deepspace 0.22.1 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # deepspace
 
+## 0.23.0
+
+### Minor Changes
+
+- Fix the six top findings from the five-app AX audit: enforce chat ownership in `getChat` (a signed-in user could rename, delete, or write another user's AI chat), make failed writes observable instead of silently succeeding (system-managed column updates, queries against a collection the room does not carry, and writes attempted before the room is ready — now a `not_ready` `WriteError`), key the Playwright storage-state cache by origin and validate the session before reuse (raising `TestSignInError` rather than returning a signed-out context), resolve the browser bundle's app id from the wrangler config being built so `deploy --env` cannot ship a bundle wired to another environment, add `deepspace test accounts recover` so pool accounts created on another machine are usable, and ship a scaffold whose `collab.spec.ts` passes on a fresh app.
+
+  **Upgrading — apps scaffolded on 0.21.0–0.22.1.** Those scaffolds baked a literal app id into `src/constants.ts` and carry no `deepspace/build` wiring. They keep working untouched: plain `deploy` passes (the new bundle guard refuses only a FOREIGN id), and already-deployed apps are unaffected. What changes: `deploy --env <name>` is now **refused** (`app_id_env_mismatch`) instead of silently shipping that environment's worker against production's rooms — the refusal lists the three file edits that adopt the build-time id (`vite.config.ts` → `deepspaceBuild()`, `vitest.config.ts` → `appIdDefine()` if present, `src/constants.ts` → `__DEEPSPACE_APP_ID__`); there is deliberately no automatic migration for these app-owned files. Relatedly, `app init` no longer stamps ids into source files at all — wrangler.toml is the id's only home, and the client resolves it at build time. (The unknown-collection suffix below applies to the `resolveCollection` paths — subscription queries, record tools, and Yjs collection checks.)
+
+  **Upgrading.** Two signatures changed: `getStatePathForEmail` and `readCachedState` from `deepspace/testing` now take `(email, baseURL)`, since the cache is keyed by origin as well as account. `WriteError.kind` gains `'not_ready'`, which only breaks an exhaustive `switch` over the union.
+
+  **Two changes reach code the SDK cannot upgrade for you**, because worker routes are vendored into your repo at scaffold time. First, the unknown-collection error text gained a suffix naming the room and the collections it serves; it now reads `Schema not registered for collection: <name> — Room '<scope>' serves only: …`. The shipped template and the data-boundary migration guide both match it with `startsWith`, so supported code is unaffected, but a vendored route comparing with `===` stops matching and falls through to its error branch — in `getDocumentForAccess` that is a 403 on every Yjs document room. Change any such comparison to `startsWith`. Second, `records.query` against a collection the room does not carry now returns `{ success: false }` instead of `{ success: true, records: [] }`; since `executeTool` throws on `!success`, a cron handler or server action querying an optional collection now fails its job rather than seeing an empty list. Guard those call sites, or register the collection in the room.
+
+  **Scope of the system-column refusal.** It covers the `users` columns you can mean to set — `email`, `name`, `imageUrl` and `role`. The server-maintained timestamps `createdAt` and `lastSeenAt` are still preserved silently: the server rewrites `lastSeenAt` on every connect and every presence heartbeat without broadcasting, so a whole-record echo carries a stale value the caller never chose and has no way to refresh. Sending any system column at its current stored value still succeeds, and `null`, `''` and omitting the field are treated as the one stored state they are.
+
 ## 0.22.1
 
 ### Patch Changes

package/dist/build.d.ts

@@ -0,0 +1,115 @@
+/**
+ * `deepspace/build` — build-time helpers an app's Vite config imports.
+ *
+ * Node-only. Nothing here may be reached from client or worker code; it runs
+ * while `vite build` / `vite dev` is assembling the bundle, never inside it.
+ *
+ * The one job today is resolving the app's immutable id for the browser.
+ * `wrangler.toml` is the single source of truth for app identity — the worker
+ * reads `DEEPSPACE_APP_ID` off `env`, and every durable thing (data scope
+ * `app:{appId}`, secrets, billing) keys to it. The browser has no `env`, so
+ * the build stamps the same value in as `__DEEPSPACE_APP_ID__`, read from the
+ * config THIS build is running against. A literal baked into the client once,
+ * at scaffold time, is what let `deepspace deploy --env staging` ship a worker
+ * writing staging's rooms beside a browser reading production's, with nothing
+ * reporting the split.
+ *
+ * Living in the SDK rather than in a file copied into every app means one
+ * definition, no per-app duplicate, and `smol-toml` stays the SDK's dependency
+ * instead of every app's.
+ */
+/**
+ * The build's environment, typed structurally. This module is imported from an
+ * app's `vite.config.ts`, which sits outside the app's tsconfig `include` and
+ * runs where the app carries no `@types/node`, so nothing here leans on the
+ * ambient `NodeJS` namespace.
+ */
+type BuildEnv = Record<string, string | undefined>;
+interface ResolveAppIdOptions {
+    /**
+     * The app root — the directory holding `wrangler.toml`. The caller passes
+     * its own location (`fileURLToPath(new URL('.', import.meta.url))` from
+     * `vite.config.ts`), so the config is found by an authoritative anchor
+     * rather than a guessed `process.cwd()`.
+     */
+    appDir: string;
+    /** Defaults to `process.env`; injectable for tests. */
+    env?: BuildEnv;
+}
+/**
+ * Resolve the app id the browser bundle must carry.
+ *
+ * Mirrors the Cloudflare Vite plugin so dev, a bare `vite build`, and
+ * `deepspace deploy --env <name>` all agree:
+ *
+ *   config  ← CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH, else <appDir>/wrangler.toml
+ *   section ← [env.<CLOUDFLARE_ENV>.vars] when that is set, else [vars]
+ *
+ * Env blocks do NOT inherit `[vars]` — each environment is its own app — so a
+ * missing or malformed id throws and fails the build. It never falls back to
+ * another environment's id: a fallback that silently picks the wrong one is
+ * exactly the bug this exists to remove.
+ */
+declare function resolveAppId({ appDir, env }: ResolveAppIdOptions): string;
+/**
+ * Vite `define` entry consumed by an app's `vite.config.ts` and
+ * `vitest.config.ts`, so unit tests see the same id the bundle is built with:
+ *
+ * ```ts
+ * import { fileURLToPath } from 'node:url'
+ * import { appIdDefine } from 'deepspace/build'
+ * export default defineConfig({
+ *   define: appIdDefine({ appDir: fileURLToPath(new URL('.', import.meta.url)) }),
+ * })
+ * ```
+ */
+declare function appIdDefine(options: ResolveAppIdOptions): Record<string, string>;
+
+/**
+ * `deepspaceBuild()` — the one Vite plugin an app's build config needs.
+ *
+ * It carries the build-time wiring that is identical in every DeepSpace app
+ * and belongs to the SDK's contract rather than to app code:
+ *
+ *   1. the app id `define` (see ./app-id) — so the browser is keyed to the
+ *      environment THIS build targets, never a literal frozen at scaffold time;
+ *   2. removing the preview `.dev.vars` the Cloudflare plugin drops beside the
+ *      built worker — DeepSpace has one local runtime, so that second plaintext
+ *      copy is not kept;
+ *   3. the client `dedupe` hint — two copies of React (or better-auth) break
+ *      the SDK's hooks, and which packages must be single-instance is the SDK's
+ *      knowledge, not the app's.
+ *
+ * Housing these here means a future fix to any of them ships in an SDK version
+ * bump, with no edit to — and no migration of — a single app.
+ *
+ * The return is a structural Vite plugin: typing it against `vite` would make
+ * the SDK carry a Vite dependency it otherwise does not need, and Vite's
+ * plugin hooks are optional and method-shaped, so a compatible object is
+ * assignable to `PluginOption` where an app composes it.
+ */
+
+/**
+ * Packages that must resolve to a single instance in the client graph. Two
+ * Reacts throw "Cannot read properties of null (reading 'useState')"; two
+ * better-auth clients split the session. The SDK owns this list because it is
+ * the SDK's hooks and auth client that break when it is wrong.
+ */
+declare const CLIENT_DEDUPE: readonly string[];
+/** The subset of Vite's `Plugin` this helper implements — declared locally so
+ *  `deepspace/build` needs no `vite` dependency. Assignable to `PluginOption`. */
+interface VitePluginLike {
+    name: string;
+    enforce?: 'pre' | 'post';
+    config(): {
+        define: Record<string, string>;
+        resolve: {
+            dedupe: string[];
+        };
+    };
+    closeBundle(): void;
+}
+type DeepspaceBuildOptions = ResolveAppIdOptions;
+declare function deepspaceBuild(options: DeepspaceBuildOptions): VitePluginLike;
+
+export { type BuildEnv, CLIENT_DEDUPE, type DeepspaceBuildOptions, type ResolveAppIdOptions, appIdDefine, deepspaceBuild, resolveAppId };

package/dist/build.js

@@ -0,0 +1,66 @@
+// src/build/app-id.ts
+import { readFileSync } from "fs";
+import { resolve } from "path";
+import { parse as parseToml } from "smol-toml";
+
+// src/server/utils/registry-client.ts
+var APP_ID_RE = /^app_[0-9A-HJKMNP-TV-Z]{26}$/;
+
+// src/build/app-id.ts
+function resolveAppId({ appDir, env = process.env }) {
+  const configPath = env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH ? resolve(env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH) : resolve(appDir, "wrangler.toml");
+  const envName = env.CLOUDFLARE_ENV;
+  const section = envName ? `[env.${envName}.vars]` : "[vars]";
+  let config;
+  try {
+    config = parseToml(readFileSync(configPath, "utf-8"));
+  } catch (error) {
+    throw new Error(
+      `Could not read the app id: ${configPath} is missing or not valid TOML (${error instanceof Error ? error.message : String(error)}).`
+    );
+  }
+  const appId = (envName ? config.env?.[envName]?.vars : config.vars)?.DEEPSPACE_APP_ID;
+  if (typeof appId !== "string" || !APP_ID_RE.test(appId)) {
+    const uninitialized = appId === void 0 || appId === "__APP_ID__";
+    throw new Error(
+      `${configPath}: ${section} has no valid DEEPSPACE_APP_ID (found ${appId === void 0 ? "nothing" : JSON.stringify(appId)}). The browser keys its RecordRooms to this id, so the build stops rather than ship a wrong or empty one. ` + (uninitialized ? `Run \`npx deepspace app init${envName ? ` --env ${envName}` : ""}\` to register this app \u2014 ids are server-minted; never hand-write one.` : `Add the id your \`deepspace app init\` registered under ${section}.`) + (envName ? ` Environments do not inherit the top-level id; each one is its own app.` : ``)
+    );
+  }
+  return appId;
+}
+function appIdDefine(options) {
+  return { __DEEPSPACE_APP_ID__: JSON.stringify(resolveAppId(options)) };
+}
+
+// src/build/plugin.ts
+import { existsSync, readdirSync, unlinkSync } from "fs";
+import { join, resolve as resolve2 } from "path";
+var CLIENT_DEDUPE = ["react", "react-dom", "better-auth"];
+function deepspaceBuild(options) {
+  const distDir = resolve2(options.appDir, "dist");
+  return {
+    name: "deepspace-build",
+    enforce: "post",
+    config() {
+      return {
+        define: appIdDefine(options),
+        resolve: { dedupe: [...CLIENT_DEDUPE] }
+      };
+    },
+    closeBundle() {
+      if (!existsSync(distDir)) return;
+      for (const entry of readdirSync(distDir, { withFileTypes: true })) {
+        if (!entry.isDirectory()) continue;
+        const secretPath = join(distDir, entry.name, ".dev.vars");
+        if (existsSync(secretPath)) unlinkSync(secretPath);
+      }
+    }
+  };
+}
+export {
+  CLIENT_DEDUPE,
+  appIdDefine,
+  deepspaceBuild,
+  resolveAppId
+};
+//# sourceMappingURL=build.js.map

package/dist/build.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/build/app-id.ts","../src/server/utils/registry-client.ts","../src/build/plugin.ts"],"sourcesContent":["/**\n * `deepspace/build` — build-time helpers an app's Vite config imports.\n *\n * Node-only. Nothing here may be reached from client or worker code; it runs\n * while `vite build` / `vite dev` is assembling the bundle, never inside it.\n *\n * The one job today is resolving the app's immutable id for the browser.\n * `wrangler.toml` is the single source of truth for app identity — the worker\n * reads `DEEPSPACE_APP_ID` off `env`, and every durable thing (data scope\n * `app:{appId}`, secrets, billing) keys to it. The browser has no `env`, so\n * the build stamps the same value in as `__DEEPSPACE_APP_ID__`, read from the\n * config THIS build is running against. A literal baked into the client once,\n * at scaffold time, is what let `deepspace deploy --env staging` ship a worker\n * writing staging's rooms beside a browser reading production's, with nothing\n * reporting the split.\n *\n * Living in the SDK rather than in a file copied into every app means one\n * definition, no per-app duplicate, and `smol-toml` stays the SDK's dependency\n * instead of every app's.\n */\n\nimport { readFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\nimport { parse as parseToml } from 'smol-toml'\n\n/** `app_` + 26-char Crockford ULID. */\n// Single source: the shared registry client owns the id shape.\nimport { APP_ID_RE } from '../server/utils/registry-client'\n\ninterface WranglerIdentity {\n  vars?: Record<string, unknown>\n  env?: Record<string, { vars?: Record<string, unknown> } | undefined>\n}\n\n/**\n * The build's environment, typed structurally. This module is imported from an\n * app's `vite.config.ts`, which sits outside the app's tsconfig `include` and\n * runs where the app carries no `@types/node`, so nothing here leans on the\n * ambient `NodeJS` namespace.\n */\nexport type BuildEnv = Record<string, string | undefined>\n\nexport interface ResolveAppIdOptions {\n  /**\n   * The app root — the directory holding `wrangler.toml`. The caller passes\n   * its own location (`fileURLToPath(new URL('.', import.meta.url))` from\n   * `vite.config.ts`), so the config is found by an authoritative anchor\n   * rather than a guessed `process.cwd()`.\n   */\n  appDir: string\n  /** Defaults to `process.env`; injectable for tests. */\n  env?: BuildEnv\n}\n\n/**\n * Resolve the app id the browser bundle must carry.\n *\n * Mirrors the Cloudflare Vite plugin so dev, a bare `vite build`, and\n * `deepspace deploy --env <name>` all agree:\n *\n *   config  ← CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH, else <appDir>/wrangler.toml\n *   section ← [env.<CLOUDFLARE_ENV>.vars] when that is set, else [vars]\n *\n * Env blocks do NOT inherit `[vars]` — each environment is its own app — so a\n * missing or malformed id throws and fails the build. It never falls back to\n * another environment's id: a fallback that silently picks the wrong one is\n * exactly the bug this exists to remove.\n */\nexport function resolveAppId({ appDir, env = process.env }: ResolveAppIdOptions): string {\n  const configPath = env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH\n    ? resolve(env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH)\n    : resolve(appDir, 'wrangler.toml')\n  const envName = env.CLOUDFLARE_ENV\n  const section = envName ? `[env.${envName}.vars]` : '[vars]'\n\n  let config: WranglerIdentity\n  try {\n    config = parseToml(readFileSync(configPath, 'utf-8')) as WranglerIdentity\n  } catch (error) {\n    throw new Error(\n      `Could not read the app id: ${configPath} is missing or not valid TOML ` +\n        `(${error instanceof Error ? error.message : String(error)}).`,\n    )\n  }\n\n  const appId = (envName ? config.env?.[envName]?.vars : config.vars)?.DEEPSPACE_APP_ID\n  if (typeof appId !== 'string' || !APP_ID_RE.test(appId)) {\n    // A fresh-but-uninitialized scaffold (signed out at scaffold time) still\n    // carries the __APP_ID__ placeholder — the remedy is registration, not\n    // hand-writing an id (ids are server-minted at `deepspace app init`).\n    const uninitialized = appId === undefined || appId === '__APP_ID__'\n    throw new Error(\n      `${configPath}: ${section} has no valid DEEPSPACE_APP_ID ` +\n        `(found ${appId === undefined ? 'nothing' : JSON.stringify(appId)}). ` +\n        `The browser keys its RecordRooms to this id, so the build stops rather than ship a wrong or empty one. ` +\n        (uninitialized\n          ? `Run \\`npx deepspace app init${envName ? ` --env ${envName}` : ''}\\` to register this app — ids are server-minted; never hand-write one.`\n          : `Add the id your \\`deepspace app init\\` registered under ${section}.`) +\n        (envName ? ` Environments do not inherit the top-level id; each one is its own app.` : ``),\n    )\n  }\n  return appId\n}\n\n/**\n * Vite `define` entry consumed by an app's `vite.config.ts` and\n * `vitest.config.ts`, so unit tests see the same id the bundle is built with:\n *\n * ```ts\n * import { fileURLToPath } from 'node:url'\n * import { appIdDefine } from 'deepspace/build'\n * export default defineConfig({\n *   define: appIdDefine({ appDir: fileURLToPath(new URL('.', import.meta.url)) }),\n * })\n * ```\n */\nexport function appIdDefine(options: ResolveAppIdOptions): Record<string, string> {\n  return { __DEEPSPACE_APP_ID__: JSON.stringify(resolveAppId(options)) }\n}\n","/**\n * The ONE registry client. Every platform worker reaches the app-registry\n * Durable Object (hosted by the deploy worker, singleton `v1:global`) through\n * a cross-script REGISTRY binding — and before this module, each of the five\n * workers hand-rolled its own copy of the same mechanics: the instance name\n * appeared in 6 places, the `https://registry/` URL in 6, `APP_ID_RE` in 5,\n * and `RegistryClientError` + `registryErrorJson` existed byte-identical in\n * two workers. Copies that must agree and nothing enforcing it.\n *\n * This module owns the MECHANICS: instance name, stub lookup, the wire call,\n * the error type, and the standard route mapping. Each worker still declares\n * its own typed convenience wrapper listing only the actions it uses — that\n * subset is genuinely per-worker; the plumbing is not.\n */\n\n/** The singleton registry instance — one DO holds every app/route/collaborator. */\nexport const REGISTRY_INSTANCE = 'v1:global'\n\n/** Public app ids have one canonical ULID-minted shape. */\nexport const APP_ID_RE = /^app_[0-9A-HJKMNP-TV-Z]{26}$/\nexport const STRICT_APP_ID_RE = APP_ID_RE\n\n/** Internal physical locators survive identity migration and are not public ids. */\nexport const RESOURCE_ID_RE = /^(app_[0-9A-HJKMNP-TV-Z]{26}|[a-z0-9][a-z0-9_-]{0,63})$/\n\nconst CROCKFORD = '0123456789ABCDEFGHJKMNPQRSTVWXYZ'\n\n/** A 26-char ULID (48-bit ms timestamp + 80 random bits, Crockford base32) —\n *  the id shape shared by app ids (`app_…`) and workspace ids (`ws_…`). */\nexport function mintUlid(now = Date.now()): string {\n  let ts = ''\n  let t = now\n  for (let i = 0; i < 10; i++) {\n    ts = CROCKFORD[t % 32] + ts\n    t = Math.floor(t / 32)\n  }\n  const rand = new Uint8Array(10)\n  crypto.getRandomValues(rand)\n  let rs = ''\n  let acc = 0\n  let bits = 0\n  for (const byte of rand) {\n    acc = (acc << 8) | byte\n    bits += 8\n    while (bits >= 5) {\n      bits -= 5\n      rs += CROCKFORD[(acc >> bits) & 31]\n    }\n  }\n  return `${ts}${rs}`.slice(0, 26)\n}\n\n/** Mint a fresh app id: `app_` + 26-char ULID. App ids are minted ONLY by the\n *  deploy worker's authenticated `POST /api/apps/mint`, which registers the id\n *  to its caller in the same step — an id with no owner never exists. */\nexport function mintAppId(now = Date.now()): string {\n  return `app_${mintUlid(now)}`\n}\n\nexport class RegistryClientError extends Error {\n  constructor(\n    message: string,\n    readonly code: string,\n    readonly status: number,\n  ) {\n    super(message)\n    this.name = 'RegistryClientError'\n  }\n}\n\nexport function registryStub(ns: DurableObjectNamespace): DurableObjectStub {\n  return ns.get(ns.idFromName(REGISTRY_INSTANCE))\n}\n\n/**\n * One registry action over the wire. Non-2xx answers throw\n * {@link RegistryClientError} carrying the DO's structured `code` (or\n * `'error'` for a transport-shaped body) — callers distinguish a registry-\n * REPORTED miss (`code === 'not_found'`) from an outage by that code, never\n * by treating every throw as \"not found\".\n */\nexport async function callRegistry<T>(\n  stub: DurableObjectStub,\n  body: { action: string } & Record<string, unknown>,\n): Promise<T> {\n  const res = await stub.fetch('https://registry/', {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(body),\n  })\n  const json = (await res.json().catch(() => ({}))) as { error?: string; code?: string }\n  if (!res.ok) {\n    throw new RegistryClientError(\n      json.error ?? `Registry error (${res.status})`,\n      json.code ?? 'error',\n      res.status,\n    )\n  }\n  return json as T\n}\n\n/** Standard mapping of a registry failure onto a route response. */\nexport function registryErrorJson(\n  c: { json: (body: unknown, status?: number) => Response },\n  err: unknown,\n): Response {\n  if (err instanceof RegistryClientError) {\n    return c.json({ error: err.message, code: err.code }, err.status as 400)\n  }\n  throw err\n}\n","/**\n * `deepspaceBuild()` — the one Vite plugin an app's build config needs.\n *\n * It carries the build-time wiring that is identical in every DeepSpace app\n * and belongs to the SDK's contract rather than to app code:\n *\n *   1. the app id `define` (see ./app-id) — so the browser is keyed to the\n *      environment THIS build targets, never a literal frozen at scaffold time;\n *   2. removing the preview `.dev.vars` the Cloudflare plugin drops beside the\n *      built worker — DeepSpace has one local runtime, so that second plaintext\n *      copy is not kept;\n *   3. the client `dedupe` hint — two copies of React (or better-auth) break\n *      the SDK's hooks, and which packages must be single-instance is the SDK's\n *      knowledge, not the app's.\n *\n * Housing these here means a future fix to any of them ships in an SDK version\n * bump, with no edit to — and no migration of — a single app.\n *\n * The return is a structural Vite plugin: typing it against `vite` would make\n * the SDK carry a Vite dependency it otherwise does not need, and Vite's\n * plugin hooks are optional and method-shaped, so a compatible object is\n * assignable to `PluginOption` where an app composes it.\n */\n\nimport { existsSync, readdirSync, unlinkSync } from 'node:fs'\nimport { join, resolve } from 'node:path'\nimport { appIdDefine } from './app-id'\nimport type { ResolveAppIdOptions } from './app-id'\n\n/**\n * Packages that must resolve to a single instance in the client graph. Two\n * Reacts throw \"Cannot read properties of null (reading 'useState')\"; two\n * better-auth clients split the session. The SDK owns this list because it is\n * the SDK's hooks and auth client that break when it is wrong.\n */\nexport const CLIENT_DEDUPE: readonly string[] = ['react', 'react-dom', 'better-auth']\n\n/** The subset of Vite's `Plugin` this helper implements — declared locally so\n *  `deepspace/build` needs no `vite` dependency. Assignable to `PluginOption`. */\ninterface VitePluginLike {\n  name: string\n  enforce?: 'pre' | 'post'\n  config(): { define: Record<string, string>; resolve: { dedupe: string[] } }\n  closeBundle(): void\n}\n\nexport type DeepspaceBuildOptions = ResolveAppIdOptions\n\nexport function deepspaceBuild(options: DeepspaceBuildOptions): VitePluginLike {\n  const distDir = resolve(options.appDir, 'dist')\n  return {\n    name: 'deepspace-build',\n    enforce: 'post',\n    config() {\n      return {\n        define: appIdDefine(options),\n        resolve: { dedupe: [...CLIENT_DEDUPE] },\n      }\n    },\n    closeBundle() {\n      // Cloudflare emits a preview-only `.dev.vars` beside each built worker.\n      if (!existsSync(distDir)) return\n      for (const entry of readdirSync(distDir, { withFileTypes: true })) {\n        if (!entry.isDirectory()) continue\n        const secretPath = join(distDir, entry.name, '.dev.vars')\n        if (existsSync(secretPath)) unlinkSync(secretPath)\n      }\n    },\n  }\n}\n"],"mappings":";AAqBA,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AACxB,SAAS,SAAS,iBAAiB;;;ACJ5B,IAAM,YAAY;;;ADiDlB,SAAS,aAAa,EAAE,QAAQ,MAAM,QAAQ,IAAI,GAAgC;AACvF,QAAM,aAAa,IAAI,uCACnB,QAAQ,IAAI,oCAAoC,IAChD,QAAQ,QAAQ,eAAe;AACnC,QAAM,UAAU,IAAI;AACpB,QAAM,UAAU,UAAU,QAAQ,OAAO,WAAW;AAEpD,MAAI;AACJ,MAAI;AACF,aAAS,UAAU,aAAa,YAAY,OAAO,CAAC;AAAA,EACtD,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,8BAA8B,UAAU,kCAClC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC9D;AAAA,EACF;AAEA,QAAM,SAAS,UAAU,OAAO,MAAM,OAAO,GAAG,OAAO,OAAO,OAAO;AACrE,MAAI,OAAO,UAAU,YAAY,CAAC,UAAU,KAAK,KAAK,GAAG;AAIvD,UAAM,gBAAgB,UAAU,UAAa,UAAU;AACvD,UAAM,IAAI;AAAA,MACR,GAAG,UAAU,KAAK,OAAO,yCACb,UAAU,SAAY,YAAY,KAAK,UAAU,KAAK,CAAC,gHAEhE,gBACG,+BAA+B,UAAU,UAAU,OAAO,KAAK,EAAE,gFACjE,2DAA2D,OAAO,QACrE,UAAU,4EAA4E;AAAA,IAC3F;AAAA,EACF;AACA,SAAO;AACT;AAcO,SAAS,YAAY,SAAsD;AAChF,SAAO,EAAE,sBAAsB,KAAK,UAAU,aAAa,OAAO,CAAC,EAAE;AACvE;;;AE9FA,SAAS,YAAY,aAAa,kBAAkB;AACpD,SAAS,MAAM,WAAAA,gBAAe;AAUvB,IAAM,gBAAmC,CAAC,SAAS,aAAa,aAAa;AAa7E,SAAS,eAAe,SAAgD;AAC7E,QAAM,UAAUC,SAAQ,QAAQ,QAAQ,MAAM;AAC9C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,SAAS;AACP,aAAO;AAAA,QACL,QAAQ,YAAY,OAAO;AAAA,QAC3B,SAAS,EAAE,QAAQ,CAAC,GAAG,aAAa,EAAE;AAAA,MACxC;AAAA,IACF;AAAA,IACA,cAAc;AAEZ,UAAI,CAAC,WAAW,OAAO,EAAG;AAC1B,iBAAW,SAAS,YAAY,SAAS,EAAE,eAAe,KAAK,CAAC,GAAG;AACjE,YAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,cAAM,aAAa,KAAK,SAAS,MAAM,MAAM,WAAW;AACxD,YAAI,WAAW,UAAU,EAAG,YAAW,UAAU;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACF;","names":["resolve","resolve"]}

package/dist/{chunk-XXOLIJB5.js → chunk-A7VKZRCB.js}

@@ -1274,7 +1274,7 @@ function renderInlineMarkdown(value) {
 import { useEffect as useEffect6, useRef as useRef5, useState as useState5 } from "react";
 
 // package.json
-var version = "0.22.1";
+var version = "0.23.0";
 
 // src/documentation/runtime/navigation.tsx
 import { Fragment as Fragment4, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
@@ -1954,4 +1954,4 @@ export {
   DefaultDocumentation,
   DocumentationContent
 };
-//# sourceMappingURL=chunk-XXOLIJB5.js.map
+//# sourceMappingURL=chunk-A7VKZRCB.js.map