@browserlessapi/inferlo 0.4.0 → 0.6.0

package/dist/route.js

@@ -25,4 +25,28 @@ export const route = {
 export function isRoute(value) {
     return typeof value === "object" && value !== null && value.kind === "inferlo.route";
 }
+/** The routes in route sources: routes, arrays and modules (import * as tickets), named after their exports. */
+export function collectRoutes(sources) {
+    const out = [];
+    const seen = new Set();
+    const visit = (source, name) => {
+        if (!source || typeof source !== "object" || seen.has(source))
+            return;
+        seen.add(source);
+        if (isRoute(source)) {
+            out.push(name && !source.name ? { ...source, name } : source);
+            return;
+        }
+        if (Array.isArray(source)) {
+            for (const item of source)
+                visit(item);
+            return;
+        }
+        for (const [key, value] of Object.entries(source))
+            if (isRoute(value) || Array.isArray(value))
+                visit(value, key === "default" ? undefined : key);
+    };
+    visit(sources);
+    return out;
+}
 //# sourceMappingURL=route.js.map

package/dist/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../src/route.ts"],"names":[],"mappings":"AA6GA,MAAM,OAAO,YAAY;IACd,MAAM,CAAS;IACf,IAAI,CAAO;IACX,OAAO,CAAwB;IAExC,YAAY,MAAc,EAAE,IAAU,EAAE,OAA8B;QACpE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,qFAAqF;IACrF,MAAM,CACJ,OAQC;QAED,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAuC,EAE5I,CAAC;IACJ,CAAC;CACF;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,CAOL,IAAU,EACV,UAAgD,EAAE,EAClD,EAAE,CAAC,IAAI,YAAY,CAAmB,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;IACrB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC;CAC1B,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAAkB,CAAC,IAAI,KAAK,eAAe,CAAC;AACrG,CAAC"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../src/route.ts"],"names":[],"mappings":"AA8JA,MAAM,OAAO,YAAY;IACd,MAAM,CAAS;IACf,IAAI,CAAO;IACX,OAAO,CAAwB;IAExC,YAAY,MAAc,EAAE,IAAU,EAAE,OAA8B;QACpE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,qFAAqF;IACrF,MAAM,CACJ,OAQC;QAED,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAuC,EAE5I,CAAC;IACJ,CAAC;CACF;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,CAOL,IAAU,EACV,UAAgD,EAAE,EAClD,EAAE,CAAC,IAAI,YAAY,CAAmB,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;IACrB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC;CAC1B,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAAkB,CAAC,IAAI,KAAK,eAAe,CAAC;AACrG,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,MAAe,EAAE,IAAa,EAAE,EAAE;QAC/C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QACtE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnJ,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,CAAC;IACf,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/secure-headers.d.ts

@@ -0,0 +1,8 @@
+/** Header name to value; false leaves the header out. Names are case-insensitive. */
+export type SecureHeadersConfig = Record<string, string | false>;
+/** Sent on every response by default. Strict-Transport-Security is sent only over HTTPS. */
+export declare const DEFAULT_SECURE_HEADERS: Readonly<Record<string, string>>;
+/** The headers to send (lowercase names), from createApp({ secureHeaders }). */
+export declare function resolveSecureHeaders(option: boolean | SecureHeadersConfig | undefined): [string, string][];
+/** Add the headers the response does not set itself. Strict-Transport-Security only when the request came over HTTPS. */
+export declare function applySecureHeaders(response: Response, headers: [string, string][], https: boolean): Response;

package/dist/secure-headers.js

@@ -0,0 +1,61 @@
+/**
+ * Secure response headers, sent on every response unless the response already has the header:
+ *
+ *   createApp({ secureHeaders: { "X-Frame-Options": "SAMEORIGIN", "Content-Security-Policy": false } })
+ *   createApp({ secureHeaders: false })   // none of them
+ */
+import { InferloError } from "./errors.js";
+/** Sent on every response by default. Strict-Transport-Security is sent only over HTTPS. */
+export const DEFAULT_SECURE_HEADERS = Object.freeze({
+    "content-security-policy": "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'",
+    "cross-origin-opener-policy": "same-origin",
+    "cross-origin-resource-policy": "same-origin",
+    "referrer-policy": "no-referrer",
+    "strict-transport-security": "max-age=31536000; includeSubDomains",
+    "x-content-type-options": "nosniff",
+    "x-frame-options": "DENY",
+});
+const HSTS = "strict-transport-security";
+const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+/** The headers to send (lowercase names), from createApp({ secureHeaders }). */
+export function resolveSecureHeaders(option) {
+    if (option === false)
+        return [];
+    const fix = 'Use createApp({ secureHeaders: { "X-Frame-Options": "SAMEORIGIN", "Content-Security-Policy": false } }), or secureHeaders: false to send none.';
+    if (option !== undefined && option !== true && (typeof option !== "object" || option === null || Array.isArray(option))) {
+        throw new InferloError("IL6016", `secureHeaders must be true, false or an object of header names, got ${JSON.stringify(option)}.`, { fix });
+    }
+    const headers = new Map(Object.entries(DEFAULT_SECURE_HEADERS));
+    for (const [name, value] of Object.entries(typeof option === "object" ? option : {})) {
+        if (!TOKEN.test(name))
+            throw new InferloError("IL6016", `secureHeaders: "${name}" is not a valid header name.`, { fix });
+        if (value === false) {
+            headers.delete(name.toLowerCase());
+            continue;
+        }
+        if (typeof value !== "string" || /[\r\n\0]/.test(value)) {
+            throw new InferloError("IL6016", `secureHeaders["${name}"] must be a string (without line breaks) or false, got ${JSON.stringify(value)}.`, { fix });
+        }
+        headers.set(name.toLowerCase(), value);
+    }
+    return [...headers];
+}
+/** Add the headers the response does not set itself. Strict-Transport-Security only when the request came over HTTPS. */
+export function applySecureHeaders(response, headers, https) {
+    const missing = headers.filter(([name]) => (name !== HSTS || https) && !response.headers.has(name));
+    if (!missing.length)
+        return response;
+    try {
+        for (const [name, value] of missing)
+            response.headers.set(name, value);
+        return response;
+    }
+    catch {
+        // Immutable headers (Response.redirect, a fetch() response passed through): copy the response.
+        const copy = new Response(response.body, response);
+        for (const [name, value] of missing)
+            copy.headers.set(name, value);
+        return copy;
+    }
+}
+//# sourceMappingURL=secure-headers.js.map

package/dist/secure-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-headers.js","sourceRoot":"","sources":["../src/secure-headers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAK3C,4FAA4F;AAC5F,MAAM,CAAC,MAAM,sBAAsB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACpF,yBAAyB,EAAE,oGAAoG;IAC/H,4BAA4B,EAAE,aAAa;IAC3C,8BAA8B,EAAE,aAAa;IAC7C,iBAAiB,EAAE,aAAa;IAChC,2BAA2B,EAAE,qCAAqC;IAClE,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,MAAM;CAC1B,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,2BAA2B,CAAC;AACzC,MAAM,KAAK,GAAG,+BAA+B,CAAC;AAE9C,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,MAAiD;IACpF,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,gJAAgJ,CAAC;IAC7J,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACxH,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,uEAAuE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9I,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,mBAAmB,IAAI,+BAA+B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACzH,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,kBAAkB,IAAI,2DAA2D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACvJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,kBAAkB,CAAC,QAAkB,EAAE,OAA2B,EAAE,KAAc;IAChG,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpG,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IACrC,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO;YAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,+FAA+F;QAC/F,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/serve.d.ts

@@ -1,4 +1,3 @@
-/** Start an HTTP server on Bun, Deno or Node using the app's fetch handler. */
 import type { App } from "./app.ts";
 export interface ServeOptions {
     port?: number;
@@ -8,4 +7,76 @@ export interface Server {
     port: number;
     close(): Promise<void>;
 }
+/**
+ * The parts of a Node.js http.IncomingMessage that Inferlo reads. Express, Fastify (request.raw),
+ * NestJS, Koa (ctx.req) and plain node:http requests all have this shape.
+ */
+export interface NodeRequest {
+    method?: string;
+    url?: string;
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        remoteAddress?: string;
+        encrypted?: boolean;
+    } | null;
+    /**
+     * A body the host framework already read (express.json(), body-parser): a string, bytes, or a plain object or
+     * array. Used instead of the stream. Instances of other classes are ignored and the stream is read.
+     */
+    body?: unknown;
+    [Symbol.asyncIterator](): AsyncIterator<unknown>;
+}
+/** The parts of a Node.js http.ServerResponse that Inferlo writes to. */
+export interface NodeResponse {
+    readonly headersSent: boolean;
+    readonly writableFinished?: boolean;
+    writeHead(status: number, headers: Record<string, string | string[]>): unknown;
+    write(chunk: Uint8Array): boolean;
+    end(chunk?: string): unknown;
+    once(event: "drain", listener: () => void): unknown;
+    on(event: "close", listener: () => void): unknown;
+}
+export interface NodeHandlerOptions {
+    /**
+     * Path the app is mounted under, for example "/ai". It is removed from the URL before routing, so
+     * GET /ai/tickets matches route.get("/tickets"). Requests outside it go to next() (or get a 404).
+     * Leave it out when the host framework already strips the mount path (Express app.use("/ai", ...)).
+     */
+    prefix?: string;
+    /**
+     * Pass requests the app has no route for (by method and path, outside its OpenAPI, MCP, health and metrics
+     * endpoints) to the host framework's next() instead of answering 404 or 405. Mount the app before the host's
+     * routes with it, to move routes to Inferlo one at a time at the same URLs. Needs an app from createApp and
+     * a host that calls the handler with next (Express, NestJS, Connect). Default false.
+     */
+    fallthrough?: boolean;
+}
+export interface FromNodeRequestOptions extends NodeHandlerOptions {
+    /** Aborts the request (for example when the client disconnects). */
+    signal?: AbortSignal;
+}
+export type NodeHandler = (req: NodeRequest, res: NodeResponse, next?: (error?: unknown) => void) => Promise<void>;
+export declare function normalizePrefix(prefix: string | undefined): string;
+/** The path and query of a Node request with the prefix removed, or null when it is outside the prefix. */
+export declare function stripPrefix(rawUrl: string, prefix: string): string | null;
+/**
+ * Whether toNodeHandler(app, { prefix, fallthrough: true }) answers a Node request itself instead of passing it
+ * on. For hosts that must decide before handing the request over, such as a Fastify onRequest hook.
+ */
+export declare function answersNodeRequest(app: object, req: Pick<NodeRequest, "url" | "method">, prefix?: string): boolean;
+export declare function buildRequest(req: NodeRequest, path: string, signal?: AbortSignal): Request;
+/**
+ * Convert a Node.js request (node:http, Express, Fastify's request.raw, NestJS) to a Web Request.
+ * With prefix, the prefix is removed from the path; a request outside it keeps its path.
+ */
+export declare function fromNodeRequest(req: NodeRequest, options?: FromNodeRequestOptions): Request;
+/** Write a Web Response (status, headers with every Set-Cookie, streamed body) to a Node response. */
+export declare function writeResponse(res: NodeResponse, response: Response, method: string): Promise<void>;
+/**
+ * A (req, res, next) handler that runs a whole Inferlo app (routes, OpenAPI, MCP) inside node:http,
+ * Express, Fastify, NestJS or any framework that hands out Node requests and responses.
+ */
+export declare function toNodeHandler(app: Pick<App<any>, "fetch">, options?: NodeHandlerOptions): NodeHandler;
 export declare function serve(app: Pick<App<any>, "fetch">, options?: ServeOptions): Promise<Server>;
+/** Closes every open connection of a Node server from serve(), for app.close() after its timeout. */
+export declare const forceClosers: WeakMap<Server, () => void>;

package/dist/serve.js

@@ -1,86 +1,226 @@
+/**
+ * Run an app's fetch handler as an HTTP server (Bun, Deno or Node), or inside another Node framework:
+ *
+ *   await serve(app, { port: 3000 })
+ *   expressApp.use("/ai", toNodeHandler(app))                     // Express strips the mount path
+ *   http.createServer(toNodeHandler(app, { prefix: "/ai" }))       // or strip it with prefix
+ */
+import { createRedactor } from "./redact.js";
+import { appAnswers } from "./request-matcher.js";
+import { InferloError } from "./errors.js";
 import { clientIps } from "./client-ip.js";
-export async function serve(app, options = {}) {
-    const port = options.port ?? 3000;
-    const hostname = options.hostname ?? "0.0.0.0";
-    const g = globalThis;
-    if (g.Bun) {
-        const server = g.Bun.serve({ port, hostname, fetch: (req, bunServer) => app.fetch(req, bunServer) });
-        return { port: server.port, close: async () => server.stop(true) };
+export function normalizePrefix(prefix) {
+    if (!prefix || prefix === "/")
+        return "";
+    return ("/" + prefix.replace(/^\/+|\/+$/g, "")).replace(/\/+/g, "/");
+}
+/** The path and query of a Node request with the prefix removed, or null when it is outside the prefix. */
+export function stripPrefix(rawUrl, prefix) {
+    const url = rawUrl.startsWith("/") ? rawUrl : "/" + rawUrl;
+    if (!prefix)
+        return url;
+    if (!url.startsWith(prefix))
+        return null;
+    const rest = url.slice(prefix.length);
+    if (rest === "" || rest[0] === "?")
+        return "/" + rest;
+    if (rest[0] !== "/")
+        return null;
+    return rest;
+}
+/** Whether the app answers a method and a path (with query, prefix already removed) itself. */
+function answersPath(app, method, path) {
+    let pathname = path.split("?")[0];
+    try {
+        pathname = new URL(pathname, "http://localhost").pathname;
     }
-    if (g.Deno) {
-        const server = g.Deno.serve({ port, hostname }, (req, info) => app.fetch(req, info));
-        return { port: server.addr.port, close: () => server.shutdown() };
+    catch {
+        // Leave a path the URL parser rejects to the app, which answers it.
     }
-    const http = await import("node:http");
-    const { Readable } = await import("node:stream");
-    const server = http.createServer(async (req, res) => {
-        try {
-            const host = req.headers.host ?? `localhost:${port}`;
-            const url = new URL(req.url ?? "/", `http://${host}`);
-            const headers = new Headers();
-            for (const [k, v] of Object.entries(req.headers)) {
-                if (v === undefined)
-                    continue;
-                if (Array.isArray(v))
-                    for (const item of v)
-                        headers.append(k, item);
-                else
-                    headers.set(k, v);
+    return appAnswers(app, method, pathname) === true;
+}
+/**
+ * Whether toNodeHandler(app, { prefix, fallthrough: true }) answers a Node request itself instead of passing it
+ * on. For hosts that must decide before handing the request over, such as a Fastify onRequest hook.
+ */
+export function answersNodeRequest(app, req, prefix) {
+    const path = stripPrefix(req.url ?? "/", normalizePrefix(prefix));
+    return path !== null && answersPath(app, req.method ?? "GET", path);
+}
+function bodyStream(req) {
+    const iterator = req[Symbol.asyncIterator]();
+    return new ReadableStream({
+        async pull(controller) {
+            try {
+                const { value, done } = await iterator.next();
+                if (done)
+                    return controller.close();
+                controller.enqueue(typeof value === "string" ? new TextEncoder().encode(value) : value);
+            }
+            catch (error) {
+                controller.error(error);
             }
-            const hasBody = req.method !== "GET" && req.method !== "HEAD";
+        },
+        async cancel() {
+            await iterator.return?.();
+        },
+    });
+}
+/**
+ * True when req.body holds a body the host framework already read: a string or bytes (body-parser text and
+ * raw), or a plain object or array (express.json(), urlencoded forms). An instance of some other class is the
+ * host's own object, such as the body reader of an Encore raw request, and the stream is read instead.
+ */
+function isParsedBody(body) {
+    if (body === undefined)
+        return false;
+    if (body === null || typeof body !== "object" || body instanceof Uint8Array || Array.isArray(body))
+        return true;
+    const proto = Object.getPrototypeOf(body);
+    return proto === Object.prototype || proto === null;
+}
+export function buildRequest(req, path, signal) {
+    const host = [req.headers.host].flat()[0] ?? "localhost";
+    const url = new URL(path, `${req.socket?.encrypted ? "https" : "http"}://${host}`);
+    const headers = new Headers();
+    for (const [k, v] of Object.entries(req.headers)) {
+        if (v === undefined || k.startsWith(":"))
+            continue;
+        if (Array.isArray(v))
+            for (const item of v)
+                headers.append(k, item);
+        else
+            headers.set(k, v);
+    }
+    const method = (req.method ?? "GET").toUpperCase();
+    let body;
+    if (method !== "GET" && method !== "HEAD") {
+        if (isParsedBody(req.body)) {
+            // The host framework already read the stream: use what it parsed.
+            headers.delete("content-length");
+            if (typeof req.body === "string" || req.body instanceof Uint8Array)
+                body = req.body;
+            else {
+                body = JSON.stringify(req.body);
+                headers.set("content-type", "application/json");
+            }
+        }
+        else
+            body = bodyStream(req);
+    }
+    const request = new Request(url, {
+        method,
+        headers,
+        body,
+        signal,
+        // @ts-expect-error duplex is required by Node for streaming bodies
+        duplex: "half",
+    });
+    if (req.socket?.remoteAddress)
+        clientIps.set(request, req.socket.remoteAddress);
+    return request;
+}
+/**
+ * Convert a Node.js request (node:http, Express, Fastify's request.raw, NestJS) to a Web Request.
+ * With prefix, the prefix is removed from the path; a request outside it keeps its path.
+ */
+export function fromNodeRequest(req, options = {}) {
+    const raw = req.url ?? "/";
+    const path = stripPrefix(raw, normalizePrefix(options.prefix)) ?? (raw.startsWith("/") ? raw : "/" + raw);
+    return buildRequest(req, path, options.signal);
+}
+/** Write a Web Response (status, headers with every Set-Cookie, streamed body) to a Node response. */
+export async function writeResponse(res, response, method) {
+    const outHeaders = {};
+    response.headers.forEach((value, key) => {
+        if (key === "set-cookie")
+            return;
+        outHeaders[key] = value;
+    });
+    const cookies = response.headers.getSetCookie?.() ?? [];
+    if (cookies.length)
+        outHeaders["set-cookie"] = cookies;
+    res.writeHead(response.status, outHeaders);
+    if (!response.body || method === "HEAD")
+        return void res.end();
+    const reader = response.body.getReader();
+    while (true) {
+        const { value, done } = await reader.read();
+        if (done)
+            break;
+        if (!res.write(value))
+            await new Promise((r) => res.once("drain", () => r()));
+    }
+    res.end();
+}
+/**
+ * A (req, res, next) handler that runs a whole Inferlo app (routes, OpenAPI, MCP) inside node:http,
+ * Express, Fastify, NestJS or any framework that hands out Node requests and responses.
+ */
+export function toNodeHandler(app, options = {}) {
+    const prefix = normalizePrefix(options.prefix);
+    if (options.fallthrough !== undefined && typeof options.fallthrough !== "boolean") {
+        throw new InferloError("IL5019", "toNodeHandler fallthrough must be true or false.", { fix: "Use toNodeHandler(app, { fallthrough: true })." });
+    }
+    if (options.fallthrough && appAnswers(app, "GET", "/") === undefined) {
+        throw new InferloError("IL5019", "toNodeHandler(app, { fallthrough: true }) needs an app from createApp.", {
+            fix: "Pass the app returned by createApp, which knows its routes; a plain fetch handler cannot tell which requests to pass on.",
+        });
+    }
+    return async (req, res, next) => {
+        const path = stripPrefix(req.url ?? "/", prefix);
+        if (path === null && next)
+            return next();
+        if (options.fallthrough && next && path !== null && !answersPath(app, req.method ?? "GET", path))
+            return next();
+        try {
             const controller = new AbortController();
             res.on("close", () => {
                 if (!res.writableFinished)
                     controller.abort();
             });
-            const request = new Request(url, {
-                method: req.method,
-                headers,
-                body: hasBody ? Readable.toWeb(req) : undefined,
-                signal: controller.signal,
-                // @ts-expect-error duplex is required by Node for streaming bodies
-                duplex: "half",
-            });
-            if (req.socket.remoteAddress)
-                clientIps.set(request, req.socket.remoteAddress);
+            const request = buildRequest(req, path ?? (req.url ?? "/"), controller.signal);
             const response = await app.fetch(request);
-            const outHeaders = {};
-            response.headers.forEach((value, key) => {
-                if (key === "set-cookie")
-                    return;
-                outHeaders[key] = value;
-            });
-            const cookies = response.headers.getSetCookie?.() ?? [];
-            if (cookies.length)
-                outHeaders["set-cookie"] = cookies;
-            res.writeHead(response.status, outHeaders);
-            if (!response.body || req.method === "HEAD")
-                return void res.end();
-            const reader = response.body.getReader();
-            while (true) {
-                const { value, done } = await reader.read();
-                if (done)
-                    break;
-                if (!res.write(value))
-                    await new Promise((r) => res.once("drain", r));
-            }
-            res.end();
+            await writeResponse(res, response, request.method);
         }
         catch (error) {
-            console.error("[inferlo] server error", error);
+            console.error("[inferlo] server error", createRedactor([]).value(error));
             if (!res.headersSent)
                 res.writeHead(500, { "content-type": "application/json" });
             res.end(JSON.stringify({ error: { code: "IL9000", message: "Internal server error" } }));
         }
-    });
+    };
+}
+export async function serve(app, options = {}) {
+    const port = options.port ?? 3000;
+    const hostname = options.hostname ?? "0.0.0.0";
+    const g = globalThis;
+    if (g.Bun) {
+        const server = g.Bun.serve({ port, hostname, fetch: (req, bunServer) => app.fetch(req, bunServer) });
+        return { port: server.port, close: async () => server.stop(true) };
+    }
+    if (g.Deno) {
+        const server = g.Deno.serve({ port, hostname }, (req, info) => app.fetch(req, info));
+        return { port: server.addr.port, close: () => server.shutdown() };
+    }
+    const http = await import("node:http");
+    const handler = toNodeHandler(app);
+    const server = http.createServer((req, res) => void handler(req, res));
     await new Promise((resolve, reject) => {
         server.once("error", reject);
         server.listen(port, hostname, () => resolve());
     });
     const address = server.address();
-    return {
+    const result = {
         port: typeof address === "object" && address ? address.port : port,
-        close: () => new Promise((resolve) => server.close(() => resolve())),
+        close: () => new Promise((resolve) => {
+            server.close(() => resolve());
+            server.closeIdleConnections();
+        }),
     };
+    forceClosers.set(result, () => server.closeAllConnections());
+    return result;
 }
+/** Closes every open connection of a Node server from serve(), for app.close() after its timeout. */
+export const forceClosers = new WeakMap();
 //# sourceMappingURL=serve.js.map

package/dist/serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAY3C,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAA4B,EAAE,UAAwB,EAAE;IAClF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC/C,MAAM,CAAC,GAAG,UAGT,CAAC;IAEF,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAY,EAAE,SAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACvH,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACrF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,aAAa,IAAI,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,KAAK,SAAS;oBAAE,SAAS;gBAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,KAAK,MAAM,IAAI,IAAI,CAAC;wBAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;;oBAC/D,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzB,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;YAC9D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,GAAG,CAAC,gBAAgB;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YAChD,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;gBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC,CAAC,CAAC,SAAS;gBACnE,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,mEAAmE;gBACnE,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa;gBAAE,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC/E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAsC,EAAE,CAAC;YACzD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtC,IAAI,GAAG,KAAK,YAAY;oBAAE,OAAO;gBACjC,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;YACxD,IAAI,OAAO,CAAC,MAAM;gBAAE,UAAU,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;YACvD,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACjF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,OAAO;QACL,IAAI,EAAE,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAClE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;KAC3E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA+D3C,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,GAAG,GAAG,IAAI,CAAC;IACtD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,SAAS,WAAW,CAAC,GAAW,EAAE,MAAc,EAAE,IAAY;IAC5D,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAwC,EAAE,MAAe;IACvG,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,OAAO,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAC7C,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC9C,IAAI,IAAI;oBAAE,OAAO,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpC,UAAU,CAAC,OAAO,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAoB,CAAC,CAAC;YAC1G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,YAAY,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChH,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,IAAY,EAAE,MAAoB;IAC/E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,KAAK,MAAM,IAAI,IAAI,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;;YAC/D,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,IAA2C,CAAC;IAChD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kEAAkE;YAClE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACjC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,YAAY,UAAU;gBAAE,IAAI,GAAG,GAAG,CAAC,IAAgB,CAAC;iBAC3F,CAAC;gBACJ,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;;YAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;QAC/B,MAAM;QACN,OAAO;QACP,IAAI;QACJ,MAAM;QACN,mEAAmE;QACnE,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa;QAAE,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAgB,EAAE,UAAkC,EAAE;IACpF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAC1G,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAiB,EAAE,QAAkB,EAAE,MAAc;IACvF,MAAM,UAAU,GAAsC,EAAE,CAAC;IACzD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,GAAG,KAAK,YAAY;YAAE,OAAO;QACjC,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM;QAAE,UAAU,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;IACvD,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAA4B,EAAE,UAA8B,EAAE;IAC1F,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClF,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,kDAAkD,EAAE,EAAE,GAAG,EAAE,gDAAgD,EAAE,CAAC,CAAC;IAClJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;QACrE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,wEAAwE,EAAE;YACzG,GAAG,EAAE,0HAA0H;SAChI,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAChH,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,GAAG,CAAC,gBAAgB;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YAChD,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACjF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAA4B,EAAE,UAAwB,EAAE;IAClF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC/C,MAAM,CAAC,GAAG,UAGT,CAAC;IAEF,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAY,EAAE,SAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACvH,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACrF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,GAAkB,EAAE,GAAG,CAAC,CAAC,CAAC;IACtF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAW;QACrB,IAAI,EAAE,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAClE,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,CAAC,CAAC;KACL,CAAC;IACF,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,EAAsB,CAAC"}

package/dist/sessions.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Cookie sessions for browser apps: signed, HttpOnly cookies and CSRF protection, with no session table.
+ *
+ *   export const session = sessions({
+ *     secret: config.SESSION_SECRET,
+ *     user: ({ userId }, { db }) => db.users.find(userId),
+ *   });
+ *   createApp({ auth: session, ... });
+ *
+ *   // in a login route (auth: "public"), after checking the password:
+ *   const { csrfToken } = await session.signIn(ctx, user.id);
+ *   // in a logout route:
+ *   session.signOut(ctx);
+ *
+ * Requests that change data (POST, PUT, PATCH, DELETE) with a session cookie must send the CSRF token in an
+ * X-CSRF-Token header or a _csrf form field, or they are rejected with IL3005.
+ */
+import type { AuthConfig } from "./app.ts";
+import type { AppDb, AppUser } from "./route.ts";
+export interface SessionData {
+    /** The id passed to session.signIn(ctx, userId). */
+    userId: string;
+    /** When the session was created (milliseconds since 1970). Compare it to a "signed out everywhere" time to revoke older sessions. */
+    issuedAt: number;
+}
+export interface SessionCookieOptions {
+    /** Cookie name. Default "inferlo_session"; the CSRF cookie is the same name with "_csrf" added. */
+    name?: string;
+    /** SameSite attribute. Default "lax" (links from other sites keep the session, cross-site form posts do not send it). */
+    sameSite?: "lax" | "strict";
+    /** Secure attribute. Default true, except for plain http on localhost, 127.0.0.1 and ::1 during development. */
+    secure?: boolean;
+    /** Domain attribute, to share the session with subdomains. Default: none (only the host that set it). */
+    domain?: string;
+    /** Path attribute. Default "/". */
+    path?: string;
+}
+export interface SessionsOptions {
+    /**
+     * The signing secret, at least 32 characters: keep it in config({ secrets }). To rotate it, pass
+     * [newSecret, oldSecret]: new sessions are signed with the first, and sessions signed with any of them stay valid.
+     */
+    secret: string | readonly string[];
+    /** Load the signed-in user for a session, or return null to end it (deleted or disabled users, revoked sessions). */
+    user: (session: SessionData, ctx: {
+        db: AppDb;
+        req: Request;
+    }) => AppUser | null | undefined | Promise<AppUser | null | undefined>;
+    /** How long a session lasts after sign-in, in milliseconds. Default 7 days; 1 minute to 400 days. */
+    maxAgeMs?: number;
+    cookie?: SessionCookieOptions;
+    /** Roles of a user, checked when a route uses auth: "<role>". Default: user.roles ?? []. */
+    roles?: (user: AppUser) => string[];
+}
+/** What session.signIn and session.signOut need from the route context. */
+export interface SessionResponseContext {
+    url: URL;
+    header(name: string, value: string): void;
+}
+/** createApp({ auth: session }) with sign-in, sign-out and the CSRF token of the current session. */
+export interface Sessions extends AuthConfig {
+    /** Start a session for this user: sets the session and CSRF cookies. Returns the CSRF token to send with changes. */
+    signIn(ctx: SessionResponseContext, userId: string): Promise<{
+        csrfToken: string;
+    }>;
+    /** End the session: clears both cookies. */
+    signOut(ctx: SessionResponseContext): void;
+    /** The CSRF token of the request's session (to put in a form's _csrf field), or null without a valid session. */
+    csrfToken(req: Request): Promise<string | null>;
+}
+/** Signed cookie sessions with CSRF protection: createApp({ auth: sessions({ secret, user }) }). */
+export declare function sessions(options: SessionsOptions): Sessions;