@sockethub/server 5.0.0-beta.0 → 5.0.0-beta.2

package/dist/message-handlers.d.ts

@@ -30,7 +30,5 @@ export interface MessageHandlersOptions {
  * Normalize middleware errors into payload-safe error responses.
  * Removes internal-only properties that must never be sent to clients.
  */
-export declare function attachError<T extends ActivityStream>(err: unknown, msg?: T): Error | (T & {
-    sessionSecret?: string;
-});
+export declare function attachError<T extends ActivityStream>(err: unknown, msg?: T): T | Error;
 export declare function createMessageHandlers(options: MessageHandlersOptions): MessageHandlers;

package/dist/middleware/normalize-activity-stream.d.ts

@@ -1,3 +1,16 @@
 import type { ActivityStream } from "@sockethub/schemas";
 import type { MiddlewareChainInterface } from "../middleware.js";
+/**
+ * Maximum nesting depth accepted for client-supplied messages. Validation
+ * error formatting and the socket.io encoder both recurse over the message, so
+ * an unbounded depth lets a single payload overflow the stack and crash the
+ * server.
+ */
+export declare const MAX_MESSAGE_DEPTH = 64;
+/**
+ * Iteratively check whether a value nests deeper than `max` levels. Must not
+ * recurse itself, since it guards the recursive code paths.
+ */
+export declare function exceedsDepth(root: unknown, max?: number): boolean;
+/** Reject malformed or over-deep input before normalizing an activity. */
 export default function normalizeActivityStreamMiddleware<T extends ActivityStream>(msg: T, done: MiddlewareChainInterface<T>): void;

package/dist/payload-debug.d.ts

@@ -0,0 +1,2 @@
+/** Disable namespaces that log raw payloads or session IDs, or recurse over client input. */
+export default function disablePayloadDebug(): void;

package/dist/platform-instance.d.ts

@@ -55,6 +55,7 @@ export default class PlatformInstance {
     readonly parentId: string;
     private readonly parentSecret1?;
     readonly sessions: Set<string>;
+    readonly ownerIps: Set<string>;
     readonly sessionIps: Map<string, string>;
     private readonly sessionSecrets;
     private processMessageListener?;
@@ -63,12 +64,14 @@ export default class PlatformInstance {
     private heartbeatFailureHandled;
     private replaced;
     private shutdownResult?;
+    private retirementError?;
     /**
      * Actor this instance was opened for. Updated when the platform re-keys
      * (IRC nick change) so a later rename moves the credential scope off the
      * actor the client is using now, not the one from process start.
      */
     private actor?;
+    get actorId(): string | undefined;
     constructor(params: PlatformInstanceParams);
     createQueue(): void;
     resolveSentryEnv(): string | undefined;
@@ -97,7 +100,7 @@ export default class PlatformInstance {
      * independent run would resolve while the first is still obliterating
      * the queue name the replacement is about to reuse.
      */
-    shutdown(): Promise<void>;
+    shutdown(pendingJobError?: string): Promise<void>;
     private teardown;
     /**
      * When jobs are completed or failed, we prepare the results and send them to the client socket
@@ -110,6 +113,7 @@ export default class PlatformInstance {
      * mid-job) don't leak handlers for the lifetime of the instance.
      */
     registerCompletedJobHandler(title: string, handler: CompletedJobHandler): void;
+    private failRetiredJob;
     private takeCompletedJobHandler;
     private pruneExpiredJobHandlers;
     /**

package/dist/platform.js

@@ -20497,7 +20497,7 @@ var init_package = __esm(() => {
   package_default = {
     name: "@sockethub/schemas",
     description: "JSON schema files for validating Sockethub Activity Streams",
-    version: "3.0.0-beta.0",
+    version: "3.0.0-beta.2",
     type: "module",
     private: false,
     author: "Nick Jennings <nick@silverbucket.net>",
@@ -20567,7 +20567,7 @@ var init_package = __esm(() => {
       "ajv-formats": "^2.1.1",
       "ajv-formats-draft2019": "^1.6.1"
     },
-    gitHead: "75002ae8f15d7679bd58a9327f5a1d7eeaffa237",
+    gitHead: "1f74d4e07311496f0acc021855137bc197d79eab",
     types: "./dist/index.d.ts"
   };
 });
@@ -20676,8 +20676,11 @@ var init_sockethub_config = __esm(() => {
           "@sockethub/platform-caldav",
           "@sockethub/platform-dummy",
           "@sockethub/platform-feeds",
+          "@sockethub/platform-email",
           "@sockethub/platform-irc",
           "@sockethub/platform-metadata",
+          "@sockethub/platform-messenger",
+          "@sockethub/platform-instagram",
           "@sockethub/platform-xmpp"
         ]
       },
@@ -20693,7 +20696,8 @@ var init_sockethub_config = __esm(() => {
               connectTimeoutMs: { type: "integer", minimum: 1 },
               allowPrivateAddresses: { type: "boolean" },
               allowInsecureHttp: { type: "boolean" },
-              concurrency: { type: "integer", minimum: 1 }
+              concurrency: { type: "integer", minimum: 1 },
+              discoveryCacheTtlMs: { type: "integer", minimum: 0 }
             }
           },
           "@sockethub/platform-caldav": {
@@ -20703,7 +20707,20 @@ var init_sockethub_config = __esm(() => {
               connectTimeoutMs: { type: "integer", minimum: 1 },
               allowPrivateAddresses: { type: "boolean" },
               allowInsecureHttp: { type: "boolean" },
-              concurrency: { type: "integer", minimum: 1 }
+              concurrency: { type: "integer", minimum: 1 },
+              discoveryCacheTtlMs: { type: "integer", minimum: 0 }
+            }
+          },
+          "@sockethub/platform-email": {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+              connectTimeoutMs: {
+                type: "integer",
+                minimum: 5000,
+                maximum: 120000
+              },
+              allowPrivateAddresses: { type: "boolean" }
             }
           },
           "@sockethub/platform-dummy": {
@@ -20726,14 +20743,16 @@ var init_sockethub_config = __esm(() => {
             type: "object",
             additionalProperties: false,
             properties: {
-              connectTimeoutMs: { type: "number" }
+              connectTimeoutMs: { type: "number" },
+              allowPrivateAddresses: { type: "boolean" }
             }
           },
           "@sockethub/platform-xmpp": {
             type: "object",
             additionalProperties: false,
             properties: {
-              connectTimeoutMs: { type: "number" }
+              connectTimeoutMs: { type: "number" },
+              allowPrivateAddresses: { type: "boolean" }
             }
           },
           "@sockethub/platform-metadata": {
@@ -20823,11 +20842,29 @@ var init_sockethub_config = __esm(() => {
         type: "object",
         additionalProperties: false,
         properties: {
+          maxInstancesPerSession: {
+            type: "integer",
+            minimum: 0,
+            default: 10,
+            description: "Maximum persistent instances per socket session. 0 disables the cap."
+          },
+          maxInstancesPerIp: {
+            type: "integer",
+            minimum: 0,
+            default: 20,
+            description: "Maximum persistent instances per client IP, including HTTP actions. 0 disables the cap."
+          },
+          maxStartsPerIpPerMinute: {
+            type: "integer",
+            minimum: 0,
+            default: 60,
+            description: "Maximum new persistent instances a client IP may start per minute, " + "including HTTP actions. Bounds fork/teardown churn that the " + "concurrent caps allow. Reusing a running instance does not count. " + "0 disables the cap."
+          },
           maxPlatformInstances: {
             type: "number",
             minimum: 0,
             default: 100,
-            description: "Upper bound on concurrently running platform instances " + "(child processes). Each persistent-platform actor forks " + "its own process, so an unbounded count is a resource " + "exhaustion risk on public instances. 0 disables the cap."
+            description: "Upper bound on concurrently running persistent platform instances " + "(child processes). Each persistent-platform actor forks " + "its own process, so an unbounded count is a resource " + "exhaustion risk on public instances. 0 disables the cap."
           }
         }
       },
@@ -27196,15 +27233,33 @@ var require_ajv = __commonJS(function(exports, module) {
   } });
 });
 
+// ../schemas/src/helpers/codegen.ts
+function isCodegenAvailable() {
+  if (available === undefined) {
+    try {
+      new Function("return true");
+      available = true;
+    } catch {
+      available = false;
+    }
+  }
+  return available;
+}
+function warnCodegenUnavailable() {
+  if (warned) {
+    return;
+  }
+  warned = true;
+  console.warn("[@sockethub/schemas] Schema validation is disabled: this environment's Content Security Policy blocks `new Function`, which Ajv needs to compile schemas. The Sockethub server still validates every message.");
+}
+var available, warned = false;
+
 // ../schemas/src/schemas/service-descriptor.ts
 var init_service_descriptor = () => {};
 
 // ../schemas/src/service-descriptor.ts
-var import_ajv, ajv;
 var init_service_descriptor2 = __esm(() => {
   init_service_descriptor();
-  import_ajv = __toESM(require_ajv(), 1);
-  ajv = new import_ajv.default({ strictTypes: false, allErrors: true });
 });
 
 // ../../node_modules/ajv-formats/dist/formats.js
@@ -36752,15 +36807,35 @@ var init_error_parser = __esm(() => {
 });
 
 // ../schemas/src/validator.ts
+function getAjv() {
+  if (!isCodegenAvailable()) {
+    warnCodegenUnavailable();
+    return;
+  }
+  if (!ajv) {
+    const instance = new import_ajv.default({ strictTypes: false, allErrors: true });
+    import_ajv_formats.default(instance);
+    import_ajv_formats_draft2019.default(instance);
+    for (const uri in schemas) {
+      instance.addSchema(schemas[uri], uri);
+    }
+    ajv = instance;
+  }
+  return ajv;
+}
 function registerSystemContext(platformId, contextUrl) {
   registerPlatformContext(platformId, contextUrl, `${schemaURL}/context/${platformId}/messages`, `${schemaURL}/context/${platformId}/credentials`);
+  const instance = getAjv();
+  if (!instance) {
+    return;
+  }
   const messageSchemaRef = `${schemaURL}/context/${platformId}/messages`;
-  if (!ajv2.getSchema(messageSchemaRef)) {
-    ajv2.addSchema({}, messageSchemaRef);
+  if (!instance.getSchema(messageSchemaRef)) {
+    instance.addSchema({}, messageSchemaRef);
   }
   const credentialsSchemaRef = `${schemaURL}/context/${platformId}/credentials`;
-  if (!ajv2.getSchema(credentialsSchemaRef)) {
-    ajv2.addSchema({}, credentialsSchemaRef);
+  if (!instance.getSchema(credentialsSchemaRef)) {
+    instance.addSchema({}, credentialsSchemaRef);
   }
 }
 function registerSystemPlatformContexts() {
@@ -36772,17 +36847,21 @@ function registerSystemPlatformContexts() {
   systemContextsRegistered = true;
 }
 function validateSockethubConfig(config) {
+  const instance = getAjv();
+  if (!instance) {
+    return "";
+  }
   if (!sockethubConfigValidator) {
-    sockethubConfigValidator = ajv2.compile(SockethubConfigSchema);
+    sockethubConfigValidator = instance.compile(SockethubConfigSchema);
   }
   if (sockethubConfigValidator(config)) {
     return "";
   }
-  return ajv2.errorsText(sockethubConfigValidator.errors, {
+  return instance.errorsText(sockethubConfigValidator.errors, {
     dataVar: "config"
   });
 }
-var import_ajv2, import_ajv_formats, import_ajv_formats_draft2019, ajv2, schemaURL = "https://sockethub.org/schemas/v0", schemas, systemContextsRegistered = false, sockethubConfigValidator;
+var import_ajv, import_ajv_formats, import_ajv_formats_draft2019, schemaURL = "https://sockethub.org/schemas/v0", schemas, systemContextsRegistered = false, ajv, sockethubConfigValidator;
 var init_validator = __esm(() => {
   init_context();
   init_error_parser();
@@ -36790,17 +36869,11 @@ var init_validator = __esm(() => {
   init_activity_stream();
   init_platform();
   init_sockethub_config();
-  import_ajv2 = __toESM(require_ajv(), 1);
+  import_ajv = __toESM(require_ajv(), 1);
   import_ajv_formats = __toESM(require_dist(), 1);
   import_ajv_formats_draft2019 = __toESM(require_ajv_formats_draft2019(), 1);
-  ajv2 = new import_ajv2.default({ strictTypes: false, allErrors: true });
-  import_ajv_formats.default(ajv2);
-  import_ajv_formats_draft2019.default(ajv2);
   schemas = {};
   schemas[`${schemaURL}/activity-stream`] = ActivityStreamSchema;
-  for (const uri in schemas) {
-    ajv2.addSchema(schemas[uri], uri);
-  }
   registerSystemPlatformContexts();
 });
 
@@ -73881,6 +73954,9 @@ var init_config_schema = __esm(() => {
     "rateLimiter.maxRequests": { format: "nat" },
     "rateLimiter.blockDurationMs": { format: "nat" },
     "rateLimiter.maxConnectionsPerIp": { format: "nat" },
+    "limits.maxInstancesPerSession": { format: "nat" },
+    "limits.maxInstancesPerIp": { format: "nat" },
+    "limits.maxStartsPerIpPerMinute": { format: "nat" },
     "limits.maxPlatformInstances": { format: "nat" },
     "credentials.ttlMs": {
       format: "nat",
@@ -95701,6 +95777,7 @@ class JobWorker extends JobBase {
   redisConfig;
   queueId;
   concurrency;
+  maxStalledCount;
   initialized = false;
   constructor(parentId, instanceId, secret, redisConfig, options = {}) {
     super(secret);
@@ -95709,6 +95786,7 @@ class JobWorker extends JobBase {
       throw new Error(`JobWorker concurrency must be a positive integer, got ${options.concurrency}`);
     }
     this.concurrency = concurrency;
+    this.maxStalledCount = options.maxStalledCount ?? 3;
     this.log = createLogger(`data-layer:worker:${parentId}:${instanceId}`);
     this.connectionName = getLoggerNamespace(this.log);
     redisConfig.connectionName = this.connectionName;
@@ -95724,7 +95802,7 @@ class JobWorker extends JobBase {
     this.worker = new import_bullmq2.Worker(queueName, this.jobHandler.bind(this), {
       connection: this.redisConfig,
       concurrency: this.concurrency,
-      maxStalledCount: 3
+      maxStalledCount: this.maxStalledCount
     });
     this.worker.on("error", (err) => {
       this.log.warn(`worker error: ${err.message}`);
@@ -96165,7 +96243,10 @@ async function startPlatformProcess() {
       }
     }
     const concurrency = getWorkerConcurrency();
-    jobWorker = new JobWorker(parentId, queueInstanceId, parentSecret1 + parentSecret2, { url: redisUrl }, { concurrency });
+    jobWorker = new JobWorker(parentId, queueInstanceId, parentSecret1 + parentSecret2, { url: redisUrl }, {
+      concurrency,
+      maxStalledCount: platform.config.persist && platform.config.retryStalledJobs === false ? 0 : 3
+    });
     logger.info(`listening on the queue for incoming jobs (concurrency: ${concurrency})`);
     jobWorker.onJob(getJobHandler());
     jobWorkerStarted = true;

package/dist/process-manager.d.ts

@@ -6,6 +6,8 @@ declare class ProcessManager {
     private readonly parentSecret2;
     private init;
     private readonly ensureChains;
+    private readonly startsPerIp;
+    private startsWindowBegan;
     constructor(parentId: string, parentSecret1: string, parentSecret2: string, init: IInitObject);
     /**
      * @param sessionId socket id to register with the instance; absent for HTTP
@@ -24,18 +26,19 @@ declare class ProcessManager {
      */
     private ensureProcess;
     private ensureProcessNow;
-    /**
-     * Each platform instance forks a full child process; without an upper
-     * bound, a public instance can be driven into resource exhaustion.
-     * Throws when the configured cap (`limits.maxPlatformInstances`, 0 =
-     * disabled) has been reached and a new instance would be created.
-     *
-     * `identifier`'s existing (dead) slot, if any, is excluded from the
-     * count: replacing a crashed instance for the same actor doesn't
-     * increase the total instance count, so it shouldn't be blocked by
-     * the cap.
+    /** Stateless workers are bounded by the enabled platform count, independently
+     * of client occupancy. Check owners even when attaching to a shared worker.
      */
     private assertInstanceCapacity;
+    /**
+     * Instance caps bound how many workers run at once, not how fast a client
+     * can churn them (e.g. replacing credentials forks a fresh worker each
+     * time). Budget new persistent starts per IP, the one key a client cannot
+     * rotate.
+     * shortcut: fixed one-minute window allows a 2x burst at the boundary;
+     * switch to a sliding window if that burst matters.
+     */
+    private assertStartRate;
     private isProcessAlive;
 }
 export default ProcessManager;

package/dist/trust-proxy.d.ts

@@ -1,3 +1,22 @@
+import type { IncomingMessage } from "node:http";
+import type { Express } from "express";
+/** Resolve socket admission using the same compiled proxy policy as Express req.ip. */
+export declare function getRequestClientIp(request: IncomingMessage, app: Express): string;
+/**
+ * Client address for socket admission, per-IP quotas, and anonymous reconnect.
+ *
+ * `x-forwarded-for` is a chain. The nearest proxy appends the address it
+ * actually accepted, and anything to the left of that may have been set by
+ * the client. Reading the first entry treats that prefix as the client, so
+ * an attacker can present a victim's address and, during janitor grace,
+ * take over that victim's anonymous connection (the reconnect key is the
+ * actor plus this address). Hop count is already what HTTP uses: one trusted
+ * hop yields the address the proxy appended, not the spoofed prefix.
+ *
+ * A custom `proxyHeader` is not a chain Express understands. The operator
+ * vouched for that header, and its first address is the value.
+ */
+export declare function resolveSocketClientIp(request: IncomingMessage, app: Express | undefined, reconnectIpSource: unknown, proxyHeader: unknown, fallbackAddress: string | undefined): string;
 /**
  * Resolution of Express's `trust proxy` setting.
  *

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sockethub/server",
   "description": "A polyglot messaging service, server libraries",
-  "version": "5.0.0-beta.0",
+  "version": "5.0.0-beta.2",
   "type": "module",
   "private": false,
   "author": "Nick Jennings <nick@silverbucket.net>",
@@ -26,7 +26,7 @@
   "bin": "bin/sockethub",
   "preferGlobal": true,
   "engines": {
-    "node": ">=20"
+    "node": ">=20.19"
   },
   "keywords": [
     "sockethub",
@@ -53,17 +53,19 @@
   "dependencies": {
     "@sentry/node": "^10.36.0",
     "@sentry/profiling-node": "10.36.0",
-    "@sockethub/client": "^5.0.0-beta.0",
-    "@sockethub/data-layer": "^1.0.0-beta.0",
-    "@sockethub/logger": "^1.0.0-beta.0",
-    "@sockethub/schemas": "^3.0.0-beta.0",
-    "@sockethub/util": "^1.0.0-beta.0",
+    "@sockethub/client": "^5.0.0-beta.2",
+    "@sockethub/data-layer": "^1.0.0-beta.2",
+    "@sockethub/logger": "^1.0.0-beta.2",
+    "@sockethub/schemas": "^3.0.0-beta.2",
+    "@sockethub/util": "^1.0.0-beta.2",
     "chalk": "^5.6.2",
     "convict": "^6.2.5",
+    "debug": "^4.4.3",
     "ejs": "^3.1.10",
     "express": "^5.1.0",
     "express-rate-limit": "^8.2.1",
     "jquery": "^3.7.1",
+    "proxy-addr": "^2.0.7",
     "rate-limit-redis": "^4.2.0",
     "socket.io": "^4.8.3"
   },
@@ -82,21 +84,25 @@
     "@types/debug": "^4.1.12",
     "@types/express": "^5.0.0",
     "@types/jquery": "^3.5.33",
+    "@types/proxy-addr": "^2.0.3",
     "@types/sinon": "^17.0.4",
     "jaribu": "^2.2.3",
     "sinon": "^17.0.2",
     "web-streams-polyfill": "^3.3.3"
   },
   "optionalDependencies": {
-    "@sockethub/examples": "^1.0.0-beta.0",
-    "@sockethub/platform-caldav": "^1.0.0-beta.0",
-    "@sockethub/platform-carddav": "^1.0.0-beta.0",
-    "@sockethub/platform-dummy": "^3.0.0-beta.0",
-    "@sockethub/platform-feeds": "^4.0.0-beta.0",
-    "@sockethub/platform-irc": "^4.0.0-beta.0",
-    "@sockethub/platform-metadata": "^1.0.1-beta.0",
-    "@sockethub/platform-xmpp": "^5.0.0-beta.0"
+    "@sockethub/examples": "^1.0.0-beta.2",
+    "@sockethub/platform-caldav": "^1.0.0-beta.2",
+    "@sockethub/platform-carddav": "^1.0.0-beta.2",
+    "@sockethub/platform-dummy": "^3.0.0-beta.2",
+    "@sockethub/platform-email": "^1.0.0-beta.2",
+    "@sockethub/platform-feeds": "^4.0.0-beta.2",
+    "@sockethub/platform-instagram": "^1.0.0-beta.2",
+    "@sockethub/platform-irc": "^4.0.0-beta.2",
+    "@sockethub/platform-messenger": "^1.0.0-beta.2",
+    "@sockethub/platform-metadata": "^1.0.1-beta.2",
+    "@sockethub/platform-xmpp": "^5.0.0-beta.2"
   },
-  "gitHead": "a17e337ee7d2dd496d225c0d6e8ae48f4f4ce73c",
+  "gitHead": "d241420f9743f66a15ed083a1390595b331a96ac",
   "types": "./dist/index.d.ts"
 }