esdev@0.27.0

Added

• A plugins entry may be several plugins (DECISIONS D214). An export, or
  what its factory returns, may be a list of plugins, and the list takes the
  entry's place in order, so a package made of several plugins needs one
  esdev.json entry. Nested lists flatten and null/false are skipped.
  runtime:build's build({ plugins }) reads its list the same way and also
  awaits promises, as Rollup does. A 0 or "" is refused rather than
  skipped. This used to fail with plugin-0: unknown hook "0".

• The fullstack template's server is the generated AFW handler
  (@afw/server): API routes, loaders, middleware, server functions and
  server-rendered pages all come through one createHandler, so a new route
  needs no edit to server.js. It ships a server-function sample
  (app/todos/todos.server.js) that the todos page calls and its loader calls
  directly. In TypeScript the sample is typed; that needs
  @opentf/esdev-plugin-afw with its .tsx type fix (after 0.7.0).

• dev.servers (DECISIONS D208): esdev start runs several servers —
  each with its own target, port, env, args, started after the ones
  it names — restarts only those whose output changed, and shows each one's
  errors on the page under its name. dev.server.proxy may name a server,
  making esdev the front door: one address for the page, the update channel
  and every server, with the page's Host kept. dev.run is unchanged.

• Server errors in the overlay (DECISIONS D207). When the server
  esdev start runs fails a request or crashes, open pages show it under
  Server error, with the request's method, path and trace id.

• esdev start and its server are linked: a restart drains in-flight
  requests on every platform, Windows included (it used to kill the server
  there), the loop learns the server is listening when serve() binds, and a
  server whose esdev start is killed exits instead of holding its port.

• An outbound proxy (DECISIONS D205). fetch, the WebSocket client
  and the --otel exporter — in the programs esdev runs, esdev start's
  server, esdev create's registry lookups and esdev upgrade — follow
  HTTPS_PROXY/HTTP_PROXY/NO_PROXY (lowercase first), as npm and git do.
  --proxy=<url> and --no-proxy=<list> override them; --no-proxy=* turns
  the proxy off.

Changed

• esdev create and esdev init ask in Clack's layout and colours, as
  create-afw does (@clack/prompts 1.8): a gray gutter joining the questions
  under a cyan title badge, the question being asked in cyan with a
  ↑/↓ to navigate • Enter: confirm • Esc: back footer, ●/○ options with
  the hint beside the focused one, an inline ● Yes / ○ No for yes/no
  questions, and a text input with its default as the placeholder. Outcomes
  are marked with ticks, crosses and warning signs: a green ✔ on each answer
  and on created, a red ✖ and struck-through answer on a cancel, a gray –
  on a skipped question and a yellow ⚠ on a registry retry. The keys stay as
  they were (Esc steps back, a digit jumps). Esc on the install question now
  reads Skipped; it still installs nothing.

• esdev create --template=docs leaves the blog out unless asked, as
  create-afw does: the question is now "Add a blog?" and starts on No, and an
  unattended run without --blog writes docs only. --blog adds app/blog/
  with a sample post, a Blog link, and RSS and Atom feeds; --no-blog is
  still accepted.

• esdev upgrade also updates the esrun installed beside it
  (DECISIONS D204), each to its own newest release, checked against its
  checksums.txt. --only=esdev or --only=esrun (install.sh's spelling)
  limits it to one, and --dry-run reports on both. An esrun elsewhere on
  PATH is left alone. This replaces esrun upgrade, which is removed.

• The bundler moves to rolldown 1.3.1 and oxc 0.157. Among rolldown's
  fixes since 1.2.3: a use-after-free in async transforms that read a
  tsconfig.json, side effects dropped by tree-shaking (through import
  cycles, after exports.x writes, and when an exported constant was inlined),
  several renaming collisions, chunk execution order, and module namespace
  objects that are now null-prototype and non-extensible. oxc fixes TypeScript
  enums exported across namespace blocks and the lowering of private class
  members and using. The React Compiler pass stays on the oxc it targets.

• A library build names a non-JavaScript module's output after the whole
  file: button.module.css becomes button.module.css.js (was
  button.module.js), and data.json becomes data.json.js, as Rollup and
  Vite library builds name them. A module can no longer collide with a
  button.module.js beside it. The imports, requires and declarations the
  build writes name the new files; a package exports map that names one of
  the old paths needs updating.

Fixed

• esdev upgrade tries a download again when the network fails it (a
  dropped connection, a truncated or stalled body, a 5xx or 429), up to
  three attempts in all, and shows a progress bar for the archive when
  stderr is a terminal.

Security

• An import loads only what esdev turns into a module (DECISIONS D209),
  as under esrun: module files, the TypeScript and JSX esdev compiles,
  .css, and whatever a plugin's transform filter admits. Anything else is
  refused with ERR_UNKNOWN_FILE_EXTENSION before it is read — it used to
  run as JavaScript. A plugin with no id filter on its transform still
  claims every file.
• A web page can no longer attach to --inspect. The debugger answered
  any Host and any Origin, so a page using DNS rebinding could read
  /json/list, attach and run code in the process — Node's CVE-2018-7160.
  It now answers only to localhost or an IP address, refuses a WebSocket
  upgrade carrying any Origin but Chrome DevTools' (devtools://devtools),
  and its session id comes from the OS random source rather than the clock.