@spfn/core 0.2.0-beta.52 → 0.2.0-beta.54

package/dist/route/index.d.ts

@@ -2,6 +2,8 @@ import * as _sinclair_typebox from '@sinclair/typebox';
 import { TSchema, Static, Kind } from '@sinclair/typebox';
 import { Context, MiddlewareHandler, Hono } from 'hono';
 import { ContentfulStatusCode, RedirectStatusCode } from 'hono/utils/http-status';
+import { N as NamedMiddleware } from '../define-middleware-DuXD8Hvu.js';
+export { E as ExtractMiddlewareNames, b as NamedMiddlewareFactory, d as defineMiddleware, a as defineMiddlewareFactory } from '../define-middleware-DuXD8Hvu.js';
 import { HttpMethod } from './types.js';
 
 /**
@@ -209,170 +211,6 @@ type RouteBuilderContext<TInput extends RouteInput = RouteInput, TInterceptor ex
     raw: Context;
 };
 
-/**
- * Middleware Definition Helper
- *
- * Provides type-safe middleware definition with name inference
- */
-
-/**
- * Named middleware with type inference
- *
- * @example
- * ```ts
- * export const authMiddleware = defineMiddleware('auth', async (c, next) => {
- *   // auth logic
- *   c.set('user', { id: 1 });
- *   await next();
- * });
- *
- * export const rateLimitMiddleware = defineMiddleware('rateLimit', async (c, next) => {
- *   // rate limit logic
- *   await next();
- * });
- * ```
- */
-type NamedMiddleware<TName extends string = string> = {
-    name: TName;
-    handler: MiddlewareHandler;
-    _name: TName;
-    skips?: string[];
-};
-/**
- * Named middleware factory with type inference
- *
- * Factory function that creates middleware instances with parameters
- *
- * @example
- * ```ts
- * export const requirePermissions = defineMiddleware('permission',
- *   (...permissions: string[]) => async (c, next) => {
- *     // permission check logic
- *     await next();
- *   }
- * );
- * ```
- */
-type NamedMiddlewareFactory<TName extends string = string, TArgs extends any[] = any[]> = {
-    name: TName;
-    _name: TName;
-} & ((...args: TArgs) => MiddlewareHandler);
-/**
- * Define a named middleware
- *
- * Creates a middleware with a unique name that can be referenced
- * in route-level skip() calls with full type safety.
- *
- * Supports two patterns:
- * 1. Regular middleware: Direct middleware handler
- * 2. Factory middleware: Function that creates middleware with parameters
- *
- * @param name - Unique middleware name
- * @param handler - Middleware handler function
- * @returns Named middleware with type inference
- *
- * @example
- * ```ts
- * // Regular middleware
- * export const authMiddleware = defineMiddleware('auth', async (c, next) => {
- *   const token = c.req.header('authorization');
- *   if (!token) {
- *     return c.json({ error: 'Unauthorized' }, 401);
- *   }
- *   c.set('user', await verifyToken(token));
- *   await next();
- * });
- *
- * // Factory middleware
- * export const requirePermissions = defineMiddleware('permission',
- *   (...permissions: string[]) => async (c, next) => {
- *     const user = c.get('user');
- *     if (!hasPermissions(user, permissions)) {
- *       return c.json({ error: 'Forbidden' }, 403);
- *     }
- *     await next();
- *   }
- * );
- *
- * // server.config.ts
- * export default defineServerConfig()
- *   .middlewares([authMiddleware])
- *   .routes(appRouter)
- *   .build();
- *
- * // routes.ts - skip by name
- * export const publicRoute = route.get('/health')
- *   .skip(['auth'])  // ✅ Type-safe! Autocomplete!
- *   .handler(async (c) => c.success({ status: 'ok' }));
- *
- * // Use factory middleware inline
- * export const protectedRoute = route.get('/admin')
- *   .use([requirePermissions('admin:write')])
- *   .handler(async (c) => { ... });
- * ```
- */
-/**
- * Options for defineMiddleware
- */
-interface DefineMiddlewareOptions {
-    /**
-     * Server-level middleware names to auto-skip when this middleware is used at route level.
-     *
-     * @example
-     * ```ts
-     * // optionalAuth auto-skips the global 'auth' middleware
-     * export const optionalAuth = defineMiddleware('optionalAuth', handler, {
-     *     skips: ['auth']
-     * });
-     *
-     * // Usage: .use([optionalAuth]) — no need for .skip(['auth'])
-     * ```
-     */
-    skips?: string[];
-}
-declare function defineMiddleware<TName extends string>(name: TName, handler: MiddlewareHandler, options?: DefineMiddlewareOptions): NamedMiddleware<TName>;
-declare function defineMiddleware<TName extends string, TArgs extends any[]>(name: TName, factory: (...args: TArgs) => MiddlewareHandler, options?: DefineMiddlewareOptions): NamedMiddlewareFactory<TName, TArgs>;
-/**
- * Define a middleware factory explicitly
- *
- * Use this when your factory function has exactly 2 parameters,
- * which would be incorrectly detected as a regular middleware handler.
- *
- * @param name - Unique middleware name
- * @param factory - Factory function that returns a middleware handler
- * @returns Named middleware factory with type inference
- *
- * @example
- * ```ts
- * // Factory with 2 params (would be misdetected by defineMiddleware)
- * export const rateLimiter = defineMiddlewareFactory('rateLimit',
- *   (limit: number, window: number) => async (c, next) => {
- *     // rate limit logic using limit and window
- *     await next();
- *   }
- * );
- *
- * // Usage
- * route.get('/api')
- *   .use([rateLimiter(100, 60000)])  // 100 requests per minute
- *   .handler(...)
- * ```
- */
-declare function defineMiddlewareFactory<TName extends string, TArgs extends unknown[]>(name: TName, factory: (...args: TArgs) => MiddlewareHandler): NamedMiddlewareFactory<TName, TArgs>;
-/**
- * Extract middleware names from an array of named middlewares
- *
- * @example
- * ```ts
- * type Middlewares = [
- *   NamedMiddleware<'auth'>,
- *   NamedMiddleware<'rateLimit'>
- * ];
- * type Names = ExtractMiddlewareNames<Middlewares>;  // 'auth' | 'rateLimit'
- * ```
- */
-type ExtractMiddlewareNames<T extends readonly NamedMiddleware<string>[]> = T[number]['_name'];
-
 /**
  * Route Builder
  *
@@ -911,4 +749,4 @@ declare function getFileOptions(schema: TSchema): FileSchemaOptions | FileArrayS
  */
 declare function formatFileSize(bytes: number): string;
 
-export { type ExtractMiddlewareNames, FileArraySchema, type FileArraySchemaOptions, type FileArraySchemaType, FileSchema, type FileSchemaOptions, type FileSchemaType, HttpMethod, type MergedInput, type NamedMiddleware, type NamedMiddlewareFactory, Nullable, OptionalFileSchema, OptionalNullable, type PaginatedResult, type RegisteredRoute, type RouteBuilderContext, type RouteDef, type RouteHandlerFn, type RouteInput, type Router, defineMiddleware, defineMiddlewareFactory, defineRouter, formatFileSize, getFileOptions, isFileArraySchema, isFileSchema, isHttpMethod, registerRoutes, route };
+export { FileArraySchema, type FileArraySchemaOptions, type FileArraySchemaType, FileSchema, type FileSchemaOptions, type FileSchemaType, HttpMethod, type MergedInput, NamedMiddleware, Nullable, OptionalFileSchema, OptionalNullable, type PaginatedResult, type RegisteredRoute, type RouteBuilderContext, type RouteDef, type RouteHandlerFn, type RouteInput, type Router, defineRouter, formatFileSize, getFileOptions, isFileArraySchema, isFileSchema, isHttpMethod, registerRoutes, route };

package/dist/server/index.d.ts

@@ -3,11 +3,11 @@ import { MiddlewareHandler, Hono } from 'hono';
 import { cors } from 'hono/cors';
 import { serve } from '@hono/node-server';
 import { NamedMiddleware, Router } from '@spfn/core/route';
-import { OnErrorContext } from '@spfn/core/middleware';
-import { J as JobRouter, B as BossOptions } from '../boss-Cxqc-Oiw.js';
-import { E as EventRouterDef } from '../token-manager-C2Ag5-s8.js';
-import { S as SSEHandlerConfig, a as SSEAuthConfig } from '../types-VpVQIsyB.js';
-import { W as WSRouterDef, a as WSHandlerConfig, b as WSMessageHandlers, c as WSAuthConfig } from '../types-CKsmzaB8.js';
+import { OnErrorContext, ProxyGuardConfig } from '@spfn/core/middleware';
+import { J as JobRouter, B as BossOptions } from '../boss-CEik0yq-.js';
+import { E as EventRouterDef } from '../token-manager-jKD_EsSE.js';
+import { S as SSEHandlerConfig, a as SSEAuthConfig } from '../types-BFB72jbM.js';
+import { W as WSRouterDef, a as WSHandlerConfig, b as WSMessageHandlers, c as WSAuthConfig } from '../types-DVjf37yO.js';
 import '@sinclair/typebox';
 import 'pg-boss';
 
@@ -96,6 +96,28 @@ interface ServerConfig {
      * Additional custom middleware
      */
     use?: MiddlewareHandler[];
+    /**
+     * Proxy-guard: verify requests came through the trusted Next.js RPC proxy
+     * (HMAC signature) and/or an allowed browser origin, then tag `clientType`.
+     * Lets the backend reject direct-to-backend calls that bypass the proxy.
+     *
+     * Disabled by default (`mode: 'off'`). Requires the same `SPFN_PROXY_SECRET`
+     * on the proxy and the backend. See PROXY-BACKEND-AUTH-SPEC.md.
+     *
+     * @example
+     * ```typescript
+     * .proxyGuard({ mode: 'strict', allowedOrigins: ['https://app.example.com'] })
+     * ```
+     */
+    proxyGuard?: Omit<ProxyGuardConfig, 'nonceStore'> & {
+        /**
+         * Enable hard replay rejection via a Redis nonce store. Evaluated in BOTH modes
+         * (tag observes replays, strict rejects). Requires a cache (CACHE_URL); without
+         * one, falls back to the timestamp window. Degrades to the window if the store
+         * is briefly unavailable. @default false
+         */
+        nonce?: boolean;
+    };
     /**
      * Global middlewares with names for route-level skip control
      * Use defineMiddleware() for type-safe middleware definitions
@@ -788,6 +810,10 @@ declare class ServerConfigBuilder {
      * Add named middlewares for route-level skip control
      */
     middlewares(middlewares: ServerConfig['middlewares']): this;
+    /**
+     * Configure proxy-guard (verify trusted-proxy signature + origin → clientType)
+     */
+    proxyGuard(proxyGuard: ServerConfig['proxyGuard']): this;
     /**
      * Register define-route based router
      *

package/dist/server/index.js

@@ -8,7 +8,7 @@ import { cors } from 'hono/cors';
 import { registerRoutes } from '@spfn/core/route';
 import { ErrorHandler, RequestLogger } from '@spfn/core/middleware';
 import { streamSSE } from 'hono/streaming';
-import { randomBytes } from 'crypto';
+import { randomBytes, createHash } from 'crypto';
 import { Agent, setGlobalDispatcher } from 'undici';
 import { initDatabase, getDatabase, closeDatabase } from '@spfn/core/db';
 import { initCache, getCache, closeCache } from '@spfn/core/cache';
@@ -445,6 +445,23 @@ function createBoundedWriter(stream, maxQueue, onClose) {
 
 // src/event/sse/handler.ts
 var sseLogger = logger.child("@spfn/core:sse");
+var frameCache = /* @__PURE__ */ new WeakMap();
+function serializeFrame(eventName, payload) {
+  if (payload === null || typeof payload !== "object") {
+    return JSON.stringify({ event: eventName, data: payload });
+  }
+  let byEvent = frameCache.get(payload);
+  if (!byEvent) {
+    byEvent = /* @__PURE__ */ new Map();
+    frameCache.set(payload, byEvent);
+  }
+  let serialized = byEvent.get(eventName);
+  if (serialized === void 0) {
+    serialized = JSON.stringify({ event: eventName, data: payload });
+    byEvent.set(eventName, serialized);
+  }
+  return serialized;
+}
 var DEFAULT_MAX_QUEUE = 1e3;
 function createSSEHandler(router, config = {}, tokenManager) {
   const {
@@ -495,12 +512,14 @@ function createSSEHandler(router, config = {}, tokenManager) {
       let connectionDead = false;
       let pingTimer;
       let writer;
+      let onClosed;
       const cleanup = (reason) => {
         if (connectionDead) return;
         connectionDead = true;
         clearInterval(pingTimer);
         unsubscribes.forEach((fn) => fn());
         writer?.close();
+        onClosed?.();
         sseLogger.info("SSE dead connection cleaned up", {
           events: allowedEvents,
           reason
@@ -530,10 +549,6 @@ function createSSEHandler(router, config = {}, tokenManager) {
             }
           }
           messageId++;
-          const message = {
-            event: eventName,
-            data: payload
-          };
           sseLogger.debug("SSE sending event", {
             event: eventName,
             messageId
@@ -541,7 +556,7 @@ function createSSEHandler(router, config = {}, tokenManager) {
           writer.enqueue({
             id: String(messageId),
             event: eventName,
-            data: JSON.stringify(message)
+            data: serializeFrame(eventName, payload)
           });
         });
         unsubscribes.push(unsubscribe);
@@ -558,8 +573,15 @@ function createSSEHandler(router, config = {}, tokenManager) {
         });
       }, pingInterval);
       const abortSignal = c.req.raw.signal;
-      while (!abortSignal.aborted && !connectionDead) {
-        await stream.sleep(pingInterval);
+      if (!abortSignal.aborted && !connectionDead) {
+        await new Promise((resolve2) => {
+          const onAbort = () => resolve2();
+          abortSignal.addEventListener("abort", onAbort, { once: true });
+          onClosed = () => {
+            abortSignal.removeEventListener("abort", onAbort);
+            resolve2();
+          };
+        });
       }
       cleanup();
     }, async (err) => {
@@ -596,24 +618,28 @@ async function authorizeEvents(subject, requestedEvents, authConfig) {
   }
   return allowed;
 }
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
 var InMemoryTokenStore = class {
   tokens = /* @__PURE__ */ new Map();
   async set(token, data) {
-    this.tokens.set(token, data);
+    this.tokens.set(hashToken(token), data);
   }
   async consume(token) {
-    const data = this.tokens.get(token);
+    const key = hashToken(token);
+    const data = this.tokens.get(key);
     if (!data) {
       return null;
     }
-    this.tokens.delete(token);
+    this.tokens.delete(key);
     return data;
   }
   async cleanup() {
     const now = Date.now();
-    for (const [token, data] of this.tokens) {
+    for (const [key, data] of this.tokens) {
       if (data.expiresAt <= now) {
-        this.tokens.delete(token);
+        this.tokens.delete(key);
       }
     }
   }
@@ -626,14 +652,14 @@ var CacheTokenStore = class {
   async set(token, data) {
     const ttlSeconds = Math.max(1, Math.ceil((data.expiresAt - Date.now()) / 1e3));
     await this.cache.set(
-      this.prefix + token,
+      this.prefix + hashToken(token),
       JSON.stringify(data),
       "EX",
       ttlSeconds
     );
   }
   async consume(token) {
-    const key = this.prefix + token;
+    const key = this.prefix + hashToken(token);
     let raw = null;
     if (this.cache.getdel) {
       raw = await this.cache.getdel(key);
@@ -668,7 +694,6 @@ var SSETokenManager = class {
   async issue(subject) {
     const token = randomBytes(32).toString("hex");
     await this.store.set(token, {
-      token,
       subject,
       expiresAt: Date.now() + this.ttl
     });
@@ -1343,6 +1368,7 @@ async function createAutoConfiguredApp(config) {
     });
   }
   applyDefaultMiddleware(app, config, enableLogger, enableCors);
+  await applyProxyGuard(app, config);
   if (Array.isArray(config?.use)) {
     config.use.forEach((mw) => app.use("*", mw));
   }
@@ -1365,6 +1391,51 @@ function applyDefaultMiddleware(app, config, enableLogger, enableCors) {
     app.use("*", cors(corsOptions));
   }
 }
+async function applyProxyGuard(app, config) {
+  const proxyGuardConfig = config?.proxyGuard;
+  const mode = proxyGuardConfig?.mode ?? "off";
+  if (mode === "off") {
+    return;
+  }
+  const { createProxyGuard, createCacheNonceStore, createInMemoryNonceStore } = await import('@spfn/core/middleware');
+  let nonceStore;
+  if (proxyGuardConfig?.nonce) {
+    try {
+      const { getCache: getCache2 } = await import('@spfn/core/cache');
+      const cache = getCache2();
+      if (cache) {
+        nonceStore = createCacheNonceStore(cache);
+        serverLogger.info("Proxy-guard nonce replay rejection: cache (Redis/Valkey)");
+      } else {
+        nonceStore = createInMemoryNonceStore();
+        serverLogger.info("Proxy-guard nonce replay rejection: in-memory (single instance only \u2014 use a cache for multi-instance)");
+      }
+    } catch {
+      nonceStore = createInMemoryNonceStore();
+      serverLogger.warn("Proxy-guard nonce: cache module unavailable \u2014 using in-memory store (single instance only)");
+    }
+  }
+  const autoSkip = [config?.healthCheck?.path ?? "/health"];
+  if (config?.events) {
+    autoSkip.push(config.eventsConfig?.path ?? "/events/stream");
+  }
+  if (config?.websockets) {
+    autoSkip.push(config.websocketsConfig?.path ?? "/ws");
+  }
+  const skipPaths = [...proxyGuardConfig?.skipPaths ?? [], ...autoSkip];
+  app.use("*", createProxyGuard({
+    mode,
+    secret: proxyGuardConfig?.secret,
+    previousSecrets: proxyGuardConfig?.previousSecrets,
+    windowMs: proxyGuardConfig?.windowMs,
+    allowedOrigins: proxyGuardConfig?.allowedOrigins,
+    maxBodyBytes: proxyGuardConfig?.maxBodyBytes,
+    nonceStore,
+    nonceFailClosed: proxyGuardConfig?.nonceFailClosed,
+    skipPaths
+  }));
+  serverLogger.info(`\u2713 Proxy-guard enabled (mode: ${mode})`);
+}
 function registerHealthCheckEndpoint(app, config) {
   const healthCheckConfig = config?.healthCheck ?? {};
   const healthCheckEnabled = healthCheckConfig.enabled !== false;
@@ -1606,9 +1677,7 @@ async function registerJobs(router) {
     }
     jobLogger2.info("Existing jobs cleared");
   }
-  for (const job2 of jobs) {
-    await registerJob(job2);
-  }
+  await Promise.all(jobs.map((job2) => registerJob(job2)));
   jobLogger2.info("All jobs registered successfully");
 }
 async function ensureQueue(boss, queueName) {
@@ -1641,9 +1710,10 @@ async function executeJobHandler(job2, pgBossJob) {
 async function registerWorker(boss, job2, queueName) {
   await ensureQueue(boss, queueName);
   const batchSize = job2.options?.batchSize ?? 1;
+  const pollingIntervalSeconds = job2.options?.pollingIntervalSeconds ?? env.JOB_POLLING_INTERVAL_SECONDS;
   await boss.work(
     queueName,
-    { batchSize },
+    { batchSize, pollingIntervalSeconds },
     async (pgBossJobs) => {
       if (batchSize <= 1) {
         await executeJobHandler(job2, pgBossJobs[0]);
@@ -1721,24 +1791,54 @@ async function registerJob(job2) {
   jobLogger2.debug(`Job registered: ${job2.name}`);
 }
 var wsLogger = logger.child("@spfn/core:ws");
+function isOriginAllowed(origin, allowList) {
+  if (!allowList) {
+    return true;
+  }
+  if (!origin) {
+    return true;
+  }
+  return allowList.has(origin);
+}
 async function attachWSHandler(server, router, config = {}, tokenManager) {
   const WebSocketServer = await loadWSServer();
   const {
     pingInterval = 3e4,
     path = "/ws",
+    maxPayload = 1048576,
+    maxBufferedBytes = 1048576,
+    maxConnections = 1e4,
+    maxConnectionsPerSubject = 0,
+    allowedOrigins,
     auth: authConfig
   } = config;
+  const originAllowList = allowedOrigins && allowedOrigins.length > 0 ? new Set(allowedOrigins) : null;
   if (authConfig?.enabled && !tokenManager) {
     throw new Error(
       "WebSocket auth.enabled=true requires a tokenManager. Pass tokenManager or use .websockets(router, { auth: { enabled: true } }) via startServer."
     );
   }
-  const wss = new WebSocketServer({ server, path });
+  const wss = new WebSocketServer({ server, path, maxPayload });
   const clients = /* @__PURE__ */ new Set();
+  const subjectCounts = /* @__PURE__ */ new Map();
   wss.on("connection", (ws, req) => {
+    if (!isOriginAllowed(req.headers?.origin, originAllowList)) {
+      wsLogger.warn("WebSocket rejected: disallowed origin", { origin: req.headers?.origin });
+      ws.close(1008, "Origin not allowed");
+      return;
+    }
+    if (clients.size >= maxConnections) {
+      ws.close(1013, "Server at capacity");
+      return;
+    }
     clients.add(ws);
     ws.on("close", () => clients.delete(ws));
-    handleConnection(ws, req, router, authConfig, tokenManager, pingInterval).catch((err) => {
+    handleConnection(ws, req, router, authConfig, tokenManager, {
+      pingInterval,
+      maxBufferedBytes,
+      maxConnectionsPerSubject,
+      subjectCounts
+    }).catch((err) => {
       wsLogger.error("WebSocket connection handler error", err);
       if (ws.readyState === 1) ws.close(1011, "Internal server error");
     });
@@ -1761,7 +1861,8 @@ async function attachWSHandler(server, router, config = {}, tokenManager) {
     });
   });
 }
-async function handleConnection(ws, req, router, authConfig, tokenManager, pingInterval) {
+async function handleConnection(ws, req, router, authConfig, tokenManager, opts) {
+  const { pingInterval, maxBufferedBytes, maxConnectionsPerSubject, subjectCounts } = opts;
   let pingTimer;
   let connectionUnsubscribes = [];
   let subscribedEvents = [];
@@ -1795,13 +1896,26 @@ async function handleConnection(ws, req, router, authConfig, tokenManager, pingI
     ws.close(4003, "Not authorized for any requested events");
     return;
   }
+  if (maxConnectionsPerSubject > 0 && typeof subject === "string") {
+    const current = subjectCounts.get(subject) ?? 0;
+    if (current >= maxConnectionsPerSubject) {
+      ws.close(1013, "Too many connections for this subject");
+      return;
+    }
+    subjectCounts.set(subject, current + 1);
+    ws.on("close", () => {
+      const remaining = (subjectCounts.get(subject) ?? 1) - 1;
+      if (remaining <= 0) subjectCounts.delete(subject);
+      else subjectCounts.set(subject, remaining);
+    });
+  }
   subscribedEvents = allowedEvents;
   wsLogger.info("WebSocket connection established", {
     events: allowedEvents,
     subject: subject ?? void 0
   });
-  const connection = createConnection(ws);
-  connectionUnsubscribes = subscribeEvents(ws, router, allowedEvents, subject, authConfig);
+  const connection = createConnection(ws, maxBufferedBytes);
+  connectionUnsubscribes = subscribeEvents(ws, router, allowedEvents, subject, authConfig, maxBufferedBytes);
   if (ws.readyState !== 1) {
     connectionUnsubscribes.forEach((fn) => fn());
     connectionUnsubscribes = [];
@@ -1811,8 +1925,18 @@ async function handleConnection(ws, req, router, authConfig, tokenManager, pingI
     onClientMessage(data, router, connection, subject).catch((err) => wsLogger.error("Unhandled message error", err));
   });
   if (pingInterval > 0) {
+    ws.isAlive = true;
+    ws.on("pong", () => {
+      ws.isAlive = true;
+    });
     pingTimer = setInterval(() => {
-      if (ws.readyState === 1) ws.ping();
+      if (ws.readyState !== 1) return;
+      if (ws.isAlive === false) {
+        ws.terminate();
+        return;
+      }
+      ws.isAlive = false;
+      ws.ping();
     }, pingInterval);
   }
   connection.send("__connected", {
@@ -1851,16 +1975,24 @@ async function resolveAllowedEvents(subject, requestedEvents, authConfig) {
   const allowed = await authConfig.authorize(subject, requestedEvents);
   return allowed.length === 0 ? null : allowed;
 }
-function createConnection(ws) {
+function safeSend(ws, frame, maxBufferedBytes) {
+  if (ws.readyState !== 1) return;
+  if (ws.bufferedAmount > maxBufferedBytes) {
+    ws.close(1013, "Send buffer overflow");
+    return;
+  }
+  try {
+    ws.send(JSON.stringify(frame));
+  } catch {
+  }
+}
+function createConnection(ws, maxBufferedBytes) {
   return {
-    send: (type, payload) => {
-      if (ws.readyState !== 1) return;
-      ws.send(JSON.stringify({ type, data: payload }));
-    },
+    send: (type, payload) => safeSend(ws, { type, data: payload }, maxBufferedBytes),
     close: (code, reason) => ws.close(code, reason)
   };
 }
-function subscribeEvents(ws, router, allowedEvents, subject, authConfig) {
+function subscribeEvents(ws, router, allowedEvents, subject, authConfig, maxBufferedBytes) {
   const unsubscribes = [];
   for (const eventName of allowedEvents) {
     const eventDef = router.events[eventName];
@@ -1870,10 +2002,7 @@ function subscribeEvents(ws, router, allowedEvents, subject, authConfig) {
       if (subject && authConfig?.filter?.[eventName]) {
         if (!authConfig.filter[eventName](subject, payload)) return;
       }
-      try {
-        ws.send(JSON.stringify({ type: eventName, data: payload }));
-      } catch {
-      }
+      safeSend(ws, { type: eventName, data: payload }, maxBufferedBytes);
     });
     unsubscribes.push(unsubscribe);
   }
@@ -2493,6 +2622,13 @@ var ServerConfigBuilder = class {
     this.config.middlewares = middlewares;
     return this;
   }
+  /**
+   * Configure proxy-guard (verify trusted-proxy signature + origin → clientType)
+   */
+  proxyGuard(proxyGuard) {
+    this.config.proxyGuard = proxyGuard;
+    return this;
+  }
   /**
    * Register define-route based router
    *