@vex-chat/spire 1.0.1 → 1.0.3

package/dist/utils/jwtSecret.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwtSecret.js","sourceRoot":"","sources":["../../src/utils/jwtSecret.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,mEAAmE,CACtE,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"jwtSecret.js","sourceRoot":"","sources":["../../src/utils/jwtSecret.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,mEAAmE,CACtE,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/utils/loadEnv.d.ts

@@ -1 +1,6 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
 export declare function loadEnv(): void;

package/dist/utils/loadEnv.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
 import { config } from "dotenv";
 /* Populate process.env with vars from .env and verify required vars are present. */
 export function loadEnv() {

package/dist/utils/loadEnv.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/utils/loadEnv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,oFAAoF;AACpF,MAAM,UAAU,OAAO;IACnB,MAAM,EAAE,CAAC;IACT,MAAM,eAAe,GAAa,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,kCAAkC,QAAQ,4CAA4C,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;AACL,CAAC"}
+{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/utils/loadEnv.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,oFAAoF;AACpF,MAAM,UAAU,OAAO;IACnB,MAAM,EAAE,CAAC;IACT,MAAM,eAAe,GAAa,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,kCAAkC,QAAQ,4CAA4C,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/utils/msgpack.d.ts

@@ -1,2 +1,7 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
 import { Packr } from "msgpackr";
 export declare const msgpack: Packr;

package/dist/utils/msgpack.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
 import { Packr } from "msgpackr";
 // Standard msgpack encoder/decoder configured for broad compatibility.
 export const msgpack = new Packr({ moreTypes: false, useRecords: false });

package/dist/utils/msgpack.js.map

@@ -1 +1 @@
-{"version":3,"file":"msgpack.js","sourceRoot":"","sources":["../../src/utils/msgpack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEjC,uEAAuE;AACvE,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC"}
+{"version":3,"file":"msgpack.js","sourceRoot":"","sources":["../../src/utils/msgpack.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEjC,uEAAuE;AACvE,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC"}

package/package.json

@@ -1,12 +1,15 @@
 {
     "name": "@vex-chat/spire",
-    "version": "1.0.1",
+    "version": "1.0.3",
     "description": "Vex server implementation in NodeJS.",
     "type": "module",
     "files": [
         "dist",
         "src",
-        "LICENSE"
+        "LICENSE",
+        "LICENSE-COMMERCIAL",
+        "LICENSING.md",
+        "CLA.md"
     ],
     "author": "Extra <extrahash@protonmail.com>",
     "license": "AGPL-3.0-or-later",
@@ -23,16 +26,20 @@
         "preinstall": "npx only-allow npm",
         "start": "node --experimental-strip-types src/run.ts",
         "restart": "pm2 restart spire && pm2 logs spire",
-        "build": "tsc",
+        "build": "tsc && node scripts/clean-dist-tests.mjs",
         "format": "prettier --write .",
         "format:check": "prettier --check .",
-        "lint": "eslint src/",
-        "lint:fix": "eslint src/ --fix",
+        "lint": "eslint src/ scripts/stress/",
+        "lint:fix": "eslint src/ scripts/stress/ --fix",
         "prepare": "husky || true",
         "test": "vitest run",
+        "stress:web": "node --experimental-strip-types scripts/stress/spire-stress.ts",
+        "stress:cli": "node --experimental-strip-types scripts/stress/stress-cli-sweep.ts",
+        "stress:repo-manifest": "node --experimental-strip-types scripts/stress/stress-repo-manifest.ts",
+        "stress:docs-pack": "node --experimental-strip-types scripts/stress/stress-docs-pack.ts",
+        "stress:llm-triage": "node --experimental-strip-types scripts/stress/stress-llm-triage.ts",
         "gen-spk": "node scripts/gen-spk.js",
         "docs": "node ./scripts/generate-docs.js",
-        "license:check": "node scripts/fix-license-checker.mjs && npx @onebeyond/license-checker scan --allowOnly MIT MIT-0 ISC BSD-2-Clause BSD-3-Clause Apache-2.0 0BSD MPL-2.0 CC0-1.0 CC-BY-3.0 CC-BY-4.0 Unlicense BlueOak-1.0.0 Python-2.0 Zlib PSF-2.0 Artistic-2.0 AGPL-3.0-or-later WTFPL \"(MIT AND CC-BY-3.0)\" --ignoreRootPackageLicense --disableReport",
         "service:status-monitor": "node ./services/status-monitor/index.js",
         "service:status-monitor:clear-history": "node ./services/status-monitor/clear-history.js",
         "service:deploy-hook": "node ./services/deploy-hook/index.js",
@@ -40,7 +47,7 @@
     },
     "devDependencies": {
         "@changesets/cli": "2.30.0",
-        "@onebeyond/license-checker": "2.2.0",
+        "@socketsecurity/cli": "1.1.84",
         "@types/better-sqlite3": "7.6.13",
         "@types/cors": "2.8.19",
         "@types/express": "5.0.6",
@@ -50,13 +57,16 @@
         "@types/node": "25.6.0",
         "@types/uuid": "10.0.0",
         "@types/ws": "8.18.1",
+        "@vex-chat/libvex": "5.2.0",
         "@vitest/eslint-plugin": "1.6.15",
+        "axios": "1.15.0",
         "eslint": "10.2.0",
         "eslint-config-prettier": "10.1.8",
         "eslint-plugin-n": "17.24.0",
         "eslint-plugin-perfectionist": "5.8.0",
         "husky": "9.1.7",
         "lint-staged": "16.4.0",
+        "npm-package-json-lint": "10.2.1",
         "prettier": "3.8.2",
         "type-coverage": "2.29.7",
         "typedoc": "0.28.18",
@@ -86,7 +96,7 @@
     "dependencies": {
         "@asyncapi/web-component": "2.6.5",
         "@scalar/express-api-reference": "0.9.7",
-        "@vex-chat/crypto": "2.0.0",
+        "@vex-chat/crypto": "2.0.1",
         "@vex-chat/types": "2.0.0",
         "argon2": "0.44.0",
         "better-sqlite3": "11.10.0",

package/src/ClientManager.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { Database } from "./Database.ts";
 import type {
     BaseMsg,
@@ -271,8 +277,7 @@ export class ClientManager extends EventEmitter {
     }
 
     private async pingLoop() {
-        // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- intentional infinite loop
-        while (true) {
+        while (!this.failed) {
             this.ping();
             await sleep(5000);
         }

package/src/Database.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { ServerDatabase } from "./db/schema.ts";
 import type { SpireOptions } from "./Spire.ts";
 import type {
@@ -21,6 +27,7 @@ import type { Migration, MigrationProvider } from "kysely";
 
 import { EventEmitter } from "events";
 import { pbkdf2Sync } from "node:crypto";
+import { statSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -119,6 +126,34 @@ export interface InternalUserRecord extends UserRecord {
 export class Database extends EventEmitter {
     private db: Kysely<ServerDatabase>;
 
+    /** Underlying better-sqlite3 handle (file or :memory:). */
+    private readonly rawSqlite: InstanceType<typeof BetterSqlite3>;
+
+    /**
+     * In-process cache for {@link retrieveUserDeviceList} when queried for a
+     * single owner. Libvex calls GET /user/:id/devices on every outgoing
+     * `forward()`; stress runs otherwise hammer SQLite with identical reads.
+     * Cleared on device create/delete and when the DB is closed.
+     */
+    private readonly userDeviceListCache = new Map<
+        string,
+        { devices: Device[]; until: number }
+    >();
+
+    /**
+     * Short TTL cache for {@link retrieveEmojiList} (key = server id, stored as
+     * `emojis.owner`). The noise harness fires `emoji.retrieveList` as a
+     * follow-up on ~1/25 successful ops, so this path can contend on SQLite
+     * before heavier surfaces. Invalidated on emoji create/delete.
+     */
+    private readonly emojiListByServerCache = new Map<
+        string,
+        { rows: Emoji[]; until: number }
+    >();
+
+    private static readonly USER_DEVICE_LIST_CACHE_TTL_MS = 10_000;
+    private static readonly EMOJI_LIST_CACHE_TTL_MS = 10_000;
+
     constructor(options?: SpireOptions) {
         super();
 
@@ -138,22 +173,86 @@ export class Database extends EventEmitter {
                 break;
         }
 
-        const sqliteDb = new BetterSqlite3(filename);
-        sqliteDb.pragma("journal_mode = WAL");
-        sqliteDb.pragma("synchronous = NORMAL");
-        sqliteDb.pragma("busy_timeout = 5000");
-        sqliteDb.pragma("cache_size = -64000");
-        sqliteDb.pragma("temp_store = memory");
-        sqliteDb.pragma("foreign_keys = ON");
+        this.rawSqlite = new BetterSqlite3(filename);
+        this.rawSqlite.pragma("journal_mode = WAL");
+        this.rawSqlite.pragma("synchronous = NORMAL");
+        this.rawSqlite.pragma("busy_timeout = 5000");
+        this.rawSqlite.pragma("cache_size = -64000");
+        this.rawSqlite.pragma("temp_store = memory");
+        this.rawSqlite.pragma("foreign_keys = ON");
 
         this.db = new Kysely<ServerDatabase>({
-            dialect: new SqliteDialect({ database: sqliteDb }),
+            dialect: new SqliteDialect({ database: this.rawSqlite }),
         });
 
         void this.init();
     }
 
+    /**
+     * Dev-only snapshot of SQLite files + pragmas (same process as Spire).
+     * Not for production callers.
+     */
+    public getDevSqliteMonitor(): Record<string, unknown> {
+        const openedAs = this.rawSqlite.name;
+        const absPath =
+            openedAs === ":memory:"
+                ? ":memory:"
+                : path.isAbsolute(openedAs)
+                  ? openedAs
+                  : path.resolve(process.cwd(), openedAs);
+
+        const journalMode = this.rawSqlite.pragma("journal_mode", {
+            simple: true,
+        });
+        const synchronous = this.rawSqlite.pragma("synchronous", {
+            simple: true,
+        });
+        const busyTimeout = this.rawSqlite.pragma("busy_timeout", {
+            simple: true,
+        });
+        const cacheSize = this.rawSqlite.pragma("cache_size", { simple: true });
+        const pageCount = this.rawSqlite.pragma("page_count", { simple: true });
+        const pageSize = this.rawSqlite.pragma("page_size", { simple: true });
+        const freelistCount = this.rawSqlite.pragma("freelist_count", {
+            simple: true,
+        });
+
+        const out: Record<string, unknown> = {
+            absPath,
+            busyTimeout,
+            cacheSize,
+            freelistCount,
+            journalMode,
+            openedAs,
+            pageCount,
+            pageSize,
+            synchronous,
+        };
+
+        if (openedAs !== ":memory:") {
+            const filePaths = {
+                main: absPath,
+                shm: `${absPath}-shm`,
+                wal: `${absPath}-wal`,
+            };
+            out["filePaths"] = filePaths;
+            const sizes: Record<string, number> = {};
+            for (const [label, fp] of Object.entries(filePaths)) {
+                try {
+                    sizes[label] = statSync(fp).size;
+                } catch {
+                    sizes[label] = 0;
+                }
+            }
+            out["fileBytes"] = sizes;
+        }
+
+        return out;
+    }
+
     public async close(): Promise<void> {
+        this.userDeviceListCache.clear();
+        this.emojiListByServerCache.clear();
         await this.db.destroy();
     }
 
@@ -184,6 +283,7 @@ export class Database extends EventEmitter {
         };
 
         await this.db.insertInto("devices").values(device).execute();
+        this.userDeviceListCache.delete(owner);
 
         const medPreKeys = {
             deviceID: device.deviceID,
@@ -201,6 +301,7 @@ export class Database extends EventEmitter {
 
     public async createEmoji(emoji: Emoji): Promise<void> {
         await this.db.insertInto("emojis").values(emoji).execute();
+        this.emojiListByServerCache.delete(emoji.owner);
     }
 
     public async createFile(file: FileSQL): Promise<void> {
@@ -230,30 +331,31 @@ export class Database extends EventEmitter {
         resourceID: string,
         powerLevel: number,
     ): Promise<Permission> {
-        const permissionID = crypto.randomUUID();
-
-        // check if it already exists
-        const checkPermission = await this.db
-            .selectFrom("permissions")
-            .selectAll()
-            .where("userID", "=", userID)
-            .where("resourceID", "=", resourceID)
-            .execute();
-        const existing = checkPermission[0];
-        if (existing) {
-            return existing;
-        }
+        // Atomic check-then-insert inside a transaction so two concurrent
+        // callers cannot both find "no existing" and insert duplicates.
+        return this.db.transaction().execute(async (trx) => {
+            const checkPermission = await trx
+                .selectFrom("permissions")
+                .selectAll()
+                .where("userID", "=", userID)
+                .where("resourceID", "=", resourceID)
+                .execute();
+            const existing = checkPermission[0];
+            if (existing) {
+                return existing;
+            }
 
-        const permission: Permission = {
-            permissionID,
-            powerLevel,
-            resourceID,
-            resourceType,
-            userID,
-        };
+            const permission: Permission = {
+                permissionID: crypto.randomUUID(),
+                powerLevel,
+                resourceID,
+                resourceType,
+                userID,
+            };
 
-        await this.db.insertInto("permissions").values(permission).execute();
-        return permission;
+            await trx.insertInto("permissions").values(permission).execute();
+            return permission;
+        });
     }
 
     public async createServer(name: string, ownerID: string): Promise<Server> {
@@ -321,6 +423,12 @@ export class Database extends EventEmitter {
     }
 
     public async deleteDevice(deviceID: string): Promise<void> {
+        const ownerRow = await this.db
+            .selectFrom("devices")
+            .select("owner")
+            .where("deviceID", "=", deviceID)
+            .executeTakeFirst();
+
         await this.db
             .deleteFrom("preKeys")
             .where("deviceID", "=", deviceID)
@@ -336,13 +444,21 @@ export class Database extends EventEmitter {
             .set({ deleted: 1 })
             .where("deviceID", "=", deviceID)
             .execute();
+
+        if (ownerRow?.owner) {
+            this.userDeviceListCache.delete(ownerRow.owner);
+        }
     }
 
     public async deleteEmoji(emojiID: string): Promise<void> {
+        const existing = await this.retrieveEmoji(emojiID);
         await this.db
             .deleteFrom("emojis")
             .where("emojiID", "=", emojiID)
             .execute();
+        if (existing) {
+            this.emojiListByServerCache.delete(existing.owner);
+        }
     }
 
     public async deleteInvite(inviteID: string): Promise<void> {
@@ -405,31 +521,34 @@ export class Database extends EventEmitter {
     }
 
     public async getOTK(deviceID: string): Promise<null | PreKeysWS> {
-        const rows: PreKeysSQL[] = await this.db
-            .selectFrom("oneTimeKeys")
-            .selectAll()
-            .where("deviceID", "=", deviceID)
-            .orderBy("index")
-            .limit(1)
-            .execute();
-        const otkInfo = rows[0];
-        if (!otkInfo) {
-            return null;
-        }
-        const otk: PreKeysWS = {
-            deviceID: otkInfo.deviceID,
-            index: otkInfo.index,
-            publicKey: XUtils.decodeHex(otkInfo.publicKey),
-            signature: XUtils.decodeHex(otkInfo.signature),
-        };
+        // Atomic select-then-delete inside a transaction so two concurrent
+        // callers cannot dispense the same one-time key.
+        return this.db.transaction().execute(async (trx) => {
+            const rows: PreKeysSQL[] = await trx
+                .selectFrom("oneTimeKeys")
+                .selectAll()
+                .where("deviceID", "=", deviceID)
+                .orderBy("index")
+                .limit(1)
+                .execute();
+            const otkInfo = rows[0];
+            if (!otkInfo) {
+                return null;
+            }
 
-        // delete the otk
-        await this.db
-            .deleteFrom("oneTimeKeys")
-            .where("deviceID", "=", deviceID)
-            .where("index", "=", otk.index)
-            .execute();
-        return otk;
+            await trx
+                .deleteFrom("oneTimeKeys")
+                .where("deviceID", "=", deviceID)
+                .where("index", "=", otkInfo.index)
+                .execute();
+
+            return {
+                deviceID: otkInfo.deviceID,
+                index: otkInfo.index,
+                publicKey: XUtils.decodeHex(otkInfo.publicKey),
+                signature: XUtils.decodeHex(otkInfo.signature),
+            };
+        });
     }
 
     public async getOTKCount(deviceID: string): Promise<number> {
@@ -605,12 +724,25 @@ export class Database extends EventEmitter {
         return rows[0] ?? null;
     }
 
-    public async retrieveEmojiList(userID: string): Promise<Emoji[]> {
-        return this.db
+    public async retrieveEmojiList(serverID: string): Promise<Emoji[]> {
+        const now = Date.now();
+        const hit = this.emojiListByServerCache.get(serverID);
+        if (hit && hit.until > now) {
+            return hit.rows.map((r) => ({ ...r }));
+        }
+
+        const rows: Emoji[] = await this.db
             .selectFrom("emojis")
             .selectAll()
-            .where("owner", "=", userID)
+            .where("owner", "=", serverID)
             .execute();
+
+        this.emojiListByServerCache.set(serverID, {
+            rows: rows.map((r) => ({ ...r })),
+            until: now + Database.EMOJI_LIST_CACHE_TTL_MS,
+        });
+
+        return rows.map((r) => ({ ...r }));
     }
 
     public async retrieveFile(fileID: string): Promise<FileSQL | null> {
@@ -752,17 +884,25 @@ export class Database extends EventEmitter {
             .where("serverID", "=", serverID)
             .execute();
 
-        return rows.filter((invite: Invite) => {
-            const valid =
-                new Date(Date.now()).getTime() <
-                new Date(invite.expiration).getTime();
-
-            if (!valid) {
-                void this.deleteInvite(invite.inviteID);
+        const nowMs = Date.now();
+        const expiredIds: string[] = [];
+        const valid: Invite[] = [];
+        for (const row of rows) {
+            const expMs = new Date(row.expiration).getTime();
+            if (!Number.isFinite(expMs) || expMs <= nowMs) {
+                expiredIds.push(row.inviteID);
+                continue;
             }
-
-            return valid;
-        });
+            valid.push(row);
+        }
+        if (expiredIds.length > 0) {
+            await this.db
+                .deleteFrom("invites")
+                .where("serverID", "=", serverID)
+                .where("inviteID", "in", expiredIds)
+                .execute();
+        }
+        return valid;
     }
 
     public async retrieveServers(userID: string): Promise<Server[]> {
@@ -803,13 +943,36 @@ export class Database extends EventEmitter {
     }
 
     public async retrieveUserDeviceList(userIDs: string[]): Promise<Device[]> {
+        const now = Date.now();
+        if (userIDs.length === 1) {
+            const owner = userIDs[0];
+            if (typeof owner === "string") {
+                const hit = this.userDeviceListCache.get(owner);
+                if (hit && hit.until > now) {
+                    return hit.devices.map((d) => ({ ...d }));
+                }
+            }
+        }
+
         const rows = await this.db
             .selectFrom("devices")
             .selectAll()
             .where("owner", "in", userIDs)
             .where("deleted", "=", 0)
             .execute();
-        return rows.map(toDevice);
+        const devices = rows.map(toDevice);
+
+        if (userIDs.length === 1) {
+            const owner = userIDs[0];
+            if (typeof owner === "string") {
+                this.userDeviceListCache.set(owner, {
+                    devices: devices.map((d) => ({ ...d })),
+                    until: now + Database.USER_DEVICE_LIST_CACHE_TTL_MS,
+                });
+            }
+        }
+
+        return devices;
     }
 
     public async retrieveUsers(): Promise<InternalUserRecord[]> {