@fitzzero/quickdraw-core 5.0.0 → 5.1.0

package/dist/{infer-Dw21kmLw.d.ts → infer-Teo1xpsd.d.ts}

@@ -347,6 +347,8 @@ interface CollectionWhere {
 }
 /** Any collection of any contract, as `defineContract` stores it. */
 interface CollectionDef {
+    /** What the list holds, in a sentence or two, for the generated docs. */
+    readonly describe?: string | undefined;
     /** A string column of the entity, or `via(...)` for a junction table. */
     readonly scope: string | ViaScope;
     /** The projection each item is sent as: `"entity"` or a named projection. */
@@ -434,6 +436,8 @@ interface StreamDef<Item extends StandardSchemaV1 = StandardSchemaV1> {
     readonly volatile?: boolean;
     /** Who may subscribe. Without it the stream is closed. */
     readonly access?: StreamAccess;
+    /** What the stream carries, in a sentence or two, for the generated docs. */
+    readonly describe?: string;
 }
 /**
  * Where a channel requirement finds its row id or scope value in the parsed
@@ -498,10 +502,14 @@ interface ChannelDef<Payload extends StandardSchemaV1 = StandardSchemaV1> {
     readonly burst?: number;
     /** What the sender must already be subscribed to, or the app room it must be in. */
     readonly requires?: ChannelRequires;
+    /** What a message says, in a sentence or two, for the generated docs. */
+    readonly describe?: string;
 }
 /** A typed custom room event, delivered as `qd:event` (RFC 0003 section 8.3). */
 interface EventDef<Payload extends StandardSchemaV1 = StandardSchemaV1> {
     readonly payload: Payload;
+    /** What the event announces, in a sentence or two, for the generated docs. */
+    readonly describe?: string;
 }
 /** True when a stream has one feed per scope value; false for a global stream. */
 declare function isScopedStream(def: Pick<StreamDef, "scope">): boolean;
@@ -521,6 +529,11 @@ interface ChannelDefinition extends Omit<ChannelDef, "requires"> {
 }
 /** The second argument of {@link defineContract}. */
 interface ContractDefinition {
+    /**
+     * What the service is for, in a sentence or two. The generated API docs
+     * lead the service's page with it and list it in their index.
+     */
+    readonly describe?: string;
     /**
      * The full row; its output must contain `id: string`. Omit it for a service
      * without a model, which then has no projections, fields or collections.
@@ -567,6 +580,8 @@ type MemberOf<Def, Key extends string, Absent> = Def extends {
 interface Contract<Name extends string = string, Def extends ContractDefinition = ContractDefinition> {
     /** The service name, unchanged on the wire and in stored grants. */
     readonly name: Name;
+    /** What the service is for; absent when the definition has none. */
+    readonly describe?: string;
     readonly entity: MemberOf<Def, "entity", undefined>;
     readonly projections: MemberOf<Def, "projections", Empty>;
     readonly fields: MemberOf<Def, "fields", Empty>;
@@ -579,6 +594,7 @@ interface Contract<Name extends string = string, Def extends ContractDefinition
 /** Any contract. Every contract `defineContract` returns is assignable to it. */
 interface AnyContract {
     readonly name: string;
+    readonly describe?: string;
     readonly entity: RowSchema | undefined;
     readonly projections: {
         readonly [name: string]: RowSchema;
@@ -615,6 +631,7 @@ type IndexRow<Item, Fields> = Pick<Item, Extract<keyof Item, "id" | Fields>>;
 type ColumnOf<Row> = [Row] extends [never] ? string : keyof Row & string;
 type ScopeColumnOf<Row> = [Row] extends [never] ? string : StringColumn<Row> & string;
 interface CollectionContext<Row, Entity, Projections, Item, Index> {
+    readonly describe?: string | undefined;
     readonly scope: NoInfer<ViaScope | ScopeColumnOf<Row>>;
     readonly item: Item;
     readonly order: NoInfer<OrderBy<ColumnOf<Row>>>;

package/dist/{metrics-C0WvB7-I.d.ts → metrics-BdBu5o8G.d.ts}

@@ -1,6 +1,6 @@
-import { k as MethodKind } from './infer-Dw21kmLw.js';
+import { k as MethodKind } from './infer-Teo1xpsd.js';
 import { a as ErrorCode } from './errors-S-bxEIBC.js';
-import { T as Transport } from './types-Bwg3kIEc.js';
+import { T as Transport } from './types-Cu0vmx7c.js';
 
 /** How a call ended: `"ok"`, `"not-modified"`, or the error code it failed with. */
 type CallOutcome = "ok" | "not-modified" | ErrorCode;

package/dist/prisma/index.d.ts

@@ -1,9 +1,9 @@
 import { L as Logger } from '../logger-BY28acW-.js';
-export { C as CountArgs, F as FindManyArgs, c as StatementCount, S as StorageAdapter, a as StorageRow, b as StorageWhere, s as storageOf } from '../caller-DHzK3oiI.js';
-import '../envelope-nf5eGB-a.js';
-import '../infer-Dw21kmLw.js';
+export { C as CountArgs, F as FindManyArgs, c as StatementCount, S as StorageAdapter, a as StorageRow, b as StorageWhere, s as storageOf } from '../caller-CXTFswBO.js';
+import '../envelope-Cp3YcVxC.js';
+import '../infer-Teo1xpsd.js';
 import '../errors-S-bxEIBC.js';
-import '../types-Bwg3kIEc.js';
+import '../types-Cu0vmx7c.js';
 
 /** Options of {@link trackPrisma}. */
 interface TrackPrismaOptions {

package/dist/prisma/index.js

@@ -1,7 +1,7 @@
 import {
   createWriteTracker,
   quietly
-} from "../chunk-DNCAI3KY.js";
+} from "../chunk-4DIQHASK.js";
 import "../chunk-DD4SKCNO.js";
 import {
   STORAGE_KEY,

package/dist/server/auth/index.d.ts

@@ -1,8 +1,8 @@
 import { L as Logger } from '../../logger-BY28acW-.js';
 import { IncomingHttpHeaders, IncomingMessage, ServerResponse } from 'node:http';
-import { M as MaybePromise, P as Principal } from '../../types-Bwg3kIEc.js';
-import { b as AuthenticateRequest, H as HttpRequest } from '../../auth-CMyRkfjZ.js';
-import '../../infer-Dw21kmLw.js';
+import { M as MaybePromise, P as Principal } from '../../types-Cu0vmx7c.js';
+import { b as AuthenticateRequest, H as HttpRequest } from '../../auth-BhWqdyb-.js';
+import '../../infer-Teo1xpsd.js';
 import 'socket.io';
 
 /**
@@ -266,6 +266,14 @@ declare function registerMockOAuthProvider(router: MockOAuthRouter, options: Reg
 
 /**
  * Origin validation utility for OAuth redirect and CORS security.
+ *
+ * An origin is allowed when it is the client URL, one of the extra origins
+ * or matches an app's pattern, or, outside production, is localhost. GitHub
+ * Codespaces origins (`*.app.github.dev`) are never allowed by default since
+ * 5.0.1 (finding R1.2 of the 5.0.0 review): anyone can open a Codespace, so
+ * the allowance let any such page open a socket or finish a sign-in as a
+ * signed-in user in production, wherever an app used this helper for CORS or
+ * a cookie check. An app that wants one lists a pattern in `allowedPatterns`.
  */
 declare const OAUTH_RETURN_ORIGIN_COOKIE = "oauth_return_origin";
 interface ValidateOriginOptions {
@@ -284,8 +292,9 @@ interface ValidateOriginOptions {
      */
     allowedPatterns?: RegExp[];
     /**
-     * Allow GitHub Codespace forwarded-port origins
-     * (https://{workspace}-{username}-{port}.app.github.dev). Default: true.
+     * Ignored: kept so 5.0.0 code that passes it still compiles.
+     *
+     * @deprecated Codespaces origins are never allowed since 5.0.1; list a pattern in allowedPatterns if one is wanted.
      */
     allowCodespaces?: boolean;
     /**

package/dist/server/auth/index.js

@@ -130,7 +130,6 @@ import { randomBytes } from "crypto";
 
 // src/server/auth/validateOrigin.ts
 var OAUTH_RETURN_ORIGIN_COOKIE = "oauth_return_origin";
-var CODESPACE_REGEX = /^https:\/\/[a-z0-9-]+-[a-z0-9-]+-\d+\.app\.github\.dev$/;
 var LOCALHOST_REGEX = /^http:\/\/localhost:\d+$/;
 function envExtraOrigins() {
   const raw = process.env.EXTRA_ALLOWED_ORIGINS;
@@ -157,9 +156,6 @@ function validateRedirectOrigin(origin, options = {}) {
   if (options.allowedPatterns?.some((pattern) => pattern.test(cleanOrigin))) {
     return cleanOrigin;
   }
-  if ((options.allowCodespaces ?? true) && CODESPACE_REGEX.test(cleanOrigin)) {
-    return cleanOrigin;
-  }
   if ((options.allowLocalhostInDev ?? true) && process.env.NODE_ENV !== "production" && LOCALHOST_REGEX.test(cleanOrigin)) {
     return cleanOrigin;
   }
@@ -459,7 +455,6 @@ function originAllowlist(allowedOrigins, owner, allowEmpty = false) {
     clientUrl: "",
     extraAllowedOrigins: exact,
     allowedPatterns: patterns,
-    allowCodespaces: false,
     allowLocalhostInDev: false
   };
   return Object.freeze({