@_linked/server 2.13.4 → 2.13.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,30 @@
|
|
|
1
1
|
# @\_linked/server
|
|
2
2
|
|
|
3
|
+
## 2.13.6
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- [#83](https://github.com/linked-fw/server/pull/83) [`5b58619`](https://github.com/linked-fw/server/commit/5b586190b45d52ac8ab70f90e414a7d52fc4d3a9) Thanks [@flyon](https://github.com/flyon)! - Document this package's server-only surface — see
|
|
8
|
+
`docs/architecture/01-server-only-surface.md`.
|
|
9
|
+
|
|
10
|
+
## 2.13.5
|
|
11
|
+
|
|
12
|
+
### Patch Changes
|
|
13
|
+
|
|
14
|
+
- [#92](https://github.com/linked-fw/server/pull/92) [`c17a450`](https://github.com/linked-fw/server/commit/c17a4501f55b824ad3f22ab24fc989f8145f11e7) Thanks [@flyon](https://github.com/flyon)! - Cover `GET /resized/*` with an SVG source.
|
|
15
|
+
|
|
16
|
+
The route had no test at all. These assert on the BYTES and the KEY rather than
|
|
17
|
+
the status code, because the half that matters is silent: writing PNG bytes under
|
|
18
|
+
a `.svg` key still returns 200, and only misbehaves on the next request, when the
|
|
19
|
+
cache-hit path types the response `image/svg+xml` from that extension.
|
|
20
|
+
|
|
21
|
+
Both branches are covered — the `src`-parameter branch and the uploads branch —
|
|
22
|
+
because the bug was in both, for two different reasons. A third case pins a JPEG
|
|
23
|
+
source as staying a JPEG, so the rasterization cannot quietly become
|
|
24
|
+
unconditional.
|
|
25
|
+
|
|
26
|
+
Verified against the reverted fix: both SVG cases fail, the JPEG case passes.
|
|
27
|
+
|
|
3
28
|
## 2.13.4
|
|
4
29
|
|
|
5
30
|
### Patch Changes
|
|
@@ -0,0 +1,58 @@
|
|
|
1
|
+
---
|
|
2
|
+
summary: Why this package declares its own server-only surface rather than being named by
|
|
3
|
+
consumers, what the declaration means, and the one part of this package that is not server-only
|
|
4
|
+
and should not live here.
|
|
5
|
+
---
|
|
6
|
+
|
|
7
|
+
# This package's server-only surface
|
|
8
|
+
|
|
9
|
+
This package is a **replaceable module**. An application may swap it for another implementation,
|
|
10
|
+
and anything that depends on knowing it by name breaks the moment someone does.
|
|
11
|
+
|
|
12
|
+
That matters for one specific rule: **a frontend bundle must not contain this package.** Almost
|
|
13
|
+
everything here touches a filesystem, a process or a socket, and a `ShapeProvider` extends
|
|
14
|
+
`BackendProvider`, which imports node's `path`. Pull any of it into a client graph and the bundler
|
|
15
|
+
resolves `path` to the abandoned npm shim of the same name, the shim references `process`, and the
|
|
16
|
+
application hydrates into an empty shell with `ReferenceError: process is not defined` — an error
|
|
17
|
+
naming nothing that would lead you back to the import.
|
|
18
|
+
|
|
19
|
+
## The declaration
|
|
20
|
+
|
|
21
|
+
```jsonc
|
|
22
|
+
"linked": {
|
|
23
|
+
"serverOnly": [".", "./shapes/*", "./server/*", "./utils/*"]
|
|
24
|
+
}
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
A consuming application's client/server boundary check reads this, rather than hardcoding
|
|
28
|
+
`@_linked/server`. The difference is not stylistic: a check that names this package protects one
|
|
29
|
+
arrangement of the framework, and a replacement inherits none of it. A check that reads
|
|
30
|
+
declarations protects whatever is installed.
|
|
31
|
+
|
|
32
|
+
It is purely declarative. No code, no exports, and no resolution behaviour depends on it.
|
|
33
|
+
|
|
34
|
+
## The convention it complements
|
|
35
|
+
|
|
36
|
+
A consumer also treats anything under `<pkg>/backend/**` as server-only, in **any** package, with
|
|
37
|
+
no declaration needed. Between the two, no application has to know a package by name.
|
|
38
|
+
|
|
39
|
+
A package whose server-only code all lives under `backend/` therefore needs no `linked.serverOnly`
|
|
40
|
+
at all. This package declares one because its server-only surface predates that convention and is
|
|
41
|
+
spread across several subpaths.
|
|
42
|
+
|
|
43
|
+
## What is not server-only, and should move
|
|
44
|
+
|
|
45
|
+
Three exports are client-safe and are published from here anyway:
|
|
46
|
+
|
|
47
|
+
| Export | Who uses it |
|
|
48
|
+
|---|---|
|
|
49
|
+
| `BackendAPIStore` | the store a **browser** uses to talk to the backend; constructed by an app's frontend storage config |
|
|
50
|
+
| `getAccessUrlLocalFileStore` | the same frontend config |
|
|
51
|
+
| `LincdWebApp` | constructed in a React hook |
|
|
52
|
+
|
|
53
|
+
They belong in `@_linked/server-utils`, which exists for exactly the isomorphic half of the
|
|
54
|
+
framework. Until they move, every consuming application must carry a standing exception in its
|
|
55
|
+
boundary check — and a boundary with permanent exceptions stops being one.
|
|
56
|
+
|
|
57
|
+
Tracked as follow-up work; noted here so the next person to wonder why an app imports
|
|
58
|
+
`@_linked/server` from its frontend finds the answer.
|