@design.estate/wcctools 6.2.0 → 7.0.0

package/changelog.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 2026-10-06 - 7.0.0
+
+### Breaking Changes
+
+- `wcctools dev` listens on `127.0.0.1` by default instead of every interface. `--host <address>` (`0.0.0.0` or `::` for every interface) exposes it; `WccDevServer` takes the same as its `host` option.
+- The dev server answers only the hosts it serves: `localhost`, `127.0.0.1`, `::1`, the listen address (with a wildcard listen address, every address of the machine's interfaces) and the names given with `--allowed-host` (repeatable; option `allowedHosts`). Requests and WebSocket upgrades for any other `Host` are refused with `403` and a message naming the `--allowed-host` to add.
+- Typed requests and every other request but `GET`, `HEAD` and `OPTIONS`, and WebSocket connections (shell and preview), are admitted only from the server's own origin (`http://<allowed host>:<port>`); a request without an `Origin` header only from a loopback connection.
+- The preview surface no longer sends CORS headers (`Access-Control-Allow-Origin: *`): other origins can no longer read the catalogue bundle.
+- Because of that origin rule, the shell no longer works through a TLS-terminating reverse proxy, even for an `--allowed-host` name: its typed requests and WebSocket connections carry an `https:` origin and are refused. Reach the dev server over plain HTTP on its own port (for example through an SSH tunnel).
+
+### Features
+
+- `wcctools screenshot <item | section/item> --out <file.png|.jpg>` screenshots one demo in a headless Chrome: it bundles the catalogue, serves it on a free loopback port, renders the demo alone on the preview route at a named width (`phone` 400, `phablet` 600, `tablet` 1024, `desktop` 1600, from the dees-domtools breakpoints) or a width in pixels, a height, a theme and a scale, frames the rendered element, the viewport or the whole page, writes the image and stops. It waits only on the preview's own signals (the bridge, the render's completed updates, the fonts), never for a fixed time. `--demo` counts from 0.
+- The dev server's typed API takes captures: `captureScreenshot` (`IReq_CaptureScreenshot`) and `captureInteraction` (`IReq_CaptureInteraction`), which runs scripted steps (`click`, `hover`, `fill`, `press`, `waitFor`, `wait`; selectors pierce open shadow roots) on a rendered demo while recording its screencast and answers per-step results and at most `maxFrames` timestamped JPEG frames, optionally a final screenshot. One headless browser per dev server starts with the first capture, closes after a minute without one and closes with the server; two captures run at once, eight wait, more are refused as busy; every capture has a deadline (30 s for a screenshot, 135 s for an interaction; fire interactions with a matching `timeoutMs`, since `TypedRequest.fire()` gives up after 60 s by default), ends when its client goes away, waits while a bundle builds and is refused while one failed. A capture stays on the preview route: navigations that would replace the preview document (links, form submissions, `location` assignments, reloads, `about:blank` and `blob:` URLs) are cancelled as they start, with request interception as a backstop, and the step that started one fails with `navigation to <url> blocked`. Not covered: `javascript:` URLs that evaluate to a string, and demos that route by `intercept()`-ing cross-document navigations (see Known Limitations). The browser leaves process signals to the application, so `Ctrl+C` stops the server and closes the browser once.
+- The shell samples timestamped JPEG frames from a recording (`sampleVideoFrames` with mediabunny: count, range, maximum width, quality), and its recording panel hands out the finished recording with its trim range (`getRecording()`), for the coming assistant.
+- `@design.estate/wcctools/interfaces` exports the capture contracts (`IWccScreenshotRequest`, `IWccInteractionRequest`, `TWccInteractionStep`, `IWccImage`, `IWccTimedFrame`, …).
+
+### Maintenance
+
+- New dependency `@push.rocks/smartbrowser` ^5.1.0 (Puppeteer through its `/automation` entry).
+
 ## 2026-10-06 - 6.2.0
 
 ### Features