feat: support chunked transfers and consolidate relay hardening

.yarnrc.yml

@@ -1 +1,2 @@
-nodeLinker: node-modules
+nodeLinker: node-modules
+compressionLevel: 0

CLAUDE.md

@@ -52,12 +52,11 @@ The transfer server is a Socket.IO-based real-time communication server with end
 - `utils/` - Utility functions for crypto, buffers, caching, etc.
 
 **Socket.IO Events:**
-- Client→Server: `create-room`, `join-room`, `send-encrypted-data`, `leave-room`, `get-room-status`, `get-room-list`
-- Server→Client: `room-created`, `room-joined`, `user-joined`, `user-left`, `encrypted-data`, `room-error`, `room-status`
+- Client→Server: `e2ee-request`, `e2ee-c2c-request`, `e2ee-c2c-response`
+- Server→Client: `e2ee-response`, `e2ee-c2c-request`, `e2ee-c2c-response`, `user-joined`, `user-left`, `room-full`, `start-transfer`
 
 **Configuration (via environment variables):**
 - `PORT` (default: 3868)
-- `CORS_ORIGINS` (comma-separated list)
 - `MAX_USERS_PER_ROOM` (default: 2)
 - `ROOM_TIMEOUT` (default: 3600000ms)
 - `MAX_MESSAGE_SIZE` (default: 10485760 bytes)
@@ -80,17 +79,18 @@ A Midway.js-based component for OneKey Prime synchronization functionality.
 
 ## Testing Approach
 
-- Both packages use Jest for testing
+- transfer-server uses ts-node smoke/crash scripts and the Node.js test runner
+- cloud-sync-server uses Jest
 - Test files are located in `test/` directories
 - Mock application available in `examples/mock-app/` for integration testing
 - Run individual package tests with `yarn workspace @onekeyhq/<package-name> test`
 
 ## Code Style and Linting
 
 - TypeScript is used throughout the project
-- ESLint configuration with TypeScript plugin
+- ESLint 10 with the shared root `eslint.config.cjs` and typescript-eslint 8
 - Prettier integration for code formatting
-- Each package has its own `tsconfig.json` and `.eslintrc.js`
+- Each package has its own `tsconfig.json`; source and tests share the root flat lint configuration
 - Node.js version requirement: >= 24
 
 ## Important Implementation Notes
@@ -100,7 +100,11 @@ A Midway.js-based component for OneKey Prime synchronization functionality.
 2. **Error Handling**: The transfer-server includes custom error codes (see `errors.ts`). The cloud-sync-server uses Midway.js error handling patterns.
 
 3. **Security**: 
-   - CORS is configured but currently allows all origins in development
+   - CORS is intentionally permissive; the `Origin` header is not an auth
+     boundary here (native/desktop clients send no usable Origin, and there are
+     no cookie credentials to protect). Access control is the out-of-band
+     pairing code plus the room membership check on the c2c relay. See the
+     comment on `corsOptions` in `server.ts`.
    - Message size limits are enforced
    - Room timeouts prevent resource exhaustion
 
@@ -115,4 +119,4 @@ A Midway.js-based component for OneKey Prime synchronization functionality.
 
 6. **Dependency Injection**: The cloud-sync-server heavily uses Midway.js DI patterns. When adding new services, follow the existing pattern with decorators.
 
-7. **Real-time Communication**: Socket.IO is configured with specific ping/pong intervals and buffer sizes. Be mindful of these settings when debugging connection issues.
+7. **Real-time Communication**: Socket.IO is configured with specific ping/pong intervals and buffer sizes. Be mindful of these settings when debugging connection issues.

README.md

@@ -133,7 +133,6 @@ Each package can be configured using environment variables. Create `.env` files
 #### transfer-server
 ```env
 PORT=3868
-CORS_ORIGINS=http://localhost:3000
 MAX_USERS_PER_ROOM=2
 ROOM_TIMEOUT=3600000
 MAX_MESSAGE_SIZE=10485760
@@ -300,7 +299,8 @@ chore: Update dependencies
 - All sensitive configuration should use environment variables
 - Never commit `.env` files
 - Use HTTPS in production
-- Configure CORS appropriately
+- Do not treat CORS as access control in transfer-server: it is deliberately
+  permissive (see `corsOptions` in `packages/transfer-server/src/server.ts`)
 - Implement rate limiting
 - Regular dependency updates
 

eslint.config.cjs

@@ -0,0 +1,28 @@
+const js = require('@eslint/js');
+const { defineConfig } = require('eslint/config');
+const prettier = require('eslint-config-prettier');
+const globals = require('globals');
+const tseslint = require('typescript-eslint');
+
+module.exports = defineConfig([
+  { ignores: ['**/dist/**', '**/coverage/**', '**/node_modules/**'] },
+  {
+    files: ['packages/*/{src,test}/**/*.ts', 'examples/*/{src,test}/**/*.ts'],
+    extends: [js.configs.recommended, tseslint.configs.recommended, prettier],
+    languageOptions: {
+      ecmaVersion: 2021,
+      sourceType: 'module',
+      globals: globals.node,
+    },
+    rules: {
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-unused-vars': 'off',
+      '@typescript-eslint/explicit-module-boundary-types': 'off',
+      '@typescript-eslint/no-empty-function': 'off',
+    },
+  },
+  {
+    files: ['**/test/**/*.ts'],
+    languageOptions: { globals: globals.jest },
+  },
+]);

examples/mock-app/package.json

@@ -9,7 +9,7 @@
     "start": "cross-env NODE_ENV=production node ./bootstrap.js",
     "test": "midway-bin test --ts",
     "cov": "midway-bin cov --ts",
-    "lint": "eslint src --ext .ts"
+    "lint": "eslint src test --max-warnings 0"
   },
   "dependencies": {
     "@midwayjs/bootstrap": "^3.20.0",
@@ -25,10 +25,8 @@
     "@midwayjs/mock": "^3.20.11",
     "@types/jest": "^29.0.0",
     "@types/node": "^20.0.0",
-    "@typescript-eslint/eslint-plugin": "^5.0.0",
-    "@typescript-eslint/parser": "^5.0.0",
     "cross-env": "^10.0.0",
-    "eslint": "^7.32.0",
+    "eslint": "^10.10.0",
     "jest": "^29.0.0",
     "nodemon": "^3.0.0",
     "ts-jest": "^29.0.0",

package.json

@@ -2,6 +2,7 @@
   "name": "@onekeyhq/monorepo",
   "version": "1.0.0",
   "private": true,
+  "packageManager": "yarn@4.14.1",
   "description": "OneKey Monorepo",
   "workspaces": [
     "packages/*",
@@ -19,12 +20,18 @@
     "test": "yarn workspaces foreach --all run test",
     "test:sync": "yarn workspace @onekeyhq/cloud-sync-server test",
     "test:mock": "yarn workspace @onekeyhq/mock-app test",
-    "lint": "yarn workspaces foreach --all run lint",
+    "lint": "eslint packages/*/src packages/*/test examples/*/src examples/*/test --max-warnings 0",
     "lint:sync": "yarn workspace @onekeyhq/cloud-sync-server lint",
     "clean": "yarn workspaces foreach --all run clean"
   },
   "devDependencies": {
-    "rimraf": "^5.0.5"
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.10.0",
+    "eslint-config-prettier": "^10.1.8",
+    "globals": "^17.12.0",
+    "rimraf": "^5.0.5",
+    "typescript": "^5.0.0",
+    "typescript-eslint": "^8.70.0"
   },
   "engines": {
     "node": ">=24"

packages/cloud-sync-server/package.json

@@ -8,14 +8,14 @@
     "build": "tsc",
     "dev": "tsc -w",
     "watch": "tsc -w",
-    "lint": "eslint src test --ext .ts",
-    "lint:fix": "eslint src test --ext .ts --fix",
+    "lint": "eslint src test --max-warnings 0",
+    "lint:fix": "eslint src test --fix --max-warnings 0",
     "test": "jest",
     "test:watch": "jest --watch",
     "test:cov": "jest --coverage"
   },
   "dependencies": {
-    "lodash": "^4.17.21"
+    "lodash": "^4.18.1"
   },
   "peerDependencies": {
     "@midwayjs/core": "^3.0.0",
@@ -27,11 +27,7 @@
   "devDependencies": {
     "@types/jest": "^29.0.0",
     "@types/lodash": "^4.14.200",
-    "@typescript-eslint/eslint-plugin": "^5.0.0",
-    "@typescript-eslint/parser": "^5.0.0",
-    "eslint": "^7.32.0",
-    "eslint-config-prettier": "^8.5.0",
-    "eslint-plugin-prettier": "^4.0.0",
+    "eslint": "^10.10.0",
     "jest": "^29.0.0",
     "prettier": "^2.8.8",
     "ts-jest": "^29.0.0",