@peers-app/peers-sdk 0.20.5 → 0.21.0

package/dist/data/devices.d.ts

@@ -49,15 +49,15 @@ export declare const deviceInfoSchema: z.ZodObject<{
     publicBoxKey: string;
     userId: string;
     deviceId: string;
-    userName?: string | undefined;
     deviceName?: string | undefined;
+    userName?: string | undefined;
 }, {
     publicKey: string;
     publicBoxKey: string;
     userId: string;
     deviceId: string;
-    userName?: string | undefined;
     deviceName?: string | undefined;
+    userName?: string | undefined;
 }>;
 /** Signed identity and optional presentation hints advertised by a device. */
 export type IDeviceInfo = z.infer<typeof deviceInfoSchema>;
@@ -81,8 +81,8 @@ export declare const deviceHandshakeSchema: z.ZodObject<{
     deviceId: string;
     connectionId: string;
     serverAddress: string;
-    userName?: string | undefined;
     deviceName?: string | undefined;
+    userName?: string | undefined;
 }, {
     timestamp: number;
     publicKey: string;
@@ -91,8 +91,8 @@ export declare const deviceHandshakeSchema: z.ZodObject<{
     deviceId: string;
     connectionId: string;
     serverAddress: string;
-    userName?: string | undefined;
     deviceName?: string | undefined;
+    userName?: string | undefined;
 }>;
 /** Signed device information bound to one connection handshake. */
 export type IDeviceHandshake = z.infer<typeof deviceHandshakeSchema>;

package/dist/data/voice-messages.d.ts

@@ -10,9 +10,9 @@ export declare const voiceMessageSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     content: string;
     role: "user" | "assistant";
+    sessionId: string;
     createdAt: Date;
     voiceMessageId: string;
-    sessionId: string;
     threadId?: string | undefined;
 }, {
     content: string;
@@ -26,8 +26,8 @@ export type IVoiceMessage = z.infer<typeof voiceMessageSchema>;
 export declare function VoiceMessages(dataContext?: DataContext): import("..").Table<{
     content: string;
     role: "user" | "assistant";
+    sessionId: string;
     createdAt: Date;
     voiceMessageId: string;
-    sessionId: string;
     threadId?: string | undefined;
 }>;

package/dist/device/binary-peer-connection-v2.d.ts

@@ -37,6 +37,21 @@ export interface IBinaryPeer {
 }
 /** Backwards-compatible name for a WebRTC binary peer. */
 export type IWebRTCPeer = IBinaryPeer;
+/** Hard limits applied before allocating or decoding inbound binary messages. */
+export interface BinaryPeerReceiveLimits {
+    /** Maximum encoded bytes in one complete RPC message. */
+    maxRpcMessageBytes: number;
+    /** Maximum bytes in one reassembled raw stream message. */
+    maxStreamMessageBytes: number;
+    /** Maximum bytes reserved across all incomplete inbound messages. */
+    maxInFlightReassemblyBytes: number;
+    /** Maximum number of incomplete inbound messages retained at once. */
+    maxConcurrentReassemblies: number;
+    /** Maximum time an incomplete inbound message may retain memory. */
+    reassemblyTimeoutMs: number;
+}
+/** General-purpose receive limits for authenticated Peers connections. */
+export declare const DEFAULT_BINARY_PEER_RECEIVE_LIMITS: Readonly<BinaryPeerReceiveLimits>;
 /** Options for wrapping a binary transport in a verified Peers connection. */
 export interface WrapBinaryPeerOptions {
     /** Protocol identifier used for server address (e.g., 'wrtc' or 'ws') */
@@ -46,12 +61,14 @@ export interface WrapBinaryPeerOptions {
      * When true, sets secureLocal and secureRemote to skip application-level encryption.
      */
     markTransportSecure?: boolean;
+    /** Optional hard limits for untrusted inbound messages. */
+    receiveLimits?: Partial<BinaryPeerReceiveLimits>;
 }
 /**
  * Creates an ISocket from a binary peer. This is the core v2 factory function.
  * Replaces both createBinaryPeerSocket (v1) and StreamedSocket.
  */
-export declare function createBinaryPeerSocket(connectionId: string, peer: IBinaryPeer, protocol?: string): ISocket;
+export declare function createBinaryPeerSocket(connectionId: string, peer: IBinaryPeer, protocol?: string, receiveLimitOverrides?: Partial<BinaryPeerReceiveLimits>): ISocket;
 /**
  * Wraps a binary peer (WebRTC or WebSocket) into a Connection.
  * This is the main implementation that handles all binary protocols.
@@ -61,5 +78,5 @@ export declare function wrapBinaryPeer(connectionId: string, peer: IBinaryPeer,
  * Wraps a WebRTC peer into a Connection.
  * WebRTC is encrypted at the transport layer (DTLS-SRTP).
  */
-export declare function wrapWrtc(connectionId: string, peer: IWebRTCPeer, localDevice: Device, initiator: boolean, getTrustLevel?: ITrustLevelFn): Connection;
+export declare function wrapWrtc(connectionId: string, peer: IWebRTCPeer, localDevice: Device, initiator: boolean, getTrustLevel?: ITrustLevelFn, receiveLimits?: Partial<BinaryPeerReceiveLimits>): Connection;
 export {};

package/dist/device/binary-peer-connection-v2.js

@@ -17,6 +17,7 @@
  * and event-loop yielding (critical for Go sidecar WebRTC pipeline).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_BINARY_PEER_RECEIVE_LIMITS = void 0;
 exports.createBinaryPeerSocket = createBinaryPeerSocket;
 exports.wrapBinaryPeer = wrapBinaryPeer;
 exports.wrapWrtc = wrapWrtc;
@@ -35,6 +36,14 @@ const RPC_CONT = 0x02; // [0x02][4B msgId][chunk data]
 const STREAM_COMPLETE = 0x10; // [0x10][1B sidLen][streamId bytes][data]
 const STREAM_START = 0x11; // [0x11][1B sidLen][streamId bytes][4B totalSize][chunk data]
 const STREAM_CONT = 0x12; // [0x12][1B sidLen][streamId bytes][chunk data]
+/** General-purpose receive limits for authenticated Peers connections. */
+exports.DEFAULT_BINARY_PEER_RECEIVE_LIMITS = Object.freeze({
+    maxRpcMessageBytes: 256 * 1024 * 1024,
+    maxStreamMessageBytes: 256 * 1024 * 1024,
+    maxInFlightReassemblyBytes: 512 * 1024 * 1024,
+    maxConcurrentReassemblies: 64,
+    reassemblyTimeoutMs: 30_000,
+});
 const WRTC_CONFIG = {
     maxFramePayload: 64 * 1024, // 64KB - safe for SCTP
     highWaterMark: 128 * 1024, // 128KB
@@ -227,7 +236,7 @@ function buildStreamCont(sidBytes, chunkData) {
  * Creates an ISocket from a binary peer. This is the core v2 factory function.
  * Replaces both createBinaryPeerSocket (v1) and StreamedSocket.
  */
-function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
+function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receiveLimitOverrides = {}) {
     const handlers = {};
     const callbacks = {};
     const rawBytesHandlers = {};
@@ -235,6 +244,15 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
     const stats = (0, socket_type_1.createSocketStats)();
     const transportType = protocol === "wrtc" ? "wrtc" : protocol === "ws" ? "ws" : "unknown";
     const config = getTransportConfig(protocol);
+    const receiveLimits = {
+        ...exports.DEFAULT_BINARY_PEER_RECEIVE_LIMITS,
+        ...receiveLimitOverrides,
+    };
+    for (const [name, value] of Object.entries(receiveLimits)) {
+        if (!Number.isSafeInteger(value) || value <= 0) {
+            throw new Error(`Invalid binary peer receive limit ${name}: ${value}`);
+        }
+    }
     // ─── Drain / Backpressure ────────────────────────────────────────
     // Single persistent drain handler to avoid leaking listeners
     let drainResolve = null;
@@ -311,8 +329,56 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
         rpcSendQueue = rpcSendQueue.then(sendChunked, sendChunked);
         return rpcSendQueue;
     }
-    // RPC reassembly state: keyed by msgId
     const rpcReassemblyBuffers = new Map();
+    let inFlightReassemblyBytes = 0;
+    function clearReassemblyState(state) {
+        clearTimeout(state.timer);
+        inFlightReassemblyBytes -= state.buffer.length;
+    }
+    function clearAllReassemblies() {
+        for (const state of rpcReassemblyBuffers.values()) {
+            clearTimeout(state.timer);
+        }
+        rpcReassemblyBuffers.clear();
+        for (const state of streamReassemblyBuffers.values()) {
+            clearTimeout(state.timer);
+        }
+        streamReassemblyBuffers.clear();
+        inFlightReassemblyBytes = 0;
+    }
+    function closeForProtocolViolation(reason) {
+        if (isClosed) {
+            return;
+        }
+        console.warn(`Closing ${protocol} peer after binary protocol violation: ${reason}`);
+        isClosed = true;
+        clearAllReassemblies();
+        socket.connected = false;
+        peer.destroy();
+    }
+    function reserveReassembly(key, totalSize, maximumMessageBytes, onTimeout) {
+        const concurrentCount = rpcReassemblyBuffers.size + streamReassemblyBuffers.size;
+        if (totalSize > maximumMessageBytes) {
+            closeForProtocolViolation(`${key} exceeds the message-size limit`);
+            return undefined;
+        }
+        if (concurrentCount >= receiveLimits.maxConcurrentReassemblies) {
+            closeForProtocolViolation("too many concurrent message reassemblies");
+            return undefined;
+        }
+        if (inFlightReassemblyBytes + totalSize > receiveLimits.maxInFlightReassemblyBytes) {
+            closeForProtocolViolation("aggregate reassembly memory limit exceeded");
+            return undefined;
+        }
+        const state = {
+            buffer: new Uint8Array(totalSize),
+            offset: 0,
+            timer: setTimeout(onTimeout, receiveLimits.reassemblyTimeoutMs),
+        };
+        state.timer.unref?.();
+        inFlightReassemblyBytes += totalSize;
+        return state;
+    }
     function handleIncomingRPC(bytes) {
         const message = decodeMessage(bytes);
         if (message.type === "callback") {
@@ -407,6 +473,10 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
                 // ── RPC frames ──────────────────────────────────────────
                 case RPC_COMPLETE: {
                     const rpcBytes = bytes.subarray(1);
+                    if (rpcBytes.length > receiveLimits.maxRpcMessageBytes) {
+                        closeForProtocolViolation("complete RPC exceeds the message-size limit");
+                        return;
+                    }
                     handleIncomingRPC(rpcBytes);
                     break;
                 }
@@ -417,14 +487,22 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
                     const msgId = view.getUint32(1, false);
                     const totalSize = view.getUint32(5, false);
                     const chunkData = bytes.subarray(9);
-                    const buffer = new Uint8Array(totalSize);
-                    buffer.set(chunkData, 0);
-                    const offset = chunkData.length;
-                    if (offset >= totalSize) {
-                        handleIncomingRPC(buffer);
+                    if (totalSize === 0 || chunkData.length > totalSize || rpcReassemblyBuffers.has(msgId)) {
+                        closeForProtocolViolation("invalid or duplicate RPC start frame");
+                        return;
+                    }
+                    const state = reserveReassembly(`RPC ${msgId}`, totalSize, receiveLimits.maxRpcMessageBytes, () => closeForProtocolViolation(`RPC ${msgId} reassembly timed out`));
+                    if (!state) {
+                        return;
+                    }
+                    state.buffer.set(chunkData, 0);
+                    state.offset = chunkData.length;
+                    if (state.offset === totalSize) {
+                        clearReassemblyState(state);
+                        handleIncomingRPC(state.buffer);
                     }
                     else {
-                        rpcReassemblyBuffers.set(msgId, { buffer, offset });
+                        rpcReassemblyBuffers.set(msgId, state);
                     }
                     break;
                 }
@@ -437,10 +515,15 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
                     const state = rpcReassemblyBuffers.get(msgId);
                     if (!state)
                         return; // no START received, discard
+                    if (chunkData.length > state.buffer.length - state.offset) {
+                        closeForProtocolViolation(`RPC ${msgId} continuation exceeds declared size`);
+                        return;
+                    }
                     state.buffer.set(chunkData, state.offset);
                     state.offset += chunkData.length;
-                    if (state.offset >= state.buffer.length) {
+                    if (state.offset === state.buffer.length) {
                         rpcReassemblyBuffers.delete(msgId);
+                        clearReassemblyState(state);
                         handleIncomingRPC(state.buffer);
                     }
                     break;
@@ -455,6 +538,10 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
                     const sidBytes = bytes.subarray(2, 2 + sidLen);
                     const streamId = decodeStreamId(sidBytes);
                     const payload = bytes.subarray(2 + sidLen);
+                    if (payload.length > receiveLimits.maxStreamMessageBytes) {
+                        closeForProtocolViolation("complete stream message exceeds the message-size limit");
+                        return;
+                    }
                     const handler = rawBytesHandlers[streamId];
                     if (handler)
                         handler(payload);
@@ -471,16 +558,26 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
                     const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
                     const totalSize = view.getUint32(2 + sidLen, false);
                     const chunkData = bytes.subarray(2 + sidLen + 4);
-                    const buffer = new Uint8Array(totalSize);
-                    buffer.set(chunkData, 0);
-                    const offset = chunkData.length;
-                    if (offset >= totalSize) {
+                    if (totalSize === 0 ||
+                        chunkData.length > totalSize ||
+                        streamReassemblyBuffers.has(streamId)) {
+                        closeForProtocolViolation("invalid or duplicate stream start frame");
+                        return;
+                    }
+                    const state = reserveReassembly(`stream ${streamId}`, totalSize, receiveLimits.maxStreamMessageBytes, () => closeForProtocolViolation(`stream ${streamId} reassembly timed out`));
+                    if (!state) {
+                        return;
+                    }
+                    state.buffer.set(chunkData, 0);
+                    state.offset = chunkData.length;
+                    if (state.offset === totalSize) {
+                        clearReassemblyState(state);
                         const handler = rawBytesHandlers[streamId];
                         if (handler)
-                            handler(buffer);
+                            handler(state.buffer);
                     }
                     else {
-                        streamReassemblyBuffers.set(streamId, { buffer, offset });
+                        streamReassemblyBuffers.set(streamId, state);
                     }
                     break;
                 }
@@ -496,10 +593,15 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
                     const state = streamReassemblyBuffers.get(streamId);
                     if (!state)
                         return; // no START received, discard
+                    if (chunkData.length > state.buffer.length - state.offset) {
+                        closeForProtocolViolation(`stream ${streamId} continuation exceeds declared size`);
+                        return;
+                    }
                     state.buffer.set(chunkData, state.offset);
                     state.offset += chunkData.length;
-                    if (state.offset >= state.buffer.length) {
+                    if (state.offset === state.buffer.length) {
                         streamReassemblyBuffers.delete(streamId);
+                        clearReassemblyState(state);
                         const handler = rawBytesHandlers[streamId];
                         if (handler)
                             handler(state.buffer);
@@ -512,6 +614,10 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
                     // legacy format (no discriminator), try to decode as RPC.
                     // This handles the transition period where v1 peers send raw RPC without
                     // a frame type byte.
+                    if (bytes.length > receiveLimits.maxRpcMessageBytes) {
+                        closeForProtocolViolation("legacy RPC exceeds the message-size limit");
+                        return;
+                    }
                     handleIncomingRPC(bytes);
                     break;
                 }
@@ -526,6 +632,7 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
         if (isClosed)
             return;
         isClosed = true;
+        clearAllReassemblies();
         socket.connected = false;
     });
     // ─── ISocket Implementation ──────────────────────────────────────
@@ -574,8 +681,8 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary") {
  * This is the main implementation that handles all binary protocols.
  */
 function wrapBinaryPeer(connectionId, peer, localDevice, initiator, options, getTrustLevel) {
-    const { protocol, markTransportSecure } = options;
-    const socket = createBinaryPeerSocket(connectionId, peer, protocol);
+    const { protocol, markTransportSecure, receiveLimits } = options;
+    const socket = createBinaryPeerSocket(connectionId, peer, protocol, receiveLimits);
     const serverAddress = `${protocol}://${connectionId}`;
     const localServerAddresses = initiator ? undefined : [serverAddress];
     if (process.env.NODE_ENV !== "test") {
@@ -592,6 +699,6 @@ function wrapBinaryPeer(connectionId, peer, localDevice, initiator, options, get
  * Wraps a WebRTC peer into a Connection.
  * WebRTC is encrypted at the transport layer (DTLS-SRTP).
  */
-function wrapWrtc(connectionId, peer, localDevice, initiator, getTrustLevel) {
-    return wrapBinaryPeer(connectionId, peer, localDevice, initiator, { protocol: "wrtc", markTransportSecure: true }, getTrustLevel);
+function wrapWrtc(connectionId, peer, localDevice, initiator, getTrustLevel, receiveLimits) {
+    return wrapBinaryPeer(connectionId, peer, localDevice, initiator, { protocol: "wrtc", markTransportSecure: true, receiveLimits }, getTrustLevel);
 }

package/dist/device/binary-peer-connection-v2.test.js

@@ -11,6 +11,7 @@ class MockBinaryPeer {
     drainHandlers = [];
     otherPeer;
     _bufferedAmount = 0;
+    destroyed = false;
     on(event, handler) {
         if (event === "data") {
             this.dataHandlers.push(handler);
@@ -41,6 +42,7 @@ class MockBinaryPeer {
         }
     }
     destroy() {
+        this.destroyed = true;
         for (const handler of this.closeHandlers) {
             handler();
         }
@@ -50,6 +52,20 @@ class MockBinaryPeer {
     getBufferedAmount() {
         return this._bufferedAmount;
     }
+    receive(data) {
+        for (const handler of this.dataHandlers) {
+            handler(data);
+        }
+    }
+}
+function rpcStartFrame(messageId, totalSize, chunk = new Uint8Array()) {
+    const frame = new Uint8Array(9 + chunk.length);
+    frame[0] = 0x01;
+    const view = new DataView(frame.buffer);
+    view.setUint32(1, messageId, false);
+    view.setUint32(5, totalSize, false);
+    frame.set(chunk, 9);
+    return frame;
 }
 async function getMockPeerPair() {
     const iPeer = new MockBinaryPeer();
@@ -270,6 +286,50 @@ describe("binary-peer-connection-v2", () => {
             rPeer.destroy();
         });
     });
+    describe("receive limits", () => {
+        it("closes before allocating an oversized declared RPC", async () => {
+            const { iPeer } = await getMockPeerPair();
+            (0, binary_peer_connection_v2_1.createBinaryPeerSocket)("limited", iPeer, "wrtc", {
+                maxRpcMessageBytes: 32,
+            });
+            iPeer.receive(rpcStartFrame(1, 33));
+            expect(iPeer.destroyed).toBe(true);
+        });
+        it("bounds aggregate and concurrent incomplete reassemblies", async () => {
+            const { iPeer } = await getMockPeerPair();
+            (0, binary_peer_connection_v2_1.createBinaryPeerSocket)("limited", iPeer, "wrtc", {
+                maxRpcMessageBytes: 32,
+                maxInFlightReassemblyBytes: 16,
+                maxConcurrentReassemblies: 2,
+            });
+            iPeer.receive(rpcStartFrame(1, 12, new Uint8Array([1])));
+            expect(iPeer.destroyed).toBe(false);
+            iPeer.receive(rpcStartFrame(2, 12, new Uint8Array([2])));
+            expect(iPeer.destroyed).toBe(true);
+        });
+        it("closes when an incomplete reassembly outlives its deadline", async () => {
+            const { iPeer } = await getMockPeerPair();
+            jest.useFakeTimers();
+            try {
+                (0, binary_peer_connection_v2_1.createBinaryPeerSocket)("limited", iPeer, "wrtc", {
+                    reassemblyTimeoutMs: 10,
+                });
+                iPeer.receive(rpcStartFrame(1, 32, new Uint8Array([1])));
+                jest.advanceTimersByTime(10);
+                expect(iPeer.destroyed).toBe(true);
+            }
+            finally {
+                jest.useRealTimers();
+            }
+        });
+        it("closes when continuation bytes exceed the declared RPC size", async () => {
+            const { iPeer } = await getMockPeerPair();
+            (0, binary_peer_connection_v2_1.createBinaryPeerSocket)("limited", iPeer, "wrtc");
+            iPeer.receive(rpcStartFrame(1, 2, new Uint8Array([1])));
+            iPeer.receive(new Uint8Array([0x02, 0, 0, 0, 1, 2, 3]));
+            expect(iPeer.destroyed).toBe(true);
+        });
+    });
     describe("createBinaryPeerSocket raw bytes (stream mode)", () => {
         it("should send/receive raw bytes", async () => {
             const { iPeer, rPeer } = await getMockPeerPair();

package/dist/device/binary-peer-connection.d.ts

@@ -27,12 +27,23 @@ export interface WrapBinaryPeerOptions {
      * When true, sets secureLocal and secureRemote to skip application-level encryption.
      */
     markTransportSecure?: boolean;
+    /** Optional hard limits for untrusted inbound messages. */
+    receiveLimits?: Partial<BinaryPeerReceiveLimits>;
+}
+/** Hard receive limits for the legacy binary peer parser. */
+export interface BinaryPeerReceiveLimits {
+    /** Maximum bytes in one complete or reassembled RPC message. */
+    maxRpcMessageBytes: number;
+    /** Maximum bytes in one raw stream frame. */
+    maxStreamMessageBytes: number;
+    /** Maximum time an incomplete RPC message may retain memory. */
+    reassemblyTimeoutMs: number;
 }
 /**
  * Creates an ISocket from a binary peer without creating a full Connection.
  * Useful when you need to pass custom localServerAddresses to the Connection.
  */
-export declare function createBinaryPeerSocket(connectionId: string, peer: IBinaryPeer, protocol?: string): ISocket;
+export declare function createBinaryPeerSocket(connectionId: string, peer: IBinaryPeer, protocol?: string, receiveLimitOverrides?: Partial<BinaryPeerReceiveLimits>): ISocket;
 /**
  * Wraps a binary peer (WebRTC or WebSocket) into a Connection.
  * This is the main implementation that handles all binary protocols.
@@ -43,5 +54,5 @@ export declare function wrapBinaryPeer(connectionId: string, peer: IBinaryPeer,
  * Backwards-compatible wrapper around wrapBinaryPeer.
  * WebRTC is encrypted at the transport layer (DTLS-SRTP), so we skip application-level encryption.
  */
-export declare function wrapWrtc(connectionId: string, peer: IWebRTCPeer, localDevice: Device, initiator: boolean, getTrustLevel?: ITrustLevelFn): Connection;
+export declare function wrapWrtc(connectionId: string, peer: IWebRTCPeer, localDevice: Device, initiator: boolean, getTrustLevel?: ITrustLevelFn, receiveLimits?: Partial<BinaryPeerReceiveLimits>): Connection;
 export {};