babavoss 0.12.2 → 0.12.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "babavoss",
-  "version": "0.12.2",
+  "version": "0.12.4",
   "license": "Apache-2.0",
   "repository": "github:alanremarc/babavoss",
   "homepage": "https://babavoss.org",

package/src/baba/config.ts

@@ -58,13 +58,20 @@ export function viewsConfig(): string {
   // The whole DOM: a view runs in the browser, whose sandbox is its own.
   return JSON.stringify({
     "//": note,
-    compilerOptions: { lib: ["ESNext", "DOM", "DOM.Iterable"], ...rest, jsx: "react-jsx", jsxImportSource: "react", paths: alias, composite: true, declaration: true, emitDeclarationOnly: true, rootDir: "..", outDir: "./types/views" },
+    compilerOptions: { lib: ["ESNext", "DOM", "DOM.Iterable"], ...rest, jsx: "react-jsx", jsxImportSource: "react", paths: { ...alias, ...frameworkPaths }, composite: true, declaration: true, emitDeclarationOnly: true, rootDir: "..", outDir: "./types/views" },
     // A composite program lists every file it reaches: the backend modules a view imports types from too.
     include: ["assets.d.ts", "../**/*.ts", "../**/*.tsx"],
     exclude: ["../node_modules/**", "../.voss/types/**", "../**/*.test.ts", "../**/*.test.tsx"],
   }, null, 2) + "\n";
 }
 
+/**
+ * The framework's files by package name. A composite program names the types a spec or an app exports; with `@/*`
+ * reaching into node_modules as well, the checker would name a framework type through the alias and refuse it as
+ * not portable (TS2883). This pattern names it as `babavoss/src/…` instead, with or without the package in node_modules.
+ */
+const frameworkPaths: Record<string, string[]> = { "babavoss/*": ["../node_modules/babavoss/*"] };
+
 const doc = (s: string) => `/** ${s} */`;
 const quote = (s: string) => JSON.stringify(s);
 

package/src/generated/build.ts

@@ -1,4 +1,4 @@
 // The commit and the moment a package was built from, stamped by the pack
 // of a release (tools/release/pack.ts) and restored after it. From a
 // checkout both are empty: the tree is the build.
-export const build = {"sha":"3c25c95","at":"2026-10-08T18:46:40.366Z"};
+export const build = {"sha":"f1afec7","at":"2026-10-08T21:00:04.416Z"};

package/src/kernel/children.ts

@@ -88,7 +88,11 @@ export function linkTargets(baba: string): { targets: string[]; links: string[]
       p = next;
     }
     const target = real(e);
-    if (!inside(target) && !readable().some((r) => target === r || target.startsWith(r + "/"))) out.add(target);
+    if (inside(target) || readable().some((r) => target === r || target.startsWith(r + "/"))) continue;
+    // A package in an isolated store, `node_modules/.bun/NAME@VERSION/node_modules/NAME`, reaches its own dependencies
+    // by links into the same store: the store's node_modules is the grant, as the hoisted layout's would be.
+    const store = target.indexOf("/node_modules/.bun/");
+    out.add(store >= 0 ? target.slice(0, store + "/node_modules".length) : target);
   }
   return { targets: [...out], links: [...links] };
 }

package/src/server/edge.ts

@@ -47,6 +47,20 @@ const failed = (f: Failure) => json({ error: { code: f.code, message: f.message
 
 const RAW = new Set(["spawn", "add", "remove", "despawn", "set"]);
 
+/** On every answer: no other site frames a page (clickjacking), loads a bundle, an asset or an answer into its own (CORP), or has one sniffed as another type. */
+const GUARDS: [string, string][] = [
+  ["content-security-policy", "frame-ancestors 'none'"],
+  ["x-frame-options", "DENY"],
+  ["cross-origin-resource-policy", "same-origin"],
+  ["x-content-type-options", "nosniff"],
+  ["referrer-policy", "no-referrer"],
+];
+function guarded(r: Response): Response {
+  const headers = new Headers(r.headers);
+  for (const [k, v] of GUARDS) headers.set(k, v);
+  return new Response(r.body, { status: r.status, statusText: r.statusText, headers });
+}
+
 // ---- the sockets ------------------------------------------------------------
 
 /** A window's socket: which baba it follows, where it stands, and what it asks for. */
@@ -235,6 +249,11 @@ export function edge(state: Serve, ask: Ask): Edge {
   }
 
   const fetch = async (req: globalThis.Request, server: Server<Peer>): Promise<Response | undefined> => {
+    const r = await route(req, server);
+    return r && guarded(r);
+  };
+
+  const route = async (req: globalThis.Request, server: Server<Peer>): Promise<Response | undefined> => {
     const host = req.headers.get("host") ?? "";
     if (!localHost(host)) return text("host", 403);
     const origin = req.headers.get("origin");