@azure-net/kit 6.0.0-next.13 → 6.0.0-next.15

package/README.md

@@ -189,13 +189,13 @@ export {};
 ```
 
 ```ts
-import { createApp } from '@azure-net/kit';
+import { createApp, ServerMiddlewareManager } from '@azure-net/kit';
 import { RequestContext } from '@azure-net/kit/server-context';
 
 export const { register } = createApp((app) =>
 	app
-		.useServer(async ({ event, resolve, useMiddlewares }) => {
-			await useMiddlewares([ServerAuth]);
+		.useServer(async ({ event, resolve }) => {
+			await new ServerMiddlewareManager([ServerAuth]).execute();
 			return resolve(event);
 		})
 		.useBoot(({ state }) => {
@@ -300,7 +300,15 @@ only when its turn is reached, on every request/navigation. Resolve dependencies
 inside that instance, not into module-level request-specific variables.
 
 ```ts
-import type { IServerMiddleware, ServerMiddlewareContext, IClientMiddleware, ClientMiddlewareContext } from '@azure-net/kit';
+import {
+	ServerMiddlewareManager,
+	ClientMiddlewareManager,
+	type IServerMiddleware,
+	type ServerMiddlewareContext,
+	type IClientMiddleware,
+	type ClientMiddlewareContext
+} from '@azure-net/kit';
+import { beforeNavigate } from '$app/navigation';
 
 class ServerAuth implements IServerMiddleware {
 	async execute({ event, next }: ServerMiddlewareContext) {
@@ -317,16 +325,26 @@ class ClientGuard implements IClientMiddleware {
 	}
 }
 
+const serverMiddlewares = new ServerMiddlewareManager([ServerAuth]);
+const clientMiddlewares = new ClientMiddlewareManager([ClientGuard]);
+
 app
-	.useServer(async ({ useMiddlewares, event, resolve }) => {
-		await useMiddlewares([ServerAuth]);
+	.useServer(async ({ event, resolve }) => {
+		await serverMiddlewares.execute();
 		return resolve(event);
 	})
-	.useClient(({ useMiddlewares }) => {
-		useMiddlewares([ClientGuard]);
+	.useClient(() => {
+		beforeNavigate((navigation) => clientMiddlewares.execute(navigation));
 	});
+
+// Run the same checks without navigating or registering another subscription.
+clientMiddlewares.execute();
 ```
 
+Managers snapshot the constructor list and retain no request data or middleware instances, so they can be declared at module scope. `ServerMiddlewareManager.execute()` resolves the current request each time. `ClientMiddlewareManager.execute()` uses the current page URL; `from` and `navigation` are undefined in a manual run. Client execution is a no-op during SSR.
+
+`createApp` no longer injects `useMiddlewares` or subscribes to navigation itself. Register `beforeNavigate` synchronously inside `useClient`, before any `await`. A manual run does not create a navigation to cancel: omitting `next()` only stops that run. Avoid calling a manager from middleware that it executes, including indirectly through HTTP recovery. Re-running a full chain also re-runs analytics; use a smaller manager if only auth state must be synchronized.
+
 `IMiddleware<Context, Result>` is the common interface. Client `execute` is strictly
 synchronous (`undefined` return, normally `return next()`); server `execute` can
 return `void` or `Promise<void>`. Omitting `next()` blocks the chain. Neither the
@@ -382,7 +400,11 @@ cases. With no `retry` option, a failed request is not repeated. `limit` counts
 additional attempts: `limit: 1` means at most two HTTP attempts.
 
 ```ts
+// A separate session client: no authentication recovery hooks.
+const sessionHttp = new HttpServiceInstance({ prefixUrl: apiUrl });
+
 const http = new HttpServiceInstance({
+	prefixUrl: apiUrl,
 	onRequest(request) {
 		const token = readAccessToken();
 		if (token) request.headers.set('Authorization', `Bearer ${token}`);
@@ -392,9 +414,8 @@ const http = new HttpServiceInstance({
 		statuses: [401],
 		async shouldRetry({ error }) {
 			if (!isExpiredAccessToken(error.data)) return false;
-			const refreshed = await http.post('/api/auth/refresh', {
-				json: { refreshToken: readRefreshToken() },
-				retry: { limit: 0 }
+			const refreshed = await sessionHttp.post('/api/auth/refresh', {
+				json: { refreshToken: readRefreshToken() }
 			});
 			saveTokens(refreshed.data);
 			return true;
@@ -413,16 +434,16 @@ implement token rotation or cross-tab coordination.
 - `shouldRetry` runs only after the status filter and only while budget remains.
   Both synchronous and asynchronous booleans are accepted.
 - Per-request `retry` replaces the entire default policy. Use `{ limit: 0 }` to
-  disable it, **especially for refresh requests made inside `shouldRetry`**.
-  A nested HTTP call has its own budget; forgetting this override can recurse.
+  disable it. A separate session client with no retry policy does not inherit
+  the application client's retries or hooks.
 - `onRequest` runs before every attempt so refreshed credentials are read again.
   `onResponse` runs once on success; `onError` runs once on terminal HTTP failure,
   not for intermediate failures that recover successfully.
 - Exceptions from hooks (including `shouldRetry`) propagate without further
   recovery. They are not treated as another failed transport attempt.
 - Cancelled requests and streaming request bodies are never replayed. Cancellation
-  is checked again after awaiting recovery; the callback must manage its own async
-  work and cancellation if needed.
+  also stops waiting for recovery; the callback must manage cancellation of its
+  own underlying work.
 - `limit` must be a finite non-negative safe integer. There is no implicit retry
   delay/backoff. Timeout is applied separately to each HTTP attempt.
 
@@ -430,3 +451,40 @@ Retries are opt-in for all HTTP methods. Do not blindly retry writes after netwo
 errors: the server may already have applied them. Use a narrow status/code policy
 or backend-supported idempotency keys. Numerical `retry: 3` is no longer supported;
 write `retry: { limit: 3 }` instead.
+
+HTTP hooks use these signatures:
+
+```ts
+retry: {
+ limit: 1,
+ shouldRetry: async ({ error }) => {
+  // Delegate refresh to your session service with a separate HTTP client.
+  return false;
+ }
+},
+onError: ({ error, request }) => {
+ // Terminal failure notification / validation mapping. No http is exposed.
+}
+```
+
+This is a breaking change from positional `onError(error, request, http)`.
+Request-level hook overrides use the same signatures. Nested requests use instance
+settings plus their own options, not the outer request's body or signal.
+
+AbortSignal stops waiting for hooks as well as transport operations. Arbitrary
+user promises cannot be forcibly terminated: hooks must cooperate to stop their
+own side effects. Hooks have no implicit timeout; supply and abort a signal to
+bound their waiting time. The per-attempt timeout covers transport and body
+parsing, including custom `doFetch`. With `responseFormat: 'body'`, it ends when
+the stream is returned; reading/cancelling that stream is then the caller's job.
+Timers/listeners are removed on success, failure, timeout and cancellation.
+
+JSON serialization errors now reject before sending rather than silently sending
+an empty body. The default JSON serializer does not support cyclic values or
+BigInt; provide `stringifyJson` if a custom wire format is required.
+
+Removing `http` from `onError` does not prevent recursion through a client captured
+in a closure. Do not initiate the same failing operation from its error handler.
+Neither `shouldRetry` nor `onError` exposes the HTTP client. Use a separate
+session client without recovery hooks for refresh/logout. Limits apply per HTTP
+call, not to arbitrary nested user code.

package/dist/infra/http-service/HttpServiceInstance.d.ts

@@ -66,7 +66,10 @@ export interface IHttpInstanceNormalizedRequest {
     requestInit: Omit<RequestInit, 'method' | 'headers' | 'body'>;
 }
 export type IHttpInstanceOnRequest = (request: IHttpInstanceNormalizedRequest) => void | Promise<void>;
-export type IHttpInstanceOnError = (error: HttpServiceError<unknown>, request: IHttpInstanceNormalizedRequest) => void | Promise<void>;
+export type IHttpInstanceOnError = (context: {
+    error: HttpServiceError<unknown>;
+    request: IHttpInstanceNormalizedRequest;
+}) => void | Promise<void>;
 export type IHttpInstanceDoFetch = <T = unknown>(request: IHttpInstanceNormalizedRequest) => Promise<IHttpServiceResponse<T>>;
 export interface IHttpInstanceRetryOptions {
     /** Number of additional attempts. Zero disables retries, including inherited policies. */

package/dist/infra/http-service/HttpServiceInstance.js

@@ -56,14 +56,7 @@ export class HttpServiceError extends Error {
         return this.data;
     }
 }
-const stringifyJsonFunc = (data) => {
-    try {
-        return JSON.stringify(data);
-    }
-    catch {
-        return undefined;
-    }
-};
+const stringifyJsonFunc = (data) => JSON.stringify(data);
 const isAbsoluteUrl = (value) => /^[a-zA-Z][a-zA-Z\d+\-.]*:/.test(value);
 const normalizeHeaders = (headers) => {
     if (!headers)
@@ -107,7 +100,7 @@ const mergeSearchParams = (base, extra) => {
     return result;
 };
 const mergeOptions = (base = {}, extra = {}) => {
-    const mergedHeaders = new Headers(normalizeHeaders(base.headers));
+    const mergedHeaders = normalizeHeaders(base.headers);
     for (const [key, value] of normalizeHeaders(extra.headers).entries()) {
         mergedHeaders.set(key, value);
     }
@@ -238,28 +231,46 @@ const parseResponse = async (response, request) => {
     return { data, headers: Object.fromEntries(response.headers.entries()), status: response.status, raw };
 };
 const defaultDoFetch = async (request) => {
-    const timeoutState = withTimeout(request.requestInit.signal, request.timeout);
-    try {
-        const response = await request.fetch(request.url, {
-            ...request.requestInit,
-            method: request.method,
-            headers: request.headers,
-            body: request.body,
-            signal: timeoutState.signal ?? undefined
+    const response = await request.fetch(request.url, {
+        ...request.requestInit,
+        ...(typeof ReadableStream !== 'undefined' && request.body instanceof ReadableStream ? { duplex: 'half' } : {}),
+        method: request.method,
+        headers: request.headers,
+        body: request.body
+    });
+    const { data, headers, status, raw } = await parseResponse(response, request);
+    return new HttpServiceResponse({ headers, status, success: true, data, message: 'Request completed', raw });
+};
+// Stop waiting even when a custom transport or hook ignores AbortSignal.
+// The underlying operation must cooperate to actually stop its own work.
+const waitForSignal = (value, signal) => {
+    if (!signal)
+        return Promise.resolve(value);
+    return new Promise((resolve, reject) => {
+        const abort = () => {
+            cleanup();
+            reject(signal.reason);
+        };
+        const cleanup = () => signal.removeEventListener('abort', abort);
+        if (signal.aborted)
+            abort();
+        else
+            signal.addEventListener('abort', abort, { once: true });
+        Promise.resolve(value).then((result) => {
+            cleanup();
+            resolve(result);
+        }, (error) => {
+            cleanup();
+            reject(error);
         });
-        const { data, headers, status, raw } = await parseResponse(response, request);
-        return new HttpServiceResponse({ headers, status, success: true, data, message: 'Request completed', raw });
-    }
-    finally {
-        timeoutState.clear();
-    }
+    });
 };
 const makeMethod = (method, defaults) => {
     return async (url, options = {}) => {
         const merged = mergeOptions(defaults, options);
         const stringifyJson = merged.stringifyJson ?? stringifyJsonFunc;
         const fetcher = !BROWSER ? (RequestContext.current()?.event?.fetch ?? fetch) : fetch;
-        const headers = normalizeHeaders(merged.headers);
+        const headers = merged.headers;
         let body = merged.body;
         if (merged.json !== undefined && body === undefined) {
             body = stringifyJson(merged.json);
@@ -297,6 +308,11 @@ const makeMethod = (method, defaults) => {
             }
         };
         // Snapshot the policy per call: hooks and concurrent requests cannot extend its budget.
+        const sourceSignal = merged.signal;
+        const timeout = normalizedRequest.timeout;
+        if (timeout !== false && (!Number.isFinite(timeout) || timeout < 0 || timeout > 2147483647)) {
+            throw new RangeError('timeout must be false or a finite number between 0 and 2147483647');
+        }
         const policy = merged.retry;
         const limit = policy?.limit ?? 0;
         if (!Number.isSafeInteger(limit) || limit < 0) {
@@ -307,13 +323,22 @@ const makeMethod = (method, defaults) => {
         const doFetch = merged.doFetch ?? defaultDoFetch;
         let fetched;
         for (let attempt = 0;; attempt++) {
-            normalizedRequest.requestInit.signal?.throwIfAborted();
+            sourceSignal?.throwIfAborted();
             // Re-run authentication/header hooks after recovery, without accumulating headers.
-            normalizedRequest.headers = new Headers(headers);
-            await merged.onRequest?.(normalizedRequest);
+            normalizedRequest.headers = merged.onRequest ? new Headers(headers) : headers;
+            if (merged.onRequest)
+                await waitForSignal(merged.onRequest(normalizedRequest), sourceSignal);
             normalizedRequest.requestInit.signal?.throwIfAborted();
             try {
-                fetched = await doFetch(normalizedRequest);
+                const timeoutState = withTimeout(sourceSignal, timeout);
+                normalizedRequest.requestInit.signal = timeoutState.signal;
+                try {
+                    fetched = await waitForSignal(doFetch(normalizedRequest), timeoutState.signal);
+                }
+                finally {
+                    timeoutState.clear();
+                    normalizedRequest.requestInit.signal = sourceSignal;
+                }
                 break;
             }
             catch (error) {
@@ -323,19 +348,22 @@ const makeMethod = (method, defaults) => {
                         message: normalizeUnknownError(error).message,
                         original: normalizeUnknownError(error)
                     });
-                const aborted = normalizedRequest.requestInit.signal?.aborted || normalizedError.original?.name === 'AbortError';
+                const aborted = sourceSignal?.aborted || normalizedError.original?.name === 'AbortError';
                 const streaming = typeof ReadableStream !== 'undefined' && normalizedRequest.body instanceof ReadableStream;
                 const eligible = !aborted && !streaming && attempt < limit && (!statuses || statuses.includes(normalizedError.status));
-                if (eligible && (!shouldRetry || (await shouldRetry({ error: normalizedError })))) {
+                if (eligible && (!shouldRetry || (await waitForSignal(shouldRetry({ error: normalizedError }), sourceSignal)))) {
                     normalizedRequest.requestInit.signal?.throwIfAborted();
                     continue;
                 }
-                await merged.onError?.(normalizedError, normalizedRequest);
+                if (merged.onError)
+                    await waitForSignal(merged.onError({ error: normalizedError, request: normalizedRequest }), sourceSignal);
                 throw normalizedError;
             }
         }
         // Consumer callback failures must never replay a successful HTTP operation.
-        await merged.onResponse?.(fetched);
+        sourceSignal?.throwIfAborted();
+        if (merged.onResponse)
+            await waitForSignal(merged.onResponse(fetched), sourceSignal);
         return fetched;
     };
 };

package/dist/shared/app/App.d.ts

@@ -1,9 +1,7 @@
 import { type TranslationManagerSource } from '../../i18n/Internal.js';
 import { type ContextData } from '../../shared/request-context/Internal.js';
-import { type ServerMiddlewareClass } from './middleware/ServerMiddleware.js';
 import type { Handle, HandleFetch, HandleServerError, HandleClientError, Reroute, ServerInit, Transport } from '@sveltejs/kit/hooks';
 import type { RequestEvent } from '@sveltejs/kit';
-import { type ClientMiddlewareClass } from './middleware/ClientMiddleware.js';
 import { useLogger } from '../logger/index.js';
 type MaybePromise<T> = T | Promise<T>;
 type HandleInput = Parameters<Handle>[0];
@@ -11,9 +9,7 @@ type Resolve = HandleInput['resolve'];
 type BuilderFlags = Partial<Record<'useTranslations' | 'useBoot' | 'useClient' | 'useClientInit' | 'useClientError' | 'useServerInit' | 'useServer' | 'useServerError' | 'useServerFetch' | 'useReroute' | 'useTransport', true>>;
 type WithFlag<TFlags extends BuilderFlags, TKey extends keyof BuilderFlags> = TFlags & Record<TKey, true>;
 type OnceMethod<TFlags extends BuilderFlags, TKey extends keyof BuilderFlags, TMethod> = TFlags[TKey] extends true ? object : TMethod;
-export interface AppClientLifecycleContext {
-    useMiddlewares: (middlewares: readonly ClientMiddlewareClass[]) => void;
-}
+export type AppClientLifecycleContext = void;
 export type AppClientInitLifecycleContext = void;
 export type AppClientErrorContext = Parameters<HandleClientError>[0];
 export type AppServerInitLifecycleContext = void;
@@ -21,7 +17,6 @@ export interface AppServerLifecycleContext {
     requestContext: ContextData;
     event: RequestEvent;
     resolve: Resolve;
-    useMiddlewares: (middlewares: readonly ServerMiddlewareClass[]) => Promise<void>;
 }
 export type AppServerErrorContext = Parameters<HandleServerError>[0] & {
     requestContext: ContextData;

package/dist/shared/app/App.js

@@ -4,9 +4,6 @@ import { getContextInternals } from '../../shared/request-context/Internal.js';
 import { BROWSER } from '../../external/tools/index.js';
 import { RequestContext } from '../../shared/request-context/Internal.js';
 import { AzureNetKitInternalError } from '../app-error/AppError.js';
-import { executeServerMiddlewares } from './middleware/ServerMiddleware.js';
-import { beforeNavigate } from '$app/navigation';
-import { executeClientMiddlewares } from './middleware/ClientMiddleware.js';
 import { useLogger } from '../logger/index.js';
 const clientLifecycleFlags = new WeakMap();
 const getRequestContext = () => {
@@ -102,7 +99,6 @@ const createBuilder = (callbacks) => {
 export const createApp = (callback) => {
     const appKey = {};
     const callbacks = {};
-    let clientInitialized = false;
     let translationInitPromise;
     let serverInitPromise;
     callback(createBuilder(callbacks));
@@ -127,18 +123,7 @@ export const createApp = (callback) => {
             });
             return translationInitPromise;
         }
-        let internalMiddlewares = [];
-        if (!clientInitialized) {
-            beforeNavigate((navigation) => {
-                executeClientMiddlewares(internalMiddlewares, navigation);
-            });
-            clientInitialized = true;
-        }
-        return callbacks.useClient?.({
-            useMiddlewares: (middlewares) => {
-                internalMiddlewares = middlewares;
-            }
-        });
+        return callbacks.useClient?.();
     };
     const runServerInit = () => {
         if (BROWSER)
@@ -184,8 +169,7 @@ export const createApp = (callback) => {
             const serverResult = await callbacks.useServer?.({
                 requestContext,
                 event,
-                resolve,
-                useMiddlewares: executeServerMiddlewares
+                resolve
             });
             if (serverResult)
                 return serverResult;

package/dist/shared/app/index.d.ts

@@ -1,6 +1,8 @@
 export { createApp, type AppClientErrorCallback, type AppClientErrorContext, type AppClientInitLifecycleCallback, type AppClientInitLifecycleContext, type AppClientLifecycleCallback, type AppClientLifecycleContext, type AppRegistrar, type AppServerErrorCallback, type AppServerErrorContext, type AppServerFetchCallback, type AppServerFetchContext, type AppServerInitLifecycleCallback, type AppServerInitLifecycleContext, type AppServerLifecycleCallback, type AppServerLifecycleContext, type AppRerouteCallback, type CreateAppInstance } from './App.js';
 export type { IClientMiddleware, ClientMiddlewareContext, ClientMiddlewareClass } from './middleware/ClientMiddleware.js';
+export { ClientMiddlewareManager } from './middleware/ClientMiddleware.js';
 export type { IServerMiddleware, ServerMiddlewareContext, ServerMiddlewareClass } from './middleware/ServerMiddleware.js';
+export { ServerMiddlewareManager } from './middleware/ServerMiddleware.js';
 export type { IMiddleware, MiddlewareClass } from './middleware/Types.js';
 export type { EnsureRoute, EnsureRouteSource, EnsureRouteTarget } from './middleware/Shared.js';
 export type { AppBootContext, AppBootCallback } from './App.js';

package/dist/shared/app/index.js

@@ -1 +1,3 @@
 export { createApp } from './App.js';
+export { ClientMiddlewareManager } from './middleware/ClientMiddleware.js';
+export { ServerMiddlewareManager } from './middleware/ServerMiddleware.js';

package/dist/shared/app/middleware/ClientMiddleware.d.ts

@@ -13,4 +13,10 @@ export interface IClientMiddleware extends IMiddleware<ClientMiddlewareContext,
     execute(context: ClientMiddlewareContext): undefined;
 }
 export type ClientMiddlewareClass = MiddlewareClass<IClientMiddleware>;
+/** Execute manually, or pass the navigation supplied by beforeNavigate. */
+export declare class ClientMiddlewareManager {
+    private readonly middlewares;
+    constructor(middlewares: readonly ClientMiddlewareClass[]);
+    execute(navigation?: BeforeNavigate): void;
+}
 export declare const executeClientMiddlewares: (middlewares: readonly ClientMiddlewareClass[], navigation?: BeforeNavigate) => void;

package/dist/shared/app/middleware/ClientMiddleware.js

@@ -1,6 +1,19 @@
 import { ensureRoute } from './Shared.js';
 import { page } from '$app/state';
 import { goto } from '$app/navigation';
+import { BROWSER } from '../../../external/tools/index.js';
+/** Execute manually, or pass the navigation supplied by beforeNavigate. */
+export class ClientMiddlewareManager {
+    middlewares;
+    constructor(middlewares) {
+        this.middlewares = [...middlewares];
+    }
+    execute(navigation) {
+        if (!BROWSER)
+            return;
+        executeClientMiddlewares(this.middlewares, navigation);
+    }
+}
 export const executeClientMiddlewares = (middlewares, navigation) => {
     const from = navigation?.from?.url ?? undefined;
     const to = navigation?.to?.url ?? page.url;

package/dist/shared/app/middleware/ServerMiddleware.d.ts

@@ -13,4 +13,10 @@ export interface IServerMiddleware extends IMiddleware<ServerMiddlewareContext,
     execute(context: ServerMiddlewareContext): Promise<void> | void;
 }
 export type ServerMiddlewareClass = MiddlewareClass<IServerMiddleware>;
+/** Stores definitions only; request context and instances are resolved per execution. */
+export declare class ServerMiddlewareManager {
+    private readonly middlewares;
+    constructor(middlewares: readonly ServerMiddlewareClass[]);
+    execute(): Promise<void>;
+}
 export declare const executeServerMiddlewares: (middlewares: readonly ServerMiddlewareClass[]) => Promise<void>;

package/dist/shared/app/middleware/ServerMiddleware.js

@@ -2,6 +2,16 @@ import { error, redirect } from '@sveltejs/kit';
 import { ensureRoute } from './Shared.js';
 import { BROWSER } from '../../../external/tools/index.js';
 import { RequestContext } from '../../../shared/request-context/Internal.js';
+/** Stores definitions only; request context and instances are resolved per execution. */
+export class ServerMiddlewareManager {
+    middlewares;
+    constructor(middlewares) {
+        this.middlewares = [...middlewares];
+    }
+    execute() {
+        return executeServerMiddlewares(this.middlewares);
+    }
+}
 export const executeServerMiddlewares = async (middlewares) => {
     if (!BROWSER && middlewares.length) {
         const event = RequestContext.current().event;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@azure-net/kit",
-  "version": "6.0.0-next.13",
+  "version": "6.0.0-next.15",
   "license": "MIT",
   "author": "Pixel1917",
   "description": "Universal toolkit and library collection, developed as part of the Azure-net ecosystem",