@abide/abide 0.57.1 → 0.100.0

package/src/lib/server/runtime/types/RequestStore.ts

@@ -1,125 +0,0 @@
-import type { CacheStore } from '../../../shared/types/CacheStore.ts'
-import type { DocSnapshots } from '../../../shared/types/DocSnapshots.ts'
-import type { PendingAsyncCells } from '../../../shared/types/PendingAsyncCells.ts'
-import type { ResolvedCells } from '../../../shared/types/ResolvedCells.ts'
-import type { SocketTails } from '../../../shared/types/SocketTails.ts'
-import type { StreamedCells } from '../../../shared/types/StreamedCells.ts'
-import type { TraceContext } from '../../../shared/types/TraceContext.ts'
-import type { Scope } from '../../../ui/types/Scope.ts'
-
-/*
-Per-request state propagated through AsyncLocalStorage. Every field is
-populated once at the server's fetch boundary; helpers and rpc-defined
-remote functions read from it without threading arguments through user code.
-The inbound request's AbortSignal is reached via `req.signal` rather than a
-separate field.
-*/
-export type RequestStore = {
-    url: URL
-    req: Request
-    cache: CacheStore
-    /*
-    In-flight async-cell promises registered during this request's SSR pass. The
-    Tier-2 barrier (`settleAsyncCells`) drains and awaits them between a
-    component's cell declarations and its template so resolved values bake into
-    the HTML. Per-request (like `cache`) so concurrent renders never share a drain.
-    */
-    pendingAsyncCells: PendingAsyncCells
-    /*
-    Async-cell values that RESOLVED during this request's SSR pass, keyed by render-path id.
-    `createAsyncCell.settleValue` pushes each; the page renderer stamps them into `__SSR__.cells`
-    (ref-json) so the client hydrates the cell warm. Sibling of `pendingAsyncCells` (the barrier's
-    in-flight list) — this one holds settled VALUES, read at render-return, not awaited.
-    */
-    resolvedCells: ResolvedCells
-    /*
-    STREAMING async-cell settled VALUES recorded during this request's SSR pass, keyed by render-path
-    id (ADR-0035). A streaming cell ships pending in the shell; the page renderer drains this after the
-    shell and streams an `__abideResolve({ cellKey, value })` chunk for each so the client adopts the
-    resolved value post-hydration. These are already-settled values (pushed by `createAsyncCell`),
-    never awaited here — a cell that stays pending through the request is simply not recorded and the
-    client cold-runs it (awaiting one would hang the response). Per-request so concurrent renders never
-    mix. Sibling of `resolvedCells` (the blocking partition baked into the head snapshot).
-    */
-    streamedCells: StreamedCells
-    /*
-    Retained socket frames read via `peek(socket)` during this request's SSR pass, keyed by socket
-    name. `defineSocket`'s server `peek()` pushes each read; the page renderer stamps them into
-    `__SSR__.sockets` (ref-json) so the client seeds `peek(socket)` to the SAME retained value the
-    server rendered instead of `undefined` on the not-yet-connected client. Sibling of `resolvedCells`
-    — a server value carried forward, read at render-return, not awaited.
-    */
-    socketTails: SocketTails
-    /*
-    Reactive-document snapshots captured during this request's SSR pass, keyed by render-path id.
-    `createScope` registers a lazy `take` for each rendered scope; the page renderer stamps the
-    non-empty ones into `__SSR__.docs` (ref-json) so the client seeds a plain `state(initial)` to
-    the server value rather than re-running a divergent init. Sibling of `resolvedCells` — this holds
-    synchronous document state, taken at render-return rather than at settle.
-    */
-    docSnapshots: DocSnapshots
-    /*
-    W3C trace position: inbound `traceparent` continued (prefer-incoming) or a
-    fresh sampled trace minted at the boundary. Read by trace()/log via the
-    request-scope resolver and stamped into __SSR__ for the browser half.
-    */
-    trace: TraceContext
-    /* Bun.nanoseconds() at scope entry — anchors log `+elapsed`, Server-Timing, and the closing record's total. */
-    start: number
-    /*
-    The matched page route and its decoded params, set just before the page
-    renders so the `page` proxy resolves them inside layout-scoped components
-    during SSR. Undefined on rpc/socket requests and until a page match lands.
-    */
-    route?: string
-    params?: Record<string, string>
-    /*
-    store.url with the mount base re-applied — the browser-space URL the `page`
-    proxy publishes, memoized by pageUrlFromStore on first read. `url` itself
-    stays app-space for routing and error-prefix matching.
-    */
-    pageUrl?: URL
-    /*
-    Set by a server-side health() read (via healthReadSlot) during this
-    request's SSR pass. The renderer stamps the health payload into __SSR__
-    only when set, so the client seed stays reader-driven like the poll.
-    */
-    healthRead?: boolean
-    /*
-    The request's cookie jar, materialized lazily by the first cookies() call
-    and flushed to Set-Cookie headers when the scope returns. Undefined while a
-    request never touches cookies, so the common path parses and emits nothing.
-    */
-    cookies?: Bun.CookieMap
-    /*
-    File parts split off a multipart/form-data body by parseArgs, grouped by
-    field name, for files() to read. Files never enter the handler's args so the
-    input schema keeps validating a plain object; undefined when the request
-    carried no file parts.
-    */
-    files?: Record<string, File[]>
-    /*
-    The allowlisted headers forwarded onto in-process rpc Requests during this
-    request's SSR pass — derived once from the inbound headers (which don't change
-    within the scope) and reused by every defineRpc call. Each call clones it,
-    since buildRpcRequest mutates the Headers (content-type/ref-json) before
-    constructing the Request. Undefined until the first in-process rpc.
-    */
-    forwardedHeaders?: Headers
-    /*
-    The body class of the response the dispatch pipeline produced, stashed so
-    runWithRequestScope's closing-record stream monitor reuses the single S2
-    classification instead of re-deriving from the Content-Type. Undefined for
-    callers that don't classify (mcp, the fetch fallback, tests) — those fall
-    back to classifying the response themselves.
-    */
-    responseStreaming?: boolean
-    /*
-    The request's ambient lexical scope during its SSR pass — the backing for
-    `CURRENT_SCOPE.current` under the server's ALS-backed holder
-    (installAmbientScopeStore). Keeping it per-request isolates the ambient across
-    the inline `await`s a render suspends on, so concurrent renders don't clobber
-    one shared module global. Undefined until the render enters its first scope.
-    */
-    currentScope?: Scope
-}

package/src/lib/server/runtime/warnUnguardedMcp.ts

@@ -1,43 +0,0 @@
-import { abideLog } from '../../shared/abideLog.ts'
-import { MCP_PATH } from '../../shared/MCP_PATH.ts'
-import { rpcRegistry } from '../rpc/rpcRegistry.ts'
-import { socketRegistry } from '../sockets/socketRegistry.ts'
-import { ensureRegistriesLoaded } from './registryManifests.ts'
-
-/*
-Boot-time disclosure for an unguarded MCP endpoint: when /__abide/mcp is
-mounted with at least one MCP-exposed declaration and no app.handle
-middleware to authenticate requests, say so. Printed unconditionally — the
-surface map is DEBUG-gated diagnostics, but an unauthenticated machine
-surface should never boot silently. The caller skips this entirely when
-app.handle exists, so only the authless path pays the eager registry load.
-Best-effort like the surface map: enumeration failures are swallowed.
-*/
-export async function warnUnguardedMcp(): Promise<void> {
-    try {
-        await ensureRegistriesLoaded()
-    } catch {
-        return
-    }
-    /* Rpc entries carry the resolved clients on `entry.remote` (ADR-0020); socket entries
-       keep their own `entry.clients`. Count each from its own home. */
-    let exposed = 0
-    for (const entry of rpcRegistry.values()) {
-        if (entry.remote.clients.mcp) {
-            exposed += 1
-        }
-    }
-    for (const entry of socketRegistry.values()) {
-        if (entry.clients.mcp) {
-            exposed += 1
-        }
-    }
-    if (exposed === 0) {
-        return
-    }
-    abideLog.warn(
-        `MCP endpoint ${MCP_PATH} exposes ${exposed} declaration${exposed === 1 ? '' : 's'} ` +
-            'with no auth guard — add an app.handle middleware in src/app.ts to ' +
-            'authenticate machine clients, or set clients.mcp: false per declaration',
-    )
-}

package/src/lib/server/runtime/withResponseDefaults.ts

@@ -1,29 +0,0 @@
-/*
-Merges a caller's `ResponseInit` over a respond helper's default headers.
-The helper's defaults seed the header set; the caller's headers overlay them
-per-key (so an explicit `cache-control` wins over the helper's `no-store`),
-and the rest of `init` (status, statusText) passes straight through. Shared
-by `json` / `jsonl` / `sse` / `error` / `redirect` so every helper accepts a
-final `ResponseInit` with identical override semantics.
-
-A helper that owns the status itself (`error`, `redirect`) passes it as the
-final `status` argument; it is applied last so it always wins over any
-`init.status`, keeping that precedence inside the helper rather than relying
-on each call site spreading in the right order.
-*/
-export function withResponseDefaults(
-    init: ResponseInit | undefined,
-    defaultHeaders: Record<string, string>,
-    status?: number,
-): ResponseInit {
-    const headers = new Headers(defaultHeaders)
-    /* The dominant case carries no overrides — skip the second Headers
-       allocation + per-key copy and ship the defaults alone. Only merge when
-       the caller actually supplied headers. */
-    if (init?.headers !== undefined) {
-        new Headers(init.headers).forEach((value, key) => {
-            headers.set(key, value)
-        })
-    }
-    return { ...init, headers, ...(status !== undefined && { status }) }
-}

package/src/lib/server/server.ts

@@ -1,33 +0,0 @@
-import type { Server } from 'bun'
-import { getActiveServer } from './runtime/getActiveServer.ts'
-import { inProcessServer } from './runtime/inProcessServer.ts'
-import { requestContext } from './runtime/requestContext.ts'
-
-/*
-Returns the active Bun.serve instance. Mirrors `request()`'s function-call
-shape so call sites appear in stack traces (a Proxy trap intermediates and
-obscures them).
-
-When no Bun.serve has booted, resolution forks on the request scope:
-- Inside a scope it is in-process dispatch (CLI / MCP / test client), which
-  never boots a server — return the no-op inProcessServer so handler idioms
-  (server().timeout/publish/requestIP …) run unchanged instead of throwing.
-  createServer sets the slot at boot before any request, so an empty slot
-  while a scope is live can only be in-process.
-- Outside any scope it is a genuine before-init misuse (module top-level /
-  app.ts init); keep throwing — silent undefined would mask it and strand
-  later property reads with cryptic errors.
-*/
-// @documentation request-scope
-export function server(): Server<unknown> {
-    const active = getActiveServer()
-    if (active) {
-        return active
-    }
-    if (requestContext.getStore()) {
-        return inProcessServer
-    }
-    throw new Error(
-        '[abide] server() called before init — make sure your call happens inside or after app.ts init() resolves',
-    )
-}

package/src/lib/server/socket.ts

@@ -1,32 +0,0 @@
-import type { Socket } from '../shared/types/Socket.ts'
-import type { StandardSchemaV1 } from '../shared/types/StandardSchemaV1.ts'
-import type { SocketOptions } from './sockets/types/SocketOptions.ts'
-
-/*
-Declares a Socket inside a file under `src/server/sockets/`. Each file contains
-exactly one export, named after the file (e.g. `chat.ts` →
-`export const chat = socket<ChatMessage>(...)`). The bundler reads the
-export name from the filename and the socket name from the file path
-under `src/server/sockets/`, then rewrites this call to bind the name into the
-runtime implementation (defineSocket on the server, socketProxy on the
-client). Opts (tail, clientPublish, schema, clients) live on the
-server side only; the client target discards them.
-
-When `schema` is set, `T` infers from `InferOutput<Schema>` and publish
-payloads validate against it on the server. `clients` controls which
-adapter surfaces (browser / mcp / cli) advertise the socket — defaults
-to browser-only when schemaless, all surfaces when a schema is present.
-
-This function exists only for the type signature; calling it directly
-means the bundler plugin didn't process the file, which throws.
-*/
-// @documentation sockets
-export function socket<Schema extends StandardSchemaV1>(
-    opts: SocketOptions<Schema> & { schema: Schema },
-): Socket<StandardSchemaV1.InferOutput<Schema>>
-export function socket<T = unknown>(opts?: SocketOptions): Socket<T>
-export function socket<T = unknown>(_opts?: SocketOptions): Socket<T> {
-    throw new Error(
-        '[abide] `socket(...)` was called outside an $sockets module — the socket helper is only valid as the value of `export const <filename> = ...` inside a file under src/server/sockets/',
-    )
-}

package/src/lib/server/sockets/amendFamilyEntry.ts

@@ -1,39 +0,0 @@
-import { browserClientFlags } from '../../shared/browserClientFlags.ts'
-import type { Socket } from '../../shared/types/Socket.ts'
-import type { SocketRegistryEntry } from './types/SocketRegistryEntry.ts'
-
-/* An empty async iterable — the amend channel replays nothing (live-only, no tail). */
-const emptyIterable = {
-    [Symbol.asyncIterator]: () => ({
-        next: async () => ({ done: true as const, value: undefined }),
-    }),
-}
-
-/*
-The single synthetic registry entry the dispatcher resolves every `__abide/amend/<key>`
-topic to (ADR-0043). The amend value channel is a per-call reserved topic family: the
-per-key Bun topic is the sub frame's own socket name, so one shared entry serves the whole
-family — there is no per-key socket object or module to load. It is subscribe-only
-(clientPublish false, so a browser can't forge a push), holds no tail (snapshotTail empty —
-a missed frame heals via the reader's reconnect refresh), and is browser-only, so the REST
-face 404s. The stub Socket methods are never reached: the ws sub path subscribes the raw
-Bun topic and replays via snapshotTail, and the REST face is gated off by the clients flags.
-*/
-const socket = {
-    name: '__abide/amend',
-    clients: browserClientFlags,
-    publish: () => undefined,
-    tail: () => emptyIterable,
-    peek: () => undefined,
-    refresh: () => undefined,
-    watch: () => () => undefined,
-    [Symbol.asyncIterator]: emptyIterable[Symbol.asyncIterator],
-} as unknown as Socket<unknown>
-
-export const amendFamilyEntry: SocketRegistryEntry = {
-    socket,
-    allowClientPublish: false,
-    schema: undefined,
-    clients: browserClientFlags,
-    snapshotTail: () => [],
-}