@astroscope/wormhole 0.1.1 → 0.2.0

package/README.md

@@ -18,6 +18,11 @@ Astro recommends [nanostores](https://docs.astro.build/en/recipes/sharing-state/
 - Server-loaded configuration (theme, locale, permissions) bridged to the UI
 - Any request-scoped data that multiple disconnected islands need to read
 
+## Important notes
+
+- **No secrets in wormholes.** All wormhole data is serialized into an inline `<script>` tag and sent to the browser. Never store tokens, API keys, credentials, or any sensitive data in a wormhole.
+- **`set()` is client-only.** Calling `set()` does not work on the server. Use `open(wormhole, data, fn)` from `@astroscope/wormhole/server` to populate data in middleware.
+
 ## Examples
 
 See the [demo/wormhole](../../demo/wormhole) directory for a working example.

package/dist/index.d.ts

@@ -1,5 +1,11 @@
-import { W as Wormhole } from './types-DkH89ULF.js';
+import { W as Wormhole } from './types-hCfcC5bZ.js';
 
+/**
+ * Define a wormhole that transfers state from server middleware to client components.
+ *
+ * **Security:** wormhole data is serialized into the HTML and sent to the browser.
+ * Never store secrets (tokens, API keys, credentials) in a wormhole.
+ */
 declare function defineWormhole<T>(name: string): Wormhole<T>;
 
 export { Wormhole, defineWormhole };

package/dist/index.js

@@ -13,6 +13,11 @@ function defineWormhole(name) {
       throw new Error(`wormhole "${name}" is not initialized`);
     },
     set(data) {
+      if (typeof globalThis.window === "undefined") {
+        throw new Error(
+          `wormhole "${name}" set() cannot be called on the server as it is not request-scoped; use open(wormhole, data, fn) from "@astroscope/wormhole/server" instead`
+        );
+      }
       store = data;
       for (const fn of listeners) fn(data);
     },

package/dist/react/index.d.ts

@@ -1,4 +1,4 @@
-import { W as Wormhole } from '../types-DkH89ULF.js';
+import { W as Wormhole } from '../types-hCfcC5bZ.js';
 
 declare function useWormhole<T>(wormhole: Wormhole<T>): T;
 

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { W as Wormhole } from './types-DkH89ULF.js';
+import { W as Wormhole } from './types-hCfcC5bZ.js';
 
 declare function open<T, R>(wh: Wormhole<T>, data: T, fn: () => R): R;
 

package/dist/types-hCfcC5bZ.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A wormhole transfers state from server middleware to client-side components.
+ *
+ * **Security:** wormhole data is serialized into an inline `<script>` tag and sent to the browser.
+ * Never store secrets (tokens, API keys, credentials) in a wormhole.
+ */
+interface Wormhole<T> {
+    readonly name: string;
+    readonly key: string;
+    get(): T;
+    /**
+     * Update the wormhole value on the **client only**.
+     * Throws on the server — use `open(wormhole, data, fn)` from `@astroscope/wormhole/server` instead.
+     */
+    set(data: T): void;
+    subscribe(fn: (data: T) => void): () => void;
+}
+
+export type { Wormhole as W };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astroscope/wormhole",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Share dynamic server data with React islands and client scripts — typed, reactive",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,18 +52,18 @@
   "scripts": {
     "build": "tsup src/index.ts src/server.ts src/react/index.ts --format esm --dts",
     "typecheck": "tsc --noEmit",
-    "lint": "eslint 'src/**/*.{ts,tsx}'",
-    "lint:fix": "eslint 'src/**/*.{ts,tsx}' --fix"
+    "lint": "eslint src",
+    "lint:fix": "eslint src --fix"
   },
   "devDependencies": {
-    "@types/react": "^19.2.13",
-    "astro": "^5.17.1",
+    "@types/react": "^19.2.14",
+    "astro": "^6.0.2",
     "react": "^19.2.4",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "astro": "^5.0.0",
+    "astro": "^6.0.0",
     "react": "^18.0.0 || ^19.0.0"
   },
   "peerDependenciesMeta": {

package/dist/types-DkH89ULF.d.ts

@@ -1,9 +0,0 @@
-interface Wormhole<T> {
-    readonly name: string;
-    readonly key: string;
-    get(): T;
-    set(data: T): void;
-    subscribe(fn: (data: T) => void): () => void;
-}
-
-export type { Wormhole as W };