OpenCore Framework v1.3.1

Fixed

• Exported AppearanceService from the client runtime services (src/runtime/client/services/index.ts). It was missing from the barrel, so it could not be accessed from the client side of a project. Reported in #122 and fixed in #123.

Contributors

• Thanks to @SzybkiRito (Mateusz Jakubczak) for reporting and fixing the missing client export in #123.

OpenCore Framework v1.3.0

Added

• Typed library events through the Register type registry. The OpenCore CLI (vX.Y.Z+) now generates a serverLibraryEvents and a clientLibraryEvents map per resource from its @OnLibraryEvent listeners and, for the events no listener types, from the library's emit() calls.
• createServerLibrary(), createClientLibrary() and createLibraryBase() keep the library name as a literal type (OpenCoreServerLibrary<'rp'>), so on(), once(), off() and emit() are typed against that library's events: names autocomplete and payloads are checked against the listeners.
• emit() requires the payload of a generated event unless its listeners accept undefined.
• In strict mode (build.typegen.strict), a registered library rejects event names no listener or emit() declares. Unlike network events, it does not admit the framework's opencore:* names, as library events are local to a library.
• Exported the library helper types (ServerLibraryEvents, ClientLibraryEvents, LooseLibraryEventMap, LibraryEventsOf, LibraryEventNameIn, LibraryEventNameOf, LibraryPayloadOf, LibraryEmitArgsOf) from the package root.

Changed

• LibraryBus, OpenCoreLibraryBase, OpenCoreServerLibrary and OpenCoreClientLibrary take type parameters for the library name and its event map. Both default to the previous loose form, so existing annotations such as lib: OpenCoreServerLibrary keep accepting any library.
• Without generated types, or for a library typegen has not registered, every library signature keeps its previous loose form, and an explicit payload type argument (lib.emit<Payload>(...)) keeps working.

Notes

• Library events are keyed by library name across the whole project. Two unrelated libraries created with the same name in different resources have their events merged, and the CLI warns when it detects it; give one of them a different name.

OpenCore Framework v1.2.0

Added

• Added the Register type registry, exported from @open-core/framework/register, which the OpenCore CLI (v1.6.0+) augments with the generated .opencore/opencore.gen.ts of every resource.
• Typed events.emit(), player.emit(), rpc.call(), rpc.notify() and WebView.send() against the registered handlers: names autocomplete and payloads are checked against the handler signatures.
• Typed rpc.call() results from the handler's return type.
• Added strict mode, enabled through the CLI's build.typegen.strict, which rejects names no handler declares while still accepting the framework's own opencore:* events.
• Exported the registry helper types (ClientEvents, ServerEvents, ServerRpc, ClientRpc, Commands, ViewSend, ViewReceive, NameOf, StrictNameOf, ArgsOf, RpcArgsOf, RpcResultOf, RpcCallResultOf, PayloadOf, DropFirst, IsRegistered) from the package root.

Changed

• Without generated types every signature keeps its previous loose form, so enabling or disabling typegen requires no source changes.
• WebViewBridge, NuiBridge and createWebView() now default their message maps to the registered ViewSend and ViewReceive, and accept any object type as a map.
• Removed the untyped emit(event: string, target, ...args: unknown[]) overload of EventsAPI. It matched every call the typed signature rejected; without generated types the remaining signature is equally loose.
• For a registered RPC name, rpc.call() always resolves to the handler's result and ignores an explicit TResult. TResult still types calls to unregistered names.

Fixed

• Prevented a contextual type from overriding a registered RPC result, which let const x: Promise<string> = rpc.call('bank:getBalance') compile against a handler returning number.
• Fixed the WebView and NUI singletons being published with a pinned loose type, which kept send() from ever being narrowed.

OpenCore Framework v1.2.0

Added

• Added the Register type registry, exported from @open-core/framework/register, which the OpenCore CLI (v1.6.0+) augments with the generated .opencore/opencore.gen.ts of every resource.
• Typed events.emit(), player.emit(), rpc.call(), rpc.notify() and WebView.send() against the registered handlers: names autocomplete and payloads are checked against the handler signatures.
• Typed rpc.call() results from the handler's return type.
• Added strict mode, enabled through the CLI's build.typegen.strict, which rejects names no handler declares while still accepting the framework's own opencore:* events.
• Exported the registry helper types (ClientEvents, ServerEvents, ServerRpc, ClientRpc, Commands, ViewSend, ViewReceive, NameOf, StrictNameOf, ArgsOf, RpcArgsOf, RpcResultOf, RpcCallResultOf, PayloadOf, DropFirst, IsRegistered) from the package root.

Changed

• Without generated types every signature keeps its previous loose form, so enabling or disabling typegen requires no source changes.
• WebViewBridge, NuiBridge and createWebView() now default their message maps to the registered ViewSend and ViewReceive, and accept any object type as a map.
• Removed the untyped emit(event: string, target, ...args: unknown[]) overload of EventsAPI. It matched every call the typed signature rejected; without generated types the remaining signature is equally loose.
• For a registered RPC name, rpc.call() always resolves to the handler's result and ignores an explicit TResult. TResult still types calls to unregistered names.

Fixed

• Prevented a contextual type from overriding a registered RPC result, which let const x: Promise<string> = rpc.call('bank:getBalance') compile against a handler returning number.
• Fixed the WebView and NUI singletons being published with a pinned loose type, which kept send() from ever being narrowed.

OpenCore Framework v1.1.2

Updates

• Dependencies updated and override js-yaml to 5.4.1
• Typescript updated to version 7.

OpenCore Framework v1.1.1

Added

• Added CodeQL analysis for JavaScript and TypeScript on master, develop, pull requests, and a weekly schedule.
• Added Dependabot updates for npm packages and GitHub Actions.

Changed

• Replaced development-mode event history eviction with a fixed-capacity circular buffer.

Fixed

• Redacted raw command arguments from suspicious-command rejection logs while retaining the argument count.
• Returned a generic public error for invalid RPC payloads without exposing validation details to callers.
• Preserved invalid RPC payload details in server-only logs for diagnostics.
• Kept rate-limit hits until their configured throttle window has elapsed.
• Prevented unbounded pending-event tracking without expiring valid long-running operations.

OpenCore Framework v1.1.0

Added

• @Controller() now accepts an optional ControllerOptions object to define default decorations applied automatically to every method in the class.
  • guard — applies @Guard to all methods that do not declare their own.
  • throttle — applies @Throttle (supports both object and [limit, windowMs] tuple) to all methods that do not declare their own.
  • requiresState — applies @RequiresState to all methods that do not declare their own.
  • public — applies @Public to all methods that are not already marked @Public().
• Explicit method-level decorators always override controller-level defaults. No breaking changes.

Tests

• Added comprehensive unit tests for controller default decorations and override behavior.

OpenCore Framework v1.0.13

Fixed

• Fixed @Guard rejecting valid players with clientID: 0, which affected the first RageMP player connected to a fresh server.
• Fixed @Throttle skipping rate-limit enforcement for valid players with clientID: 0, preventing an unthrottled first-player security bypass on RageMP.

Tests

• Added regression coverage for @Guard and @Throttle with clientID: 0.

OpenCore Framework v1.0.12

Changes

• A flag was added to decide whether you want to skip the transition effect in player.spawn
• Useful Decorators were added from Server side to Client Side

OpenCore Framework v1.0.10

Added

• Added authoritative CORE exports to link and unlink player accounts from remote resources.
• Added debug logs for remote player session mutations delegated from RESOURCE to CORE.

Fixed

• Fixed RESOURCE player session mutations so player.linkAccount(), player.unlinkAccount(), player.setMeta() and state changes propagate to CORE.
• Fixed secure @OnNet and @OnRPC handlers being blocked in sibling resources after successful authentication performed from a RESOURCE auth module.