@jimhoyd/urlcode-auth 0.1.0-alpha.6 → 0.4.0-alpha.3

package/README.md

@@ -131,6 +131,12 @@ import, or a named export that is not a function fails **activation** —
 before this extension serves a single request — never the first request
 that happens to reach the hook.
 
+Each activation re-reads the hook's **entry** module from disk, so editing a
+hook file and re-activating (a dev reload) takes effect without restarting
+the process. Only the entry module is refreshed: modules the hook itself
+imports stay on Node's module cache for the life of the process, so a change
+to a hook's own dependency still needs a restart.
+
 **`sandbox: true` is not implemented for these hooks and is refused
 explicitly at activation**, naming the hook: `hook <name>: sandbox: true is
 not yet supported for project-level hooks, see jimhoyd-com/urlcode-auth#35`.

package/dist/lifecycle-hooks.js

@@ -20,6 +20,17 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 // no way to actually isolate a hook call yet (tracked in
 // jimhoyd-com/urlcode#151). Accepting `sandbox: true` and running it trusted
 // anyway would misrepresent the isolation the project believes it configured.
+//
+// Each activation re-imports the hook's ENTRY module under a fresh
+// cache-busting query, mirroring core's trusted route activation
+// (src/trusted-functions.ts, `urlcode-trusted-epoch`): Node's ESM loader
+// caches a resolved module forever by URL, so without this an edited hook
+// file kept returning its previous decision for the life of the process
+// (jimhoyd-com/urlcode#198). Only the entry module is refreshed — modules the
+// hook itself imports stay on Node's module cache, the same already-documented
+// core limitation the trusted route path has; a change to a hook's own
+// dependency still needs a process restart.
+import { randomUUID } from 'node:crypto';
 import { isAbsolute, relative, resolve } from 'node:path';
 import { realpath, stat } from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
@@ -82,6 +93,10 @@ export async function loadLifecycleHooks(config, root) {
     const hooks = {};
     if (!config)
         return hooks;
+    // One epoch per activation, not per hook: two hooks naming the same entry
+    // module still share a single instance within this activation, exactly as
+    // core's per-runtime-instance epoch does.
+    const epoch = randomUUID();
     for (const name of hookNames) {
         const ref = config[name];
         if (ref === undefined)
@@ -92,7 +107,7 @@ export async function loadLifecycleHooks(config, root) {
         const file = await projectFile(root, definition.source, name);
         let mod;
         try {
-            mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(file).href)));
+            mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(file).href + '?urlcode-hook-epoch=' + epoch)));
         }
         catch {
             throw new Error(`hook ${name}: failed to load module "${definition.source}"`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jimhoyd/urlcode-auth",
-  "version": "0.1.0-alpha.6",
+  "version": "0.4.0-alpha.3",
   "type": "module",
   "description": "Operator-installed authentication extension for URLCode: accounts, sessions, passkeys, OIDC, TOTP and trusted account pages",
   "license": "Apache-2.0",
@@ -52,8 +52,8 @@
     "otpauth": "9.5.2"
   },
   "peerDependencies": {
-    "@jimhoyd/urlcode": ">=0.4.0-alpha.2 <0.5.0",
-    "@jimhoyd/urlcode-ui": ">=0.1.0-alpha.1 <0.2.0"
+    "@jimhoyd/urlcode": ">=0.4.0-alpha.3 <0.5.0",
+    "@jimhoyd/urlcode-ui": ">=0.4.0-alpha.3 <0.5.0"
   },
   "bin": {
     "urlcode-auth": "./dist/cli.js"