@vex-chat/spire 1.0.0 → 1.0.2

package/dist/server/rateLimit.js

@@ -1,4 +1,52 @@
+import { timingSafeEqual } from "node:crypto";
 import rateLimit, { ipKeyGenerator } from "express-rate-limit";
+/** HTTP header carrying the dev API key (must match {@link process.env.DEV_API_KEY}). */
+export const DEV_API_KEY_HEADER = "x-dev-api-key";
+/**
+ * When `DEV_API_KEY` is set in the environment, any request whose
+ * `x-dev-api-key` header matches (constant-time) skips all in-process rate
+ * limiters. Dev / load-testing escape hatch only — never set in production.
+ * (Future: first-class API keys with scopes may reuse this header name.)
+ */
+export function devApiKeySkipsRateLimits(req) {
+    const configured = process.env["DEV_API_KEY"]?.trim() ?? "";
+    if (configured.length === 0) {
+        return false;
+    }
+    const presented = req.get(DEV_API_KEY_HEADER);
+    if (!presented || presented.length !== configured.length) {
+        return false;
+    }
+    try {
+        return timingSafeEqual(Buffer.from(presented, "utf8"), Buffer.from(configured, "utf8"));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Rate limiting middleware.
+ *
+ * Three tiers matching CWE-307 (brute-force auth), CWE-400 / CWE-770
+ * (unrestricted resource consumption), and OWASP API4:2023:
+ *
+ * - `globalLimiter` — baseline per-IP limit across every route. Wide
+ *   enough to not bother normal clients, tight enough to shield the
+ *   server from a single-host flood.
+ * - `authLimiter` — strict per-IP limit on auth endpoints (register,
+ *   login, device challenge). `skipSuccessfulRequests` means only the
+ *   failed attempts count, so a correct login doesn't eat the budget.
+ * - `uploadLimiter` — upload-specific limit applied before multer,
+ *   so multer never even parses a request that's over quota.
+ *
+ * All three use `ipKeyGenerator` from `express-rate-limit@7.4+` to
+ * bucket IPv4 and IPv4-mapped IPv6 correctly (CVE-2026-30827 — older
+ * versions silently collapsed all IPv4-mapped IPv6 addresses into
+ * one bucket, which let attackers bypass the limiter).
+ *
+ * `trust proxy` must be set on the Express app (see Spire.ts) so
+ * `req.ip` returns the real client address, not the immediate proxy.
+ */
 /**
  * Bucket requests by the real client IP, IPv6-safe.
  *
@@ -11,14 +59,15 @@ const keyByIp = (req) => ipKeyGenerator(req.ip ?? "");
 /**
  * Global per-IP limiter. Applied app-wide via `api.use(globalLimiter)`.
  *
- * 300 requests per 15 minutes per client IP. A human chatting via a
+ * 3000 requests per 15 minutes per client IP. A human chatting via a
  * browser or the libvex client won't come close; a single-host DoS
  * gets throttled quickly.
  */
 export const globalLimiter = rateLimit({
     keyGenerator: keyByIp,
     legacyHeaders: false,
-    limit: 300,
+    limit: 3000,
+    skip: devApiKeySkipsRateLimits,
     standardHeaders: "draft-7",
     windowMs: 15 * 60 * 1000,
 });
@@ -26,7 +75,7 @@ export const globalLimiter = rateLimit({
  * Strict auth endpoint limiter. Applied per-route to /auth, /register,
  * and /auth/device.
  *
- * 5 failed attempts per 15 minutes per IP. Successful logins don't
+ * 50 failed attempts per 15 minutes per IP. Successful logins don't
  * count (`skipSuccessfulRequests`), so a normal user doesn't lock
  * themselves out by fat-fingering a password once. Blocks brute force
  * (CWE-307) without harming UX.
@@ -34,7 +83,8 @@ export const globalLimiter = rateLimit({
 export const authLimiter = rateLimit({
     keyGenerator: keyByIp,
     legacyHeaders: false,
-    limit: 5,
+    limit: 50,
+    skip: devApiKeySkipsRateLimits,
     skipSuccessfulRequests: true,
     standardHeaders: "draft-7",
     windowMs: 15 * 60 * 1000,
@@ -45,13 +95,14 @@ export const authLimiter = rateLimit({
  * upload attempts per minute so an attacker can't force spire to
  * spend CPU/IO on repeated large-body parses.
  *
- * 20 uploads per minute per IP — generous for a chat client (rapid-
+ * 200 uploads per minute per IP — generous for a chat client (rapid-
  * fire image attachments) but tight enough to shield the disk.
  */
 export const uploadLimiter = rateLimit({
     keyGenerator: keyByIp,
     legacyHeaders: false,
-    limit: 20,
+    limit: 200,
+    skip: devApiKeySkipsRateLimits,
     standardHeaders: "draft-7",
     windowMs: 60 * 1000,
 });

package/dist/server/rateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/server/rateLimit.ts"],"names":[],"mappings":"AAyBA,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,GAAG;IACV,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,CAAC;IACR,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAC"}
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/server/rateLimit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE/D,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,eAAe,CAClB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAC9B,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAClC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,IAAI;IACX,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,wBAAwB;IAC9B,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAC"}

package/dist/server/user.d.ts

@@ -1,4 +1,3 @@
 import type { Database } from "../Database.ts";
-import type winston from "winston";
 import { TokenScopes } from "@vex-chat/types";
-export declare const getUserRouter: (db: Database, log: winston.Logger, tokenValidator: (key: string, scope: TokenScopes) => boolean) => import("express-serve-static-core").Router;
+export declare const getUserRouter: (db: Database, tokenValidator: (key: string, scope: TokenScopes) => boolean) => import("express-serve-static-core").Router;

package/dist/server/user.js

@@ -6,7 +6,7 @@ import { stringify } from "uuid";
 import { msgpack } from "../utils/msgpack.js";
 import { censorUser, getParam, getUser } from "./utils.js";
 import { protect } from "./index.js";
-export const getUserRouter = (db, log, tokenValidator) => {
+export const getUserRouter = (db, tokenValidator) => {
     const router = express.Router();
     router.get("/:id", protect, async (req, res) => {
         const user = await db.retrieveUser(getParam(req, "id"));
@@ -18,9 +18,13 @@ export const getUserRouter = (db, log, tokenValidator) => {
         }
     });
     router.get("/:id/devices", protect, async (req, res) => {
-        const deviceList = await db.retrieveUserDeviceList([
-            getParam(req, "id"),
-        ]);
+        const id = getParam(req, "id");
+        const user = await db.retrieveUser(id);
+        if (!user) {
+            res.sendStatus(404);
+            return;
+        }
+        const deviceList = await db.retrieveUserDeviceList([id]);
         return res.send(msgpack.encode(deviceList));
     });
     router.get("/:id/permissions", protect, async (req, res) => {
@@ -69,7 +73,6 @@ export const getUserRouter = (db, log, tokenValidator) => {
         const deviceData = parsed.data;
         const token = xSignOpen(XUtils.decodeHex(deviceData.signed), XUtils.decodeHex(deviceData.signKey));
         if (!token) {
-            log.warn("Invalid signature on token.");
             res.sendStatus(400);
             return;
         }
@@ -78,9 +81,8 @@ export const getUserRouter = (db, log, tokenValidator) => {
                 const device = await db.createDevice(userDetails.userID, deviceData);
                 res.send(msgpack.encode(device));
             }
-            catch (err) {
-                log.warn(String(err));
-                // failed registration due to signkey being taken
+            catch (_err) {
+                // signkey already taken
                 res.sendStatus(470);
                 return;
             }

package/dist/server/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/server/user.ts"],"names":[],"mappings":"AAGA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG,CACzB,EAAY,EACZ,GAAmB,EACnB,cAA4D,EAC9D,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAExD,IAAI,IAAI,EAAE,CAAC;YACP,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACJ,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC;YAC/C,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAC5C,WAAW,CAAC,MAAM,EAClB,KAAK,CACR,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC;YAC/C,WAAW,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oCAAoC;aAC9C,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QAE/B,MAAM,KAAK,GAAG,SAAS,CACnB,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EACnC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CACvC,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YACxC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,IAAI,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAChC,WAAW,CAAC,MAAM,EAClB,UAAU,CACb,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACpB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtB,iDAAiD;gBACjD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACpB,OAAO;YACX,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/server/user.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG,CACzB,EAAY,EACZ,cAA4D,EAC9D,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAExD,IAAI,IAAI,EAAE,CAAC;YACP,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACJ,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAC5C,WAAW,CAAC,MAAM,EAClB,KAAK,CACR,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC;YAC/C,WAAW,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oCAAoC;aAC9C,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QAE/B,MAAM,KAAK,GAAG,SAAS,CACnB,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EACnC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CACvC,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,IAAI,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAChC,WAAW,CAAC,MAAM,EAClB,UAAU,CACb,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,IAAa,EAAE,CAAC;gBACrB,wBAAwB;gBACxB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACpB,OAAO;YACX,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/utils/jwtSecret.d.ts

@@ -1,7 +1,7 @@
 /**
- * Returns the JWT signing secret.
+ * Returns the dedicated JWT HMAC signing secret.
  *
- * Prefers JWT_SECRET (dedicated HMAC key) over SPK (NaCl server signing key).
- * Falls back to SPK for backward compat with existing deployments.
+ * This MUST be a separate key from SPK (the Ed25519 server signing key)
+ * so that compromise of one does not affect the other.
  */
 export declare function getJwtSecret(): string;

package/dist/utils/jwtSecret.js

@@ -1,14 +1,13 @@
 /**
- * Returns the JWT signing secret.
+ * Returns the dedicated JWT HMAC signing secret.
  *
- * Prefers JWT_SECRET (dedicated HMAC key) over SPK (NaCl server signing key).
- * Falls back to SPK for backward compat with existing deployments.
+ * This MUST be a separate key from SPK (the Ed25519 server signing key)
+ * so that compromise of one does not affect the other.
  */
 export function getJwtSecret() {
-    const secret = process.env["JWT_SECRET"] ?? process.env["SPK"];
+    const secret = process.env["JWT_SECRET"];
     if (!secret) {
-        throw new Error("Neither JWT_SECRET nor SPK is set. " +
-            "Set JWT_SECRET (preferred) or SPK in your environment.");
+        throw new Error("JWT_SECRET is not set. Generate one with: node scripts/gen-spk.js");
     }
     return secret;
 }

package/dist/utils/jwtSecret.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwtSecret.js","sourceRoot":"","sources":["../../src/utils/jwtSecret.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,qCAAqC;YACjC,wDAAwD,CAC/D,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"jwtSecret.js","sourceRoot":"","sources":["../../src/utils/jwtSecret.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,mEAAmE,CACtE,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/utils/loadEnv.js

@@ -2,7 +2,7 @@ import { config } from "dotenv";
 /* Populate process.env with vars from .env and verify required vars are present. */
 export function loadEnv() {
     config();
-    const requiredEnvVars = ["CANARY", "DB_TYPE", "SPK"];
+    const requiredEnvVars = ["DB_TYPE", "JWT_SECRET", "SPK"];
     for (const required of requiredEnvVars) {
         if (process.env[required] === undefined) {
             process.stderr.write(`Required environment variable '${required}' is not set. Please consult the README.\n`);

package/dist/utils/loadEnv.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/utils/loadEnv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,oFAAoF;AACpF,MAAM,UAAU,OAAO;IACnB,MAAM,EAAE,CAAC;IACT,MAAM,eAAe,GAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,kCAAkC,QAAQ,4CAA4C,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;AACL,CAAC"}
+{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/utils/loadEnv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,oFAAoF;AACpF,MAAM,UAAU,OAAO;IACnB,MAAM,EAAE,CAAC;IACT,MAAM,eAAe,GAAa,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,kCAAkC,QAAQ,4CAA4C,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@vex-chat/spire",
-    "version": "1.0.0",
+    "version": "1.0.2",
     "description": "Vex server implementation in NodeJS.",
     "type": "module",
     "files": [
@@ -23,13 +23,18 @@
         "preinstall": "npx only-allow npm",
         "start": "node --experimental-strip-types src/run.ts",
         "restart": "pm2 restart spire && pm2 logs spire",
-        "build": "tsc",
+        "build": "tsc && node scripts/clean-dist-tests.mjs",
         "format": "prettier --write .",
         "format:check": "prettier --check .",
-        "lint": "eslint src/",
-        "lint:fix": "eslint src/ --fix",
-        "prepare": "husky",
+        "lint": "eslint src/ scripts/stress/",
+        "lint:fix": "eslint src/ scripts/stress/ --fix",
+        "prepare": "husky || true",
         "test": "vitest run",
+        "stress:web": "node --experimental-strip-types scripts/stress/spire-stress.ts",
+        "stress:cli": "node --experimental-strip-types scripts/stress/stress-cli-sweep.ts",
+        "stress:repo-manifest": "node --experimental-strip-types scripts/stress/stress-repo-manifest.ts",
+        "stress:docs-pack": "node --experimental-strip-types scripts/stress/stress-docs-pack.ts",
+        "stress:llm-triage": "node --experimental-strip-types scripts/stress/stress-llm-triage.ts",
         "gen-spk": "node scripts/gen-spk.js",
         "docs": "node ./scripts/generate-docs.js",
         "license:check": "node scripts/fix-license-checker.mjs && npx @onebeyond/license-checker scan --allowOnly MIT MIT-0 ISC BSD-2-Clause BSD-3-Clause Apache-2.0 0BSD MPL-2.0 CC0-1.0 CC-BY-3.0 CC-BY-4.0 Unlicense BlueOak-1.0.0 Python-2.0 Zlib PSF-2.0 Artistic-2.0 AGPL-3.0-or-later WTFPL \"(MIT AND CC-BY-3.0)\" --ignoreRootPackageLicense --disableReport",
@@ -50,7 +55,9 @@
         "@types/node": "25.6.0",
         "@types/uuid": "10.0.0",
         "@types/ws": "8.18.1",
+        "@vex-chat/libvex": "5.1.0",
         "@vitest/eslint-plugin": "1.6.15",
+        "axios": "1.15.0",
         "eslint": "10.2.0",
         "eslint-config-prettier": "10.1.8",
         "eslint-plugin-n": "17.24.0",
@@ -72,6 +79,9 @@
         "*.ts": [
             "eslint --fix",
             "prettier --write"
+        ],
+        "*.{yml,yaml}": [
+            "prettier --write"
         ]
     },
     "overrides": {
@@ -83,8 +93,9 @@
     "dependencies": {
         "@asyncapi/web-component": "2.6.5",
         "@scalar/express-api-reference": "0.9.7",
-        "@vex-chat/crypto": "2.0.0",
+        "@vex-chat/crypto": "2.0.1",
         "@vex-chat/types": "2.0.0",
+        "argon2": "0.44.0",
         "better-sqlite3": "11.10.0",
         "cors": "2.8.6",
         "dotenv": "17.4.1",
@@ -98,10 +109,8 @@
         "msgpackr": "1.11.8",
         "multer": "2.1.1",
         "parse-duration": "2.1.6",
-        "picocolors": "1.1.1",
         "tweetnacl": "1.0.3",
         "uuid": "8.3.2",
-        "winston": "3.19.0",
         "ws": "8.20.0",
         "zod": "4.3.6"
     }

package/src/ClientManager.ts

@@ -11,7 +11,6 @@ import type {
     User,
     UserRecord,
 } from "@vex-chat/types";
-import type winston from "winston";
 import type WebSocket from "ws";
 
 import { EventEmitter } from "events";
@@ -21,11 +20,9 @@ import { xConcat, XUtils } from "@vex-chat/crypto";
 import { xSignOpen } from "@vex-chat/crypto";
 import { MailWSSchema, SocketAuthErrors } from "@vex-chat/types";
 
-import pc from "picocolors";
 import { parse as uuidParse, validate as uuidValidate } from "uuid";
 
-import { type SpireOptions, TOKEN_EXPIRY } from "./Spire.ts";
-import { createLogger } from "./utils/createLogger.ts";
+import { TOKEN_EXPIRY } from "./Spire.ts";
 import { createUint8UUID } from "./utils/createUint8UUID.ts";
 import { msgpack } from "./utils/msgpack.ts";
 
@@ -50,7 +47,6 @@ export class ClientManager extends EventEmitter {
     private db: Database;
     private device: Device | null;
     private failed: boolean = false;
-    private log: winston.Logger;
     private notify: (
         userID: string,
         event: string,
@@ -66,7 +62,6 @@ export class ClientManager extends EventEmitter {
         db: Database,
         notify: (userID: string, event: string, transmissionID: string) => void,
         userDetails: User,
-        options?: SpireOptions,
     ) {
         super();
         this.conn = ws;
@@ -75,7 +70,6 @@ export class ClientManager extends EventEmitter {
         this.userDetails = userDetails;
         this.device = null;
         this.notify = notify;
-        this.log = createLogger("client-manager", options?.logLevel || "error");
 
         this.initListeners();
         this.challenge();
@@ -96,28 +90,11 @@ export class ClientManager extends EventEmitter {
     }
 
     public send(msg: BaseMsg, header?: Uint8Array) {
-        if (header) {
-            this.log.debug(pc.bold(pc.red("OUTH")), header.toString());
-        } else {
-            this.log.debug(pc.bold(pc.red("OUTH")), emptyHeader.toString());
-        }
-
         const packedMessage = packMessage(msg, header);
-
-        this.log.info(
-            pc.bold("⟶   ") +
-                responseColor(msg.type.toUpperCase()) +
-                " " +
-                this.toString() +
-                " " +
-                pc.yellow(Buffer.byteLength(packedMessage)),
-        );
-
-        this.log.debug(pc.bold(pc.red("OUT")), msg);
         try {
             this.conn.send(packedMessage);
-        } catch (err: unknown) {
-            this.log.warn(String(err));
+        } catch (_err: unknown) {
+            // debugger: WS send failed
             this.fail();
         }
     }
@@ -150,7 +127,6 @@ export class ClientManager extends EventEmitter {
         if (this.failed) {
             return;
         }
-        this.log.warn("Connection closed.");
         this.conn.close();
         this.failed = true;
         this.emit("fail");
@@ -173,12 +149,11 @@ export class ClientManager extends EventEmitter {
             this.fail();
         });
         this.conn.on("message", (message: Buffer) => {
-            const [header, msg] = unpackMessage(message);
             const size = Buffer.byteLength(message);
 
             if (size > MAX_MSG_SIZE) {
                 this.sendErr(
-                    msg.transmissionID,
+                    "00000000-0000-0000-0000-000000000000",
                     "Message is too big. Received size " +
                         String(size) +
                         " while max size is " +
@@ -187,16 +162,7 @@ export class ClientManager extends EventEmitter {
                 return;
             }
 
-            this.log.info(
-                pc.bold("⟵   ") +
-                    pc.bold(msg.type.toUpperCase()) +
-                    " " +
-                    this.toString() +
-                    " " +
-                    pc.yellow(String(size)),
-            );
-            this.log.debug(pc.bold(pc.red("INH")), header.toString());
-            this.log.debug(pc.bold(pc.red("IN")), msg);
+            const [header, msg] = unpackMessage(message);
 
             if (!msg.type) {
                 this.sendErr(msg.transmissionID, "Message type is required.");
@@ -238,7 +204,6 @@ export class ClientManager extends EventEmitter {
                     void this.verifyResponse(msg as RespMsg);
                     break;
                 default:
-                    this.log.info("unsupported message %s", msg.type);
                     break;
             }
         });
@@ -266,8 +231,6 @@ export class ClientManager extends EventEmitter {
                             this.getDevice().deviceID,
                             this.getUser().userID,
                         );
-                        this.log.info("Received mail for " + mail.recipient);
-
                         const deviceDetails = await this.db.retrieveDevice(
                             mail.recipient,
                         );
@@ -288,13 +251,12 @@ export class ClientManager extends EventEmitter {
                             mail.recipient,
                         );
                     } catch (err: unknown) {
-                        this.log.error(String(err));
                         this.sendErr(msg.transmissionID, String(err));
                     }
                 }
                 break;
             default:
-                this.log.info("Unsupported resource type " + msg.resourceType);
+                break;
         }
     }
 
@@ -309,8 +271,7 @@ export class ClientManager extends EventEmitter {
     }
 
     private async pingLoop() {
-        // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- intentional infinite loop
-        while (true) {
+        while (!this.failed) {
             this.ping();
             await sleep(5000);
         }
@@ -384,7 +345,6 @@ export class ClientManager extends EventEmitter {
                 }
             }
             if (!message) {
-                this.log.warn("Signature verification failed!");
                 this.sendAuthError(SocketAuthErrors.BadSignature);
                 this.fail();
                 return;
@@ -394,11 +354,9 @@ export class ClientManager extends EventEmitter {
                 this.user = user;
                 this.authorize(msg.transmissionID);
             } else {
-                this.log.warn("Token is bad!");
                 this.sendAuthError(SocketAuthErrors.InvalidToken);
             }
         } else {
-            this.log.info("User is not registered.");
             this.sendAuthError(SocketAuthErrors.UserNotRegistered);
 
             this.fail();
@@ -421,14 +379,3 @@ function unpackMessage(msg: Buffer): [Uint8Array, BaseMsg] {
 
     return [msgh, msgb];
 }
-
-const responseColor = (status: string): string => {
-    switch (status) {
-        case "ERROR":
-            return pc.bold(pc.red(status));
-        case "SUCCESS":
-            return pc.bold(pc.green(status));
-        default:
-            return status;
-    }
-};