@spfn/core 0.2.0-beta.53 → 0.2.0-beta.54

package/dist/{token-manager-C2Ag5-s8.d.ts → token-manager-jKD_EsSE.d.ts}

@@ -188,7 +188,6 @@ type CacheClient = {
  * Stored SSE token data
  */
 interface SSEToken {
-    token: string;
     subject: string;
     expiresAt: number;
 }

package/dist/{types-VpVQIsyB.d.ts → types-BFB72jbM.d.ts}

@@ -1,5 +1,5 @@
 import { Context } from 'hono';
-import { h as SSETokenStore, S as SSETokenManager, E as EventRouterDef, I as InferEventNames, b as InferEventPayload } from './token-manager-C2Ag5-s8.js';
+import { h as SSETokenStore, S as SSETokenManager, E as EventRouterDef, I as InferEventNames, b as InferEventPayload } from './token-manager-jKD_EsSE.js';
 
 /**
  * SSE Types

package/dist/{types-CKsmzaB8.d.ts → types-DVjf37yO.d.ts}

@@ -1,5 +1,5 @@
 import { Context } from 'hono';
-import { a as EventDef, E as EventRouterDef, h as SSETokenStore, S as SSETokenManager, I as InferEventNames, b as InferEventPayload } from './token-manager-C2Ag5-s8.js';
+import { a as EventDef, E as EventRouterDef, h as SSETokenStore, S as SSETokenManager, I as InferEventNames, b as InferEventPayload } from './token-manager-jKD_EsSE.js';
 
 /**
  * WebSocket Types
@@ -101,6 +101,42 @@ interface WSHandlerConfig {
      * prefixes to isolate apps/tenants that share one Redis instance.
      */
     channelPrefix?: string;
+    /**
+     * Maximum inbound message size in bytes. Frames larger than this are
+     * rejected by the ws library before they are buffered or parsed.
+     * @default 1048576 (1 MiB)
+     */
+    maxPayload?: number;
+    /**
+     * Backpressure cap: if a connection's outbound buffer (`bufferedAmount`)
+     * exceeds this many bytes, the connection is closed (1013) instead of
+     * buffering more — a slow consumer cannot drive the process to OOM.
+     * @default 1048576 (1 MiB)
+     */
+    maxBufferedBytes?: number;
+    /**
+     * Maximum number of concurrent connections accepted by this server. New
+     * connections beyond the cap are rejected with close code 1013.
+     * @default 10000
+     */
+    maxConnections?: number;
+    /**
+     * Maximum concurrent connections per authenticated subject (0 = unlimited).
+     * @default 0
+     */
+    maxConnectionsPerSubject?: number;
+    /**
+     * Allow-list of `Origin` header values permitted to open a WebSocket. A
+     * browser sends Origin on the upgrade, so this blocks cross-site scripts from
+     * connecting with the user's ambient cookies (WebSocket has no same-origin
+     * policy / CORS of its own). Connections whose Origin isn't listed are closed
+     * with 1008. Undefined/empty = no Origin check (default; non-browser clients
+     * such as native apps send no Origin and are always allowed).
+     *
+     * @example ['https://app.example.com', 'https://admin.example.com']
+     * @default undefined (disabled)
+     */
+    allowedOrigins?: string[];
     /**
      * Authentication and authorization configuration
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spfn/core",
-  "version": "0.2.0-beta.53",
+  "version": "0.2.0-beta.54",
   "description": "SPFN Framework Core - File-based routing, transactions, repository pattern",
   "type": "module",
   "exports": {
@@ -149,25 +149,25 @@
     "node": ">=18.18.0"
   },
   "dependencies": {
-    "@hono/node-server": "^1.0.0",
+    "@hono/node-server": "^1.19.13",
     "@sinclair/typebox": "^0.34.0",
     "chalk": "^5.6.2",
     "chokidar": "^4.0.3",
     "dotenv": "^17.2.3",
-    "drizzle-orm": "^0.45.0",
+    "drizzle-orm": "^0.45.2",
     "drizzle-typebox": "^0.1.0",
-    "hono": "^4.12.4",
+    "hono": "^4.12.25",
     "jiti": "^2.6.1",
     "micromatch": "^4.0.8",
     "pg-boss": "^11.1.2",
     "postgres": "^3.4.0",
     "typescript": "^5.3.3",
-    "undici": "^7.24.0",
+    "undici": "^7.28.0",
     "zod": "^4.1.11"
   },
   "optionalDependencies": {
     "ioredis": "^5.4.1",
-    "ws": "^8.0.0"
+    "ws": "^8.21.0"
   },
   "devDependencies": {
     "@types/micromatch": "^4.0.9",