@pluv/io 0.41.7 → 0.43.0

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @pluv/io@0.41.7 build /home/runner/work/pluv/pluv/packages/io
+> @pluv/io@0.43.0 build /home/runner/work/pluv/pluv/packages/io
 > pnpm run version && tsup src/index.ts --format esm,cjs --dts
 
 
-> @pluv/io@0.41.7 version /home/runner/work/pluv/pluv/packages/io
+> @pluv/io@0.43.0 version /home/runner/work/pluv/pluv/packages/io
 > genversion ./src/version.generated.ts --esm
 
 CLI Building entry: src/index.ts
@@ -12,11 +12,11 @@
 CLI Target: es6
 ESM Build start
 CJS Build start
-ESM dist/index.mjs 49.44 KB
-ESM ⚡️ Build success in 113ms
-CJS dist/index.js 51.61 KB
-CJS ⚡️ Build success in 116ms
+ESM dist/index.mjs 50.72 KB
+ESM ⚡️ Build success in 150ms
+CJS dist/index.js 52.90 KB
+CJS ⚡️ Build success in 151ms
 DTS Build start
-DTS ⚡️ Build success in 2933ms
-DTS dist/index.d.mts 31.42 KB
-DTS dist/index.d.ts  31.42 KB
+DTS ⚡️ Build success in 2855ms
+DTS dist/index.d.mts 32.19 KB
+DTS dist/index.d.ts  32.19 KB

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # @pluv/io
 
+## 0.43.0
+
+### Minor Changes
+
+- 0063e80: **BREAKING** Added a configurable limit for the max-size (in bytes) for storage (defaulting to 30MB). To unset this limit, you can set this limit to `0` or `null`.
+
+  ```ts
+  createIO({
+    limits: {
+      storageMaxSize: null,
+    },
+  });
+  ```
+
+- 4b0fbb3: **BREAKING** Added the ability to configure the limits for user object size, presence size, and user id length. User id is now defaulted to be limited to 128 characters. To unset this limit, you can set this limit to `0` or `null`.
+
+  ```ts
+  // defaults
+  createIO(
+    platformCloudflare({
+      limits: {
+        presenceMaxSize: 512,
+        storageMaxSize: 31_457_280,
+        userIdMaxLength: 128,
+        userMaxSize: 512,
+      },
+    }),
+  );
+  ```
+
+### Patch Changes
+
+- e60a677: Fix 1 and 2 character long room names not being supported.
+- 244a973: Fixed not applying user size limits when calling `PluvIO.authorize` and not allowing it to be overwritten for `platformPluv`.
+  - @pluv/crdt@0.43.0
+  - @pluv/types@0.43.0
+
+## 0.42.0
+
+### Patch Changes
+
+- cf1529a: Each time garbage collection is run, a sync-state event will be emitted to connected sessions with info of currently connected users.
+  - @pluv/crdt@0.42.0
+  - @pluv/types@0.42.0
+
 ## 0.41.7
 
 ### Patch Changes

package/dist/index.d.mts

@@ -9,8 +9,9 @@ declare abstract class AbstractPersistence {
     abstract deleteUsers(room: string): Promise<void>;
     abstract getStorageState(room: string): Promise<string | null>;
     abstract getUser(room: string, connectionId: string): Promise<JsonObject | null>;
-    abstract getUsers(room: string): Promise<readonly (JsonObject | null)[]>;
+    abstract getUsers(room: string): Promise<Map<[connectionId: string][0], JsonObject | null>>;
     abstract getUsersSize(room: string): Promise<number>;
+    abstract initialize(roomContext: any): AbstractPersistence;
     abstract setStorageState(room: string, state: string): Promise<void>;
 }
 
@@ -194,6 +195,24 @@ type ResolvedPluvIOAuthorize<TPlatform extends AbstractPlatform<any, any, any, a
     secret?: string;
 }, Exclude<"secret", InferPlatformAuthorizeProperties<TPlatform>>>;
 type PluvIOAuthorize<TPlatform extends AbstractPlatform<any, any, any, any>, TUser extends BaseUser | null = any, TContext extends Record<string, unknown> = {}> = (TUser extends BaseUser ? ResolvedPluvIOAuthorize<TPlatform, TUser> : null) | ((context: TContext) => TUser extends BaseUser ? ResolvedPluvIOAuthorize<TPlatform, TUser> : null);
+interface PluvIOLimits {
+    /**
+     * @description Maximum size of presence object in bytes
+     */
+    presenceMaxSize?: number | null;
+    /**
+     * @description Maximum size of storage state in bytes
+     */
+    storageMaxSize?: number | null;
+    /**
+     * @description Maximum length of user id in characters
+     */
+    userIdMaxLength?: number | null;
+    /**
+     * @description Maximum size of user object in bytes
+     */
+    userMaxSize?: number | null;
+}
 type BasePluvIOListeners<TPlatform extends AbstractPlatform<any, any, any, any>, TAuthorize extends PluvIOAuthorize<TPlatform, any, InferInitContextType<TPlatform>> | null, TContext extends Record<string, any>, TEvents extends PluvRouterEventConfig<TPlatform, TAuthorize, TContext>> = {
     onRoomDeleted: (event: IORoomListenerEvent<TContext>) => void;
     onRoomMessage: (event: IORoomMessageEvent<TPlatform, TAuthorize, TContext, TEvents>) => void;
@@ -385,6 +404,7 @@ declare class IORoom<TPlatform extends AbstractPlatform<any> = AbstractPlatform<
     private _closeWebSockets;
     private _emitQuitters;
     private _emitRegistered;
+    private _emitSyncState;
     private _ensureDetached;
     private _getAbstractWs;
     private _getAuthorizedUser;
@@ -417,6 +437,8 @@ type PluvServerConfig<TPlatform extends AbstractPlatform<any, any> = AbstractPla
     };
     debug?: boolean;
     getInitialStorage?: GetInitialStorageFn<TContext>;
+    limits: PluvIOLimits;
+    io: PluvIO<TPlatform, TAuthorize, TContext>;
     platform: TPlatform;
     router?: PluvRouter<TPlatform, TAuthorize, TContext, TEvents>;
 };
@@ -432,6 +454,8 @@ declare class PluvServer<TPlatform extends AbstractPlatform<any, any> = Abstract
     private readonly _crdt;
     private readonly _debug;
     private readonly _getInitialStorage;
+    private readonly _io;
+    private readonly _limits;
     private readonly _platform;
     private readonly _router;
     get fetch(): (...args: any[]) => Promise<any>;
@@ -450,7 +474,6 @@ declare class PluvServer<TPlatform extends AbstractPlatform<any, any> = Abstract
     constructor(options: PluvServerConfig<TPlatform, TAuthorize, TContext, TEvents>);
     createRoom(room: string, ...options: CreateRoomOptions<TPlatform, TAuthorize, TContext, TEvents>): IORoom<TPlatform, TAuthorize, TContext, TEvents>;
     createToken(params: JWTEncodeParams<InferIOAuthorizeUser<InferIOAuthorize<this>>, TPlatform>): Promise<string>;
-    private _getIOAuthorize;
     private _getListeners;
     private _logDebug;
 }
@@ -460,6 +483,7 @@ type PluvIOConfig<TPlatform extends AbstractPlatform<any>, TAuthorize extends IO
     context?: PluvContext<TPlatform, TContext>;
     crdt?: CrdtLibraryType;
     debug?: boolean;
+    limits?: PluvIOLimits;
     platform: TPlatform;
 };
 type ResolvedServerConfig<TPlatform extends AbstractPlatform<any> = AbstractPlatform<any>, TAuthorize extends PluvIOAuthorize<TPlatform, any, InferInitContextType<TPlatform>> | null = any, TContext extends Record<string, any> = {}, TEvents extends PluvRouterEventConfig<TPlatform, TAuthorize, TContext> = {}> = Partial<PluvIOListeners<TPlatform, TAuthorize, TContext, TEvents>> & PluvIORouter<TPlatform, TAuthorize, TContext, TEvents> & {
@@ -474,6 +498,7 @@ declare class PluvIO<TPlatform extends AbstractPlatform<any> = AbstractPlatform<
     private readonly _context;
     private readonly _crdt;
     private readonly _debug;
+    private readonly _limits;
     private readonly _platform;
     get procedure(): PluvProcedure<TPlatform, TAuthorize, TContext, {}, {}>;
     constructor(options: PluvIOConfig<TPlatform, TAuthorize, TContext>);
@@ -489,8 +514,9 @@ type CreateIOParams<TPlatform extends AbstractPlatform<any> = AbstractPlatform<a
     context?: PluvContext<TPlatform, TContext>;
     crdt?: CrdtLibraryType;
     debug?: boolean;
+    limits?: PluvIOLimits;
     platform: TPlatform;
 };
 declare const createIO: <TPlatform extends AbstractPlatform<any> = AbstractPlatform<any>, TContext extends Record<string, any> = {}, TUser extends BaseUser | null = null>(params: CreateIOParams<TPlatform, TContext, TUser>) => PluvIO<TPlatform, PluvIOAuthorize<TPlatform, TUser, InferInitContextType<TPlatform>>, TContext>;
 
-export { type AbstractCloseEvent, type AbstractErrorEvent, type AbstractEvent, type AbstractEventMap, type AbstractListener, type AbstractMessageEvent, AbstractPersistence, AbstractPlatform, type AbstractPlatformConfig, AbstractPubSub, AbstractWebSocket, type AbstractWebSocketConfig, type AbstractWebSocketHandleErrorParams, type AuthorizeModule, type AuthorizeParams, type ConvertWebSocketConfig, type CrdtLibraryType, type CreateIOParams, type CreateRoomOptions, type GetInitialStorageFn, type HandleMode, type IOPubSubEventMessage, IORoom, type IORoomListenerEvent, type IORoomMessageEvent, type IOStorageUpdatedEvent, type IOUserConnectedEvent, type IOUserDisconnectedEvent, type InferIORoom, type InferInitContextType, type InferPlatformWebSocketType, type InferRoomContextType, type JWT, type JWTEncodeParams, type MergedRouter, type PlatformConfig, type PluvContext, PluvIO, type PluvIOAuthorize, type PluvIOConfig, type PluvIOListeners, PluvProcedure, type PluvProcedureConfig, PluvRouter, type PluvRouterEventConfig, PluvServer, type PluvServerConfig, type ServerConfig, type WebSocketRegistrationMode, type WebSocketSerializedState, type WebSocketSession, authorize, createIO };
+export { type AbstractCloseEvent, type AbstractErrorEvent, type AbstractEvent, type AbstractEventMap, type AbstractListener, type AbstractMessageEvent, AbstractPersistence, AbstractPlatform, type AbstractPlatformConfig, AbstractPubSub, AbstractWebSocket, type AbstractWebSocketConfig, type AbstractWebSocketHandleErrorParams, type AuthorizeModule, type AuthorizeParams, type ConvertWebSocketConfig, type CrdtLibraryType, type CreateIOParams, type CreateRoomOptions, type GetInitialStorageFn, type HandleMode, type IOPubSubEventMessage, IORoom, type IORoomListenerEvent, type IORoomMessageEvent, type IOStorageUpdatedEvent, type IOUserConnectedEvent, type IOUserDisconnectedEvent, type InferIORoom, type InferInitContextType, type InferPlatformWebSocketType, type InferRoomContextType, type JWT, type JWTEncodeParams, type MergedRouter, type PlatformConfig, type PluvContext, PluvIO, type PluvIOAuthorize, type PluvIOConfig, type PluvIOLimits, type PluvIOListeners, PluvProcedure, type PluvProcedureConfig, PluvRouter, type PluvRouterEventConfig, PluvServer, type PluvServerConfig, type ServerConfig, type WebSocketRegistrationMode, type WebSocketSerializedState, type WebSocketSession, authorize, createIO };

package/dist/index.d.ts

@@ -9,8 +9,9 @@ declare abstract class AbstractPersistence {
     abstract deleteUsers(room: string): Promise<void>;
     abstract getStorageState(room: string): Promise<string | null>;
     abstract getUser(room: string, connectionId: string): Promise<JsonObject | null>;
-    abstract getUsers(room: string): Promise<readonly (JsonObject | null)[]>;
+    abstract getUsers(room: string): Promise<Map<[connectionId: string][0], JsonObject | null>>;
     abstract getUsersSize(room: string): Promise<number>;
+    abstract initialize(roomContext: any): AbstractPersistence;
     abstract setStorageState(room: string, state: string): Promise<void>;
 }
 
@@ -194,6 +195,24 @@ type ResolvedPluvIOAuthorize<TPlatform extends AbstractPlatform<any, any, any, a
     secret?: string;
 }, Exclude<"secret", InferPlatformAuthorizeProperties<TPlatform>>>;
 type PluvIOAuthorize<TPlatform extends AbstractPlatform<any, any, any, any>, TUser extends BaseUser | null = any, TContext extends Record<string, unknown> = {}> = (TUser extends BaseUser ? ResolvedPluvIOAuthorize<TPlatform, TUser> : null) | ((context: TContext) => TUser extends BaseUser ? ResolvedPluvIOAuthorize<TPlatform, TUser> : null);
+interface PluvIOLimits {
+    /**
+     * @description Maximum size of presence object in bytes
+     */
+    presenceMaxSize?: number | null;
+    /**
+     * @description Maximum size of storage state in bytes
+     */
+    storageMaxSize?: number | null;
+    /**
+     * @description Maximum length of user id in characters
+     */
+    userIdMaxLength?: number | null;
+    /**
+     * @description Maximum size of user object in bytes
+     */
+    userMaxSize?: number | null;
+}
 type BasePluvIOListeners<TPlatform extends AbstractPlatform<any, any, any, any>, TAuthorize extends PluvIOAuthorize<TPlatform, any, InferInitContextType<TPlatform>> | null, TContext extends Record<string, any>, TEvents extends PluvRouterEventConfig<TPlatform, TAuthorize, TContext>> = {
     onRoomDeleted: (event: IORoomListenerEvent<TContext>) => void;
     onRoomMessage: (event: IORoomMessageEvent<TPlatform, TAuthorize, TContext, TEvents>) => void;
@@ -385,6 +404,7 @@ declare class IORoom<TPlatform extends AbstractPlatform<any> = AbstractPlatform<
     private _closeWebSockets;
     private _emitQuitters;
     private _emitRegistered;
+    private _emitSyncState;
     private _ensureDetached;
     private _getAbstractWs;
     private _getAuthorizedUser;
@@ -417,6 +437,8 @@ type PluvServerConfig<TPlatform extends AbstractPlatform<any, any> = AbstractPla
     };
     debug?: boolean;
     getInitialStorage?: GetInitialStorageFn<TContext>;
+    limits: PluvIOLimits;
+    io: PluvIO<TPlatform, TAuthorize, TContext>;
     platform: TPlatform;
     router?: PluvRouter<TPlatform, TAuthorize, TContext, TEvents>;
 };
@@ -432,6 +454,8 @@ declare class PluvServer<TPlatform extends AbstractPlatform<any, any> = Abstract
     private readonly _crdt;
     private readonly _debug;
     private readonly _getInitialStorage;
+    private readonly _io;
+    private readonly _limits;
     private readonly _platform;
     private readonly _router;
     get fetch(): (...args: any[]) => Promise<any>;
@@ -450,7 +474,6 @@ declare class PluvServer<TPlatform extends AbstractPlatform<any, any> = Abstract
     constructor(options: PluvServerConfig<TPlatform, TAuthorize, TContext, TEvents>);
     createRoom(room: string, ...options: CreateRoomOptions<TPlatform, TAuthorize, TContext, TEvents>): IORoom<TPlatform, TAuthorize, TContext, TEvents>;
     createToken(params: JWTEncodeParams<InferIOAuthorizeUser<InferIOAuthorize<this>>, TPlatform>): Promise<string>;
-    private _getIOAuthorize;
     private _getListeners;
     private _logDebug;
 }
@@ -460,6 +483,7 @@ type PluvIOConfig<TPlatform extends AbstractPlatform<any>, TAuthorize extends IO
     context?: PluvContext<TPlatform, TContext>;
     crdt?: CrdtLibraryType;
     debug?: boolean;
+    limits?: PluvIOLimits;
     platform: TPlatform;
 };
 type ResolvedServerConfig<TPlatform extends AbstractPlatform<any> = AbstractPlatform<any>, TAuthorize extends PluvIOAuthorize<TPlatform, any, InferInitContextType<TPlatform>> | null = any, TContext extends Record<string, any> = {}, TEvents extends PluvRouterEventConfig<TPlatform, TAuthorize, TContext> = {}> = Partial<PluvIOListeners<TPlatform, TAuthorize, TContext, TEvents>> & PluvIORouter<TPlatform, TAuthorize, TContext, TEvents> & {
@@ -474,6 +498,7 @@ declare class PluvIO<TPlatform extends AbstractPlatform<any> = AbstractPlatform<
     private readonly _context;
     private readonly _crdt;
     private readonly _debug;
+    private readonly _limits;
     private readonly _platform;
     get procedure(): PluvProcedure<TPlatform, TAuthorize, TContext, {}, {}>;
     constructor(options: PluvIOConfig<TPlatform, TAuthorize, TContext>);
@@ -489,8 +514,9 @@ type CreateIOParams<TPlatform extends AbstractPlatform<any> = AbstractPlatform<a
     context?: PluvContext<TPlatform, TContext>;
     crdt?: CrdtLibraryType;
     debug?: boolean;
+    limits?: PluvIOLimits;
     platform: TPlatform;
 };
 declare const createIO: <TPlatform extends AbstractPlatform<any> = AbstractPlatform<any>, TContext extends Record<string, any> = {}, TUser extends BaseUser | null = null>(params: CreateIOParams<TPlatform, TContext, TUser>) => PluvIO<TPlatform, PluvIOAuthorize<TPlatform, TUser, InferInitContextType<TPlatform>>, TContext>;
 
-export { type AbstractCloseEvent, type AbstractErrorEvent, type AbstractEvent, type AbstractEventMap, type AbstractListener, type AbstractMessageEvent, AbstractPersistence, AbstractPlatform, type AbstractPlatformConfig, AbstractPubSub, AbstractWebSocket, type AbstractWebSocketConfig, type AbstractWebSocketHandleErrorParams, type AuthorizeModule, type AuthorizeParams, type ConvertWebSocketConfig, type CrdtLibraryType, type CreateIOParams, type CreateRoomOptions, type GetInitialStorageFn, type HandleMode, type IOPubSubEventMessage, IORoom, type IORoomListenerEvent, type IORoomMessageEvent, type IOStorageUpdatedEvent, type IOUserConnectedEvent, type IOUserDisconnectedEvent, type InferIORoom, type InferInitContextType, type InferPlatformWebSocketType, type InferRoomContextType, type JWT, type JWTEncodeParams, type MergedRouter, type PlatformConfig, type PluvContext, PluvIO, type PluvIOAuthorize, type PluvIOConfig, type PluvIOListeners, PluvProcedure, type PluvProcedureConfig, PluvRouter, type PluvRouterEventConfig, PluvServer, type PluvServerConfig, type ServerConfig, type WebSocketRegistrationMode, type WebSocketSerializedState, type WebSocketSession, authorize, createIO };
+export { type AbstractCloseEvent, type AbstractErrorEvent, type AbstractEvent, type AbstractEventMap, type AbstractListener, type AbstractMessageEvent, AbstractPersistence, AbstractPlatform, type AbstractPlatformConfig, AbstractPubSub, AbstractWebSocket, type AbstractWebSocketConfig, type AbstractWebSocketHandleErrorParams, type AuthorizeModule, type AuthorizeParams, type ConvertWebSocketConfig, type CrdtLibraryType, type CreateIOParams, type CreateRoomOptions, type GetInitialStorageFn, type HandleMode, type IOPubSubEventMessage, IORoom, type IORoomListenerEvent, type IORoomMessageEvent, type IOStorageUpdatedEvent, type IOUserConnectedEvent, type IOUserDisconnectedEvent, type InferIORoom, type InferInitContextType, type InferPlatformWebSocketType, type InferRoomContextType, type JWT, type JWTEncodeParams, type MergedRouter, type PlatformConfig, type PluvContext, PluvIO, type PluvIOAuthorize, type PluvIOConfig, type PluvIOLimits, type PluvIOListeners, PluvProcedure, type PluvProcedureConfig, PluvRouter, type PluvRouterEventConfig, PluvServer, type PluvServerConfig, type ServerConfig, type WebSocketRegistrationMode, type WebSocketSerializedState, type WebSocketSession, authorize, createIO };

package/dist/index.js

@@ -145,9 +145,19 @@ var Persistence = class extends AbstractPersistence {
     return Promise.resolve(user != null ? user : null);
   }
   getUsers(room) {
-    const users = this._users.get(room);
-    if (!users) return Promise.resolve([]);
-    return Promise.resolve(Array.from(users.values()));
+    return __async(this, null, function* () {
+      const users = this._users.get(room);
+      if (!users) return /* @__PURE__ */ new Map();
+      return users;
+    });
+  }
+  getUsersSize(room) {
+    return __async(this, null, function* () {
+      return this._users.size;
+    });
+  }
+  initialize(roomContext) {
+    return this;
   }
   setStorageState(room, state) {
     this._storages.set(room, state);
@@ -389,6 +399,8 @@ var import_kleur = __toESM(require("kleur"));
 // src/constants.ts
 var GARBAGE_COLLECT_INTERVAL_MS = 6e4;
 var MAX_PRESENCE_SIZE_BYTES = 512;
+var MAX_STORAGE_SIZE_BYTES = 31457280;
+var MAX_USER_ID_LENGTH = 128;
 var MAX_USER_SIZE_BYTES = 512;
 var PING_TIMEOUT_MS = 3e4;
 
@@ -503,6 +515,7 @@ var IORoom = class {
     return __async(this, null, function* () {
       this._lastGarbageCollectMs = Date.now();
       this._emitQuitters();
+      this._emitSyncState();
     });
   }
   getSize() {
@@ -695,6 +708,17 @@ var IORoom = class {
       }
     });
   }
+  _emitSyncState() {
+    return __async(this, null, function* () {
+      const connectionIds = yield this._platform.persistence.getUsers(this.id).then((map) => Object.keys(map));
+      yield this._broadcast({
+        message: {
+          type: "$syncStateReceived",
+          data: { connectionIds }
+        }
+      });
+    });
+  }
   _ensureDetached() {
     if (this._platform._config.registrationMode === "detached") return;
     throw new Error("Platform must use detached mode");
@@ -1117,7 +1141,7 @@ var pickBy = (obj, by) => {
 };
 
 // src/version.generated.ts
-var version = "0.41.7";
+var version = "0.43.0";
 
 // src/PluvServer.ts
 var PluvServer = class {
@@ -1168,18 +1192,22 @@ var PluvServer = class {
           update
         ];
         if (updates.some((_update) => !!_update)) {
-          const encodedState = doc.batchApplyEncodedState(updates).getEncodedState();
-          yield this._platform.persistence.setStorageState(room, encodedState);
+          const encodedState2 = doc.batchApplyEncodedState(updates).getEncodedState();
+          yield this._platform.persistence.setStorageState(room, encodedState2);
           this._getListeners().onStorageUpdated({
             context,
-            encodedState,
+            encodedState: encodedState2,
             room,
             user: session == null ? void 0 : session.user,
             webSocket: session == null ? void 0 : session.webSocket.webSocket
           });
         }
-        const state = (_b = yield this._platform.persistence.getStorageState(room)) != null ? _b : doc.getEncodedState();
-        return { $storageReceived: { state } };
+        const encodedState = (_b = yield this._platform.persistence.getStorageState(room)) != null ? _b : doc.getEncodedState();
+        const storageSize = new TextEncoder().encode(encodedState).length;
+        if (!!this._limits.storageMaxSize && storageSize > this._limits.storageMaxSize) {
+          throw new Error("Storage has exceeded the size limit");
+        }
+        return { $storageReceived: { state: encodedState } };
       })),
       $ping: this._procedure.self((data, { session }) => {
         if (!session) return {};
@@ -1199,7 +1227,7 @@ var PluvServer = class {
         const cleanedPatch = pickBy(presence != null ? presence : {}, (value) => typeof value !== "undefined");
         const updated = Object.assign(/* @__PURE__ */ Object.create(null), session.presence, cleanedPatch);
         const bytes = new TextEncoder().encode(JSON.stringify(updated)).length;
-        if (bytes > MAX_PRESENCE_SIZE_BYTES) {
+        if (!!this._limits.presenceMaxSize && bytes > this._limits.presenceMaxSize) {
           throw new Error(
             `Large presence. Presence must be at most 512 bytes. Current size: ${bytes.toLocaleString()}`
           );
@@ -1219,6 +1247,10 @@ var PluvServer = class {
         if (origin === "$initialized" && Object.keys(doc.toJson()).length) return {};
         const updated = update === null ? doc : doc.applyEncodedState({ update });
         const encodedState = updated.getEncodedState();
+        const storageSize = new TextEncoder().encode(encodedState).length;
+        if (!!this._limits.storageMaxSize && storageSize > this._limits.storageMaxSize) {
+          throw new Error("Storage has exceeded the size limit");
+        }
         this._platform.persistence.setStorageState(room, encodedState).then(() => {
           this._getListeners().onStorageUpdated({
             context,
@@ -1237,6 +1269,8 @@ var PluvServer = class {
       crdt = import_crdt2.noop,
       debug = false,
       getInitialStorage,
+      io,
+      limits,
       platform,
       router = new PluvRouter({})
     } = options;
@@ -1244,6 +1278,8 @@ var PluvServer = class {
     platform.validateConfig(options);
     this._crdt = crdt;
     this._debug = debug;
+    this._io = io;
+    this._limits = limits;
     this._platform = platform;
     this._router = router ? PluvRouter.merge(this._baseRouter, router) : this._baseRouter;
     if (authorize2) this._authorize = authorize2;
@@ -1285,7 +1321,7 @@ var PluvServer = class {
     if (this._platform._config.handleMode !== "io") {
       throw new Error(`\`createRoom\` is unsupported for \`${this._platform._name}\``);
     }
-    if (!/^[a-z0-9]+[a-z0-9\-_]+[a-z0-9]+$/i.test(room)) throw new Error("Unsupported room name");
+    if (!/^[a-z0-9](?:[a-z0-9-_]*[a-z0-9])?$/i.test(room)) throw new Error("Unsupported room name");
     const roomContext = platformRoomContext;
     const context = typeof this._context === "function" ? this._context(roomContext) : this._context;
     const newRoom = new IORoom(room, __spreadProps(__spreadValues({}, !!_meta ? { _meta } : {}), {
@@ -1319,29 +1355,9 @@ var PluvServer = class {
   }
   createToken(params) {
     return __async(this, null, function* () {
-      var _a;
-      if (!this._authorize) {
-        throw new Error("IO does not specify authorize during initialization.");
-      }
-      const ioAuthorize = this._getIOAuthorize(params);
-      const user = params.user;
-      const parsed = !!ioAuthorize ? ioAuthorize.user.parse(user) : user;
-      const bytes = new TextEncoder().encode(JSON.stringify(parsed)).length;
-      if (bytes > MAX_USER_SIZE_BYTES) {
-        throw new Error(
-          `createToken called with large payload. User must be at most 512 bytes. Current size: ${bytes.toLocaleString()}`
-        );
-      }
-      if (this._platform._createToken) return yield this._platform._createToken(params);
-      const secret = (_a = ioAuthorize == null ? void 0 : ioAuthorize.secret) != null ? _a : null;
-      if (!secret) throw new Error("`authorize` was specified without a valid secret");
-      return yield authorize({ platform: this._platform, secret }).encode(params);
+      return yield this._io.createToken(params);
     });
   }
-  _getIOAuthorize(options) {
-    if (typeof this._authorize === "function") return this._authorize(options);
-    return this._authorize;
-  }
   _getListeners() {
     return this._listeners;
   }
@@ -1356,9 +1372,15 @@ var PluvIO = class {
     this.version = version;
     this._authorize = null;
     this._context = {};
-    const { authorize: authorize2, context, crdt = import_crdt3.noop, debug = false, platform } = options;
+    const { authorize: authorize2, context, crdt = import_crdt3.noop, debug = false, limits, platform } = options;
     this._crdt = crdt;
     this._debug = debug;
+    this._limits = __spreadValues({
+      presenceMaxSize: MAX_PRESENCE_SIZE_BYTES,
+      storageMaxSize: MAX_STORAGE_SIZE_BYTES,
+      userIdMaxLength: MAX_USER_ID_LENGTH,
+      userMaxSize: MAX_USER_SIZE_BYTES
+    }, limits);
     this._platform = platform;
     if (authorize2) this._authorize = authorize2;
     if (context) this._context = context;
@@ -1371,6 +1393,20 @@ var PluvIO = class {
       var _a;
       if (!this._authorize) throw new Error("IO does not specify authorize during initialization.");
       const ioAuthorize = this._getIOAuthorize(params);
+      const user = params.user;
+      const parsed = !!ioAuthorize ? ioAuthorize.user.parse(user) : user;
+      if (!!this._limits.userIdMaxLength && user.id.length > this._limits.userIdMaxLength) {
+        throw new Error(
+          `createToken was called with a long user id. User ID must be at most 128 characters. Current length: ${user.id.length.toLocaleString()}`
+        );
+      }
+      const bytes = new TextEncoder().encode(JSON.stringify(parsed)).length;
+      if (!!this._limits.userMaxSize && bytes > this._limits.userMaxSize) {
+        throw new Error(
+          `createToken called with large payload. User must be at most 512 bytes. Current size: ${bytes.toLocaleString()}`
+        );
+      }
+      if (this._platform._createToken) return yield this._platform._createToken(params);
       const secret = (_a = ioAuthorize == null ? void 0 : ioAuthorize.secret) != null ? _a : null;
       if (!secret) throw new Error("`authorize` was specified without a valid secret");
       return yield authorize({ platform: this._platform, secret }).encode(params);
@@ -1393,6 +1429,8 @@ var PluvIO = class {
       context: this._context,
       crdt: this._crdt,
       debug: this._debug,
+      io: this,
+      limits: this._limits,
       platform: this._platform
     }));
   }
@@ -1406,12 +1444,13 @@ var PluvIO = class {
 
 // src/createIO.ts
 var createIO = (params) => {
-  const { authorize: authorize2, context, crdt, debug, platform } = params;
+  const { authorize: authorize2, context, crdt, debug, limits, platform } = params;
   return new PluvIO({
     authorize: authorize2,
     context,
     crdt,
     debug,
+    limits,
     platform
   });
 };

package/dist/index.mjs

@@ -103,9 +103,19 @@ var Persistence = class extends AbstractPersistence {
     return Promise.resolve(user != null ? user : null);
   }
   getUsers(room) {
-    const users = this._users.get(room);
-    if (!users) return Promise.resolve([]);
-    return Promise.resolve(Array.from(users.values()));
+    return __async(this, null, function* () {
+      const users = this._users.get(room);
+      if (!users) return /* @__PURE__ */ new Map();
+      return users;
+    });
+  }
+  getUsersSize(room) {
+    return __async(this, null, function* () {
+      return this._users.size;
+    });
+  }
+  initialize(roomContext) {
+    return this;
   }
   setStorageState(room, state) {
     this._storages.set(room, state);
@@ -347,6 +357,8 @@ import colors from "kleur";
 // src/constants.ts
 var GARBAGE_COLLECT_INTERVAL_MS = 6e4;
 var MAX_PRESENCE_SIZE_BYTES = 512;
+var MAX_STORAGE_SIZE_BYTES = 31457280;
+var MAX_USER_ID_LENGTH = 128;
 var MAX_USER_SIZE_BYTES = 512;
 var PING_TIMEOUT_MS = 3e4;
 
@@ -461,6 +473,7 @@ var IORoom = class {
     return __async(this, null, function* () {
       this._lastGarbageCollectMs = Date.now();
       this._emitQuitters();
+      this._emitSyncState();
     });
   }
   getSize() {
@@ -653,6 +666,17 @@ var IORoom = class {
       }
     });
   }
+  _emitSyncState() {
+    return __async(this, null, function* () {
+      const connectionIds = yield this._platform.persistence.getUsers(this.id).then((map) => Object.keys(map));
+      yield this._broadcast({
+        message: {
+          type: "$syncStateReceived",
+          data: { connectionIds }
+        }
+      });
+    });
+  }
   _ensureDetached() {
     if (this._platform._config.registrationMode === "detached") return;
     throw new Error("Platform must use detached mode");
@@ -1075,7 +1099,7 @@ var pickBy = (obj, by) => {
 };
 
 // src/version.generated.ts
-var version = "0.41.7";
+var version = "0.43.0";
 
 // src/PluvServer.ts
 var PluvServer = class {
@@ -1126,18 +1150,22 @@ var PluvServer = class {
           update
         ];
         if (updates.some((_update) => !!_update)) {
-          const encodedState = doc.batchApplyEncodedState(updates).getEncodedState();
-          yield this._platform.persistence.setStorageState(room, encodedState);
+          const encodedState2 = doc.batchApplyEncodedState(updates).getEncodedState();
+          yield this._platform.persistence.setStorageState(room, encodedState2);
           this._getListeners().onStorageUpdated({
             context,
-            encodedState,
+            encodedState: encodedState2,
             room,
             user: session == null ? void 0 : session.user,
             webSocket: session == null ? void 0 : session.webSocket.webSocket
           });
         }
-        const state = (_b = yield this._platform.persistence.getStorageState(room)) != null ? _b : doc.getEncodedState();
-        return { $storageReceived: { state } };
+        const encodedState = (_b = yield this._platform.persistence.getStorageState(room)) != null ? _b : doc.getEncodedState();
+        const storageSize = new TextEncoder().encode(encodedState).length;
+        if (!!this._limits.storageMaxSize && storageSize > this._limits.storageMaxSize) {
+          throw new Error("Storage has exceeded the size limit");
+        }
+        return { $storageReceived: { state: encodedState } };
       })),
       $ping: this._procedure.self((data, { session }) => {
         if (!session) return {};
@@ -1157,7 +1185,7 @@ var PluvServer = class {
         const cleanedPatch = pickBy(presence != null ? presence : {}, (value) => typeof value !== "undefined");
         const updated = Object.assign(/* @__PURE__ */ Object.create(null), session.presence, cleanedPatch);
         const bytes = new TextEncoder().encode(JSON.stringify(updated)).length;
-        if (bytes > MAX_PRESENCE_SIZE_BYTES) {
+        if (!!this._limits.presenceMaxSize && bytes > this._limits.presenceMaxSize) {
           throw new Error(
             `Large presence. Presence must be at most 512 bytes. Current size: ${bytes.toLocaleString()}`
           );
@@ -1177,6 +1205,10 @@ var PluvServer = class {
         if (origin === "$initialized" && Object.keys(doc.toJson()).length) return {};
         const updated = update === null ? doc : doc.applyEncodedState({ update });
         const encodedState = updated.getEncodedState();
+        const storageSize = new TextEncoder().encode(encodedState).length;
+        if (!!this._limits.storageMaxSize && storageSize > this._limits.storageMaxSize) {
+          throw new Error("Storage has exceeded the size limit");
+        }
         this._platform.persistence.setStorageState(room, encodedState).then(() => {
           this._getListeners().onStorageUpdated({
             context,
@@ -1195,6 +1227,8 @@ var PluvServer = class {
       crdt = noop2,
       debug = false,
       getInitialStorage,
+      io,
+      limits,
       platform,
       router = new PluvRouter({})
     } = options;
@@ -1202,6 +1236,8 @@ var PluvServer = class {
     platform.validateConfig(options);
     this._crdt = crdt;
     this._debug = debug;
+    this._io = io;
+    this._limits = limits;
     this._platform = platform;
     this._router = router ? PluvRouter.merge(this._baseRouter, router) : this._baseRouter;
     if (authorize2) this._authorize = authorize2;
@@ -1243,7 +1279,7 @@ var PluvServer = class {
     if (this._platform._config.handleMode !== "io") {
       throw new Error(`\`createRoom\` is unsupported for \`${this._platform._name}\``);
     }
-    if (!/^[a-z0-9]+[a-z0-9\-_]+[a-z0-9]+$/i.test(room)) throw new Error("Unsupported room name");
+    if (!/^[a-z0-9](?:[a-z0-9-_]*[a-z0-9])?$/i.test(room)) throw new Error("Unsupported room name");
     const roomContext = platformRoomContext;
     const context = typeof this._context === "function" ? this._context(roomContext) : this._context;
     const newRoom = new IORoom(room, __spreadProps(__spreadValues({}, !!_meta ? { _meta } : {}), {
@@ -1277,29 +1313,9 @@ var PluvServer = class {
   }
   createToken(params) {
     return __async(this, null, function* () {
-      var _a;
-      if (!this._authorize) {
-        throw new Error("IO does not specify authorize during initialization.");
-      }
-      const ioAuthorize = this._getIOAuthorize(params);
-      const user = params.user;
-      const parsed = !!ioAuthorize ? ioAuthorize.user.parse(user) : user;
-      const bytes = new TextEncoder().encode(JSON.stringify(parsed)).length;
-      if (bytes > MAX_USER_SIZE_BYTES) {
-        throw new Error(
-          `createToken called with large payload. User must be at most 512 bytes. Current size: ${bytes.toLocaleString()}`
-        );
-      }
-      if (this._platform._createToken) return yield this._platform._createToken(params);
-      const secret = (_a = ioAuthorize == null ? void 0 : ioAuthorize.secret) != null ? _a : null;
-      if (!secret) throw new Error("`authorize` was specified without a valid secret");
-      return yield authorize({ platform: this._platform, secret }).encode(params);
+      return yield this._io.createToken(params);
     });
   }
-  _getIOAuthorize(options) {
-    if (typeof this._authorize === "function") return this._authorize(options);
-    return this._authorize;
-  }
   _getListeners() {
     return this._listeners;
   }
@@ -1314,9 +1330,15 @@ var PluvIO = class {
     this.version = version;
     this._authorize = null;
     this._context = {};
-    const { authorize: authorize2, context, crdt = noop3, debug = false, platform } = options;
+    const { authorize: authorize2, context, crdt = noop3, debug = false, limits, platform } = options;
     this._crdt = crdt;
     this._debug = debug;
+    this._limits = __spreadValues({
+      presenceMaxSize: MAX_PRESENCE_SIZE_BYTES,
+      storageMaxSize: MAX_STORAGE_SIZE_BYTES,
+      userIdMaxLength: MAX_USER_ID_LENGTH,
+      userMaxSize: MAX_USER_SIZE_BYTES
+    }, limits);
     this._platform = platform;
     if (authorize2) this._authorize = authorize2;
     if (context) this._context = context;
@@ -1329,6 +1351,20 @@ var PluvIO = class {
       var _a;
       if (!this._authorize) throw new Error("IO does not specify authorize during initialization.");
       const ioAuthorize = this._getIOAuthorize(params);
+      const user = params.user;
+      const parsed = !!ioAuthorize ? ioAuthorize.user.parse(user) : user;
+      if (!!this._limits.userIdMaxLength && user.id.length > this._limits.userIdMaxLength) {
+        throw new Error(
+          `createToken was called with a long user id. User ID must be at most 128 characters. Current length: ${user.id.length.toLocaleString()}`
+        );
+      }
+      const bytes = new TextEncoder().encode(JSON.stringify(parsed)).length;
+      if (!!this._limits.userMaxSize && bytes > this._limits.userMaxSize) {
+        throw new Error(
+          `createToken called with large payload. User must be at most 512 bytes. Current size: ${bytes.toLocaleString()}`
+        );
+      }
+      if (this._platform._createToken) return yield this._platform._createToken(params);
       const secret = (_a = ioAuthorize == null ? void 0 : ioAuthorize.secret) != null ? _a : null;
       if (!secret) throw new Error("`authorize` was specified without a valid secret");
       return yield authorize({ platform: this._platform, secret }).encode(params);
@@ -1351,6 +1387,8 @@ var PluvIO = class {
       context: this._context,
       crdt: this._crdt,
       debug: this._debug,
+      io: this,
+      limits: this._limits,
       platform: this._platform
     }));
   }
@@ -1364,12 +1402,13 @@ var PluvIO = class {
 
 // src/createIO.ts
 var createIO = (params) => {
-  const { authorize: authorize2, context, crdt, debug, platform } = params;
+  const { authorize: authorize2, context, crdt, debug, limits, platform } = params;
   return new PluvIO({
     authorize: authorize2,
     context,
     crdt,
     debug,
+    limits,
     platform
   });
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pluv/io",
-  "version": "0.41.7",
+  "version": "0.43.0",
   "description": "@pluv/io server-side websocket manager",
   "author": "leedavidcs",
   "license": "MIT",
@@ -21,16 +21,16 @@
     "jose": "^5.10.0",
     "kleur": "^4.1.5",
     "wonka": "^6.3.5",
-    "@pluv/crdt": "^0.41.7",
-    "@pluv/types": "^0.41.7"
+    "@pluv/crdt": "^0.43.0",
+    "@pluv/types": "^0.43.0"
   },
   "devDependencies": {
-    "eslint": "^9.25.0",
+    "eslint": "^9.25.1",
     "genversion": "^3.2.0",
     "tsup": "^8.4.0",
     "typescript": "^5.8.3",
-    "@pluv/tsconfig": "^0.41.7",
-    "eslint-config-pluv": "^0.41.7"
+    "@pluv/tsconfig": "^0.43.0",
+    "eslint-config-pluv": "^0.43.0"
   },
   "scripts": {
     "build": "pnpm run version && tsup src/index.ts --format esm,cjs --dts",

package/src/AbstractPersistence.ts

@@ -13,9 +13,11 @@ export abstract class AbstractPersistence {
 
     public abstract getUser(room: string, connectionId: string): Promise<JsonObject | null>;
 
-    public abstract getUsers(room: string): Promise<readonly (JsonObject | null)[]>;
+    public abstract getUsers(room: string): Promise<Map<[connectionId: string][0], JsonObject | null>>;
 
     public abstract getUsersSize(room: string): Promise<number>;
 
+    public abstract initialize(roomContext: any): AbstractPersistence;
+
     public abstract setStorageState(room: string, state: string): Promise<void>;
 }

package/src/IORoom.ts

@@ -256,6 +256,7 @@ export class IORoom<
     public async garbageCollect(): Promise<void> {
         this._lastGarbageCollectMs = Date.now();
         this._emitQuitters();
+        this._emitSyncState();
     }
 
     public getSize(): number {
@@ -507,6 +508,17 @@ export class IORoom<
         }
     }
 
+    private async _emitSyncState(): Promise<void> {
+        const connectionIds = await this._platform.persistence.getUsers(this.id).then((map) => Object.keys(map));
+
+        await this._broadcast({
+            message: {
+                type: "$syncStateReceived",
+                data: { connectionIds },
+            },
+        });
+    }
+
     private _ensureDetached(): void {
         if (this._platform._config.registrationMode === "detached") return;
 

package/src/Persistence.ts

@@ -57,12 +57,20 @@ export class Persistence extends AbstractPersistence {
         return Promise.resolve(user ?? null);
     }
 
-    public getUsers(room: string): Promise<readonly (JsonObject | null)[]> {
+    public async getUsers(room: string): Promise<Map<string, JsonObject | null>> {
         const users = this._users.get(room);
 
-        if (!users) return Promise.resolve([]);
+        if (!users) return new Map();
 
-        return Promise.resolve(Array.from(users.values()));
+        return users;
+    }
+
+    public async getUsersSize(room: string): Promise<number> {
+        return this._users.size;
+    }
+
+    public initialize(roomContext: any): this {
+        return this;
     }
 
     public setStorageState(room: string, state: string): Promise<void> {

package/src/PluvIO.ts

@@ -1,6 +1,6 @@
 import type { AbstractCrdtDocFactory } from "@pluv/crdt";
 import { noop } from "@pluv/crdt";
-import type { IOAuthorize, InferIOAuthorizeUser } from "@pluv/types";
+import type { BaseUser, IOAuthorize, InferIOAuthorizeUser } from "@pluv/types";
 import type { AbstractPlatform, InferInitContextType } from "./AbstractPlatform";
 import type { WebSocketRegisterConfig } from "./IORoom";
 import { PluvProcedure } from "./PluvProcedure";
@@ -9,11 +9,13 @@ import { PluvRouter } from "./PluvRouter";
 import { PluvServer, PluvServerConfig } from "./PluvServer";
 import type { JWTEncodeParams } from "./authorize";
 import { authorize } from "./authorize";
+import { MAX_PRESENCE_SIZE_BYTES, MAX_STORAGE_SIZE_BYTES, MAX_USER_ID_LENGTH, MAX_USER_SIZE_BYTES } from "./constants";
 import type {
     CrdtLibraryType,
     GetInitialStorageFn,
     PluvContext,
     PluvIOAuthorize,
+    PluvIOLimits,
     PluvIOListeners,
     PluvIORouter,
     ResolvedPluvIOAuthorize,
@@ -29,6 +31,7 @@ export type PluvIOConfig<
     context?: PluvContext<TPlatform, TContext>;
     crdt?: CrdtLibraryType;
     debug?: boolean;
+    limits?: PluvIOLimits;
     platform: TPlatform;
 };
 
@@ -69,6 +72,7 @@ export class PluvIO<
     private readonly _context: PluvContext<TPlatform, TContext> = {} as PluvContext<TPlatform, TContext>;
     private readonly _crdt: { doc: (value: any) => AbstractCrdtDocFactory<any> };
     private readonly _debug: boolean;
+    private readonly _limits: PluvIOLimits;
     private readonly _platform: TPlatform;
 
     public get procedure(): PluvProcedure<TPlatform, TAuthorize, TContext, {}, {}> {
@@ -76,10 +80,17 @@ export class PluvIO<
     }
 
     constructor(options: PluvIOConfig<TPlatform, TAuthorize, TContext>) {
-        const { authorize, context, crdt = noop, debug = false, platform } = options;
+        const { authorize, context, crdt = noop, debug = false, limits, platform } = options;
 
         this._crdt = crdt;
         this._debug = debug;
+        this._limits = {
+            presenceMaxSize: MAX_PRESENCE_SIZE_BYTES,
+            storageMaxSize: MAX_STORAGE_SIZE_BYTES,
+            userIdMaxLength: MAX_USER_ID_LENGTH,
+            userMaxSize: MAX_USER_SIZE_BYTES,
+            ...limits,
+        };
         this._platform = platform;
 
         if (authorize) this._authorize = authorize;
@@ -90,6 +101,31 @@ export class PluvIO<
         if (!this._authorize) throw new Error("IO does not specify authorize during initialization.");
 
         const ioAuthorize = this._getIOAuthorize(params);
+        const user = params.user as BaseUser;
+        const parsed = !!ioAuthorize ? ioAuthorize.user.parse(user) : user;
+
+        if (!!this._limits.userIdMaxLength && user.id.length > this._limits.userIdMaxLength) {
+            throw new Error(
+                `createToken was called with a long user id. User ID must be at most 128 characters. Current length: ${user.id.length.toLocaleString()}`,
+            );
+        }
+
+        const bytes = new TextEncoder().encode(JSON.stringify(parsed)).length;
+
+        if (!!this._limits.userMaxSize && bytes > this._limits.userMaxSize) {
+            throw new Error(
+                `createToken called with large payload. User must be at most 512 bytes. Current size: ${bytes.toLocaleString()}`,
+            );
+        }
+
+        /**
+         * !HACK
+         * @description Allow the platform to overwrite this behavior as needed. This is introduced
+         * to support platformPluv
+         * @date December 15, 2024
+         */
+        if (this._platform._createToken) return await this._platform._createToken(params as any);
+
         const secret = ioAuthorize?.secret ?? null;
 
         if (!secret) throw new Error("`authorize` was specified without a valid secret");
@@ -129,6 +165,8 @@ export class PluvIO<
             context: this._context,
             crdt: this._crdt,
             debug: this._debug,
+            io: this as PluvIO<TPlatform, TAuthorize, TContext>,
+            limits: this._limits,
             platform: this._platform,
         } as PluvServerConfig<TPlatform, TAuthorize, TContext, TEvents>);
     }

package/src/PluvServer.ts

@@ -1,23 +1,23 @@
 import type { AbstractCrdtDocFactory } from "@pluv/crdt";
 import { noop } from "@pluv/crdt";
-import type { BaseUser, IOLike, Id, InferIOAuthorize, InferIOAuthorizeUser, JsonObject, Maybe } from "@pluv/types";
+import type { IOLike, Id, InferIOAuthorize, InferIOAuthorizeUser, JsonObject, Maybe } from "@pluv/types";
 import colors from "kleur";
 import type { AbstractPlatform, InferInitContextType, InferRoomContextType } from "./AbstractPlatform";
-import type { IORoomListeners, WebSocketRegisterConfig } from "./IORoom";
+import type { IORoomListeners } from "./IORoom";
 import { IORoom } from "./IORoom";
+import type { PluvIO } from "./PluvIO";
 import { PluvProcedure } from "./PluvProcedure";
 import type { PluvRouterEventConfig } from "./PluvRouter";
 import { PluvRouter } from "./PluvRouter";
 import type { JWTEncodeParams } from "./authorize";
-import { authorize } from "./authorize";
-import { MAX_PRESENCE_SIZE_BYTES, MAX_USER_SIZE_BYTES, PING_TIMEOUT_MS } from "./constants";
+import { PING_TIMEOUT_MS } from "./constants";
 import type {
     BasePluvIOListeners,
     GetInitialStorageFn,
     PluvContext,
     PluvIOAuthorize,
+    PluvIOLimits,
     PluvIOListeners,
-    ResolvedPluvIOAuthorize,
 } from "./types";
 import { pickBy } from "./utils";
 import { __PLUV_VERSION } from "./version";
@@ -38,6 +38,8 @@ export type PluvServerConfig<
     crdt?: { doc: (value: any) => AbstractCrdtDocFactory<any> };
     debug?: boolean;
     getInitialStorage?: GetInitialStorageFn<TContext>;
+    limits: PluvIOLimits;
+    io: PluvIO<TPlatform, TAuthorize, TContext>;
     platform: TPlatform;
     router?: PluvRouter<TPlatform, TAuthorize, TContext, TEvents>;
 };
@@ -145,9 +147,14 @@ export class PluvServer<
                     });
                 }
 
-                const state = (await this._platform.persistence.getStorageState(room)) ?? doc.getEncodedState();
+                const encodedState = (await this._platform.persistence.getStorageState(room)) ?? doc.getEncodedState();
+                const storageSize = new TextEncoder().encode(encodedState).length;
 
-                return { $storageReceived: { state } };
+                if (!!this._limits.storageMaxSize && storageSize > this._limits.storageMaxSize) {
+                    throw new Error("Storage has exceeded the size limit");
+                }
+
+                return { $storageReceived: { state: encodedState } };
             }),
         $ping: this._procedure.self((data, { session }) => {
             if (!session) return {};
@@ -175,7 +182,7 @@ export class PluvServer<
             const updated = Object.assign(Object.create(null), session.presence, cleanedPatch);
             const bytes = new TextEncoder().encode(JSON.stringify(updated)).length;
 
-            if (bytes > MAX_PRESENCE_SIZE_BYTES) {
+            if (!!this._limits.presenceMaxSize && bytes > this._limits.presenceMaxSize) {
                 throw new Error(
                     `Large presence. Presence must be at most 512 bytes. Current size: ${bytes.toLocaleString()}`,
                 );
@@ -198,6 +205,11 @@ export class PluvServer<
 
             const updated = update === null ? doc : doc.applyEncodedState({ update });
             const encodedState = updated.getEncodedState();
+            const storageSize = new TextEncoder().encode(encodedState).length;
+
+            if (!!this._limits.storageMaxSize && storageSize > this._limits.storageMaxSize) {
+                throw new Error("Storage has exceeded the size limit");
+            }
 
             this._platform.persistence.setStorageState(room, encodedState).then(() => {
                 this._getListeners().onStorageUpdated({
@@ -214,6 +226,8 @@ export class PluvServer<
     private readonly _crdt: { doc: (value: any) => AbstractCrdtDocFactory<any> };
     private readonly _debug: boolean;
     private readonly _getInitialStorage: GetInitialStorageFn<TContext> | null = null;
+    private readonly _io: PluvIO<TPlatform, TAuthorize, TContext>;
+    private readonly _limits: PluvIOLimits;
     private readonly _platform: TPlatform;
     private readonly _router: PluvRouter<TPlatform, TAuthorize, TContext, TEvents>;
 
@@ -255,6 +269,8 @@ export class PluvServer<
             crdt = noop,
             debug = false,
             getInitialStorage,
+            io,
+            limits,
             platform,
             router = new PluvRouter<TPlatform, TAuthorize, TContext, TEvents>({} as TEvents),
         } = options;
@@ -266,6 +282,8 @@ export class PluvServer<
 
         this._crdt = crdt;
         this._debug = debug;
+        this._io = io;
+        this._limits = limits;
         this._platform = platform;
         this._router = (router ? PluvRouter.merge(this._baseRouter, router) : this._baseRouter) as PluvRouter<
             TPlatform,
@@ -302,7 +320,7 @@ export class PluvServer<
             throw new Error(`\`createRoom\` is unsupported for \`${this._platform._name}\``);
         }
 
-        if (!/^[a-z0-9]+[a-z0-9\-_]+[a-z0-9]+$/i.test(room)) throw new Error("Unsupported room name");
+        if (!/^[a-z0-9](?:[a-z0-9-_]*[a-z0-9])?$/i.test(room)) throw new Error("Unsupported room name");
 
         const roomContext = platformRoomContext as InferRoomContextType<TPlatform>;
         const context: TContext = typeof this._context === "function" ? this._context(roomContext) : this._context;
@@ -345,41 +363,7 @@ export class PluvServer<
     public async createToken(
         params: JWTEncodeParams<InferIOAuthorizeUser<InferIOAuthorize<this>>, TPlatform>,
     ): Promise<string> {
-        if (!this._authorize) {
-            throw new Error("IO does not specify authorize during initialization.");
-        }
-
-        const ioAuthorize = this._getIOAuthorize(params);
-        const user = params.user as BaseUser;
-        const parsed = !!ioAuthorize ? ioAuthorize.user.parse(user) : user;
-
-        const bytes = new TextEncoder().encode(JSON.stringify(parsed)).length;
-
-        if (bytes > MAX_USER_SIZE_BYTES) {
-            throw new Error(
-                `createToken called with large payload. User must be at most 512 bytes. Current size: ${bytes.toLocaleString()}`,
-            );
-        }
-
-        /**
-         * !HACK
-         * @description Allow the platform to overwrite this behavior as needed. This is introduced
-         * to support platformPluv
-         * @date December 15, 2024
-         */
-        if (this._platform._createToken) return await this._platform._createToken(params as any);
-
-        const secret = ioAuthorize?.secret ?? null;
-
-        if (!secret) throw new Error("`authorize` was specified without a valid secret");
-
-        return await authorize({ platform: this._platform, secret }).encode(params as JWTEncodeParams<any, TPlatform>);
-    }
-
-    private _getIOAuthorize(options: WebSocketRegisterConfig<TPlatform>): ResolvedPluvIOAuthorize<any, any> | null {
-        if (typeof this._authorize === "function") return this._authorize(options);
-
-        return this._authorize as ResolvedPluvIOAuthorize<any, any> | null;
+        return await this._io.createToken(params);
     }
 
     private _getListeners(): BasePluvIOListeners<TPlatform, TAuthorize, TContext, TEvents> {

package/src/constants.ts

@@ -1,4 +1,6 @@
 export const GARBAGE_COLLECT_INTERVAL_MS = 60_000;
 export const MAX_PRESENCE_SIZE_BYTES = 512;
+export const MAX_STORAGE_SIZE_BYTES = 31_457_280;
+export const MAX_USER_ID_LENGTH = 128;
 export const MAX_USER_SIZE_BYTES = 512;
 export const PING_TIMEOUT_MS = 30_000;

package/src/createIO.ts

@@ -1,7 +1,7 @@
 import type { BaseUser } from "@pluv/types";
 import type { AbstractPlatform, InferInitContextType } from "./AbstractPlatform";
 import { PluvIO } from "./PluvIO";
-import type { CrdtLibraryType, PluvContext, PluvIOAuthorize } from "./types";
+import type { CrdtLibraryType, PluvContext, PluvIOAuthorize, PluvIOLimits } from "./types";
 
 export type CreateIOParams<
     TPlatform extends AbstractPlatform<any> = AbstractPlatform<any>,
@@ -12,6 +12,7 @@ export type CreateIOParams<
     context?: PluvContext<TPlatform, TContext>;
     crdt?: CrdtLibraryType;
     debug?: boolean;
+    limits?: PluvIOLimits;
     platform: TPlatform;
 };
 
@@ -22,13 +23,14 @@ export const createIO = <
 >(
     params: CreateIOParams<TPlatform, TContext, TUser>,
 ): PluvIO<TPlatform, PluvIOAuthorize<TPlatform, TUser, InferInitContextType<TPlatform>>, TContext> => {
-    const { authorize, context, crdt, debug, platform } = params;
+    const { authorize, context, crdt, debug, limits, platform } = params;
 
     return new PluvIO<TPlatform, PluvIOAuthorize<TPlatform, TUser, InferInitContextType<TPlatform>>, TContext>({
         authorize,
         context,
         crdt,
         debug,
+        limits,
         platform,
     });
 };

package/src/index.ts

@@ -46,6 +46,7 @@ export type {
     PlatformConfig,
     PluvContext,
     PluvIOAuthorize,
+    PluvIOLimits,
     PluvIOListeners,
     WebSocketRegistrationMode,
     WebSocketSerializedState,

package/src/types.ts

@@ -145,6 +145,25 @@ export type PluvIOAuthorize<
     | (TUser extends BaseUser ? ResolvedPluvIOAuthorize<TPlatform, TUser> : null)
     | ((context: TContext) => TUser extends BaseUser ? ResolvedPluvIOAuthorize<TPlatform, TUser> : null);
 
+export interface PluvIOLimits {
+    /**
+     * @description Maximum size of presence object in bytes
+     */
+    presenceMaxSize?: number | null;
+    /**
+     * @description Maximum size of storage state in bytes
+     */
+    storageMaxSize?: number | null;
+    /**
+     * @description Maximum length of user id in characters
+     */
+    userIdMaxLength?: number | null;
+    /**
+     * @description Maximum size of user object in bytes
+     */
+    userMaxSize?: number | null;
+}
+
 export type BasePluvIOListeners<
     TPlatform extends AbstractPlatform<any, any, any, any>,
     TAuthorize extends PluvIOAuthorize<TPlatform, any, InferInitContextType<TPlatform>> | null,

package/src/version.generated.ts

@@ -1,2 +1,2 @@
 // Generated by genversion.
-export const version = '0.41.7'
+export const version = '0.43.0'