async (req, res, options) => {
-  const config = getProjectConfig12();
+  const config = getProjectConfig13();
   const shouldLogDev = config.logging.devLogs;
-  const sessionCookieName = config.http.sessionCookieName;
-  const sessionCookieOptions = buildSessionCookieOptions(
-    config.session.expiryDays,
-    //? Honor the explicit `http.sessionCookieSecure` override (CORE-39), else the
-    //? `SECURE` env flag — shared with the OAuth state cookie via
-    //? `resolveCookieSecure` so the two can never drift (WAVE4).
-    resolveCookieSecure(config.http.sessionCookieSecure, process.env.SECURE),
-    config.http
-  );
+  const sessionCookieOptions = buildSessionCookieOptions(60 * 60 * 24 * config.session.expiryDays);
   const url = req.url ?? "/";
   const [routePathRaw, queryStringRaw] = url.split("?");
   const [decodeError, decodedPath] = tryCatchSync2(() => decodeURIComponent(routePathRaw ?? "/"));
@@ -1568,11 +1593,7 @@ var handleHttpRequestInner = async (req, res, options) => {
   const rawRequestId = Array.isArray(incomingRequestId) ? incomingRequestId[0] : incomingRequestId;
   const requestId = rawRequestId && /^[a-zA-Z0-9-]{1,128}$/.test(rawRequestId) ? rawRequestId : randomUUID();
   res.setHeader("X-Request-Id", requestId);
-  const safeHeaders = {};
-  for (const [k, v] of Object.entries(req.headers)) {
-    if (k === "authorization" || k === "cookie" || k === "set-cookie" || k === "x-csrf-token" || k === "x-test-reset-token" || k === "x-session-based-token") continue;
-    safeHeaders[k] = Array.isArray(v) ? v.join(", ") : v ?? "";
-  }
+  const safeHeaders = buildHookSafeHeaders(req.headers);
   const preHttpResult = await dispatchHook5("preHttpRequest", {
     method: req.method?.toUpperCase() ?? "GET",
     url: req.url ?? "/",
@@ -1599,7 +1620,7 @@ var handleHttpRequestInner = async (req, res, options) => {
     return;
   }
   const token = extractTokenFromRequest3(req);
-  await refreshSessionCookieIfPresent({ req, res, token, sessionCookieName, sessionCookieOptions });
+  await refreshSessionCookieIfPresent({ req, res, token, sessionCookieOptions });
   const csrfRejected = await enforceCsrfOnStateChangingRequest({ req, res, routePath, token, requestId });
   if (csrfRejected) return;
   const baseCtx = {
@@ -1655,10 +1676,11 @@ import {
   extractLanguageFromHeader,
   extractTokenFromSocket,
   getLogger as getLogger8,
-  getProjectConfig as getProjectConfig13,
+  getProjectConfig as getProjectConfig14,
   dispatchHook as dispatchHook6,
   normalizeErrorResponse,
   readSession as readSession4,
+  resolveClientIp as resolveClientIp4,
   writeSession,
   tryCatch as tryCatch8
 } from "@luckystack/core";
@@ -1671,6 +1693,7 @@ var withSessionLock = async (token, fn) => {
   await tryCatch8(() => next);
   if (sessionLocks.get(token) === next) sessionLocks.delete(token);
 };
+var SYNC_ALL_RECEIVER = "all";
 var getVisibleSocketRooms = (socket, token) => {
   return [...socket.rooms].filter((room) => typeof room === "string").filter((room) => room !== socket.id).filter((room) => !token || room !== token);
 };
@@ -1680,6 +1703,7 @@ var getSessionRoomCodes = (session) => {
   ) : [];
   return [...new Set(roomCodes)];
 };
+var asPayload = (data) => typeof data === "object" && data !== null ? data : {};
 var sanitizeSessionRoomKeys = (session) => {
   const { code: _legacyCode, codes: _legacyCodes, ...sanitizedSession } = session;
   return sanitizedSession;
@@ -1741,7 +1765,16 @@ var executeRoomMutation = async (opts) => {
   const physicalRoom = formatRoomName(group, { purpose: "broadcast", userId: session.id });
   const nextRoomCodes = await mutate(socket, physicalRoom, group, existingRoomCodes, session.id);
   const sanitizedSession = sanitizeSessionRoomKeys(session);
-  await writeSession(token, { ...sanitizedSession, roomCodes: nextRoomCodes });
+  const saved = await writeSession(token, { ...sanitizedSession, roomCodes: nextRoomCodes }, void 0, { onlyIfExists: true });
+  if (!saved.ok) {
+    if (preHook === "preRoomJoin") await socket.leave(physicalRoom);
+    socket.emit(buildResponseEventName(responseIndex), normalizeErrorResponse({
+      response: { status: "error", errorCode: saved.errorCode ?? "session.notFound" },
+      preferredLocale,
+      userLanguage: session.language
+    }));
+    return;
+  }
   const visibleRooms = getVisibleSocketRooms(socket, token);
   socket.emit(buildResponseEventName(responseIndex), { rooms: visibleRooms });
   if (shouldLogDev) {
@@ -1766,12 +1799,12 @@ var registerApiAndSyncEvents = (ctx) => {
 var registerCancellationEvents = (ctx) => {
   const { socket } = ctx;
   socket.on(socketEventNames.syncCancel, (data) => {
-    const cb = typeof data.cb === "string" ? data.cb : null;
-    if (!cb) return;
+    const { cb } = asPayload(data);
+    if (typeof cb !== "string" || !cb) return;
     abortSyncByCb(socket.id, cb);
   });
   socket.on(socketEventNames.apiCancel, (data) => {
-    const responseIndex = data.responseIndex;
+    const { responseIndex } = asPayload(data);
     if (typeof responseIndex !== "number" && typeof responseIndex !== "string") return;
     abortApiByResponseIndex(socket.id, responseIndex);
   });
@@ -1779,10 +1812,18 @@ var registerCancellationEvents = (ctx) => {
 var registerRoomEvents = (ctx) => {
   const { socket, token, preferredLocale, shouldLogDev } = ctx;
   socket.on(socketEventNames.joinRoom, (data) => {
-    const group = typeof data.group === "string" ? data.group.trim() : "";
-    const responseIndex = data.responseIndex;
+    const payload = asPayload(data);
+    const group = typeof payload.group === "string" ? payload.group.trim() : "";
+    const responseIndex = payload.responseIndex;
     if (!validateRoomRequest(socket, responseIndex, token, group, preferredLocale, buildJoinRoomResponseEventName)) return;
     if (!token) return;
+    if (group === SYNC_ALL_RECEIVER) {
+      socket.emit(buildJoinRoomResponseEventName(responseIndex), normalizeErrorResponse({
+        response: { status: "error", errorCode: "room.invalid" },
+        preferredLocale
+      }));
+      return;
+    }
     void withSessionLock(token, async () => {
       await executeRoomMutation({
         socket,
@@ -1797,7 +1838,7 @@ var registerRoomEvents = (ctx) => {
         blockedErrorCode: "room.joinBlocked",
         logVerb: "joined",
         mutate: async (sock, physicalRoom, rawGroup, existingCodes, userId) => {
-          const maxRooms = getProjectConfig13().socket.maxRoomsPerSession;
+          const maxRooms = getProjectConfig14().socket.maxRoomsPerSession;
           let kept = existingCodes;
           if (maxRooms !== false && maxRooms > 0 && !existingCodes.includes(rawGroup)) {
             while (kept.length >= maxRooms) {
@@ -1814,8 +1855,9 @@ var registerRoomEvents = (ctx) => {
     });
   });
   socket.on(socketEventNames.leaveRoom, (data) => {
-    const group = typeof data.group === "string" ? data.group.trim() : "";
-    const responseIndex = data.responseIndex;
+    const payload = asPayload(data);
+    const group = typeof payload.group === "string" ? payload.group.trim() : "";
+    const responseIndex = payload.responseIndex;
     if (!validateRoomRequest(socket, responseIndex, token, group, preferredLocale, buildLeaveRoomResponseEventName)) return;
     if (!token) return;
     void withSessionLock(token, async () => {
@@ -1840,7 +1882,7 @@ var registerRoomEvents = (ctx) => {
     });
   });
   socket.on(socketEventNames.getJoinedRooms, (data) => {
-    const responseIndex = data.responseIndex;
+    const { responseIndex } = asPayload(data);
     if (typeof responseIndex !== "number") return;
     if (!token) {
       socket.emit(buildGetJoinedRoomsResponseEventName(responseIndex), {
@@ -1884,17 +1926,22 @@ var registerUpdateLocationEvent = (ctx) => {
   const { socket, token, activityBroadcasterEnabled, locationProviderEnabled, shouldLogDev } = ctx;
   socket.on(
     socketEventNames.updateLocation,
-    (newLocation) => {
+    (data) => {
       if (!token) return;
       if (!locationProviderEnabled) return;
-      if (typeof newLocation.pathName !== "string" || !newLocation.pathName.startsWith("/") || newLocation.pathName.length > 2048 || newLocation.pathName.includes("\0")) return;
-      if (newLocation.searchParams !== void 0) {
-        if (typeof newLocation.searchParams !== "object" || Array.isArray(newLocation.searchParams)) return;
-        const entries = Object.entries(newLocation.searchParams);
+      const { pathName, searchParams } = asPayload(data);
+      if (typeof pathName !== "string" || !pathName.startsWith("/") || pathName.length > 2048 || pathName.includes("\0")) return;
+      const newLocation = { pathName };
+      if (searchParams !== void 0) {
+        if (typeof searchParams !== "object" || searchParams === null || Array.isArray(searchParams)) return;
+        const entries = Object.entries(searchParams);
         if (entries.length > 50) return;
+        const validated = {};
         for (const [k, v] of entries) {
-          if (typeof k !== "string" || k.length > 256 || typeof v !== "string" || v.length > 1024) return;
+          if (k.length > 256 || typeof v !== "string" || v.length > 1024) return;
+          validated[k] = v;
         }
+        newLocation.searchParams = validated;
       }
       if (shouldLogDev) {
         getLogger8().debug("updating location", { pathName: newLocation.pathName });
@@ -1912,7 +1959,8 @@ var registerUpdateLocationEvent = (ctx) => {
         const extendedUser = user;
         const oldLocation = extendedUser.location;
         const sanitizedUser = sanitizeSessionRoomKeys({ ...extendedUser, location: newLocation });
-        await writeSession(token, sanitizedUser);
+        const saved = await writeSession(token, sanitizedUser, void 0, { onlyIfExists: true });
+        if (!saved.ok) return;
         void dispatchHook6("onLocationUpdate", { token, oldLocation, newLocation });
       });
     }
@@ -1955,6 +2003,7 @@ var rejoinPersistedRooms = (ctx) => {
       const roomCodes = session ? getSessionRoomCodes(session) : [];
       const userId = session?.id ?? null;
       for (const roomCode of roomCodes) {
+        if (roomCode === SYNC_ALL_RECEIVER) continue;
         await socket.join(formatRoomName(roomCode, { purpose: "broadcast", userId }));
       }
       return roomCodes;
@@ -1969,7 +2018,7 @@ var rejoinPersistedRooms = (ctx) => {
   })();
 };
 var loadSocket = (httpServer, options = {}) => {
-  const config = getProjectConfig13();
+  const config = getProjectConfig14();
   const shouldLogDev = config.logging.devLogs;
   const shouldLogSocketStartup = config.logging.socketStartup;
   const io = new SocketIOServer(httpServer, {
@@ -2014,7 +2063,14 @@ var loadSocket = (httpServer, options = {}) => {
     void dispatchHook6("onSocketConnect", {
       socketId: socket.id,
       token,
-      ip: socket.handshake.address
+      //? Same resolution as the api/sync socket paths, so behind a trusted proxy
+      //? the hook sees the client and not the proxy address.
+      ip: resolveClientIp4({
+        rawAddress: socket.handshake.address,
+        headers: socket.handshake.headers,
+        trustProxy: config.http.trustProxy,
+        trustedProxyHopCount: config.http.trustedProxyHopCount
+      })
     });
     const ctx = {
       socket,
@@ -2040,7 +2096,7 @@ var loadSocket = (httpServer, options = {}) => {
 import {
   collectSynchronizedEnvKeys,
   getLogger as getLogger9,
-  getProjectConfig as getProjectConfig14,
+  getProjectConfig as getProjectConfig15,
   isDeployConfigRegistered,
   isLocalizedNormalizerRegistered,
   isProjectConfigRegistered,
@@ -2107,7 +2163,7 @@ var verifyBootstrap = async (requirements = {}) => {
   }
   if (isProjectConfigRegistered()) {
     const synchronizedKeyCount = collectSynchronizedEnvKeys().length;
-    const healthHashMode = getProjectConfig14().http.healthHash.mode;
+    const healthHashMode = getProjectConfig15().http.healthHash.mode;
     if (synchronizedKeyCount > 0 && healthHashMode === "plain") {
       getLogger9().warn(
         `[LuckyStack] SECURITY: /_health exposes UNSALTED sha256 fingerprints of ${String(synchronizedKeyCount)} synchronized env secret(s) by default. Set \`http.healthHash.mode\` to 'hmac' (or 'salted' with salt '@bootUuid') to stop publishing brute-forceable secret fingerprints to unauthenticated callers.`
@@ -2115,7 +2171,7 @@ var verifyBootstrap = async (requirements = {}) => {
     }
   }
   if (isProjectConfigRegistered()) {
-    const cfg = getProjectConfig14();
+    const cfg = getProjectConfig15();
     if (!cfg.session.basedToken && cfg.http.sessionCookieSameSite !== "Strict") {
       getLogger9().warn(
         `[LuckyStack] SECURITY: http.sessionCookieSameSite is '${cfg.http.sessionCookieSameSite}', not 'Strict', but the CSRF-exempt auth-bootstrap endpoints (/auth/api/credentials, /auth/callback/*) rely on SameSite=Strict to block cross-site login-CSRF. Use 'Strict', or add your own CSRF/origin check on those routes.`
@@ -2138,7 +2194,8 @@ var verifyBootstrap = async (requirements = {}) => {
 import {
   getLogger as getLogger10,
   registerRuntimeMapsProvider,
-  isProductionRuntime as isProductionRuntime3
+  isProductionRuntime as isProductionRuntime3,
+  tryCatch as tryCatch9
 } from "@luckystack/core";
 var emptyRuntimeMaps = {
   apisObject: {},
@@ -2201,6 +2258,7 @@ var mergeInto = (target, source, kind, fromPreset, keyOrigin) => {
 var isProduction = () => isProductionRuntime3();
 var createProdRuntimeMapsProvider = (options) => {
   let prodMapsPromise = null;
+  const reportedFailures = /* @__PURE__ */ new Set();
   let devkitModulePromise = null;
   const getDevkit = async () => {
     devkitModulePromise ??= import("@luckystack/devkit");
@@ -2208,6 +2266,7 @@ var createProdRuntimeMapsProvider = (options) => {
   };
   const loadProdRuntimeMaps = async () => {
     if (prodMapsPromise) return await prodMapsPromise;
+    const loadState = { anyPresetFailed: false };
     prodMapsPromise = (async () => {
       const presets = resolvePresets(options);
       const merged = {
@@ -2219,19 +2278,29 @@ var createProdRuntimeMapsProvider = (options) => {
       const syncOrigin = /* @__PURE__ */ new Map();
       const functionOrigin = /* @__PURE__ */ new Map();
       const loadedModules = await Promise.all(
-        presets.map(async (preset) => ({
-          preset,
-          mod: await options.loadGenerated(preset).catch(() => null)
-        }))
+        presets.map(async (preset) => {
+          const [loadError, mod] = await tryCatch9(() => options.loadGenerated(preset));
+          return { preset, mod, loadError };
+        })
       );
       let loadedAny = false;
-      for (const { preset, mod } of loadedModules) {
+      let newFailure = false;
+      for (const { preset, mod, loadError } of loadedModules) {
         if (!mod) {
-          getLogger10().warn(
-            `[luckystack:runtimeMaps] preset "${preset}" failed to load \u2014 skipping. Calls owned by that preset will return notFound until the generated module resolves.`
-          );
+          loadState.anyPresetFailed = true;
+          if (!reportedFailures.has(preset)) {
+            reportedFailures.add(preset);
+            newFailure = true;
+            getLogger10().error(
+              `[luckystack:runtimeMaps] preset "${preset}" failed to load \u2014 skipping. Calls owned by that preset will return notFound until the generated module resolves (retried on the next request).`,
+              loadError ?? new Error("loadGenerated returned no module")
+            );
+          }
           continue;
         }
+        if (reportedFailures.delete(preset)) {
+          getLogger10().info(`[luckystack:runtimeMaps] preset "${preset}" loaded after an earlier failure.`);
+        }
         loadedAny = true;
         const normalized = normalizeGeneratedModule(mod, preset);
         mergeInto(merged.apisObject, normalized.apisObject, "api", preset, apiOrigin);
@@ -2239,14 +2308,16 @@ var createProdRuntimeMapsProvider = (options) => {
         mergeInto(merged.functionsObject, normalized.functionsObject, "function", preset, functionOrigin);
       }
       if (!loadedAny) {
-        getLogger10().warn(
+        if (newFailure || presets.length === 0) getLogger10().warn(
           `[luckystack:runtimeMaps] no presets resolved (tried: ${presets.join(", ")}). Every api/sync request will return notFound until at least one generated module loads.`
         );
         return emptyRuntimeMaps;
       }
       return merged;
     })();
-    return await prodMapsPromise;
+    const result = await prodMapsPromise;
+    if (loadState.anyPresetFailed) prodMapsPromise = null;
+    return result;
   };
   const getRuntimeApiMaps = async () => {
     if (!isProduction()) {
@@ -2283,7 +2354,7 @@ import {
   dispatchHook as dispatchHook7,
   flushErrorTrackers,
   getLogger as getLogger11,
-  tryCatch as tryCatch9
+  tryCatch as tryCatch10
 } from "@luckystack/core";
 var DEFAULT_SHUTDOWN_TIMEOUT_MS = 1e4;
 var withTimeout = async (label, timeoutMs, fn) => {
@@ -2296,7 +2367,7 @@ var withTimeout = async (label, timeoutMs, fn) => {
     timer.unref();
   });
   const run = (async () => {
-    const [error] = await tryCatch9(fn);
+    const [error] = await tryCatch10(fn);
     if (error) getLogger11().warn(`[shutdown] step "${label}" failed: ${error.message}`);
     return true;
   })();
@@ -2312,7 +2383,7 @@ var closeHttpServer = (httpServer) => new Promise((resolve, reject) => {
 });
 var closeIoServer = (ioServer) => new Promise((resolve, reject) => {
   void ioServer.close((error) => {
-    if (error) reject(error);
+    if (error && error.code !== "ERR_SERVER_NOT_RUNNING") reject(error);
     else resolve();
   });
 });
@@ -2366,9 +2437,9 @@ var clearDevServerInfo = () => {
 };
 
 // src/afterListen.ts
-import { getLogger as getLogger13, tryCatch as tryCatch10 } from "@luckystack/core";
+import { getLogger as getLogger13, tryCatch as tryCatch11 } from "@luckystack/core";
 var runAfterListenTask = async (task, { fatal = false, label = "post-listen task" } = {}) => {
-  const [error] = await tryCatch10(async () => task());
+  const [error] = await tryCatch11(async () => task());
   if (!error) return;
   if (fatal) throw error;
   getLogger13().error(
@@ -2403,7 +2474,7 @@ var initDevTools = async () => {
     );
     return;
   }
-  const [devkitError] = await tryCatch11(async () => {
+  const [devkitError] = await tryCatch12(async () => {
     const devkit = await import(devkitModuleId);
     await devkit.initializeAll();
     devkit.setupWatchers();
@@ -2428,6 +2499,7 @@ var listenLuckyStackServer = (httpServer, ip, port, callback) => new Promise((re
   else autoIncrement = !production;
   const tryListen = (attemptPort) => {
     const onError = (err) => {
+      httpServer.off("listening", onListening);
       if (err.code !== "EADDRINUSE") {
         reject(err);
         return;
@@ -2452,8 +2524,7 @@ var listenLuckyStackServer = (httpServer, ip, port, callback) => new Promise((re
       );
       reject(err);
     };
-    httpServer.once("error", onError);
-    httpServer.listen(attemptPort, ip, () => {
+    function onListening() {
       httpServer.off("error", onError);
       const address = httpServer.address();
       const boundPort = typeof address === "object" && address !== null ? address.port : attemptPort;
@@ -2463,7 +2534,7 @@ var listenLuckyStackServer = (httpServer, ip, port, callback) => new Promise((re
         process.once("exit", clearDevServerInfo);
       }
       if (attemptPort !== startPort && !production) {
-        const configuredCallbackBase = tryCatchSync3(() => getProjectConfig15().oauthCallbackBase)[1] ?? "";
+        const configuredCallbackBase = tryCatchSync3(() => getProjectConfig16().oauthCallbackBase)[1] ?? "";
         const callbackPort = tryCatchSync3(() => {
           const callbackUrl = new URL(configuredCallbackBase);
           return callbackUrl.port || (callbackUrl.protocol === "https:" ? "443" : "80");
@@ -2474,13 +2545,16 @@ var listenLuckyStackServer = (httpServer, ip, port, callback) => new Promise((re
           );
         }
       }
-      const config = getProjectConfig15();
+      const config = getProjectConfig16();
       if (config.logging.socketStartup || config.logging.devLogs) {
         getLogger14().info(`Server is running on http://${ip}:${String(boundPort)}/`);
       }
       callback?.();
       resolve(httpServer);
-    });
+    }
+    httpServer.once("error", onError);
+    httpServer.once("listening", onListening);
+    httpServer.listen(attemptPort, ip);
   };
   tryListen(startPort);
 });
@@ -2507,7 +2581,7 @@ var createLuckyStackServer = async (options = {}) => {
   if (enableDevTools) {
     await initDevTools();
   }
-  const [bootUuidError] = await tryCatch11(() => writeBootUuid());
+  const [bootUuidError] = await tryCatch12(() => writeBootUuid());
   if (bootUuidError) {
     throw new Error(
       "Failed to write the boot UUID to Redis. Check REDIS_HOST / REDIS_PORT / REDIS_USER / REDIS_PASSWORD and that Redis is reachable.",
@@ -2557,7 +2631,7 @@ var createLuckyStackServer = async (options = {}) => {
 import path3 from "path";
 import fs2 from "fs";
 import { pathToFileURL } from "url";
-import { ROOT_DIR, tryCatch as tryCatch12, getLogger as getLogger15, isTestFile, isTestDirectory } from "@luckystack/core";
+import { ROOT_DIR, tryCatch as tryCatch13, getLogger as getLogger15, isTestFile, isTestDirectory } from "@luckystack/core";
 var OVERLAY_ORDER = [
   // Core registries first — clients, paths, routing rules. Anything below
   // depends on these being in place.
@@ -2582,7 +2656,7 @@ var OVERLAY_ORDER = [
 ];
 var importIfExists = async (filePath) => {
   if (!fs2.existsSync(filePath)) return;
-  const [error] = await tryCatch12(async () => {
+  const [error] = await tryCatch13(async () => {
     await import(pathToFileURL(filePath).href);
   });
   if (error) {