@sockethub/server 5.0.0-alpha.14 → 5.0.0-alpha.15

package/dist/cors.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Parse the `sockethub:cors:origin` config value into either `"*"` (any
+ * origin) or a normalized origin allow-list. Both the socket.io listener and
+ * the HTTP actions routes resolve their CORS policy through this single
+ * parser so the two transports can never drift apart.
+ *
+ * Browsers serialize the `Origin` request header as a lowercase
+ * `scheme://host[:port]` with default ports omitted and no trailing slash or
+ * path. Configured entries are normalized to that same serialization before
+ * matching, so values like `https://App.example.com/` still match what the
+ * browser actually sends. Entries that cannot yield a usable origin are
+ * dropped with a warning rather than left in the list where they would
+ * silently never match.
+ *
+ * A restrictive config that yields no valid origins returns an empty list
+ * (blocking all cross-origin requests) instead of falling back to `"*"`:
+ * when an operator attempted to restrict origins, failing closed is the only
+ * safe interpretation.
+ */
+export declare function parseCorsOrigins(configured: unknown): "*" | Array<string>;
+/**
+ * Resolve the `Access-Control-Allow-Origin` value for a request against an
+ * allow-list already parsed by `parseCorsOrigins`. Returns `"*"` when any
+ * origin is allowed, the request's own origin when it is in the allow-list,
+ * or `undefined` when it is not allowed (the browser then blocks the
+ * response). The request origin is run through the same URL normalization as
+ * the configured entries, so matching never depends on the client sending
+ * the canonical serialization.
+ */
+export declare function resolveAllowedOrigin(allowedOrigins: "*" | Array<string>, requestOrigin: string | undefined): string | undefined;

package/dist/http/actions.d.ts

@@ -24,14 +24,6 @@ interface HttpActionsDependencies {
     createCredentialsStore?: (parentId: string, sessionId: string, secret: string, redisConfig: RedisConfig) => CredentialsStoreInterface;
     getIdempotencyRedisConnection?: () => ReturnType<typeof getIdempotencyRedisConnection>;
 }
-/**
- * Resolve the `Access-Control-Allow-Origin` value for a request, using the same
- * `sockethub:cors:origin` config that governs socket.io. Returns `"*"` when any
- * origin is allowed, the request's own origin when it is in a configured
- * allow-list, or `undefined` when the origin is not allowed (the browser then
- * blocks the response).
- */
-export declare function resolveAllowedOrigin(configuredOrigin: string | undefined, requestOrigin: string | undefined): string | undefined;
 declare function getIdempotencyRedisConnection(): import("ioredis").default;
 export declare function registerHttpActionsRoutes(app: Express, options: HttpActionsOptions, deps?: HttpActionsDependencies): void;
 export {};

package/dist/index.js

@@ -28957,9 +28957,11 @@ function buildSchema() {
       path: { format: String, default: "/sockethub" },
       cors: {
         origin: {
-          doc: "Allowed CORS origin(s) for socket.io connections. " + "'*' allows any website to connect visitors' " + "browsers to this instance; public deployments " + "should set an explicit origin or comma-separated " + "list of origins.",
+          doc: "Allowed CORS origin(s) for socket.io connections " + "and the HTTP actions endpoint. '*' allows any " + "website to connect visitors' browsers to this " + "instance; public deployments should set an " + "explicit origin or comma-separated list of " + "origins.",
           format: String,
-          default: "*"
+          default: "*",
+          env: "SOCKETHUB_CORS_ORIGIN",
+          arg: "cors.origin"
         }
       }
     },
@@ -70297,7 +70299,7 @@ var require_package2 = __commonJS((exports, module) => {
   module.exports = {
     name: "@sockethub/server",
     description: "A polyglot messaging service, server libraries",
-    version: "5.0.0-alpha.14",
+    version: "5.0.0-alpha.15",
     type: "module",
     private: false,
     author: "Nick Jennings <nick@silverbucket.net>",
@@ -70347,11 +70349,11 @@ var require_package2 = __commonJS((exports, module) => {
     homepage: "https://sockethub.org",
     dependencies: {
       "@sentry/node": "^10.36.0",
-      "@sockethub/client": "^5.0.0-alpha.14",
-      "@sockethub/data-layer": "^1.0.0-alpha.14",
-      "@sockethub/logger": "^1.0.0-alpha.14",
-      "@sockethub/schemas": "^3.0.0-alpha.14",
-      "@sockethub/util": "^1.0.0-alpha.2",
+      "@sockethub/client": "^5.0.0-alpha.15",
+      "@sockethub/data-layer": "^1.0.0-alpha.15",
+      "@sockethub/logger": "^1.0.0-alpha.15",
+      "@sockethub/schemas": "^3.0.0-alpha.15",
+      "@sockethub/util": "^1.0.0-alpha.3",
       chalk: "^5.6.2",
       convict: "^6.2.5",
       ejs: "^3.1.10",
@@ -70382,14 +70384,14 @@ var require_package2 = __commonJS((exports, module) => {
       "web-streams-polyfill": "^3.3.3"
     },
     optionalDependencies: {
-      "@sockethub/examples": "^1.0.0-alpha.14",
-      "@sockethub/platform-dummy": "^3.0.0-alpha.14",
-      "@sockethub/platform-feeds": "^4.0.0-alpha.14",
-      "@sockethub/platform-irc": "^4.0.0-alpha.14",
-      "@sockethub/platform-metadata": "^1.0.1-alpha.9",
-      "@sockethub/platform-xmpp": "^5.0.0-alpha.14"
-    },
-    gitHead: "4bc8ffa00d29aa78e59e269ac6e5ea9859ec01a8",
+      "@sockethub/examples": "^1.0.0-alpha.15",
+      "@sockethub/platform-dummy": "^3.0.0-alpha.15",
+      "@sockethub/platform-feeds": "^4.0.0-alpha.15",
+      "@sockethub/platform-irc": "^4.0.0-alpha.15",
+      "@sockethub/platform-metadata": "^1.0.1-alpha.10",
+      "@sockethub/platform-xmpp": "^5.0.0-alpha.15"
+    },
+    gitHead: "7f85c0aa1c317b56336af4149b29dc78afc5f2bd",
     types: "./dist/index.d.ts"
   };
 });
@@ -121087,7 +121089,7 @@ var require_node7 = __commonJS((exports, module) => {
   var tty2 = __require("tty");
   var util = __require("util");
   exports.init = init2;
-  exports.log = log5;
+  exports.log = log6;
   exports.formatArgs = formatArgs;
   exports.save = save;
   exports.load = load;
@@ -121219,7 +121221,7 @@ var require_node7 = __commonJS((exports, module) => {
     }
     return new Date().toISOString() + " ";
   }
-  function log5(...args) {
+  function log6(...args) {
     return process.stderr.write(util.format(...args) + `
 `);
   }
@@ -126023,7 +126025,7 @@ var require_node8 = __commonJS((exports, module) => {
   var tty2 = __require("tty");
   var util = __require("util");
   exports.init = init2;
-  exports.log = log5;
+  exports.log = log6;
   exports.formatArgs = formatArgs;
   exports.save = save;
   exports.load = load;
@@ -126155,7 +126157,7 @@ var require_node8 = __commonJS((exports, module) => {
     }
     return new Date().toISOString() + " ";
   }
-  function log5(...args) {
+  function log6(...args) {
     return process.stderr.write(util.format(...args) + `
 `);
   }
@@ -135189,7 +135191,7 @@ function disable() {
 function isEnabled() {
   return _getLoggerSettings().enabled;
 }
-function log9(...args) {
+function log10(...args) {
   _maybeLog("log", ...args);
 }
 function warn(...args) {
@@ -135233,7 +135235,7 @@ var init_debug_logger = __esm(() => {
     enable,
     disable,
     isEnabled,
-    log: log9,
+    log: log10,
     warn,
     error
   };
@@ -139704,12 +139706,12 @@ function estimateMetricSizeInBytes(metric) {
   weight += 8;
   return weight + estimateAttributesSizeInBytes(metric.attributes);
 }
-function estimateLogSizeInBytes(log10) {
+function estimateLogSizeInBytes(log11) {
   let weight = 0;
-  if (log10.message) {
-    weight += log10.message.length * 2;
+  if (log11.message) {
+    weight += log11.message.length * 2;
   }
-  return weight + estimateAttributesSizeInBytes(log10.attributes);
+  return weight + estimateAttributesSizeInBytes(log11.attributes);
 }
 function estimateAttributesSizeInBytes(attributes) {
   if (!attributes) {
@@ -140954,8 +140956,8 @@ function instrumentConsole() {
       return function(...args) {
         const handlerData = { args, level };
         triggerHandlers("console", handlerData);
-        const log10 = originalConsoleMethods[level];
-        log10?.apply(GLOBAL_OBJ.console, args);
+        const log11 = originalConsoleMethods[level];
+        log11?.apply(GLOBAL_OBJ.console, args);
       };
     });
   });
@@ -148585,7 +148587,7 @@ var init_common = () => {};
 
 // ../../node_modules/@sentry/node-core/build/esm/integrations/local-variables/local-variables-async.js
 import { Worker as Worker3 } from "node:worker_threads";
-function log10(...args) {
+function log11(...args) {
   debug.log("[LocalVariables]", ...args);
 }
 var base64WorkerScript = "LyohIEBzZW50cnkvbm9kZS1jb3JlIDEwLjM2LjAgKDIxZWM4ZjEpIHwgaHR0cHM6Ly9naXRodWIuY29tL2dldHNlbnRyeS9zZW50cnktamF2YXNjcmlwdCAqLwppbXBvcnR7U2Vzc2lvbiBhcyBlfWZyb20ibm9kZTppbnNwZWN0b3IvcHJvbWlzZXMiO2ltcG9ydHt3b3JrZXJEYXRhIGFzIHR9ZnJvbSJub2RlOndvcmtlcl90aHJlYWRzIjtjb25zdCBuPWdsb2JhbFRoaXMsaT17fTtjb25zdCBvPSJfX1NFTlRSWV9FUlJPUl9MT0NBTF9WQVJJQUJMRVNfXyI7Y29uc3QgYT10O2Z1bmN0aW9uIHMoLi4uZSl7YS5kZWJ1ZyYmZnVuY3Rpb24oZSl7aWYoISgiY29uc29sZSJpbiBuKSlyZXR1cm4gZSgpO2NvbnN0IHQ9bi5jb25zb2xlLG89e30sYT1PYmplY3Qua2V5cyhpKTthLmZvckVhY2goZT0+e2NvbnN0IG49aVtlXTtvW2VdPXRbZV0sdFtlXT1ufSk7dHJ5e3JldHVybiBlKCl9ZmluYWxseXthLmZvckVhY2goZT0+e3RbZV09b1tlXX0pfX0oKCk9PmNvbnNvbGUubG9nKCJbTG9jYWxWYXJpYWJsZXMgV29ya2VyXSIsLi4uZSkpfWFzeW5jIGZ1bmN0aW9uIGMoZSx0LG4saSl7Y29uc3Qgbz1hd2FpdCBlLnBvc3QoIlJ1bnRpbWUuZ2V0UHJvcGVydGllcyIse29iamVjdElkOnQsb3duUHJvcGVydGllczohMH0pO2lbbl09by5yZXN1bHQuZmlsdGVyKGU9PiJsZW5ndGgiIT09ZS5uYW1lJiYhaXNOYU4ocGFyc2VJbnQoZS5uYW1lLDEwKSkpLnNvcnQoKGUsdCk9PnBhcnNlSW50KGUubmFtZSwxMCktcGFyc2VJbnQodC5uYW1lLDEwKSkubWFwKGU9PmUudmFsdWU/LnZhbHVlKX1hc3luYyBmdW5jdGlvbiByKGUsdCxuLGkpe2NvbnN0IG89YXdhaXQgZS5wb3N0KCJSdW50aW1lLmdldFByb3BlcnRpZXMiLHtvYmplY3RJZDp0LG93blByb3BlcnRpZXM6ITB9KTtpW25dPW8ucmVzdWx0Lm1hcChlPT5bZS5uYW1lLGUudmFsdWU/LnZhbHVlXSkucmVkdWNlKChlLFt0LG5dKT0+KGVbdF09bixlKSx7fSl9ZnVuY3Rpb24gdShlLHQpe2UudmFsdWUmJigidmFsdWUiaW4gZS52YWx1ZT92b2lkIDA9PT1lLnZhbHVlLnZhbHVlfHxudWxsPT09ZS52YWx1ZS52YWx1ZT90W2UubmFtZV09YDwke2UudmFsdWUudmFsdWV9PmA6dFtlLm5hbWVdPWUudmFsdWUudmFsdWU6ImRlc2NyaXB0aW9uImluIGUudmFsdWUmJiJmdW5jdGlvbiIhPT1lLnZhbHVlLnR5cGU/dFtlLm5hbWVdPWA8JHtlLnZhbHVlLmRlc2NyaXB0aW9ufT5gOiJ1bmRlZmluZWQiPT09ZS52YWx1ZS50eXBlJiYodFtlLm5hbWVdPSI8dW5kZWZpbmVkPiIpKX1hc3luYyBmdW5jdGlvbiBsKGUsdCl7Y29uc3Qgbj1hd2FpdCBlLnBvc3QoIlJ1bnRpbWUuZ2V0UHJvcGVydGllcyIse29iamVjdElkOnQsb3duUHJvcGVydGllczohMH0pLGk9e307Zm9yKGNvbnN0IHQgb2Ygbi5yZXN1bHQpaWYodC52YWx1ZT8ub2JqZWN0SWQmJiJBcnJheSI9PT10LnZhbHVlLmNsYXNzTmFtZSl7Y29uc3Qgbj10LnZhbHVlLm9iamVjdElkO2F3YWl0IGMoZSxuLHQubmFtZSxpKX1lbHNlIGlmKHQudmFsdWU/Lm9iamVjdElkJiYiT2JqZWN0Ij09PXQudmFsdWUuY2xhc3NOYW1lKXtjb25zdCBuPXQudmFsdWUub2JqZWN0SWQ7YXdhaXQgcihlLG4sdC5uYW1lLGkpfWVsc2UgdC52YWx1ZSYmdSh0LGkpO3JldHVybiBpfWxldCBmOyhhc3luYyBmdW5jdGlvbigpe2NvbnN0IHQ9bmV3IGU7dC5jb25uZWN0VG9NYWluVGhyZWFkKCkscygiQ29ubmVjdGVkIHRvIG1haW4gdGhyZWFkIik7bGV0IG49ITE7dC5vbigiRGVidWdnZXIucmVzdW1lZCIsKCk9PntuPSExfSksdC5vbigiRGVidWdnZXIucGF1c2VkIixlPT57bj0hMCxhc3luYyBmdW5jdGlvbihlLHtyZWFzb246dCxkYXRhOntvYmplY3RJZDpufSxjYWxsRnJhbWVzOml9KXtpZigiZXhjZXB0aW9uIiE9PXQmJiJwcm9taXNlUmVqZWN0aW9uIiE9PXQpcmV0dXJuO2lmKGY/LigpLG51bGw9PW4pcmV0dXJuO2NvbnN0IGE9W107Zm9yKGxldCB0PTA7dDxpLmxlbmd0aDt0Kyspe2NvbnN0e3Njb3BlQ2hhaW46bixmdW5jdGlvbk5hbWU6byx0aGlzOnN9PWlbdF0sYz1uLmZpbmQoZT0+ImxvY2FsIj09PWUudHlwZSkscj0iZ2xvYmFsIiE9PXMuY2xhc3NOYW1lJiZzLmNsYXNzTmFtZT9gJHtzLmNsYXNzTmFtZX0uJHtvfWA6bztpZih2b2lkIDA9PT1jPy5vYmplY3Qub2JqZWN0SWQpYVt0XT17ZnVuY3Rpb246cn07ZWxzZXtjb25zdCBuPWF3YWl0IGwoZSxjLm9iamVjdC5vYmplY3RJZCk7YVt0XT17ZnVuY3Rpb246cix2YXJzOm59fX1hd2FpdCBlLnBvc3QoIlJ1bnRpbWUuY2FsbEZ1bmN0aW9uT24iLHtmdW5jdGlvbkRlY2xhcmF0aW9uOmBmdW5jdGlvbigpIHsgdGhpcy4ke299ID0gdGhpcy4ke299IHx8ICR7SlNPTi5zdHJpbmdpZnkoYSl9OyB9YCxzaWxlbnQ6ITAsb2JqZWN0SWQ6bn0pLGF3YWl0IGUucG9zdCgiUnVudGltZS5yZWxlYXNlT2JqZWN0Iix7b2JqZWN0SWQ6bn0pfSh0LGUucGFyYW1zKS50aGVuKGFzeW5jKCk9PntuJiZhd2FpdCB0LnBvc3QoIkRlYnVnZ2VyLnJlc3VtZSIpfSxhc3luYyBlPT57biYmYXdhaXQgdC5wb3N0KCJEZWJ1Z2dlci5yZXN1bWUiKX0pfSksYXdhaXQgdC5wb3N0KCJEZWJ1Z2dlci5lbmFibGUiKTtjb25zdCBpPSExIT09YS5jYXB0dXJlQWxsRXhjZXB0aW9ucztpZihhd2FpdCB0LnBvc3QoIkRlYnVnZ2VyLnNldFBhdXNlT25FeGNlcHRpb25zIix7c3RhdGU6aT8iYWxsIjoidW5jYXVnaHQifSksaSl7Y29uc3QgZT1hLm1heEV4Y2VwdGlvbnNQZXJTZWNvbmR8fDUwO2Y9ZnVuY3Rpb24oZSx0LG4pe2xldCBpPTAsbz01LGE9MDtyZXR1cm4gc2V0SW50ZXJ2YWwoKCk9PnswPT09YT9pPmUmJihvKj0yLG4obyksbz44NjQwMCYmKG89ODY0MDApLGE9byk6KGEtPTEsMD09PWEmJnQoKSksaT0wfSwxZTMpLnVucmVmKCksKCk9PntpKz0xfX0oZSxhc3luYygpPT57cygiUmF0ZS1saW1pdCBsaWZ0ZWQuIiksYXdhaXQgdC5wb3N0KCJEZWJ1Z2dlci5zZXRQYXVzZU9uRXhjZXB0aW9ucyIse3N0YXRlOiJhbGwifSl9LGFzeW5jIGU9PntzKGBSYXRlLWxpbWl0IGV4Y2VlZGVkLiBEaXNhYmxpbmcgY2FwdHVyaW5nIG9mIGNhdWdodCBleGNlcHRpb25zIGZvciAke2V9IHNlY29uZHMuYCksYXdhaXQgdC5wb3N0KCJEZWJ1Z2dlci5zZXRQYXVzZU9uRXhjZXB0aW9ucyIse3N0YXRlOiJ1bmNhdWdodCJ9KX0pfX0pKCkuY2F0Y2goZT0+e3MoIkZhaWxlZCB0byBzdGFydCBkZWJ1Z2dlciIsZSl9KSxzZXRJbnRlcnZhbCgoKT0+e30sMWU0KTs=", localVariablesAsyncIntegration;
@@ -148634,10 +148636,10 @@ var init_local_variables_async = __esm(() => {
         worker.terminate();
       });
       worker.once("error", (err) => {
-        log10("Worker error", err);
+        log11("Worker error", err);
       });
       worker.once("exit", (code) => {
-        log10("Worker exit", code);
+        log11("Worker exit", code);
       });
       worker.unref();
     }
@@ -150325,9 +150327,9 @@ var init_client2 = __esm(() => {
           _INTERNAL_flushLogsBuffer(this);
         };
         if (serverName) {
-          this.on("beforeCaptureLog", (log11) => {
-            log11.attributes = {
-              ...log11.attributes,
+          this.on("beforeCaptureLog", (log12) => {
+            log12.attributes = {
+              ...log12.attributes,
               "server.address": serverName
             };
           });
@@ -187441,6 +187443,63 @@ class RedisStore {
 // src/http/actions.ts
 init_config();
 
+// src/cors.ts
+init_src();
+var log5 = createLogger("server:cors");
+function parseCorsOrigins(configured) {
+  const raw = typeof configured === "string" ? configured.trim() : "";
+  if (raw === "" || raw === "*") {
+    return "*";
+  }
+  const origins = [];
+  for (const entry of raw.split(",")) {
+    const trimmed = entry.trim();
+    if (trimmed.length === 0) {
+      continue;
+    }
+    if (trimmed === "*") {
+      log5.warn("cors origin list contains '*'; allowing any origin and " + "ignoring the other entries");
+      return "*";
+    }
+    let origin;
+    try {
+      origin = new URL(trimmed).origin;
+    } catch {
+      log5.warn(`ignoring cors origin entry that is not a valid URL: "${trimmed}"` + " (origins must include a scheme, e.g. https://app.example.com)");
+      continue;
+    }
+    if (origin === "null") {
+      log5.warn(`ignoring cors origin entry with no usable origin: "${trimmed}"`);
+      continue;
+    }
+    if (origin !== trimmed) {
+      log5.warn(`normalized cors origin "${trimmed}" to "${origin}"`);
+    }
+    if (!origins.includes(origin)) {
+      origins.push(origin);
+    }
+  }
+  if (origins.length === 0) {
+    log5.error("cors origin config contained no valid origins; all " + "cross-origin requests will be blocked");
+  }
+  return origins;
+}
+function resolveAllowedOrigin(allowedOrigins, requestOrigin) {
+  if (allowedOrigins === "*") {
+    return "*";
+  }
+  if (!requestOrigin) {
+    return;
+  }
+  let normalized;
+  try {
+    normalized = new URL(requestOrigin).origin;
+  } catch {
+    return;
+  }
+  return allowedOrigins.includes(normalized) ? requestOrigin : undefined;
+}
+
 // src/message-handlers.ts
 init_src2();
 
@@ -187520,8 +187579,8 @@ var routes_default = routes;
 // src/listener.ts
 var require2 = createRequire4(import.meta.url);
 var packageJson = require2("../package.json");
-var log5 = createLogger("server:listener");
-log5.info(`sockethub v${packageJson.version}`);
+var log6 = createLogger("server:listener");
+log6.info(`sockethub v${packageJson.version}`);
 
 class Listener {
   app;
@@ -187549,10 +187608,10 @@ class Listener {
       const examplesPkgPath = require2.resolve("@sockethub/examples/package.json");
       const examplesDir = path3.join(path3.dirname(examplesPkgPath), "build");
       if (existsSync2(examplesDir)) {
-        log5.debug(`examples resolved from @sockethub/examples: ${examplesDir}`);
+        log6.debug(`examples resolved from @sockethub/examples: ${examplesDir}`);
         return examplesDir;
       }
-      log5.debug(`@sockethub/examples found but build directory missing: ${examplesDir}`);
+      log6.debug(`@sockethub/examples found but build directory missing: ${examplesDir}`);
       return null;
     } catch {
       return null;
@@ -187592,25 +187651,17 @@ class Listener {
         next();
         return;
       }
-      log5.debug(`examples request ${req.path}`);
+      log6.debug(`examples request ${req.path}`);
       res.sendFile(examplesIndex);
     });
-    log5.info(`examples served at http://${config_default.get("sockethub:host")}:${config_default.get("sockethub:port")}`);
+    log6.info(`examples served at http://${config_default.get("sockethub:host")}:${config_default.get("sockethub:port")}`);
   }
   static corsOrigin() {
-    const configured = (config_default.get("sockethub:cors:origin") || "*").trim();
-    if (configured === "*" || configured === "") {
-      return "*";
-    }
-    const origins = configured.split(",").map((origin) => origin.trim()).filter((origin) => origin.length > 0);
-    if (origins.length === 0) {
-      return "*";
-    }
-    return origins.length === 1 ? origins[0] : origins;
+    return parseCorsOrigins(config_default.get("sockethub:cors:origin"));
   }
   startHttp() {
     this.http.listen(config_default.get("sockethub:port"), config_default.get("sockethub:host"), () => {
-      log5.info(`sockethub listening on ws://${config_default.get("sockethub:host")}:${config_default.get("sockethub:port")}`);
+      log6.info(`sockethub listening on ws://${config_default.get("sockethub:host")}:${config_default.get("sockethub:port")}`);
     });
   }
   static initExpress() {
@@ -187663,6 +187714,7 @@ class PlatformInstance {
   heartbeatListener;
   heartbeatFailureHandled = false;
   replaced = false;
+  shutdownResult;
   actor;
   constructor(params) {
     this.id = params.identifier;
@@ -187722,7 +187774,13 @@ class PlatformInstance {
     this.replaced = true;
     this.flaggedForTermination = true;
   }
-  async shutdown() {
+  shutdown() {
+    if (!this.shutdownResult) {
+      this.shutdownResult = this.teardown();
+    }
+    return this.shutdownResult;
+  }
+  async teardown() {
     this.log.debug("platform process shutdown");
     this.flaggedForTermination = true;
     try {
@@ -188238,7 +188296,7 @@ function createMessageHandlers(options) {
     }
     let platformInstance;
     try {
-      platformInstance = processManager.get(platformId, msg.actor.id, platformSessionId, clientIp);
+      platformInstance = await processManager.get(platformId, msg.actor.id, platformSessionId, clientIp);
     } catch (err) {
       next(attachError(err, msg));
       return;
@@ -188285,7 +188343,7 @@ function hasHttpSessions(platformId) {
 }
 
 // src/http/actions.ts
-var log6 = createLogger("server:http:actions");
+var log7 = createLogger("server:http:actions");
 var REQUEST_ID_HEADER = "x-request-id";
 var SOCKETHUB_REQUEST_ID_HEADER = "x-sockethub-request-id";
 var DEFAULT_HTTP_ACTIONS_PATH = "/sockethub-http";
@@ -188396,23 +188454,10 @@ function resolveConfigNumber(getConfig, key, fallback) {
   }
   return fallback;
 }
-function resolveAllowedOrigin(configuredOrigin, requestOrigin) {
-  const configured = (configuredOrigin ?? "*").trim();
-  if (configured === "*" || configured === "") {
-    return "*";
-  }
-  const allowed = configured.split(",").map((origin) => origin.trim()).filter((origin) => origin.length > 0);
-  if (allowed.length === 0) {
-    return "*";
-  }
-  if (requestOrigin && allowed.includes(requestOrigin)) {
-    return requestOrigin;
-  }
-  return;
-}
 function createCorsMiddleware(getConfig) {
+  const allowedOrigins = parseCorsOrigins(getConfig("sockethub:cors:origin"));
   return (req, res, next) => {
-    const allowOrigin = resolveAllowedOrigin(getConfig("sockethub:cors:origin"), req.headers.origin);
+    const allowOrigin = resolveAllowedOrigin(allowedOrigins, req.headers.origin);
     if (allowOrigin) {
       res.setHeader("Access-Control-Allow-Origin", allowOrigin);
       if (allowOrigin !== "*") {
@@ -188574,7 +188619,7 @@ function registerHttpActionsRoutes(app, options, deps = {}) {
         requestId
       });
     } catch (err) {
-      log6.error(`idempotency lookup error for ${requestId}: ${String(err)}`);
+      log7.error(`idempotency lookup error for ${requestId}: ${String(err)}`);
       res.status(503).json({
         error: "idempotency store unavailable"
       });
@@ -188640,7 +188685,7 @@ function registerHttpActionsRoutes(app, options, deps = {}) {
         await idempotencyRedis.del(idempotencyKeys.listKey);
         await idempotencyRedis.pexpire(idempotencyKeys.listKey, idempotencyTtlMs);
       } catch (err) {
-        log6.error(`idempotency store error for ${requestId}: ${String(err)}`);
+        log7.error(`idempotency store error for ${requestId}: ${String(err)}`);
         res.status(503).json({
           error: "idempotency store unavailable"
         });
@@ -188684,7 +188729,7 @@ function registerHttpActionsRoutes(app, options, deps = {}) {
       }
       platformIds.clear();
       credentialsStore.teardown?.()?.catch((err) => {
-        log6.error(`credentials store teardown failed for ${sessionId}: ${String(err)}`);
+        log7.error(`credentials store teardown failed for ${sessionId}: ${String(err)}`);
       });
       if (requestTimeoutId) {
         clearTimeout(requestTimeoutId);
@@ -188706,7 +188751,7 @@ function registerHttpActionsRoutes(app, options, deps = {}) {
       };
       if (useIdempotency && idempotencyRedis && idempotencyKeys) {
         redisWriteChain = redisWriteChain.then(() => idempotencyRedis.set(idempotencyKeys.statusKey, "complete", "PX", idempotencyTtlMs)).catch((err) => {
-          log6.error(`failed to finalize idempotency for ${requestId}: ${String(err)}`);
+          log7.error(`failed to finalize idempotency for ${requestId}: ${String(err)}`);
         }).finally(finish);
         return;
       }
@@ -188726,7 +188771,7 @@ function registerHttpActionsRoutes(app, options, deps = {}) {
         return;
       }
       redisWriteChain = redisWriteChain.then(() => idempotencyRedis.rpush(idempotencyKeys.listKey, serialized)).then(() => idempotencyRedis.pexpire(idempotencyKeys.listKey, idempotencyTtlMs)).then(() => idempotencyRedis.pexpire(idempotencyKeys.statusKey, idempotencyTtlMs)).catch((err) => {
-        log6.error(`failed to persist idempotency result for ${requestId}: ${String(err)}`);
+        log7.error(`failed to persist idempotency result for ${requestId}: ${String(err)}`);
       });
     };
     const writeErrorLine = (message) => {
@@ -188784,7 +188829,7 @@ function registerHttpActionsRoutes(app, options, deps = {}) {
     scheduleIdleTimeout();
     req.on("close", () => {
       if (!responseClosed) {
-        log6.debug(`http actions request closed early ${requestId}`);
+        log7.debug(`http actions request closed early ${requestId}`);
       }
       if (pending > 0) {
         closeResponse();
@@ -188807,7 +188852,7 @@ function registerHttpActionsRoutes(app, options, deps = {}) {
       }
     });
   });
-  log6.info(`http actions enabled at ${routePath}`);
+  log7.info(`http actions enabled at ${routePath}`);
 }
 
 // src/janitor.ts
@@ -188918,20 +188963,16 @@ class ProcessManager {
   parentSecret1;
   parentSecret2;
   init;
+  ensureChains = new Map;
   constructor(parentId, parentSecret1, parentSecret2, init2) {
     this.parentId = parentId;
     this.parentSecret1 = parentSecret1;
     this.parentSecret2 = parentSecret2;
     this.init = init2;
   }
-  get(platform, actorId, sessionId, sessionIp) {
+  async get(platform, actorId, sessionId, sessionIp) {
     const platformDetails = this.init.platforms.get(platform);
-    let pi;
-    if (platformDetails.config.persist) {
-      pi = this.ensureProcess(platform, sessionId, actorId, sessionIp);
-    } else {
-      pi = this.ensureProcess(platform);
-    }
+    const pi = platformDetails.config.persist ? await this.ensureProcess(platform, sessionId, actorId, sessionIp) : await this.ensureProcess(platform);
     pi.config = platformDetails.config;
     pi.contextUrl = platformDetails.contextUrl;
     return pi;
@@ -188957,6 +188998,22 @@ class ProcessManager {
   }
   ensureProcess(platform, sessionId, actor, sessionIp) {
     const identifier = getPlatformId(platform, actor);
+    const prior = this.ensureChains.get(identifier) ?? Promise.resolve();
+    const run = prior.then(() => this.ensureProcessNow(identifier, platform, sessionId, actor, sessionIp));
+    const settled = run.then(() => {
+      return;
+    }, () => {
+      return;
+    });
+    this.ensureChains.set(identifier, settled);
+    settled.then(() => {
+      if (this.ensureChains.get(identifier) === settled) {
+        this.ensureChains.delete(identifier);
+      }
+    });
+    return run;
+  }
+  async ensureProcessNow(identifier, platform, sessionId, actor, sessionIp) {
     const existing = platformInstances.get(identifier);
     const reusable = existing && this.isProcessAlive(existing);
     if (!reusable) {
@@ -188964,7 +189021,7 @@ class ProcessManager {
     }
     if (existing && !reusable) {
       existing.markReplaced();
-      existing.shutdown();
+      await existing.shutdown();
     }
     const platformInstance = reusable ? existing : this.createPlatformInstance(identifier, platform, actor);
     if (sessionId) {
@@ -189008,7 +189065,7 @@ var process_manager_default = ProcessManager;
 // src/rate-limiter.ts
 init_src();
 init_src2();
-var log7 = createLogger("server:rate-limiter");
+var log8 = createLogger("server:rate-limiter");
 var DEFAULT_CONFIG = {
   windowMs: 1000,
   maxRequests: 100,
@@ -189057,7 +189114,7 @@ function createRateLimiter(config2 = {}) {
     }
     if (state.blocked) {
       if (now < state.blockedUntil) {
-        log7.debug(`dropping event for blocked socket ${socket.id}; blocked until ${new Date(state.blockedUntil).toISOString()}`);
+        log8.debug(`dropping event for blocked socket ${socket.id}; blocked until ${new Date(state.blockedUntil).toISOString()}`);
         const error = new Error("Rate limit exceeded");
         next(error);
         return;
@@ -189074,7 +189131,7 @@ function createRateLimiter(config2 = {}) {
     if (state.count > cfg.maxRequests) {
       state.blocked = true;
       state.blockedUntil = now + cfg.blockDurationMs;
-      log7.warn(`rate limit exceeded for ${socket.id}: ${state.count} requests in ${cfg.windowMs}ms, blocking for ${cfg.blockDurationMs}ms`);
+      log8.warn(`rate limit exceeded for ${socket.id}: ${state.count} requests in ${cfg.windowMs}ms, blocking for ${cfg.blockDurationMs}ms`);
       socket.emit("error", {
         type: "Error",
         "@context": buildCanonicalContext(ERROR_PLATFORM_CONTEXT_URL),
@@ -189096,7 +189153,7 @@ function cleanupClient(socketId) {
 }
 
 // src/sockethub.ts
-var log8 = createLogger("server:core");
+var log9 = createLogger("server:core");
 function normalizeIp2(ip) {
   if (!ip) {
     return "";
@@ -189183,16 +189240,16 @@ class Sockethub {
     this.parentId = crypto.randId(16);
     this.parentSecret1 = crypto.randToken(16);
     this.parentSecret2 = crypto.randToken(16);
-    log8.debug(`session id: ${this.parentId}`);
+    log9.debug(`session id: ${this.parentId}`);
   }
   async boot() {
     if (this.status) {
-      log8.warn("Sockethub.boot() called more than once");
+      log9.warn("Sockethub.boot() called more than once");
       return;
     }
     this.status = true;
     const init2 = await getInitObject().catch((err) => {
-      log8.error(err);
+      log9.error(err);
       process.exit(1);
     });
     if (!init2) {
@@ -189204,9 +189261,9 @@ class Sockethub {
     this.rateLimiter = createRateLimiter(config_default.get("rateLimiter"));
     if (config_default.get("credentialCheck:reconnectIpSource") === "proxy") {
       const proxyHeader = getProxyHeaderName();
-      log8.warn(`credentialCheck.reconnectIpSource=proxy enabled; only use this behind a trusted reverse proxy that overwrites '${proxyHeader}'`);
+      log9.warn(`credentialCheck.reconnectIpSource=proxy enabled; only use this behind a trusted reverse proxy that overwrites '${proxyHeader}'`);
     }
-    log8.debug("active platforms: ", [...init2.platforms.keys()]);
+    log9.debug("active platforms: ", [...init2.platforms.keys()]);
     listener_default.start();
     registerHttpActionsRoutes(listener_default.getApp(), {
       processManager: this.processManager,
@@ -189214,7 +189271,7 @@ class Sockethub {
       parentSecret1: this.parentSecret1
     });
     janitor_default.start();
-    log8.debug("registering handlers");
+    log9.debug("registering handlers");
     listener_default.io.on("connection", this.handleIncomingConnection.bind(this));
   }
   async shutdown() {
@@ -189222,9 +189279,9 @@ class Sockethub {
     stopCleanup();
     try {
       const removed = await purgeCredentialsStores(this.parentId, config_default.get("redis"));
-      log8.debug(`purged ${removed} credential store keys on shutdown`);
+      log9.debug(`purged ${removed} credential store keys on shutdown`);
     } catch (err) {
-      log8.warn(`failed to purge credential store keys: ${err}`);
+      log9.warn(`failed to purge credential store keys: ${err}`);
     } finally {
       await resetSharedCredentialsRedisConnection();
     }
@@ -189323,9 +189380,9 @@ async function server() {
   });
   setLoggerContext("sockethub");
   let sockethub;
-  const log11 = createLogger("server:init");
+  const log12 = createLogger("server:init");
   if (config_default.get("sentry:dsn")) {
-    log11.info("initializing sentry");
+    log12.info("initializing sentry");
     sentry = await Promise.resolve().then(() => (init_sentry(), exports_sentry));
   }
   try {
@@ -189379,4 +189436,4 @@ export {
   server
 };
 
-//# debugId=8E3E410F19F7010D64756E2164756E21
+//# debugId=97DEBF2943991B6764756E2164756E21