@astroscope/wormhole 0.1.0 → 0.1.2

package/README.md

@@ -18,6 +18,11 @@ Astro recommends [nanostores](https://docs.astro.build/en/recipes/sharing-state/
 - Server-loaded configuration (theme, locale, permissions) bridged to the UI
 - Any request-scoped data that multiple disconnected islands need to read
 
+## Important notes
+
+- **No secrets in wormholes.** All wormhole data is serialized into an inline `<script>` tag and sent to the browser. Never store tokens, API keys, credentials, or any sensitive data in a wormhole.
+- **`set()` is client-only.** Calling `set()` does not work on the server. Use `open(wormhole, data, fn)` from `@astroscope/wormhole/server` to populate data in middleware.
+
 ## Examples
 
 See the [demo/wormhole](../../demo/wormhole) directory for a working example.
@@ -218,21 +223,6 @@ import {WormholeScript} from '@astroscope/wormhole/astro';
 3. **Client** calls `wh.get()` — reads from `globalThis[key]()` (the serialized getter)
 4. **`set()`** updates a local store and notifies all subscribers — `useWormhole()` hooks and `subscribe()` callbacks re-render/fire
 
-## Monorepo note
-
-When using this package from a workspace in a monorepo, add `resolve.dedupe` to your Vite config to prevent duplicate React instances:
-
-```ts
-// astro.config.ts
-export default defineConfig({
-  vite: {
-    resolve: {
-      dedupe: ['react', 'react-dom'],
-    },
-  },
-});
-```
-
 ## License
 
 MIT

package/dist/index.d.ts

@@ -1,5 +1,11 @@
-import { W as Wormhole } from './types-DkH89ULF.js';
+import { W as Wormhole } from './types-hCfcC5bZ.js';
 
+/**
+ * Define a wormhole that transfers state from server middleware to client components.
+ *
+ * **Security:** wormhole data is serialized into the HTML and sent to the browser.
+ * Never store secrets (tokens, API keys, credentials) in a wormhole.
+ */
 declare function defineWormhole<T>(name: string): Wormhole<T>;
 
 export { Wormhole, defineWormhole };

package/dist/index.js

@@ -13,6 +13,11 @@ function defineWormhole(name) {
       throw new Error(`wormhole "${name}" is not initialized`);
     },
     set(data) {
+      if (typeof globalThis.window === "undefined") {
+        throw new Error(
+          `wormhole "${name}" set() cannot be called on the server as it is not request-scoped; use open(wormhole, data, fn) from "@astroscope/wormhole/server" instead`
+        );
+      }
       store = data;
       for (const fn of listeners) fn(data);
     },

package/dist/react/index.d.ts

@@ -1,4 +1,4 @@
-import { W as Wormhole } from '../types-DkH89ULF.js';
+import { W as Wormhole } from '../types-hCfcC5bZ.js';
 
 declare function useWormhole<T>(wormhole: Wormhole<T>): T;
 

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { W as Wormhole } from './types-DkH89ULF.js';
+import { W as Wormhole } from './types-hCfcC5bZ.js';
 
 declare function open<T, R>(wh: Wormhole<T>, data: T, fn: () => R): R;
 

package/dist/types-hCfcC5bZ.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A wormhole transfers state from server middleware to client-side components.
+ *
+ * **Security:** wormhole data is serialized into an inline `<script>` tag and sent to the browser.
+ * Never store secrets (tokens, API keys, credentials) in a wormhole.
+ */
+interface Wormhole<T> {
+    readonly name: string;
+    readonly key: string;
+    get(): T;
+    /**
+     * Update the wormhole value on the **client only**.
+     * Throws on the server — use `open(wormhole, data, fn)` from `@astroscope/wormhole/server` instead.
+     */
+    set(data: T): void;
+    subscribe(fn: (data: T) => void): () => void;
+}
+
+export type { Wormhole as W };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astroscope/wormhole",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Share dynamic server data with React islands and client scripts — typed, reactive",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,8 +52,8 @@
   "scripts": {
     "build": "tsup src/index.ts src/server.ts src/react/index.ts --format esm --dts",
     "typecheck": "tsc --noEmit",
-    "lint": "eslint 'src/**/*.{ts,tsx}'",
-    "lint:fix": "eslint 'src/**/*.{ts,tsx}' --fix"
+    "lint": "eslint src",
+    "lint:fix": "eslint src --fix"
   },
   "devDependencies": {
     "@types/react": "^19.2.13",

package/dist/define.d.ts

@@ -1,5 +0,0 @@
-import { W as Wormhole } from './types-DkH89ULF.js';
-
-declare function defineWormhole<T>(name: string): Wormhole<T>;
-
-export { Wormhole, defineWormhole };

package/dist/define.js

@@ -1,29 +0,0 @@
-// src/define.ts
-function defineWormhole(name) {
-  const key = `__wormhole_${name}__`;
-  let store;
-  const listeners = /* @__PURE__ */ new Set();
-  return {
-    name,
-    key,
-    get() {
-      if (store !== void 0) return store;
-      const getter = globalThis[key];
-      if (typeof getter === "function") return getter();
-      throw new Error(`wormhole "${name}" is not initialized`);
-    },
-    set(data) {
-      store = data;
-      for (const fn of listeners) fn(data);
-    },
-    subscribe(fn) {
-      listeners.add(fn);
-      return () => {
-        listeners.delete(fn);
-      };
-    }
-  };
-}
-export {
-  defineWormhole
-};

package/dist/react.d.ts

@@ -1,5 +0,0 @@
-import { W as Wormhole } from './types-DkH89ULF.js';
-
-declare function useWormhole<T>(wh: Wormhole<T>): T;
-
-export { useWormhole };

package/dist/react.js

@@ -1,8 +0,0 @@
-// src/react.ts
-import { useSyncExternalStore } from "react";
-function useWormhole(wh) {
-  return useSyncExternalStore(wh.subscribe, wh.get, wh.get);
-}
-export {
-  useWormhole
-};

package/dist/types-DkH89ULF.d.ts

@@ -1,9 +0,0 @@
-interface Wormhole<T> {
-    readonly name: string;
-    readonly key: string;
-    get(): T;
-    set(data: T): void;
-    subscribe(fn: (data: T) => void): () => void;
-}
-
-export type { Wormhole as W };