nestjs-web-repl 0.0.0

package/dist/web-repl.module.js

@@ -0,0 +1,82 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var WebReplModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebReplModule = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const constants_1 = require("./constants");
+const in_memory_web_repl_adapter_1 = require("./adapters/in-memory-web-repl.adapter");
+const web_repl_service_1 = require("./web-repl.service");
+const web_repl_controller_1 = require("./web-repl.controller");
+const build_repl_context_1 = require("./context/build-repl-context");
+const CONTEXT_FACTORY = 'WEB_REPL_CONTEXT_FACTORY';
+let WebReplModule = WebReplModule_1 = class WebReplModule {
+    static forRoot(options) {
+        if (!options.enabled)
+            return { module: WebReplModule_1 };
+        return this.assemble([{ provide: constants_1.WEB_REPL_OPTIONS, useValue: options }], options);
+    }
+    static forRootAsync(async) {
+        const optionsProvider = {
+            provide: constants_1.WEB_REPL_OPTIONS,
+            useFactory: async.useFactory,
+            inject: async.inject ?? [],
+        };
+        // registerController is read from resolved options only at request time
+        // in the sense that this module has no way to inspect the value
+        // useFactory will eventually produce until it runs -- and providers /
+        // controllers must be declared statically. So forRootAsync always
+        // registers the default controller; callers who need to omit it should
+        // use forRoot() with a statically-known `registerController: false`.
+        return {
+            module: WebReplModule_1,
+            imports: async.imports ?? [],
+            providers: [optionsProvider, ...this.sharedProviders()],
+            controllers: [web_repl_controller_1.WebReplController],
+            // WEB_REPL_OPTIONS must be exported alongside WebReplService: since
+            // WebReplController (and any subclass of it, per the README's
+            // "Securing it" pattern) now injects WEB_REPL_OPTIONS to enforce
+            // `enabled` at runtime (see CRITICAL 1), a caller who mounts their
+            // own guarded subclass controller on a SIBLING module (with
+            // registerController: false) needs to be able to resolve it too.
+            exports: [web_repl_service_1.WebReplService, constants_1.WEB_REPL_OPTIONS],
+        };
+    }
+    static assemble(optionProviders, options) {
+        return {
+            module: WebReplModule_1,
+            providers: [...optionProviders, ...this.sharedProviders()],
+            controllers: options.registerController === false ? [] : [web_repl_controller_1.WebReplController],
+            exports: [web_repl_service_1.WebReplService, constants_1.WEB_REPL_OPTIONS],
+        };
+    }
+    static sharedProviders() {
+        return [
+            {
+                provide: constants_1.WEB_REPL_ADAPTER,
+                useFactory: (opts) => opts.adapter ?? new in_memory_web_repl_adapter_1.InMemoryWebReplAdapter(),
+                inject: [constants_1.WEB_REPL_OPTIONS],
+            },
+            {
+                provide: CONTEXT_FACTORY,
+                useFactory: (moduleRef) => () => (0, build_repl_context_1.buildReplContext)(moduleRef),
+                inject: [core_1.ModuleRef],
+            },
+            {
+                provide: constants_1.WEB_REPL_CLOCK,
+                useValue: () => Date.now(),
+            },
+            web_repl_service_1.WebReplService,
+        ];
+    }
+};
+exports.WebReplModule = WebReplModule;
+exports.WebReplModule = WebReplModule = WebReplModule_1 = __decorate([
+    (0, common_1.Module)({})
+], WebReplModule);

package/dist/web-repl.service.d.ts

@@ -0,0 +1,46 @@
+import { type OnModuleDestroy, type OnModuleInit } from '@nestjs/common';
+import { Observable } from 'rxjs';
+import type { WebReplAdapter } from './interfaces/web-repl-adapter.interface';
+import type { WebReplModuleOptions } from './interfaces/web-repl-options.interface';
+import type { WebReplEvent } from './interfaces/web-repl-messages.interface';
+type ContextFactory = () => Record<string, unknown>;
+export declare class WebReplService implements OnModuleInit, OnModuleDestroy {
+    private readonly options;
+    private readonly adapter;
+    private readonly buildContext;
+    private readonly clock;
+    private readonly logger;
+    private readonly instanceId;
+    private readonly sessionTtl;
+    private readonly replayBufferSize;
+    private readonly heartbeatInterval;
+    private readonly enabled;
+    private readonly ownership;
+    private readonly ownerSeenAt;
+    private readonly ownerHeartbeatInterval;
+    private readonly ownerLeaseTtl;
+    private ownerHeartbeatTimer?;
+    private readonly channels;
+    private counter;
+    constructor(options: WebReplModuleOptions, adapter: WebReplAdapter, buildContext: ContextFactory, clock?: () => number);
+    onModuleInit(): Promise<void>;
+    onModuleDestroy(): Promise<void>;
+    private heartbeatOwnedChannels;
+    dispatch(channel: string, command: string): Promise<{
+        commandId: string;
+    }>;
+    stream(channel: string, lastEventId: number | null): Observable<WebReplEvent>;
+    private onCmd;
+    private executeCommand;
+    private ensureSession;
+    private emit;
+    private onOut;
+    private onSys;
+    private onUnsubscribe;
+    private maybeEvict;
+    private touchTtl;
+    private getChannel;
+    private safePublish;
+    private parse;
+}
+export {};

package/dist/web-repl.service.js

@@ -0,0 +1,402 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebReplService = void 0;
+const common_1 = require("@nestjs/common");
+const rxjs_1 = require("rxjs");
+const operators_1 = require("rxjs/operators");
+const constants_1 = require("./constants");
+const ring_buffer_1 = require("./ring-buffer");
+const repl_session_1 = require("./session/repl-session");
+let WebReplService = class WebReplService {
+    constructor(options, adapter, buildContext, clock = () => Date.now()) {
+        this.options = options;
+        this.adapter = adapter;
+        this.buildContext = buildContext;
+        this.clock = clock;
+        this.logger = new common_1.Logger('WebReplService');
+        this.ownership = new Map();
+        // Tracks, per channel, the clock() timestamp of the last claim/heartbeat
+        // seen for its current owner -- the ownership *lease*. See onCmd's
+        // staleness check and heartbeatOwnedChannels().
+        this.ownerSeenAt = new Map();
+        this.channels = new Map();
+        this.counter = 0;
+        this.instanceId = options.instanceId ?? `inst_${Math.random().toString(36).slice(2, 10)}`;
+        this.sessionTtl = options.sessionTtl ?? constants_1.DEFAULTS.sessionTtl;
+        this.replayBufferSize = options.replayBufferSize ?? constants_1.DEFAULTS.replayBufferSize;
+        this.heartbeatInterval = options.heartbeatInterval ?? constants_1.DEFAULTS.heartbeatInterval;
+        this.enabled = options.enabled;
+        this.ownerHeartbeatInterval = options.ownerHeartbeatInterval ?? constants_1.DEFAULTS.ownerHeartbeatInterval;
+        const requestedLeaseTtl = options.ownerLeaseTtl ?? constants_1.DEFAULTS.ownerLeaseTtl;
+        // Enforce a MARGIN, not just strict inequality: a lease only one tick
+        // above the heartbeat interval leaves zero slack for publish/adapter
+        // delivery jitter (measured on a PEER's clock) -- a single heartbeat
+        // delivered even slightly late could make a live owner look stale to
+        // someone else, causing exactly the preemption/split-session/lost-vars
+        // failure this feature exists to prevent. Requiring the lease to be at
+        // least 2x the heartbeat interval guarantees a live owner always has at
+        // least one full heartbeat interval of slack against jitter before it
+        // could ever appear stale to a peer.
+        const minLeaseTtl = this.ownerHeartbeatInterval * 2;
+        if (requestedLeaseTtl < minLeaseTtl) {
+            // Clamp rather than throw: this is a debugging tool, it shouldn't fail
+            // boot over a misconfigured pair of durations.
+            this.ownerLeaseTtl = minLeaseTtl;
+            this.logger.warn(`ownerLeaseTtl (${requestedLeaseTtl}ms) must be at least 2x ` +
+                `ownerHeartbeatInterval (${this.ownerHeartbeatInterval}ms) so a live owner ` +
+                `always has a full heartbeat interval of slack against delivery jitter; ` +
+                `clamping the effective lease to ${this.ownerLeaseTtl}ms`);
+        }
+        else {
+            this.ownerLeaseTtl = requestedLeaseTtl;
+        }
+    }
+    async onModuleInit() {
+        // CRITICAL: `enabled` is the product's only safety rail. forRoot()
+        // already refuses to register anything when disabled, but
+        // forRootAsync() resolves options at DI time and always registers this
+        // service/controller -- so this runtime check is what keeps a
+        // config-driven `enabled: false` (e.g. from forRootAsync) from
+        // silently subscribing to the command bus and executing arbitrary code.
+        if (!this.enabled)
+            return;
+        await this.adapter.subscribe(constants_1.TOPICS.cmd, (m) => this.onCmd(this.parse(m)));
+        await this.adapter.subscribe(constants_1.TOPICS.out, (m) => this.onOut(this.parse(m)));
+        await this.adapter.subscribe(constants_1.TOPICS.sys, (m) => this.onSys(this.parse(m)));
+        // Owner-liveness safety net: a live owner must keep renewing its lease
+        // on every channel it owns, or another instance may treat that channel
+        // as effectively ownerless once the lease expires (see onCmd). Only
+        // started when enabled, mirroring the runtime `enabled` enforcement
+        // above -- a disabled instance must never touch the adapter, including
+        // via this timer.
+        this.ownerHeartbeatTimer = setInterval(() => this.heartbeatOwnedChannels(), this.ownerHeartbeatInterval);
+        this.ownerHeartbeatTimer.unref?.();
+    }
+    async onModuleDestroy() {
+        if (this.ownerHeartbeatTimer)
+            clearInterval(this.ownerHeartbeatTimer);
+        for (const state of this.channels.values()) {
+            if (state.ttlTimer)
+                clearTimeout(state.ttlTimer);
+            state.session?.close();
+            state.live.complete();
+        }
+        this.channels.clear();
+        await this.adapter.onModuleDestroy?.();
+    }
+    // Re-announces `claim` for every channel this instance currently owns and
+    // still has a live session for -- i.e. is actually still running. This is
+    // the heartbeat that keeps a live owner's lease from ever going stale
+    // (see onCmd's leaseExpired check). A channel this instance owns per the
+    // `ownership` map but no longer has a session for (e.g. torn down by a TTL
+    // release already in flight) is intentionally NOT re-claimed here.
+    heartbeatOwnedChannels() {
+        for (const [channel, state] of this.channels) {
+            if (this.ownership.get(channel) !== this.instanceId)
+                continue;
+            if (!state.session)
+                continue;
+            void this.safePublish(constants_1.TOPICS.sys, {
+                channel,
+                kind: 'claim',
+                instanceId: this.instanceId,
+            });
+        }
+    }
+    async dispatch(channel, command) {
+        if (!this.enabled)
+            throw new common_1.NotFoundException();
+        const commandId = `cmd_${(++this.counter).toString(36)}_${Math.random().toString(36).slice(2, 6)}`;
+        const msg = { channel, commandId, command, originInstanceId: this.instanceId };
+        await this.safePublish(constants_1.TOPICS.cmd, msg);
+        return { commandId };
+    }
+    stream(channel, lastEventId) {
+        if (!this.enabled)
+            throw new common_1.NotFoundException();
+        // Wrapped in defer() so the replay snapshot is taken -- and the
+        // subscriber-count bookkeeping runs -- at SUBSCRIBE time rather than
+        // when the controller calls stream(). Without this, an event
+        // published between the call to stream() and Nest actually attaching
+        // the subscription would be missed by both the frozen replay snapshot
+        // and the not-yet-attached live subscription (MINOR 4).
+        return (0, rxjs_1.defer)(() => {
+            const state = this.getChannel(channel);
+            state.subscriberCount++;
+            const replayed = state.buffer.since(lastEventId);
+            const heartbeat = (0, rxjs_1.interval)(this.heartbeatInterval).pipe((0, operators_1.map)(() => ({ id: 0, type: 'system', commandId: null, data: { ping: true } })));
+            return (0, rxjs_1.merge)((0, rxjs_1.from)(replayed), state.live.asObservable(), heartbeat).pipe((0, operators_1.finalize)(() => this.onUnsubscribe(channel)));
+        });
+    }
+    async onCmd(msg) {
+        const owner = this.ownership.get(msg.channel);
+        const iAmOwner = owner === this.instanceId;
+        // Lease staleness: an owned channel is only trusted for
+        // `ownerLeaseTtl` since the last claim/heartbeat seen for it. A LIVE
+        // owner heartbeats itself well within that window (ownerHeartbeatInterval
+        // < ownerLeaseTtl is enforced in the constructor), so this never fires
+        // for a healthy owner -- only for one that has stopped heartbeating
+        // (crashed / killed without a clean shutdown).
+        const seenAt = this.ownerSeenAt.get(msg.channel) ?? 0;
+        const leaseExpired = owner !== undefined && this.clock() - seenAt > this.ownerLeaseTtl;
+        // A channel whose lease expired under a DIFFERENT instance is treated
+        // as ownerless for claiming purposes -- but never for the instance that
+        // still (per its own map) believes it owns it; that instance keeps
+        // executing via the `iAmOwner` branch below regardless of this flag.
+        const effectivelyOwnerless = owner === undefined || (leaseExpired && owner !== this.instanceId);
+        const isOrigin = msg.originInstanceId === this.instanceId;
+        // Only the ORIGIN instance may claim an effectively-ownerless channel --
+        // whether it's brand new or a stale takeover -- so every other instance
+        // doesn't stampede the same claim.
+        if (!iAmOwner && !(effectivelyOwnerless && isOrigin))
+            return;
+        // Resolve (or create) the channel state and mark a command as pending
+        // SYNCHRONOUSLY here, before any `await` below -- i.e. within the same
+        // microtask that decided this instance will execute the command. This
+        // closes a race with channel eviction (see maybeEvict / IMPORTANT 3):
+        // without a `pending` guard set this early, the last SSE subscriber
+        // could unsubscribe -- and evict this exact ChannelState from
+        // `this.channels` -- in the window between here and
+        // executeCommand()'s ensureSession() call. That would orphan the
+        // freshly created ReplSession on the now off-map `state` object (never
+        // close()d) while later emit() calls re-resolve through getChannel()
+        // to a brand new state, mis-tagging this command's output with
+        // commandId: null and forcing a second, disconnected ReplSession to be
+        // created for the next command on the same channel.
+        const state = this.getChannel(msg.channel);
+        state.pending++;
+        if (!iAmOwner) {
+            // effectivelyOwnerless && isOrigin: either a brand-new channel, or a
+            // takeover of a channel whose previous owner's lease went stale. On
+            // takeover, the dead owner's in-memory session (and its variables) is
+            // gone -- this instance starts a fresh session. That's an accepted,
+            // documented trade-off: the channel becomes usable again instead of
+            // being wedged fleet-wide forever.
+            this.ownership.set(msg.channel, this.instanceId);
+            this.ownerSeenAt.set(msg.channel, this.clock());
+            await this.safePublish(constants_1.TOPICS.sys, {
+                channel: msg.channel,
+                kind: 'claim',
+                instanceId: this.instanceId,
+            });
+        }
+        this.touchTtl(msg.channel, state);
+        // Enqueue the whole announce -> eval -> done unit onto the channel's
+        // own execution queue. Without this, a second command dispatched to
+        // the same channel while the first's async output is still flushing
+        // would run its (synchronous) echo + currentCommandId assignment
+        // ahead of the first command's still-in-flight eval, mistagging the
+        // first command's trailing output with the second command's id. This
+        // guarantees currentCommandId is only ever the actively-executing
+        // command, and that a queued command's echo is only emitted once it
+        // actually starts executing (correct serial-execution semantics).
+        //
+        // Every link is wrapped so it always resolves, never rejects: if
+        // executeCommand throws (e.g. the injected buildContext() factory or
+        // the ReplSession constructor throws), an unguarded rejection would
+        // permanently poison state.execQueue -- every later
+        // `.then(onFulfilled)` chained onto an already-rejected promise is
+        // silently skipped, so every subsequent command on the channel would
+        // never execute again, with no client-visible error, until process
+        // restart. Instead we log it and best-effort surface it to clients as
+        // a `system` event tagged with the failing command's id, then let the
+        // chain continue so the channel stays usable.
+        state.execQueue = state.execQueue.then(() => this.executeCommand(msg, state)
+            .catch((err) => {
+            this.logger.error(`command ${msg.commandId} on ${msg.channel} failed: ${String(err)}`);
+            try {
+                return this.emit(msg.channel, 'system', msg.commandId, {
+                    error: String(err?.message ?? err),
+                });
+            }
+            catch (emitErr) {
+                // emit() itself only throws synchronously if JSON.stringify
+                // fails on a pathological error message; safePublish already
+                // swallows adapter failures. Never let this poison the queue.
+                this.logger.error(`failed to report command failure: ${String(emitErr)}`);
+                return undefined;
+            }
+        })
+            .finally(() => {
+            // Only now -- once this command's announce -> eval -> done (or
+            // error) unit has fully settled -- may the channel become
+            // eviction-eligible again.
+            state.pending--;
+            this.maybeEvict(msg.channel, state);
+        }));
+        await state.execQueue;
+    }
+    async executeCommand(msg, state) {
+        const session = this.ensureSession(msg.channel, state);
+        await this.emit(msg.channel, 'command', msg.commandId, {
+            command: msg.command,
+            instanceId: this.instanceId,
+        });
+        await session.eval(msg.command);
+        // Silent statements (e.g. `const v = 10`) produce zero output chunks,
+        // so SSE clients have no way to know the command finished without an
+        // explicit completion signal. Emit one system event per executed
+        // command, after all of its output chunks.
+        await this.emit(msg.channel, 'system', msg.commandId, { done: true });
+    }
+    ensureSession(channel, state) {
+        if (state.session)
+            return state.session;
+        const session = new repl_session_1.ReplSession({
+            context: this.buildContext(),
+            onOutput: (chunk) => {
+                // Guard against a stray late write from an in-flight eval landing
+                // after this channel's session has been disposed/replaced (e.g.
+                // by a TTL release, which clears the buffer) -- ReplSession does
+                // not guarantee zero writes after close(). Comparing against the
+                // session captured in this closure (rather than a boolean flag)
+                // also correctly drops output from a session that's since been
+                // replaced by a fresh one for the same channel.
+                if (state.session !== session)
+                    return;
+                void this.emit(channel, 'output', state.currentCommandId, chunk);
+            },
+        });
+        state.session = session;
+        return session;
+    }
+    async emit(channel, type, commandId, data) {
+        const state = this.getChannel(channel);
+        if (type === 'command')
+            state.currentCommandId = commandId;
+        const event = { id: ++state.nextId, type, commandId, data };
+        await this.safePublish(constants_1.TOPICS.out, { channel, event });
+    }
+    onOut(msg) {
+        const state = this.getChannel(msg.channel);
+        if (msg.event.id > state.nextId)
+            state.nextId = msg.event.id;
+        state.buffer.push(msg.event);
+        state.live.next(msg.event);
+    }
+    onSys(msg) {
+        if (msg.kind === 'claim') {
+            this.ownership.set(msg.channel, msg.instanceId);
+            this.ownerSeenAt.set(msg.channel, this.clock());
+        }
+        else {
+            this.ownership.delete(msg.channel);
+            this.ownerSeenAt.delete(msg.channel);
+            const state = this.channels.get(msg.channel);
+            if (state?.session) {
+                state.session.close();
+                state.session = undefined;
+                state.buffer.clear();
+            }
+            if (state)
+                this.maybeEvict(msg.channel, state);
+        }
+    }
+    // IMPORTANT 3: stream() (a bare GET) creates and stores a ChannelState
+    // for any channel name on first subscribe. Nothing else removes it --
+    // TTL release tears down the session+buffer but previously left the
+    // ChannelState (and its live Subject) in the map forever. An
+    // unauthenticated client looping `GET /repl/<random>` would grow
+    // `this.channels` without bound. Evict a channel once it has no live SSE
+    // subscribers AND no active session AND an empty replay buffer -- a
+    // channel with buffered history but no subscribers is deliberately kept
+    // around until TTL release clears its buffer, so a reconnecting client
+    // can still replay.
+    onUnsubscribe(channel) {
+        const state = this.channels.get(channel);
+        if (!state)
+            return;
+        state.subscriberCount = Math.max(0, state.subscriberCount - 1);
+        this.maybeEvict(channel, state);
+    }
+    maybeEvict(channel, state) {
+        if (state.pending > 0)
+            return;
+        if (state.subscriberCount > 0)
+            return;
+        if (state.session)
+            return;
+        if (!state.buffer.isEmpty())
+            return;
+        this.channels.delete(channel);
+        // Mirror the channel GC: a channel this instance no longer tracks state
+        // for shouldn't keep a stale ownerSeenAt entry lying around (e.g. a
+        // non-owner instance that watched a channel via SSE, saw a remote
+        // claim/heartbeat for it, then had its own local ChannelState evicted).
+        this.ownerSeenAt.delete(channel);
+        // Deliberately NOT deleting `ownership` here (unlike the onSys release
+        // branch, which deletes both): `ownership` is cluster-wide state --
+        // every instance's map should agree on who owns a channel, and that
+        // agreement is only supposed to change via an explicit claim/release
+        // message, not as a side effect of one instance's local eviction
+        // bookkeeping. `ownerSeenAt`, by contrast, is purely local staleness
+        // tracking for this instance's own onCmd checks, so it's fine (and
+        // necessary, to avoid leaking) to drop it here. In practice this
+        // instance only ever reaches eviction-eligibility (no session, empty
+        // buffer) for a channel it owns if execution never produced any
+        // buffered output at all, which -- given emit() always buffers at least
+        // an error/done system event before pending drops to 0 -- shouldn't
+        // happen while genuinely owned; if a future refactor changes that
+        // invariant, reconsider this asymmetry.
+    }
+    touchTtl(channel, state) {
+        if (state.ttlTimer)
+            clearTimeout(state.ttlTimer);
+        state.ttlTimer = setTimeout(() => {
+            void this.safePublish(constants_1.TOPICS.sys, {
+                channel,
+                kind: 'release',
+                instanceId: this.instanceId,
+            });
+        }, this.sessionTtl);
+        state.ttlTimer.unref?.();
+    }
+    getChannel(channel) {
+        let state = this.channels.get(channel);
+        if (!state) {
+            state = {
+                buffer: new ring_buffer_1.EventRingBuffer(this.replayBufferSize),
+                live: new rxjs_1.Subject(),
+                nextId: 0,
+                currentCommandId: null,
+                execQueue: Promise.resolve(),
+                subscriberCount: 0,
+                pending: 0,
+            };
+            this.channels.set(channel, state);
+        }
+        return state;
+    }
+    async safePublish(topic, message) {
+        try {
+            await this.adapter.publish(topic, JSON.stringify(message));
+        }
+        catch (err) {
+            this.logger.error(`adapter publish failed on ${topic}: ${String(err)}`);
+        }
+    }
+    parse(message) {
+        return JSON.parse(message);
+    }
+};
+exports.WebReplService = WebReplService;
+exports.WebReplService = WebReplService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.WEB_REPL_OPTIONS)),
+    __param(1, (0, common_1.Inject)(constants_1.WEB_REPL_ADAPTER)),
+    __param(2, (0, common_1.Inject)('WEB_REPL_CONTEXT_FACTORY')),
+    __param(3, (0, common_1.Inject)(constants_1.WEB_REPL_CLOCK)),
+    __metadata("design:paramtypes", [Object, Object, Function, Function])
+], WebReplService);

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "nestjs-web-repl",
+  "version": "0.0.0",
+  "description": "Expose a live NestJS REPL over the network (HTTP + SSE + Monaco UI).",
+  "license": "MIT",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest",
+    "example": "ts-node -T example/main.ts"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^10 || ^11",
+    "@nestjs/core": "^10 || ^11",
+    "rxjs": "^7"
+  },
+  "devDependencies": {
+    "@nestjs/common": "^11",
+    "@nestjs/core": "^11",
+    "@nestjs/platform-express": "^11",
+    "@nestjs/testing": "^11",
+    "@swc/core": "^1.15.43",
+    "@types/node": "^20",
+    "@types/supertest": "^6",
+    "reflect-metadata": "^0.2",
+    "rxjs": "^7",
+    "supertest": "^7",
+    "ts-node": "^10.9.2",
+    "typescript": "^5",
+    "unplugin-swc": "^1.5.9",
+    "vitest": "^2"
+  }
+}