lecodes-sdk 2.6.0 → 2.8.1

package/src/server/rateLimit.ts

@@ -0,0 +1,72 @@
+/**
+ * How often one caller may knock: a token bucket per key, written once for the hosts that serve a
+ * project's backend — the runner (tools/runner/src/http.ts, its main thread) and the dev backend of
+ * `lecodes dev` (tools/cli/src/dev/projectBackend.ts) — and the channel hub both of them run (./channelHub.ts).
+ *
+ *   endpoint calls   per (session, endpoint id): 20 a second, a burst of 40
+ *   subscriptions    per session (channels and computeds alike): 10 a second, a burst of 20
+ *
+ * The session is the caller's bearer token, or its ip when it has none yet (a first call). Over the limit
+ * a call is answered with the envelope `{ ok: false, status: 429, message: "Too many calls" }` — the app
+ * sees `RpcError(429)` — and a subscription with an `err` frame of the same status. The limits are
+ * constants for now (the docs' "The limits"), the same on le.codes and on the developer's machine.
+ *
+ * A bucket holds `burst` tokens and gains `rate` a second; a call takes one. A full bucket is the same as
+ * none, so the table forgets the ones that have filled up again (it is swept as it grows) and a host keeps
+ * only the callers of the last few seconds.
+ */
+
+export type RateLimit = {
+  /** tokens gained a second */
+  rate: number
+  /** what the bucket holds: how many calls may come at once */
+  burst: number
+}
+
+export const RATE_LIMITS = {
+  /** an endpoint's calls by one session */
+  call: { rate: 20, burst: 40 },
+  /** the subscriptions one session opens */
+  subscribe: { rate: 10, burst: 20 },
+} as const satisfies Record<string, RateLimit>
+
+/** What a refused call answers (the transport's envelope; the app sees `RpcError(429)`). */
+export const TOO_MANY_CALLS = { ok: false as const, status: 429, message: "Too many calls" }
+
+export type RateLimiter = {
+  /** One call of `key`: true when it may go, false over the limit (nothing is taken then). */
+  take(key: string): boolean
+}
+
+/** The key of a caller: its session token, or its ip while it has none. */
+export const callerKey = (session: string | null | undefined, ip: string | undefined): string =>
+  session ? `s:${session}` : `ip:${ip ?? "?"}`
+
+/** A table of buckets. `now` (ms, monotonic) is a test's knob. */
+export const createRateLimiter = (limit: RateLimit, opts: { now?: () => number } = {}): RateLimiter => {
+  const now = opts.now ?? (() => performance.now())
+  const buckets = new Map<string, { tokens: number, at: number }>()
+  /** how long an empty bucket takes to fill: one untouched for as long is the same as none */
+  const fullAfter = (limit.burst / limit.rate) * 1000
+  let sweepAt = 1024
+  const sweep = (t: number) => {
+    for (const [k, b] of buckets) if (t - b.at >= fullAfter) buckets.delete(k)
+    sweepAt = Math.max(1024, buckets.size * 2)
+  }
+  return {
+    take(key) {
+      const t = now()
+      let b = buckets.get(key)
+      if (!b) {
+        if (buckets.size >= sweepAt) sweep(t)
+        buckets.set(key, b = { tokens: limit.burst, at: t })
+      } else {
+        b.tokens = Math.min(limit.burst, b.tokens + ((t - b.at) / 1000) * limit.rate)
+        b.at = t
+      }
+      if (b.tokens < 1) return false
+      b.tokens -= 1
+      return true
+    },
+  }
+}

package/src/server/runtime.ts

@@ -1,21 +1,29 @@
 /**
  * Host side of a compiled server bundle — used by the runner (tools/runner) and by tests.
  * Imported normally (Node/Bun), NOT through chisel: the bundle carries its own SDK copy and talks
- * to this module only through globals (`__lecodesServer`, `__lecodesRequest`, `__lecodesPublish`).
+ * to this module only through globals (`__lecodesServer`, `__lecodesRequest`, `__lecodesPublish`,
+ * `__lecodesAsyncLocalStorage` — the class `ordered` keeps the keys a body holds in, ./ordered.ts;
+ * `__lecodesDbGate` — what the bundle's db client shows every operation to, ./computedHost.ts;
+ * `__lecodesPresence` — where `watchers` / `members` are answered, ./computedHost.ts `setPresenceProvider`).
  *
  *   evaluate the bundle (it sets globalThis.__lecodesServer)
  *   const server = loadServerModules()          // classify exports, name channels
  *   const invoke = createInvoker(server)        // validate → run in request context → envelope
  *   const subscribe = createSubscribeGuard(server)   // a channel's hooks → the subscriber's group
+ *   const computed = createComputedHost(server, { watch })   // computed subscriptions (./computedHost.ts)
  *   await invoke("notes.server.ts#listNotes", [20], { headers, ip })
  */
 
 import { AsyncLocalStorage } from "node:async_hooks"
+import { createHash, randomBytes } from "node:crypto"
 import type { ServerManifest } from "../compile/serverSplit"
 import type { AuthHost } from "./auth/host"
 import type { AuthState } from "./auth/types"
 import type { FilesHost, ResourceReader } from "./files/host"
 import { isChannel, isChannelGroup, setChannelPublisher, type ChannelRecord } from "./channel"
+import { isComputed, type ComputedRecord } from "./computed"
+import { ComputedWriteError, computedSubscriptions, installDbGate, readOnly, requestRead, setPresenceProvider, type ComputedHost } from "./computedHost"
+import type { WatchSource } from "./db/watch"
 import { isPushChannel, type PushChannelRecord } from "./pushChannel"
 import { setRequestProvider, type RequestContext } from "./context"
 import type { Db } from "./db/types"
@@ -27,6 +35,8 @@ export type ServerRegistration = { modules: Record<string, Record<string, unknow
 export type LoadedServer = {
   endpoints: Map<string, (...args: any[]) => unknown>
   channels: Map<string, ChannelRecord>
+  /** The computeds (`computed()` exports). Each is an endpoint too — its one-shot call, under the read-only rule. */
+  computeds: Map<string, ComputedRecord>
   /** The push channels (`pushChannel()` exports): their presence is what makes a response ask a signed-in device to register. */
   pushChannels: Map<string, PushChannelRecord>
   /** The project's `defineDb` handle — exported or not (the bundle registers it on globalThis); none or one. */
@@ -41,14 +51,19 @@ export const loadServerModules = (
   reg: ServerRegistration | undefined = (globalThis as any).__lecodesServer,
 ): LoadedServer => {
   if (!reg) throw new Error("loadServerModules: no server bundle registered (globalThis.__lecodesServer)")
-  const out: LoadedServer = { endpoints: new Map(), channels: new Map(), pushChannels: new Map(), dbs: [], manifest: reg.manifest }
+  const out: LoadedServer = { endpoints: new Map(), channels: new Map(), computeds: new Map(), pushChannels: new Map(), dbs: [], manifest: reg.manifest }
   for (const [mod, exports] of Object.entries(reg.modules)) {
     // the compile's word on each export (serverSplit.ts): a function that is not async is the
     // server's helper, never an endpoint — an old manifest without kinds counts every function
     const kinds = new Map((reg.manifest?.modules?.[mod] ?? []).map(e => [e.name, e.kind]))
     for (const [name, value] of Object.entries(exports)) {
       const id = `${mod}#${name}`
-      if (typeof value === "function") { if (kinds.get(name) !== "other") out.endpoints.set(id, value as (...args: any[]) => unknown) }
+      if (isComputed(value)) {
+        value.__id = id
+        out.computeds.set(id, value)
+        out.endpoints.set(id, (...args: unknown[]) => readOnly(id, () => value.__fn(...args)))
+      }
+      else if (typeof value === "function") { if (kinds.get(name) !== "other") out.endpoints.set(id, value as (...args: any[]) => unknown) }
       else if (isChannel(value)) { value.__id = id; out.channels.set(id, value) }
       else if (isPushChannel(value)) { value.__id = id; out.pushChannels.set(id, value) }
       else if (isDb(value)) out.dbs.push(value)
@@ -67,9 +82,12 @@ export const loadServerModules = (
 
 /** The wire envelope. `session` = a token the client must store from now on (new guest session / rotation).
  *  `push` = the device is asked to register for notifications: its session is signed in, has no push address,
- *  and the project has push channels (the transport registers, once per run — the OS prompt comes then). */
+ *  and the project has push channels (the transport registers, once per run — the OS prompt comes then).
+ *  `subscriber` = a subscription's only (the subscribe guard's, a computed's run), for the hub and never on
+ *  the wire: the subscriber's `request.session` when it has one — who the subscription is present as
+ *  (./channelHub.ts). A device that has none yet (no call or hook read it) is nobody, and not listed. */
 export type InvokeResult =
-  | { ok: true, result: unknown, session?: string, push?: true }
+  | { ok: true, result: unknown, session?: string, push?: true, subscriber?: number }
   | { ok: false, status: number, message: string, session?: string, push?: true }
 
 export type InvokerOptions = {
@@ -108,14 +126,65 @@ const dbStatus = (e: unknown): number | null => {
  */
 // One request store for endpoints AND channel hooks (a second store would steal the provider).
 const als = new AsyncLocalStorage<RequestContext>()
-const installProvider = () => setRequestProvider(() => als.getStore())
+const installProvider = () => {
+  // a read of the request in a computed's run makes that run its subscriber's (./computedHost.ts shared runs)
+  setRequestProvider((quiet) => {
+    if (!quiet) requestRead()
+    return als.getStore()
+  })
+  installDbGate()
+  ;(globalThis as { __lecodesAsyncLocalStorage?: unknown }).__lecodesAsyncLocalStorage = AsyncLocalStorage
+}
+
+/** A token the client transport may hold: what this file and the auth host mint (32 random bytes, base64url). */
+const DEVICE_TOKEN = /^[A-Za-z0-9_-]{32,128}$/
+/** A token minted by `request.session` (no sign-in): it rides on the call's envelope, as a guest session's does. */
+const minted = new WeakMap<RequestContext, string>()
+
+/**
+ * `request.session` — decided here only, for endpoints and channel hooks, on every host. With sign-in it is
+ * the request's session row (`db.auth.sessionId`, resolved before the call). Without, a number derived from
+ * the bearer token the transport keeps per backend: the same on every worker and host for as long as the
+ * device keeps the token, and nothing is stored. A hash, not the token: the id may be shown to other players,
+ * the token is the device's password. Read lazily: the first read in a call that carries no usable token
+ * mints one and the envelope hands it to the transport — a call that never asks changes nothing.
+ *
+ * Answers the session as it stands, minting nothing (undefined = none yet): what a subscription is present as.
+ */
+const defineSession = (rc: RequestContext, auth: AuthHost | null): (() => number | undefined) => {
+  let id: number | undefined
+  const peek = () => {
+    if (auth?.enabled) return (rc.auth as AuthState | undefined)?.sessionId
+    if (id !== undefined) return id
+    if (!rc.sessionToken || !DEVICE_TOKEN.test(rc.sessionToken)) return undefined
+    // 52 bits of sha256: a safe integer, the way a row id is one
+    return id = Number.parseInt(createHash("sha256").update(rc.sessionToken).digest("hex").slice(0, 13), 16)
+  }
+  Object.defineProperty(rc, "session", {
+    configurable: true,
+    get: () => {
+      if (!auth?.enabled && id === undefined && (!rc.sessionToken || !DEVICE_TOKEN.test(rc.sessionToken))) {
+        rc.sessionToken = randomBytes(32).toString("base64url")
+        minted.set(rc, rc.sessionToken)
+      }
+      return peek()
+    },
+  })
+  return peek
+}
+/** A subscription's envelope names its subscriber, when there is one (`InvokeResult.subscriber`). */
+const subscriberOf = (peek: () => number | undefined): { subscriber?: number } => {
+  const n = peek()
+  return n === undefined ? {} : { subscriber: n }
+}
 
 // A token minted/rotated during the call rides on the envelope (the client transport stores it); so does the
 // request to register the device for notifications, when a signed-in session has no address and there are
 // push channels to hear.
 const envelope = (server: LoadedServer) => (r: InvokeResult, rc: RequestContext): InvokeResult => {
   const s = rc.auth as AuthState | undefined
-  const out = s?.issuedToken ? { ...r, session: s.issuedToken } : r
+  const token = s?.issuedToken ?? minted.get(rc)
+  const out = token ? { ...r, session: token } : r
   return s && s.userId !== null && !s.pushAddress && server.pushChannels.size ? { ...out, push: true } : out
 }
 
@@ -133,6 +202,7 @@ export const createInvoker = (server: LoadedServer, opts: InvokerOptions = {}) =
     if (!fn) return { ok: false, status: 404, message: `Unknown endpoint ${id}` }
     if (!Array.isArray(args)) return { ok: false, status: 400, message: "args must be an array" }
     const rc: RequestContext = { ...ctx, id }
+    defineSession(rc, auth)
     try {
       // an upload is an argument like any other once it is adopted: validated, then passed
       if (files) args = await files.adopt(args, rc)
@@ -146,6 +216,8 @@ export const createInvoker = (server: LoadedServer, opts: InvokerOptions = {}) =
       if (status !== null) return withSession({ ok: false, status, message: (e as Error).message }, rc)
       if (e instanceof ValidationError) return { ok: false, status: 400, message: e.message }
       onError(id, e)
+      // a computed's one-shot call that wrote: the rule it broke, in its words
+      if (e instanceof ComputedWriteError) return withSession({ ok: false, status: 500, message: e.message }, rc)
       return withSession({ ok: false, status: 500, message: "Internal error" }, rc)
     } finally {
       // in the request's scope: the urls of what the call returned are already made, this is the cleanup
@@ -249,6 +321,7 @@ export const createSubscribeGuard = (server: LoadedServer, opts: InvokerOptions
     if (!ch) return { ok: false, status: 404, message: `Unknown channel ${channelId}` }
     if (!Array.isArray(args)) return { ok: false, status: 400, message: "args must be an array" }
     const rc: RequestContext = { ...ctx, id: channelId }
+    const peek = defineSession(rc, auth)
     try {
       if (validate && ch.__groupBy && params?.[channelId]) validateArgs(params[channelId], args)
       if (auth) await auth.resolve(rc)
@@ -257,7 +330,7 @@ export const createSubscribeGuard = (server: LoadedServer, opts: InvokerOptions
         return ch.__groupBy ? await ch.__groupBy(...args) : null
       })
       if (group !== null && !isChannelGroup(group)) throw new Error(`groupBy answered ${group === undefined ? "nothing" : typeof group} — a group is a string or a number`)
-      return withSession({ ok: true, result: group }, rc)
+      return withSession({ ok: true, result: group, ...subscriberOf(peek) }, rc)
     } catch (e) {
       const status = apiStatus(e) ?? dbStatus(e)
       if (status !== null) return withSession({ ok: false, status, message: (e as Error).message }, rc)
@@ -268,5 +341,50 @@ export const createSubscribeGuard = (server: LoadedServer, opts: InvokerOptions
   }
 }
 
-export { setChannelPublisher, setRequestProvider }
+export type ComputedHostOptions = Pick<InvokerOptions, "validate" | "onError" | "auth"> & {
+  /** Where the reads of a computed are watched (./db/watch.ts): the database's source. `null` = this host
+   *  watches nothing — a computed that reads the database cannot be subscribed to. */
+  watch: WatchSource | null
+  /** Where a new value goes: `(id, sub, envelope)`. Default: the host's channel publisher (`setChannelPublisher`). */
+  publish?: (ch: string, group: number, envelope: InvokeResult) => void
+}
+
+/**
+ * The computed subscriptions of a worker (./computedHost.ts): `start(id, args, ctx, sub)` runs computed
+ * `id` for the hub's subscription `sub` the way a channel's hooks run — `args` validated like an
+ * endpoint's, in the subscriber's request scope (`request.session`, `db.auth`) — and keeps it fresh from
+ * then on; `end(sub)` lets it go. The envelope's `result` is the value. A run that read nothing of the
+ * request is the run of every subscription of its key (the export and its arguments): one run per change.
+ */
+export const createComputedHost = (server: LoadedServer, opts: ComputedHostOptions): ComputedHost => {
+  installProvider()
+  const validate = opts.validate ?? true
+  const onError = opts.onError ?? ((id, e) => console.error(`[server] ${id}:`, e))
+  const params = server.manifest.params as Record<string, ParamSchema[]> | undefined
+  const auth = opts.auth ?? null
+  const withSession = envelope(server)
+  const run = async (id: string, args: unknown[], ctx: Omit<RequestContext, "id">, around: <T>(fn: () => T, me: () => number | undefined) => T): Promise<InvokeResult> => {
+    const c = server.computeds.get(id)
+    if (!c) return { ok: false, status: 404, message: `Unknown computed ${id}` }
+    if (!Array.isArray(args)) return { ok: false, status: 400, message: "args must be an array" }
+    const rc: RequestContext = { ...ctx, id }
+    const peek = defineSession(rc, auth)
+    try {
+      if (validate && params?.[id]) validateArgs(params[id], args)
+      if (auth) await auth.resolve(rc)
+      const value = await als.run(rc, () => around(() => c.__fn(...args), peek))
+      return withSession({ ok: true, result: value === undefined ? null : value, ...subscriberOf(peek) }, rc)
+    } catch (e) {
+      const status = apiStatus(e) ?? dbStatus(e)
+      if (status !== null) return withSession({ ok: false, status, message: (e as Error).message }, rc)
+      if (e instanceof ValidationError) return { ok: false, status: 400, message: e.message }
+      onError(id, e)
+      if (e instanceof ComputedWriteError) return withSession({ ok: false, status: 500, message: e.message }, rc)
+      return withSession({ ok: false, status: 500, message: "Internal error" }, rc)
+    }
+  }
+  return computedSubscriptions({ run, watch: opts.watch, publish: opts.publish })
+}
+
+export { setChannelPublisher, setRequestProvider, setPresenceProvider }
 export { setPushSender } from "./pushChannel"

package/src/ui/UIModal.ts

@@ -23,6 +23,14 @@ export type UIModalShow = (() => boolean) | Signal<boolean>
 const MODAL_ANIM_MS = 200
 const SHOW_BINDING = "#show"
 
+// The transition period's `display` on a modal: said once per run, not per write.
+let displayWarned = false
+function warnDisplayDeprecated(): void {
+  if (displayWarned) return
+  displayWarned = true
+  console.warn("deprecated: a modal's `display` — show it with show() / hide(), or bind it with bindShow(() => …) (+ onDismiss for the scrim tap / back); `display` on a modal will throw again")
+}
+
 /**
  * A dialog: a `UIWidget` with the modal boilerplate built in. Comes with a scrim
  * (`overlayColor: "rgba(0, 0, 0, 0.5)"` unless overridden), is HIDDEN until shown, animates on
@@ -38,9 +46,10 @@ const SHOW_BINDING = "#show"
  * request, `onDismiss`. By default it hides an unbound modal and writes `false` into a bound
  * signal; a bound function has nowhere to write, so a modal bound to one without `onDismiss`
  * cannot be dismissed (a forced choice — the same as `dismissible(false)`). `display` is not a
- * modal's switch: a `.style({ display })` on it throws (a bound display died on the first
- * dismissal, which wrote a static `display: "none"` over the binding — the dialog never opened
- * again).
+ * modal's switch (a bound display died on the first dismissal, which wrote a static
+ * `display: "none"` over the binding — the dialog never opened again). Deprecated, for the
+ * transition period a `.style({ display })` is still accepted, with a warning: a function becomes
+ * `bindShow(() => fn() !== "none")`, a value a show() / hide(); it will throw again.
  */
 export interface UIModal extends UIWidget {
   /**
@@ -107,14 +116,40 @@ export class ModalElement extends WidgetElement {
     this._syncPose()
   }
 
-  /** @internal `display` is not a modal's switch. Refused on every write of the app's — `.style({
-   *  display })`, `el.style.display =` — and let through for the widget's own (`_ownWrite`). During
-   *  the constructor the field is still undefined (it is initialised after `super()`), which lets
-   *  the default `display: "none"` through. */
+  /** @internal `display` is not a modal's switch — DEPRECATED, accepted for the transition period
+   *  and translated: a function → `bindShow(() => fn() !== "none")`, a value → the start state of
+   *  an unplaced modal or a show() / hide() of a placed one (replacing a binding, as a static write
+   *  did). The widget's own writes (`_ownWrite`) pass untouched. During the constructor the field is
+   *  still undefined (it is initialised after `super()`), which lets the default `display: "none"`
+   *  through. */
   _mapStyle(style: any): void {
-    if ("display" in style && this._ownWrite === false) {
-      throw new Error("a modal's `display` is not its switch — a dialog, a sheet or a menu is shown with show() / hide(), or bound to the data with bindShow(…), never by its display")
+    if (!("display" in style) || this._ownWrite !== false) return
+    const value = style.display
+    delete style.display
+    warnDisplayDeprecated()
+    if (typeof value === "function") { this._bindDisplay(value); return }
+    if (this._bound) {
+      disposeBinding(this, SHOW_BINDING)
+      this._bound = false
+      this._showSignal = undefined
+      this._syncDismissible()
     }
+    const shown = value !== "none"
+    if (this._h.id === 0) return
+    if (tree().parent(this._h.id) === 0 && !this._shown) this._writeDisplay(shown ? "flex" : "none")   // the start state
+    else this._setOpen(shown)
+  }
+
+  /** @internal `el.style.display = () => …` (the style proxy's binding form) — DEPRECATED, as `_mapStyle`. */
+  _bindStyle(key: string, fn: () => any): boolean {
+    if (key !== "display") return false
+    warnDisplayDeprecated()
+    this._bindDisplay(fn)
+    return true
+  }
+
+  private _bindDisplay(fn: () => any): void {
+    this.bindShow(() => fn() !== "none")
   }
 
   // The pose the runtime plays on a display flip: the hidden pose + its duration, plus the scrim

package/src/ui/UINode.ts

@@ -399,6 +399,7 @@ const handler: ProxyHandler<any> = {
       // dispose the binding (this is the hot path) — override statically via `.style({ prop })`.
       const el = target._el
       const fn = value as unknown as () => any
+      if (el._bindStyle?.(key, fn) === true) return true   // the element took the binding itself
       createBinding(el, key, () => { el.style[key] = fn() })
       return true
     }
@@ -518,6 +519,9 @@ export class Element<T extends string> implements TreeElement {
    *  `type: "phone"` → `"tel"`), mutating the style in place before it is stored or sent. Runs on
    *  every entry point: the constructor's style, `.style()`, and single-key `el.style.k =` writes. */
   _mapStyle?(style: any): void
+  /** @internal A function written as `el.style.key = () => …`: true when the element bound it
+   *  itself (a modal's deprecated `display`), false for the ordinary per-key binding. */
+  _bindStyle?(key: string, fn: () => any): boolean
 
   // Per-type default styles are inlined at each component's construction site (spread UNDER the
   // user's style — e.g. UIRow's `flexDirection: "row"`), so every node reaches the host with

package/src/ui/tree.ts

@@ -233,6 +233,14 @@ export const unregisterNativeView = (viewId: number): void => { nativeViews.dele
 // ---- gestures -----------------------------------------------------------------------------------------------
 // The track handler of every pointer a listener claimed (`ev.track(...)`): the runtime feeds the
 // pointer's moves / end / cancel here by pointer id — nothing of it is retained natively.
+//
+// Several fingers on one node — the rule every host keeps (renderers/uikit + renderers/android
+// TouchPipeline, renderers/tgfx ui_internal.h Gesture, renderers/web-lite events.ts, web-canvas
+// TreeUI): every finger is its own pointer — its own touchStart and so its own `ev.track`, its own
+// moves and end / cancel at its own point, keyed here by its id. The click and the long press are the
+// node's PRIMARY finger's, the one that pressed it while no other held it: a two-finger tap is ONE
+// click, a second finger landing cancels a hold still pending (a pinch is not a hold). `$pressed`
+// holds until the last finger lifts.
 const trackers = new Map<number, TrackLike>()
 
 // The hover's own slot — the cursor is one, and it is NOT a gesture: a mouse drag keeps its touch

package/src/version.ts

@@ -4,7 +4,7 @@
 // same manifest). Its MAJOR is the bundle ↔ runtime contract: a bundle's `// sdk:` header line
 // and a host's embedded version must agree on the major for the host to run the bundle; minor
 // and patch never gate anything (features are detected, never versioned).
-export const SDK_VERSION = "2.6.0"
+export const SDK_VERSION = "2.8.1"
 
 /** The major of a semver string, or null when it is not one. */
 export const sdkMajor = (version: string | null | undefined): number | null => {