@gencow/core 0.1.0 → 0.1.1

package/dist/reactive.d.ts

@@ -53,6 +53,8 @@ export interface QueryDef<TSchema = any, TReturn = any> {
     key: string;
     handler: QueryHandler<InferArgs<TSchema>, TReturn>;
     argsSchema?: TSchema;
+    /** true = 인증 없이 접근 가능, false(기본) = auth 필수 (Secure by Default) */
+    isPublic: boolean;
     _args?: InferArgs<TSchema>;
     _return?: TReturn;
 }
@@ -60,16 +62,28 @@ export interface MutationDef<TSchema = any, TReturn = any> {
     invalidates: string[];
     handler: MutationHandler<InferArgs<TSchema>, TReturn>;
     argsSchema?: TSchema;
+    /** true = 인증 없이 접근 가능, false(기본) = auth 필수 (Secure by Default) */
+    isPublic: boolean;
     _args?: InferArgs<TSchema>;
     _return?: TReturn;
 }
+declare global {
+    var __gencow_queryRegistry: Map<string, QueryDef<any, any>>;
+    var __gencow_mutationRegistry: (MutationDef<any, any> & {
+        name: string;
+    })[];
+    var __gencow_subscribers: Map<string, Set<WSContext>>;
+    var __gencow_connectedClients: Set<WSContext>;
+}
 export declare function query<TSchema = any, TReturn = any>(key: string, handlerOrDef: QueryHandler<InferArgs<TSchema>, TReturn> | {
     args?: TSchema;
+    public?: boolean;
     handler: QueryHandler<InferArgs<TSchema>, TReturn>;
 }): QueryDef<TSchema, TReturn>;
 export declare function mutation<TSchema = any, TReturn = any>(invalidatesOrDef: string[] | {
     name?: string;
     args?: TSchema;
+    public?: boolean;
     invalidates: string[];
     handler: MutationHandler<InferArgs<TSchema>, TReturn>;
 }, handler?: MutationHandler<InferArgs<TSchema>, TReturn>, name?: string): MutationDef<TSchema, TReturn>;

package/dist/reactive.js

@@ -1,25 +1,34 @@
-// ─── Registry ───────────────────────────────────────────
-const queryRegistry = new Map();
-const mutationRegistry = [];
-const subscribers = new Map();
+if (!globalThis.__gencow_queryRegistry)
+    globalThis.__gencow_queryRegistry = new Map();
+if (!globalThis.__gencow_mutationRegistry)
+    globalThis.__gencow_mutationRegistry = [];
+if (!globalThis.__gencow_subscribers)
+    globalThis.__gencow_subscribers = new Map();
+if (!globalThis.__gencow_connectedClients)
+    globalThis.__gencow_connectedClients = new Set();
+const queryRegistry = globalThis.__gencow_queryRegistry;
+const mutationRegistry = globalThis.__gencow_mutationRegistry;
+const subscribers = globalThis.__gencow_subscribers;
 /**
  * Every WebSocket client that ever establishes a connection is tracked here.
  * This allows broadcasting invalidation events to clients that never subscribed
  * to a specific query (e.g. the admin dashboard's raw WebSocket connection).
  */
-const connectedClients = new Set();
+const connectedClients = globalThis.__gencow_connectedClients;
 // ─── Public API (Convex-style) ──────────────────────────
 export function query(key, handlerOrDef) {
     let handler;
     let argsSchema;
+    let isPublic = false;
     if (typeof handlerOrDef === "function") {
         handler = handlerOrDef;
     }
     else {
         handler = handlerOrDef.handler;
         argsSchema = handlerOrDef.args;
+        isPublic = handlerOrDef.public === true;
     }
-    const def = { key, handler, argsSchema };
+    const def = { key, handler, argsSchema, isPublic };
     queryRegistry.set(key, def);
     return def;
 }
@@ -29,6 +38,7 @@ export function mutation(invalidatesOrDef, handler, name) {
     let argsSchema;
     let actualHandler;
     let mutName;
+    let isPublic = false;
     if (Array.isArray(invalidatesOrDef)) {
         // Legacy style: mutation([...], handler, "name")
         invalidates = invalidatesOrDef;
@@ -36,17 +46,19 @@ export function mutation(invalidatesOrDef, handler, name) {
         mutName = name || `mutation_${++mutationCounter}`;
     }
     else {
-        // New object style: mutation({ name?, invalidates, args?, handler })
+        // New object style: mutation({ name?, invalidates, args?, public?, handler })
         invalidates = invalidatesOrDef.invalidates;
         actualHandler = invalidatesOrDef.handler;
         argsSchema = invalidatesOrDef.args;
+        isPublic = invalidatesOrDef.public === true;
         mutName = invalidatesOrDef.name || name || `mutation_${++mutationCounter}`;
     }
     const def = {
         name: mutName,
         invalidates,
         handler: actualHandler,
-        argsSchema
+        argsSchema,
+        isPublic,
     };
     mutationRegistry.push(def);
     return def;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gencow/core",
-    "version": "0.1.0",
+    "version": "0.1.1",
     "description": "Gencow core library — defineQuery, defineMutation, reactive subscriptions",
     "type": "module",
     "main": "dist/index.js",

package/src/__tests__/reactive.test.ts

@@ -170,3 +170,68 @@ describe("emit() 방식과 legacy invalidateQueries() 혼용", () => {
         deregisterClient(wsConnected);
     });
 });
+
+// ─── Secure by Default: public 플래그 테스트 ─────────────────────────────────
+
+import { query, mutation, getQueryDef, getRegisteredMutations } from "../reactive";
+
+describe("Secure by Default — public 플래그", () => {
+    it("query() 기본값은 isPublic === false (auth 필수)", () => {
+        const q = query("sectest.private", {
+            handler: async () => [],
+        });
+        expect(q.isPublic).toBe(false);
+    });
+
+    it("query({ public: true }) 시 isPublic === true", () => {
+        const q = query("sectest.public", {
+            public: true,
+            handler: async () => [],
+        });
+        expect(q.isPublic).toBe(true);
+    });
+
+    it("query() legacy handler 형식도 isPublic === false", () => {
+        const q = query("sectest.legacy", async () => []);
+        expect(q.isPublic).toBe(false);
+    });
+
+    it("getQueryDef()로 조회해도 isPublic 정보가 유지된다", () => {
+        query("sectest.lookup", { public: true, handler: async () => "ok" });
+        const def = getQueryDef("sectest.lookup");
+        expect(def).toBeDefined();
+        expect(def!.isPublic).toBe(true);
+    });
+
+    it("mutation() 기본값은 isPublic === false", () => {
+        const m = mutation({
+            name: "sectest.mut.private",
+            invalidates: [],
+            handler: async () => ({ ok: true }),
+        });
+        expect(m.isPublic).toBe(false);
+    });
+
+    it("mutation({ public: true }) 시 isPublic === true", () => {
+        const m = mutation({
+            name: "sectest.mut.public",
+            invalidates: [],
+            public: true,
+            handler: async () => ({ ok: true }),
+        });
+        expect(m.isPublic).toBe(true);
+    });
+
+    it("mutation() legacy array 형식도 isPublic === false", () => {
+        const m = mutation(["some.key"], async () => ({ ok: true }), "sectest.mut.legacy");
+        expect(m.isPublic).toBe(false);
+    });
+
+    it("getRegisteredMutations()에서 isPublic 정보가 노출된다", () => {
+        const all = getRegisteredMutations();
+        const pub = all.find(m => m.name === "sectest.mut.public");
+        const priv = all.find(m => m.name === "sectest.mut.private");
+        expect(pub?.isPublic).toBe(true);
+        expect(priv?.isPublic).toBe(false);
+    });
+});

package/src/reactive.ts

@@ -65,6 +65,8 @@ export interface QueryDef<TSchema = any, TReturn = any> {
     key: string;
     handler: QueryHandler<InferArgs<TSchema>, TReturn>;
     argsSchema?: TSchema;
+    /** true = 인증 없이 접근 가능, false(기본) = auth 필수 (Secure by Default) */
+    isPublic: boolean;
     _args?: InferArgs<TSchema>;
     _return?: TReturn;
 }
@@ -73,40 +75,64 @@ export interface MutationDef<TSchema = any, TReturn = any> {
     invalidates: string[];
     handler: MutationHandler<InferArgs<TSchema>, TReturn>;
     argsSchema?: TSchema;
+    /** true = 인증 없이 접근 가능, false(기본) = auth 필수 (Secure by Default) */
+    isPublic: boolean;
     _args?: InferArgs<TSchema>;
     _return?: TReturn;
 }
 
 // ─── Registry ───────────────────────────────────────────
+//
+// globalThis 기반 — 서버 번들(인라인)과 node_modules/@gencow/core 양쪽에서
+// 동일한 레지스트리 인스턴스를 공유. Dual-Module Registry 버그 방지.
+// See: docs/analysis/analysis-dual-module-registry.md
+
+declare global {
+    // eslint-disable-next-line no-var
+    var __gencow_queryRegistry: Map<string, QueryDef<any, any>>;
+    // eslint-disable-next-line no-var
+    var __gencow_mutationRegistry: (MutationDef<any, any> & { name: string })[];
+    // eslint-disable-next-line no-var
+    var __gencow_subscribers: Map<string, Set<WSContext>>;
+    // eslint-disable-next-line no-var
+    var __gencow_connectedClients: Set<WSContext>;
+}
+
+if (!globalThis.__gencow_queryRegistry) globalThis.__gencow_queryRegistry = new Map();
+if (!globalThis.__gencow_mutationRegistry) globalThis.__gencow_mutationRegistry = [];
+if (!globalThis.__gencow_subscribers) globalThis.__gencow_subscribers = new Map();
+if (!globalThis.__gencow_connectedClients) globalThis.__gencow_connectedClients = new Set();
 
-const queryRegistry = new Map<string, QueryDef<any, any>>();
-const mutationRegistry: (MutationDef<any, any> & { name: string })[] = [];
-const subscribers = new Map<string, Set<WSContext>>();
+const queryRegistry = globalThis.__gencow_queryRegistry;
+const mutationRegistry = globalThis.__gencow_mutationRegistry;
+const subscribers = globalThis.__gencow_subscribers;
 
 /**
  * Every WebSocket client that ever establishes a connection is tracked here.
  * This allows broadcasting invalidation events to clients that never subscribed
  * to a specific query (e.g. the admin dashboard's raw WebSocket connection).
  */
-const connectedClients = new Set<WSContext>();
+const connectedClients = globalThis.__gencow_connectedClients;
 
 // ─── Public API (Convex-style) ──────────────────────────
 
 export function query<TSchema = any, TReturn = any>(
     key: string,
-    handlerOrDef: QueryHandler<InferArgs<TSchema>, TReturn> | { args?: TSchema; handler: QueryHandler<InferArgs<TSchema>, TReturn> }
+    handlerOrDef: QueryHandler<InferArgs<TSchema>, TReturn> | { args?: TSchema; public?: boolean; handler: QueryHandler<InferArgs<TSchema>, TReturn> }
 ): QueryDef<TSchema, TReturn> {
     let handler: QueryHandler<InferArgs<TSchema>, TReturn>;
     let argsSchema: TSchema | undefined;
+    let isPublic = false;
 
     if (typeof handlerOrDef === "function") {
         handler = handlerOrDef;
     } else {
         handler = handlerOrDef.handler;
         argsSchema = handlerOrDef.args;
+        isPublic = handlerOrDef.public === true;
     }
 
-    const def: QueryDef<TSchema, TReturn> = { key, handler, argsSchema };
+    const def: QueryDef<TSchema, TReturn> = { key, handler, argsSchema, isPublic };
     queryRegistry.set(key, def);
     return def;
 }
@@ -114,7 +140,7 @@ export function query<TSchema = any, TReturn = any>(
 let mutationCounter = 0;
 
 export function mutation<TSchema = any, TReturn = any>(
-    invalidatesOrDef: string[] | { name?: string; args?: TSchema; invalidates: string[]; handler: MutationHandler<InferArgs<TSchema>, TReturn> },
+    invalidatesOrDef: string[] | { name?: string; args?: TSchema; public?: boolean; invalidates: string[]; handler: MutationHandler<InferArgs<TSchema>, TReturn> },
     handler?: MutationHandler<InferArgs<TSchema>, TReturn>,
     name?: string
 ): MutationDef<TSchema, TReturn> {
@@ -122,6 +148,7 @@ export function mutation<TSchema = any, TReturn = any>(
     let argsSchema: TSchema | undefined;
     let actualHandler: MutationHandler<InferArgs<TSchema>, TReturn>;
     let mutName: string;
+    let isPublic = false;
 
     if (Array.isArray(invalidatesOrDef)) {
         // Legacy style: mutation([...], handler, "name")
@@ -129,17 +156,19 @@ export function mutation<TSchema = any, TReturn = any>(
         actualHandler = handler!;
         mutName = name || `mutation_${++mutationCounter}`;
     } else {
-        // New object style: mutation({ name?, invalidates, args?, handler })
+        // New object style: mutation({ name?, invalidates, args?, public?, handler })
         invalidates = invalidatesOrDef.invalidates;
         actualHandler = invalidatesOrDef.handler;
         argsSchema = invalidatesOrDef.args;
+        isPublic = invalidatesOrDef.public === true;
         mutName = invalidatesOrDef.name || name || `mutation_${++mutationCounter}`;
     }
     const def: MutationDef<TSchema, TReturn> & { name: string } = {
         name: mutName,
         invalidates,
         handler: actualHandler,
-        argsSchema
+        argsSchema,
+        isPublic,
     };
     mutationRegistry.push(def);
     return def;