@ekrooh/bare 0.5.0 → 0.6.1

package/dist/{static-file-server-C8pIX1JD.d.mts → static-file-server-COxd-PFR.d.mts}

@@ -1,40 +1,47 @@
 import { HTTPIncomingMessage, HTTPServerResponse } from "bare-http1";
-/** Accumulates an HTTP request body into a UTF-8 string. Node http emits
- * Buffers, bare-http1 emits Uint8Arrays, and a setEncoding'd stream emits
- * strings — `String(uint8array)` would join bytes with commas, so decode
- * explicitly (the `/login` token body must match byte-for-byte). */
-declare function collectRequestBody(req: HTTPIncomingMessage, maxBytes?: number): Promise<string>;
+import "bare-tcp";
+/** The protocol socket as the routing layer sees it. */
 type WebSocketLike = {
   on(event: 'data', listener: (chunk: unknown) => void): unknown;
   on(event: 'close', listener: () => void): unknown;
   on(event: 'drain', listener: () => void): unknown;
   on(event: 'error', listener: (err: Error) => void): unknown;
-  write(data: unknown): boolean;
+  write(data: Uint8Array): boolean;
   destroy(): void;
   /** Stops/restarts `data` events (inbound backpressure). */
   pause?(): void;
   resume?(): void;
 };
-/** Handler for a registered HTTP route on the loopback server. */
-type LoopbackRouteHandler = (req: HTTPIncomingMessage, res: HTTPServerResponse) => void;
-/** Minimal shape of the HTTP request object handed to WS upgrade handlers. */
+/** Minimal shape of the HTTP request object handed to connection handlers. */
 type LoopbackRequest = {
   url?: string;
   method?: string;
-  headers: Record<string, string | string[] | number>;
+  headers: Record<string, string | string[] | number | undefined>;
 };
 type LoopbackConnectionHandler = (socket: WebSocketLike, request: LoopbackRequest) => void;
+/** Accumulates an HTTP request body into a UTF-8 string. Node http emits
+ * Buffers, bare-http1 emits Uint8Arrays, and a setEncoding'd stream emits
+ * strings — `String(uint8array)` would join bytes with commas, so decode
+ * explicitly (the `/login` token body must match byte-for-byte). */
+declare function collectRequestBody(req: HTTPIncomingMessage, maxBytes?: number): Promise<string>;
+/** Handler for a registered HTTP route on the loopback server. */
+type LoopbackRouteHandler = (req: HTTPIncomingMessage, res: HTTPServerResponse) => void;
 interface LoopbackServerOptions {
-  /** Bind address. Defaults to `127.0.0.1`. */
+  /** Bind address. Defaults to `127.0.0.1`. A non-loopback address throws
+   * unless `auth` is on. */
   host?: string;
   /** Port to bind; `0` picks an ephemeral port (on-device). */
   port?: number;
-  /** Require the per-session token/cookie on every request and WS upgrade.
-   * The dev backend turns this off (the browser cannot know the token). */
+  /** Require the per-session token/cookie on every gated request and WS
+   * upgrade. Defaults to on; only the dev backend turns it off. The origin
+   * check applies either way. */
   auth?: boolean;
-  /** Fixed session token (dev/tests); otherwise a random 32-byte token is
-   * generated on first bind. */
+  /** Fixed session token (tests); otherwise a random 32-byte token. */
   token?: string;
+  /** Extra page origins allowed to call the server, e.g. the Vite dev server
+   * (`http://localhost:5173`). The bound origin and its loopback aliases
+   * (`127.0.0.1`, `localhost`, `[::1]` on the bound port) are always allowed. */
+  allowedOrigins?: readonly string[];
   /** Idle timeout (ms) after which an authenticated WebSocket connection is
    * dropped. Defaults to 60s. */
   wsIdleTimeoutMs?: number;
@@ -45,8 +52,8 @@ interface LoopbackServerOptions {
    * application message. Defaults to 10s. */
   wsDeadPeerTimeoutMs?: number;
   /** Minimum gap, in ms, between an accepted protocol socket and the next one
-   * that may replace it. Bounds eviction churn if two live clients compete.
-   * Defaults to 1000. */
+   * that may replace it; an upgrade that arrives sooner is held until then.
+   * Bounds eviction churn if two live clients compete. Defaults to 1000. */
   wsReplaceMinIntervalMs?: number;
   /** Most bytes queued behind a protocol socket whose reader has stopped reading
    * before server pushes are dropped, newest first. Responses are queued past
@@ -59,15 +66,15 @@ interface LoopbackServer {
    * first use. */
   origin(): Promise<string>;
   /** Resolves to a URL for `path` (`<origin><path>`). The per-session cookie
-   * authorizes media loads; no token is embedded in the URL anymore. */
+   * authorizes media loads; no token is embedded in the URL. */
   url(path: string): Promise<string>;
-  /** The per-session token (generated on first bind). The host reads it from
-   * `credentials()` for its own IPC needs — never injects it into the page. */
+  /** The per-session token. The host reads it from `credentials()` for its own
+   * `X-Bare-Token` calls and never injects it into the page. */
   token(): string;
-  /** Resolves to the bound origin, port, token and a one-time bootstrap nonce —
-   * written to the handoff file for the host to read before loading the page.
-   * The host injects `bootstrap` into the page (not the token); the page
-   * exchanges it once via `POST /login` for the HttpOnly session cookie. */
+  /** Resolves to the bound origin, port, token and the one-time bootstrap
+   * nonce (empty once spent). The host injects `bootstrap` into the page (not
+   * the token); the page exchanges it once via `POST /login` for the HttpOnly
+   * session cookie. */
   credentials(): Promise<{
     origin: string;
     port: number;
@@ -78,10 +85,12 @@ interface LoopbackServer {
   mount(path: string, filePath: string): void;
   unmount(path: string): void;
   /** Serves every file under `dirPath` below `prefix` (longest-prefix match).
-   * The SPA fallback to `dirPath/index.html` for unknown nave GETs applies
-   * only to `public` mounts (the bootstrap web app). Pass `{ public: true }`
-   * to mark a mount as world-readable bootstrap content served before auth; a
-   * non-public directory mount gates every request behind the session. */
+   * The SPA fallback to `dirPath/index.html` for unknown navigation GETs
+   * applies only to `public` mounts (the bootstrap web app). Pass
+   * `{ public: true }` to mark a mount as world-readable bootstrap content
+   * served before auth; a non-public directory mount gates every request
+   * behind the session. A request never resolves outside `dirPath`, symlinks
+   * included. */
   mountDir(prefix: string, dirPath: string, opts?: {
     public?: boolean;
   }): void;
@@ -102,14 +111,10 @@ interface LoopbackServer {
  * The single loopback HTTP+WS server for the worklet. One origin serves the
  * web app (`/`), the media files mounted by plugins, and the framed-protocol
  * WebSocket socket the page connects to. On device it binds `127.0.0.1` on an
- * ephemeral port. Only the explicit **bootstrap** directory mount (`/`, marked
- * `{ public: true }`) is world-readable before auth — a fresh WebView must load
- * the page before it can `POST /login`. Mounted session files (media) and the
- * WS upgrade are gated by a per-session token, accepted as a `bare_session`
- * cookie (set via `POST /login` with the one-time bootstrap nonce or the token)
- * or the `X-Bare-Token` header (non-browser clients). The URL `?token=` query
- * param is **not** accepted — a token must never appear in a URL an observer
- * could read. All responses send `Referrer-Policy: no-referrer`.
+ * ephemeral port. Admission (origin rule, session credential, bootstrap login)
+ * is decided by the loopback gate (`loopback-gate.ts`); the protocol socket's
+ * lifecycle by the protocol socket slot (`protocol-socket.ts`). All responses
+ * send `Referrer-Policy: no-referrer`.
  */
 declare function createLoopbackServer(options?: LoopbackServerOptions): LoopbackServer;
 export { createLoopbackServer as i, LoopbackServer as n, collectRequestBody as r, LoopbackRouteHandler as t };

package/dist/transports.d.mts

@@ -1,16 +1,14 @@
-import { K as MessageHeader, ot as MessageTypeValue, tt as WireMessage } from "./index-BkwUzwVt.mjs";
+import { nt as WireMessage, q as MessageHeader, st as MessageTypeValue } from "./index-Do-kTNXw.mjs";
 declare global {
   interface Window {
     /** Per-session bridge state injected by the embedding shell on-device.
      * `bootstrap` is a one-time nonce the page exchanges for a session cookie
      * via `POST /login` (single-use — the raw session token is never exposed
-     * to page JS). `token` remains as a legacy login fallback for consumers
-     * that still inject it. The cookie then rides every same-origin request —
+     * to page JS). The cookie then rides every same-origin request —
      * including the WebSocket upgrade. Browser dev has none (the dev backend
      * runs without auth). */
     __ekrooh?: {
       bootstrap?: string;
-      token?: string;
       [key: string]: unknown;
     };
     /** Set by the embedding shell on-device. */
@@ -21,8 +19,8 @@ interface CreateWebSocketTransportOptions {
   /** WebSocket URL. Defaults to the page's same-origin (`ws://location.host`).
    * Browser dev passes `VITE_BARE_WS_URL` explicitly. */
   url?: string;
-  /** Whether to bootstrap the session cookie via `POST /login` when a token
-   * is present. Defaults to `true`. */
+  /** Whether to bootstrap the session cookie via `POST /login` when a
+   * bootstrap nonce is present. Defaults to `true`. */
   login?: boolean;
   /** Reconnect attempts after an unexpected close (boot-window). Default 5. */
   maxRetries?: number;

package/dist/transports.mjs

@@ -1,4 +1,4 @@
-import { g as ErrorCode, o as MessageProtocol, y as MessageType } from "./messages-BbpF3wNH.mjs";
+import { g as ErrorCode, o as MessageProtocol, y as MessageType } from "./messages-CMNIFMFY.mjs";
 import { t as createLogRingBuffer } from "./store-DTg1jN5E.mjs";
 import { Actor, RealClock, event, state } from "@mantaq/core";
 // web/connection-machine.ts
@@ -163,8 +163,7 @@ function createWebSocketTransport(urlOrOptions = {}) {
 	const maxRetries = options.maxRetries ?? DEFAULT_RETRIES;
 	const initialBackoff = options.backoffMs ?? DEFAULT_BACKOFF_MS;
 	const loginTimeoutMs = options.loginTimeoutMs ?? LOGIN_TIMEOUT_MS;
-	const bridge = typeof window !== "undefined" ? window.__ekrooh : void 0;
-	const credential = bridge?.bootstrap ?? bridge?.token;
+	const credential = (typeof window !== "undefined" ? window.__ekrooh : void 0)?.bootstrap;
 	const shouldLogin = options.login !== false && typeof credential === "string" && credential.length > 0;
 	const listeners = /* @__PURE__ */ new Set();
 	const queued = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ekrooh/bare",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "type": "module",
   "description": "One soul, many platforms \u2014 the boring bootstrap for cross-platform apps on the Bare runtime: wire protocol, plugin kernel, RPC messenger, transports, and native host bridges.",
   "license": "MIT",
@@ -93,7 +93,6 @@
   },
   "dependencies": {
     "@mantaq/core": "^0.2.0",
-    "@mantaq/sugar": "^0.3.0",
     "bare-crypto": "^1.15.3",
     "bare-encoding": "^1.0.3",
     "bare-env": "^3.0.0",