@nodefony/realtime 10.0.0-beta.3 → 10.0.0-beta.5

package/README.md

@@ -163,20 +163,39 @@ authenticator aurait résolue, et le verrou de frame que `@nodefony/security` po
 Sans verrou, une `policy` déclarée n'est appliquée par personne — c'est vrai en test comme
 en production, `@nodefony/realtime` ne connaissant pas `@nodefony/security`.
 
+Les deux sont fournis par `@nodefony/security/testing` — le verrou est celui du pare-feu, pas
+une copie :
+
 ```ts
-const h = createRealtimeHarness((ctx) => new ChatController(ctx), {
-  identity: monToken, // IRealtimeToken
-  frameAuthorizer: buildFrameAuthorizer(firewall, {
-    // @nodefony/security
-    channelResolver: getRealtimeHub(),
-    systemRules: DEFAULT_SYSTEM_RULES,
-  }),
+import {
+  createTestFrameAuthorizer,
+  createTestIdentity,
+} from "@nodefony/security/testing";
+
+// `chat:room` exige une connexion authentifiée. Sans `identity`, le harnais
+// pose le jeton anonyme, comme le repli du runtime : le canal est refusé.
+const anonyme = createRealtimeHarness((ctx) => new ChatController(ctx), {
+  frameAuthorizer: createTestFrameAuthorizer(getRealtimeHub()),
 });
-await h.connect();
-await h.subscribe("chat:admin");
-expect(h.denials().map((d) => d.channel)).toEqual(["chat:admin"]); // refusé
+await anonyme.connect();
+await anonyme.subscribe("chat:room");
+expect(anonyme.denials().map((d) => d.channel)).toEqual(["chat:room"]);
+anonyme.dispose();
+
+// Avec une identité, le même canal est accordé.
+const alice = createRealtimeHarness((ctx) => new ChatController(ctx), {
+  identity: createTestIdentity({ identifier: "alice", roles: ["ROLE_USER"] }),
+  frameAuthorizer: createTestFrameAuthorizer(getRealtimeHub()),
+});
+await alice.connect();
+await alice.subscribe("chat:room");
+expect(alice.denials()).toHaveLength(0);
+alice.dispose();
 ```
 
+Les deux cas vont ensemble : le refus seul passerait aussi avec un canal fermé à tous, l'accord
+seul avec un canal ouvert à tous.
+
 | Membre                                      | Rôle                                                            |
 | ------------------------------------------- | --------------------------------------------------------------- |
 | `connect()`                                 | Handshake ; rend le `realtime:welcome`, jette s'il n'arrive pas |

package/dist/_virtual/{_@oxc-project_runtime@0.153.0 → _@oxc-project_runtime@0.155.0}/helpers/esm/decorate.js

@@ -1,9 +1,8 @@
-//#region \0@oxc-project+runtime@0.153.0/helpers/esm/decorate.js
+// \0@oxc-project+runtime@0.155.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-//#endregion
 export { __decorate as default };

package/dist/index.js

@@ -17,10 +17,9 @@ import { ClusterBackplane, processIpcTransport } from "./nodefony/src/backplane/
 import { getBackplaneDriver, listBackplaneDrivers, registerBackplaneDriver } from "./nodefony/src/backplane/backplaneRegistry.js";
 import { ClusterProbeClient, clusterProbeHealth, clusterProbeInstance, clusterProbeRequestEnrich, mergeClusterHealth, processProbeTransport, setClusterProbeClient } from "./nodefony/src/cluster/ClusterProbeClient.js";
 import { buildOwnHealth, buildRealtimeHealth, createRealtimeAdminApi } from "./nodefony/src/server/RealtimeAdminApi.js";
-import __decorateMetadata from "./_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateMetadata.js";
-import __decorate from "./_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorate.js";
-import { IDENTITY_CHANGED_EVENT, Kernel, Module, services, withTimeout } from "nodefony";
-//#region index.ts
+import __decorate from "./_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import { IDENTITY_CHANGED_EVENT, Module, services, withTimeout } from "nodefony";
+// index.ts
 /**
 * @nodefony/realtime — Couche realtime serveur Nodefony.
 *
@@ -219,7 +218,6 @@ let Realtime = class Realtime extends Module {
 		}
 	}
 };
-Realtime = __decorate([services([RealtimeService]), __decorateMetadata("design:paramtypes", [typeof Kernel === "undefined" ? Object : Kernel])], Realtime);
+Realtime = __decorate([services([RealtimeService])], Realtime);
 var realtime_default = Realtime;
-//#endregion
 export { ANONYMOUS_REALTIME_TOKEN, BROWSER_ORIGIN, ClusterBackplane, ClusterProbeClient, LoopbackBackplane, MAX_CLIENT_SEVERITY, REDIS_RT_CHANNEL, RESERVED_SYSTEM_PREFIXES, Realtime, RealtimeAction, RealtimeBroadcast, RealtimeChannel, RealtimeController, RealtimeHub, RealtimeInbound, RealtimeService, RedisBackplane, SLOW_CONSUMER_BYTES, ServerRealtimeSocket, WsConnectionTransport, buildOwnHealth, buildRealtimeHealth, clusterProbeHealth, clusterProbeInstance, clusterProbeRequestEnrich, createRealtimeAdminApi, createRedisServiceTransport, createSyslogUplinkHandler, realtime_default as default, defineRealtimeConfig, getBackplaneDriver, getDeclaredBroadcastPrefixes, getRealtimeHub, isReservedSystemChannel, listBackplaneDrivers, mergeClusterHealth, processIpcTransport, processProbeTransport, realtimeConfigJsonSchema, registerBackplaneDriver, resolveBackplaneOriginId, resolveRedisChannel, serverSocket, setClusterProbeClient };

package/dist/nodefony/config/config.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-//#region nodefony/config/config.ts
+// nodefony/config/config.ts
 /**
 * @nodefony/realtime — CONFIGURATION DU MODULE (schéma Zod = source unique).
 *
@@ -62,5 +62,4 @@ const realtimeConfigSchema = z.strictObject({
 * valides par construction ; passés au `super(..., config)` du Module class.
 */
 const config = realtimeConfigSchema.parse({});
-//#endregion
 export { config as default, realtimeConfigSchema };

package/dist/nodefony/config/configSchema.js

@@ -1,6 +1,6 @@
 import { realtimeConfigSchema } from "./config.js";
 import { z } from "zod";
-//#region nodefony/config/configSchema.ts
+// nodefony/config/configSchema.ts
 /**
 * JSON Schema de la configuration de `@nodefony/realtime` — lu SANS démarrer
 * l'application, par `nodefony env` et la notice `.env.example`, qui y
@@ -15,5 +15,4 @@ import { z } from "zod";
 function configJsonSchema() {
 	return z.toJSONSchema(realtimeConfigSchema);
 }
-//#endregion
 export { configJsonSchema };

package/dist/nodefony/config/defineModuleConfig.js

@@ -1,7 +1,7 @@
 import { realtimeConfigSchema } from "./config.js";
 import { configJsonSchema } from "./configSchema.js";
 import { parseModuleConfig } from "nodefony";
-//#region nodefony/config/defineModuleConfig.ts
+// nodefony/config/defineModuleConfig.ts
 /**
 * Builder type-safe de la configuration de `@nodefony/realtime`.
 *
@@ -83,5 +83,4 @@ function isRealtimeConfig(value) {
 function realtimeConfigJsonSchema() {
 	return configJsonSchema();
 }
-//#endregion
 export { buildRealtimeConfig, defineRealtimeConfig, isRealtimeConfig, realtimeConfigJsonSchema };

package/dist/nodefony/decorators/realtimeDecorators.js

@@ -1,6 +1,6 @@
 import { isCallable, isRecord } from "../src/guards.js";
 import "reflect-metadata";
-//#region nodefony/decorators/realtimeDecorators.ts
+// nodefony/decorators/realtimeDecorators.ts
 /** Clés de métadonnées posées sur le constructor de la classe controller. */
 const ACTIONS_KEY = "realtime:actions";
 const CHANNELS_KEY = "realtime:channels";
@@ -287,5 +287,4 @@ function getDeclaredBroadcastPrefixes() {
 function applyDeclaredBroadcastPrefixes(hub) {
 	for (const prefix of declaredBroadcastPrefixes) hub.markBroadcastChannel(prefix);
 }
-//#endregion
 export { DEFAULT_ACTION_POLICY, RealtimeAction, RealtimeBroadcast, RealtimeChannel, RealtimeInbound, applyDeclaredBroadcastPrefixes, getDeclaredBroadcastPrefixes, getRealtimeActions, getRealtimeChannelPolicies, getRealtimeChannels, getRealtimeInbound };

package/dist/nodefony/interfaces/IRealtimeConnectionState.js

@@ -0,0 +1 @@
+export {};

package/dist/nodefony/src/backplane/ClusterBackplane.js

@@ -1,6 +1,6 @@
 import resolveBackplaneOriginId from "./originId.js";
 import { CLUSTER_RT_KIND } from "nodefony";
-//#region nodefony/src/backplane/ClusterBackplane.ts
+// nodefony/src/backplane/ClusterBackplane.ts
 /**
 * Transport de production : `process.send` (émission) + `process.on("message")`
 * (réception). Standalone — utilisable tel quel. En vrai câblage cluster (Phase 3c),
@@ -101,5 +101,4 @@ var ClusterBackplane = class ClusterBackplane {
 		};
 	}
 };
-//#endregion
 export { ClusterBackplane, ClusterBackplane as default, processIpcTransport };

package/dist/nodefony/src/backplane/LoopbackBackplane.js

@@ -1,5 +1,5 @@
 import resolveBackplaneOriginId from "./originId.js";
-//#region nodefony/src/backplane/LoopbackBackplane.ts
+// nodefony/src/backplane/LoopbackBackplane.ts
 /**
 * Backplane **mono-process no-op** — implémentation de RÉFÉRENCE du port
 * {@link IBackplane} quand il n'existe **aucun pair** (1 process = 1 pod).
@@ -36,5 +36,4 @@ var LoopbackBackplane = class LoopbackBackplane {
 		};
 	}
 };
-//#endregion
 export { LoopbackBackplane, LoopbackBackplane as default };

package/dist/nodefony/src/backplane/RedisBackplane.js

@@ -2,7 +2,7 @@ import { isCallable, isRecord, isThenable } from "../guards.js";
 import resolveBackplaneOriginId from "./originId.js";
 import { openBackplaneEnvelope, sealBackplaneEnvelope } from "./envelope.js";
 import { BackplanePublishQueue } from "./publishQueue.js";
-//#region nodefony/src/backplane/RedisBackplane.ts
+// nodefony/src/backplane/RedisBackplane.ts
 /**
 * BASE du canal Redis **dédié** transportant les enveloppes realtime entre pods.
 * Un seul canal pub/sub par app (les canaux logiques voyagent DANS l'enveloppe,
@@ -189,5 +189,4 @@ var RedisBackplane = class RedisBackplane {
 		};
 	}
 };
-//#endregion
 export { REDIS_RT_CHANNEL, RedisBackplane, RedisBackplane as default, createRedisServiceTransport, isRedisPublisher, isRedisSubscriber, resolveRedisChannel };

package/dist/nodefony/src/backplane/backplaneRegistry.js

@@ -1,4 +1,4 @@
-//#region nodefony/src/backplane/backplaneRegistry.ts
+// nodefony/src/backplane/backplaneRegistry.ts
 const drivers = /* @__PURE__ */ new Map();
 /**
 * Enregistre (ou remplace) la fabrique d'un driver backplane. Appelé par les
@@ -16,5 +16,4 @@ function getBackplaneDriver(name) {
 function listBackplaneDrivers() {
 	return [...drivers.keys()];
 }
-//#endregion
 export { getBackplaneDriver, listBackplaneDrivers, registerBackplaneDriver };

package/dist/nodefony/src/backplane/bootNotices.js

@@ -1,4 +1,4 @@
-//#region nodefony/src/backplane/bootNotices.ts
+// nodefony/src/backplane/bootNotices.ts
 /** Le geste qui rend le temps réel partagé entre processus et pods. */
 const REDIS_BACKPLANE_FIX = "use(\"@nodefony/realtime\", { backplane: { driver: \"redis\" } }) + NF_REDIS_URL=redis://…";
 /**
@@ -39,5 +39,4 @@ function realtimeBackplaneDownNotice(driver, reason) {
 		fix: driver === "redis" ? "vérifier NF_REDIS_URL et que Redis répond" : void 0
 	};
 }
-//#endregion
 export { realtimeBackplaneDownNotice, realtimeLocalOnlyNotice };

package/dist/nodefony/src/backplane/envelope.js

@@ -1,5 +1,5 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
-//#region nodefony/src/backplane/envelope.ts
+// nodefony/src/backplane/envelope.ts
 /**
 * **Sceau d'enveloppe backplane** — authenticité des messages transportés sur un
 * bus **PARTAGÉ** (Redis pub/sub, et tout driver userland cross-host : NATS,
@@ -106,5 +106,4 @@ function openBackplaneEnvelope(raw, secret) {
 	if (a.length !== b.length || !timingSafeEqual(a, b)) return null;
 	return msg;
 }
-//#endregion
 export { openBackplaneEnvelope, sealBackplaneEnvelope };

package/dist/nodefony/src/backplane/originId.js

@@ -1,6 +1,6 @@
 import { hostname } from "node:os";
 import { randomUUID } from "node:crypto";
-//#region nodefony/src/backplane/originId.ts
+// nodefony/src/backplane/originId.ts
 /**
 * Résout l'identifiant d'origine d'un backplane — l'étiquette que l'anti-écho
 * compare pour jeter les messages qui reviennent à leur émetteur.
@@ -31,5 +31,4 @@ function resolveBackplaneOriginId() {
 	if (!host) return randomUUID();
 	return `${host}:${process.pid}`;
 }
-//#endregion
 export { resolveBackplaneOriginId as default, resolveBackplaneOriginId };

package/dist/nodefony/src/backplane/publishQueue.js

@@ -89,5 +89,4 @@ var BackplanePublishQueue = class {
 		};
 	}
 };
-//#endregion
 export { BackplanePublishQueue, BackplanePublishQueue as default, DEFAULT_MAX_QUEUE_BYTES };

package/dist/nodefony/src/cluster/ClusterProbeClient.js

@@ -1,6 +1,6 @@
 import { isRecord } from "../guards.js";
 import { CLUSTER_PROBE_CTL_KIND, CLUSTER_PROBE_KIND, CLUSTER_PROBE_SNAPSHOT_KIND, RichProcessProbe, isClusterMessage, isClusterProbeEnrich, readOrmRich } from "nodefony";
-//#region nodefony/src/cluster/ClusterProbeClient.ts
+// nodefony/src/cluster/ClusterProbeClient.ts
 /**
 * Vrai si la valeur est une liste de santés d'instance. Le snapshot vient du
 * master du cluster par IPC — un process de la MÊME application, pas le
@@ -291,5 +291,4 @@ function clusterProbeInstance(pid) {
 	if (!health) return null;
 	return health.instances.find((i) => i.process?.pid === pid || i.instanceId === String(pid)) ?? null;
 }
-//#endregion
 export { ClusterProbeClient, ClusterProbeClient as default, clusterProbeHealth, clusterProbeInstance, clusterProbeRequestEnrich, mergeClusterHealth, processProbeTransport, setClusterProbeClient };

package/dist/nodefony/src/guards.js

@@ -1,4 +1,4 @@
-//#region nodefony/src/guards.ts
+// nodefony/src/guards.ts
 /**
 * Gardes de type internes au paquet — elles remplacent une conversion (`as`)
 * par une vérification faite à l'exécution, pour qu'une valeur d'une autre
@@ -37,5 +37,4 @@ function isCallable(value) {
 function isThenable(value) {
 	return isRecord(value) && typeof value.then === "function";
 }
-//#endregion
 export { isCallable, isRecord, isThenable };

package/dist/nodefony/src/server/AnonymousRealtimeToken.js

@@ -1,4 +1,4 @@
-//#region nodefony/src/server/AnonymousRealtimeToken.ts
+// nodefony/src/server/AnonymousRealtimeToken.ts
 /**
 * Token realtime ANONYME — fallback Zero Trust quand aucun matcher
 * `IRealtimeAuthenticatorMatcher` ne capture le handshake.
@@ -28,5 +28,4 @@ const ANONYMOUS_REALTIME_TOKEN = Object.freeze({
 	},
 	getAttribute(_key) {}
 });
-//#endregion
 export { ANONYMOUS_REALTIME_TOKEN, ANONYMOUS_REALTIME_TOKEN as default };

package/dist/nodefony/src/server/RealtimeAdminApi.js

@@ -2,7 +2,7 @@ import { getRealtimeHub } from "./RealtimeHub.js";
 import { listBackplaneDrivers } from "../backplane/backplaneRegistry.js";
 import { clusterProbeHealth } from "../cluster/ClusterProbeClient.js";
 import { Nodefony, ProcessProbe, readOrmHealth } from "nodefony";
-//#region nodefony/src/server/RealtimeAdminApi.ts
+// nodefony/src/server/RealtimeAdminApi.ts
 const processProbe = new ProcessProbe();
 /**
 * Producteur `IAdminApi` de la **socket Nodefony** — exposé sous
@@ -83,5 +83,4 @@ function createRealtimeAdminApi() {
 		adminEndpoints: () => endpoints
 	};
 }
-//#endregion
 export { buildOwnHealth, buildRealtimeHealth, createRealtimeAdminApi };