@t4h.framework/dev 0.0.0-experimental-20260902161345 → 0.0.0-experimental-20260902164013

package/CHANGELOG.md

@@ -1,10 +1,10 @@
 # @t4h.framework/dev
 
-## 0.0.0-experimental-20260902161345
+## 0.0.0-experimental-20260902164013
 
 ### Minor Changes
 
-- [#145](https://github.com/tech4humans-brasil/framework/pull/145) [`13c7a2e`](https://github.com/tech4humans-brasil/framework/commit/13c7a2e80ad5cd3e9ab10ebe5f3cdfc66f4bc664) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Replaces the interactive REPL of `framework dev` with an HTTP dev server: Hono routes workflow (`POST /projects/:projectId/workflows/:workflowId/runs` answers `201 { id }`, `PATCH .../runs/:runId/activities/:activityId` advances a pending async activity), mandatory workflow authorization resolved from the app/workflow `Authorization` manifest, `/_dev` routes for tooling (manifest, runs, waiting activities, env, SSE events) and Vite in middleware mode for a UI. Workflow runs now live in an in-memory SQLite database inside the app process, the ORM dev claim stores its rows in `db.sqlite` instead of rewriting `db.json` on every change, child workflows run in parallel, and `framework dev` gains `--port` (`PORT`) and `--host`. `DevServer` and `isWorkflowWaiting` are gone; use `Server`.
+- [#145](https://github.com/tech4humans-brasil/framework/pull/145) [`09724c3`](https://github.com/tech4humans-brasil/framework/commit/09724c3f0bb573d55b94495835362e7b66bc570e) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Replaces the interactive REPL of `framework dev` with an HTTP dev server: Hono routes workflow (`POST /projects/:projectId/workflows/:workflowId/runs` answers `201 { id }`, `PATCH .../runs/:runId/activities/:activityId` advances a pending async activity), mandatory workflow authorization resolved from the app/workflow `Authorization` manifest, `/_dev` routes for tooling (manifest, runs, waiting activities, env, SSE events) and Vite in middleware mode for a UI. Workflow runs now live in an in-memory SQLite database inside the app process, the ORM dev claim stores its rows in `db.sqlite` instead of rewriting `db.json` on every change, child workflows run in parallel, and `framework dev` gains `--port` (`PORT`) and `--host`. `DevServer` and `isWorkflowWaiting` are gone; use `Server`.
 
 ## 0.14.2
 

package/README.md

@@ -8,7 +8,7 @@ When you run `framework dev` (via `@t4h.framework/cli`), this package powers the
 
 1. **TypeScript watch** — compiles your app on every change.
 2. **App process** — forks a child Node process that loads your compiled `App` and runs the workflow engine on an in-memory SQLite database.
-3. **HTTP server** — a [Hono](https://hono.dev) app that mirrors the production routes (without the tenant prefix), enforces the workflow authorization and exposes `/_dev` routes for tooling.
+3. **HTTP server** — a [Hono](https://hono.dev) app that exposes your workflows (create runs, advance pending activities), enforces the workflow authorization and adds `/_dev` routes for tooling.
 4. **Vite** — a Vite dev server in middleware mode serves everything that is not an API route, ready for a UI plugin.
 5. **Dev claims** — provides local implementations for ORM, HTTP, file system, cache, SMTP, and more.
 
@@ -99,7 +99,7 @@ framework dev --entrypoint ./package.json -e API_KEY=secret -e DB_HOST=localhost
 
 ## HTTP routes
 
-The routes are the production ones without the `/tenants/:tenant` and `/versions/:projectVersionId` segments: the dev server has no tenants and a single live version (the last build). `projectId` must match your `App` id.
+The dev server has no tenants and a single live version (the last build), so the routes carry only the project and the workflow. `projectId` must match your `App` id.
 
 | Method | Route | Authorization | Response |
 |--------|-------|---------------|----------|
@@ -118,7 +118,7 @@ curl -X POST http://localhost:3000/projects/my-app/workflows/my-workflow/runs \
 
 ### Authorization
 
-Every production-mirror route requires an authorization, exactly like the production runtime: the workflow `authorization` wins over the app one, its manifest `pathToModule` is imported and its default export receives the manifest `context` templated with the request (`<< headers.x-signature >>`, `<< rawBody >>`, `<< body.id >>`, `<< params.projectId >>`, `<< query.token >>`). A falsy result or a thrown error answers `401`. A workflow without any authorization answers `500` on purpose: it will not work in production either.
+Every `/projects` route requires an authorization: the workflow `authorization` wins over the app one, its manifest `pathToModule` is imported and its default export receives the manifest `context` templated with the request (`<< headers.x-signature >>`, `<< rawBody >>`, `<< body.id >>`, `<< params.projectId >>`, `<< query.token >>`). A falsy result or a thrown error answers `401`. A workflow without any authorization is refused when the manifest arrives (the server emits `error`) and answers `500` if reached.
 
 `pathToModule` may be `@t4h.framework/hmac/authorize`, `@t4h.framework/jwks/authorize`, `@t4h.framework/oidc/authorize`, an absolute path, a path relative to the project or a `file://` URL.
 
@@ -139,9 +139,9 @@ Everything else is handed to Vite, so a UI plugin registered in the project's `v
 
 ## State
 
-Workflow runs, activities, pending async activities and logs live in an in-memory SQLite database (`node:sqlite`) inside the app process. Every successful build forks a fresh process, so **a rebuild resets all runs, timers and pending activities**; the `manifest` SSE event tells a UI to reload. Durability, queues and resume belong to the production runtime.
+Workflow runs, activities, pending async activities and logs live in an in-memory SQLite database (`node:sqlite`) inside the app process. Every successful build forks a fresh process, so **a rebuild resets all runs, timers and pending activities**; the `manifest` SSE event tells a UI to reload. There is no durability, queue or resume in the dev server by design.
 
-Sync activities run inline, `sleep` and other timers use `setTimeout`, and child workflows started with `startWorkflow` / `startWorkflowMany` run in parallel, like in production.
+Sync activities run inline, `sleep` and other timers use `setTimeout`, and child workflows started with `startWorkflow` / `startWorkflowMany` run in parallel.
 
 The ORM claim is the exception: its rows live in `db.sqlite` next to your `package.json` and survive rebuilds and restarts (add it to `.gitignore`). Delete the file to start over. The previous `db.json` is no longer read.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h.framework/dev",
-  "version": "0.0.0-experimental-20260902161345",
+  "version": "0.0.0-experimental-20260902164013",
   "description": "Dev server for the T4H Framework",
   "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/dev",
   "bugs": "https://github.com/tech4humans-brasil/framework/issues",
@@ -70,11 +70,11 @@
     "@types/dot-object": "^2.1.6",
     "@types/json-schema": "^7.0.15",
     "@types/mime-types": "^3",
-    "@types/node": "^25.3.5",
+    "@types/node": "^26.4.0",
     "@types/nodemailer": "^7.0.11",
     "json-schema-typed": "^8.0.2",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.11"
   },
   "peerDependencies": {
     "@t4h.framework/core": "^0.9.1"