@craft-ts/core 0.7.0-beta.13 → 0.7.0-beta.16

package/src/lib/host/craft-linked-signal.d.ts

@@ -1,4 +1,4 @@
-import { Injector, type ValueEqualityFn, type WritableSignal } from './craft-compat';
+import { Injector, type ValueEqualityFn, type WritableSignal } from './craft-compat.js';
 type PreviousValue<Source, Value> = {
     readonly source: Source;
     readonly value: Value;
@@ -14,4 +14,3 @@ export declare function craftLinkedSignal<Source, Value>(options: {
     readonly injector?: Injector;
 }): CraftLinkedSignal<Value>;
 export {};
-//# sourceMappingURL=craft-linked-signal.d.ts.map

package/src/lib/host/craft-linked-signal.js

@@ -1,5 +1,5 @@
-import { DestroyRef, inject, linkedSignal, signal, untracked, } from './craft-compat';
-import { craftWatch } from './craft-signal';
+import { DestroyRef, inject, linkedSignal, signal, untracked, } from './craft-compat.js';
+import { craftWatch } from './craft-signal.js';
 /**
  * A linked signal bridged to Craft-native dependencies.
  *
@@ -83,4 +83,3 @@ export function craftLinkedSignal(options) {
     };
     return Object.assign(value, { destroy });
 }
-//# sourceMappingURL=craft-linked-signal.js.map

package/src/lib/host/craft-router-runtime.d.ts

@@ -58,4 +58,3 @@ export declare function sliceCraftMatchForOutlet(match: CraftMatch): {
 export declare function matchCraftRoutesAsync(routes: unknown, location: CraftLocation): Promise<CraftMatch | null>;
 export declare function buildPathFromTemplate(template: string, params?: Record<string, string>): string;
 export declare function createUrlFromParts(pathname: string, queryParams?: Record<string, string | undefined> | null, fragment?: string | null): string;
-//# sourceMappingURL=craft-router-runtime.d.ts.map

package/src/lib/host/craft-router-runtime.js

@@ -453,4 +453,3 @@ export function createUrlFromParts(pathname, queryParams, fragment) {
         : '';
     return `${pathname}${search}${hash}`;
 }
-//# sourceMappingURL=craft-router-runtime.js.map

package/src/lib/host/craft-router-types.d.ts

@@ -3,7 +3,7 @@
  * `craftRoutes` type graph still names. The DSL is unchanged; only the host
  * types are local.
  */
-import { InjectionToken } from './craft-compat';
+import { InjectionToken } from './craft-compat.js';
 export type Data = Record<string, unknown>;
 export type UrlSegment = {
     path: string;
@@ -81,4 +81,3 @@ export declare abstract class TitleStrategy {
     abstract updateTitle(snapshot: RouterStateSnapshot): void;
     buildTitle(snapshot: RouterStateSnapshot): string | undefined;
 }
-//# sourceMappingURL=craft-router-types.d.ts.map

package/src/lib/host/craft-router-types.js

@@ -3,7 +3,7 @@
  * `craftRoutes` type graph still names. The DSL is unchanged; only the host
  * types are local.
  */
-import { InjectionToken } from './craft-compat';
+import { InjectionToken } from './craft-compat.js';
 /**
  * Emitted once a navigation has committed. Craft's own navigation stream
  * reports the same two moments Angular's did, so trace consumers keep working.
@@ -32,4 +32,3 @@ export class TitleStrategy {
         return title;
     }
 }
-//# sourceMappingURL=craft-router-types.js.map

package/src/lib/host/craft-signal.d.ts

@@ -42,4 +42,3 @@ export declare function craftBatch<T>(fn: () => T): T;
 export declare function untracked<T>(fn: () => T): T;
 export declare function isCraftSignal(value: unknown): value is CraftSignal<unknown>;
 export {};
-//# sourceMappingURL=craft-signal.d.ts.map

package/src/lib/host/craft-signal.js

@@ -1,5 +1,5 @@
 import { computed, effect, endBatch, setActiveSub, signal, startBatch, } from 'alien-signals';
-import { RAW_REACTIVE_VALUE } from '../reactive-read';
+import { RAW_REACTIVE_VALUE } from '../reactive-read.js';
 // alien-signals v3 flushes effects synchronously. Outlet view-transition
 // swaps also run CRAFT_SYNC_TEMPLATE_FLUSH inside startViewTransition.
 export const CRAFT_SIGNAL = Symbol('craft-signal');
@@ -158,4 +158,3 @@ export function isCraftSignal(value) {
     return (typeof value === 'function' &&
         value[CRAFT_SIGNAL] === true);
 }
-//# sourceMappingURL=craft-signal.js.map

package/src/lib/host/craft-test-bed.d.ts

@@ -1,5 +1,5 @@
-import { type CraftInjector } from './craft-injector';
-import { type ProviderToken } from './craft-compat';
+import { type CraftInjector } from './craft-injector.js';
+import { type ProviderToken } from './craft-compat.js';
 export type CraftComponentFixture<T = unknown> = {
     readonly nativeElement: HTMLElement;
     readonly componentInstance: T;
@@ -60,4 +60,3 @@ declare class CraftTestBed {
 }
 export declare const TestBed: CraftTestBed;
 export {};
-//# sourceMappingURL=craft-test-bed.d.ts.map

package/src/lib/host/craft-test-bed.js

@@ -1,5 +1,5 @@
-import { createCraftInjector, } from './craft-injector';
-import { createEnvironmentInjector, getCraftRootDefaultProviders, ɵdestroyCraftDestroyRef, } from './craft-compat';
+import { createCraftInjector, } from './craft-injector.js';
+import { createEnvironmentInjector, getCraftRootDefaultProviders, ɵdestroyCraftDestroyRef, } from './craft-compat.js';
 let mounter;
 /**
  * `@craft-ts/component` installs the renderer here on import — core has no way
@@ -111,4 +111,3 @@ class CraftTestBed {
     }
 }
 export const TestBed = new CraftTestBed();
-//# sourceMappingURL=craft-test-bed.js.map

package/src/lib/host-tag.d.ts

@@ -1,2 +1 @@
-export { type CraftTrackTags, ɵHOST_NAME_META_DATA as HOST_NAME_META_DATA, ɵHOST_TAG_LIST as HOST_TAG_LIST, ɵTRACK_TAGS_LIST as TRACK_TAGS_LIST, ɵHostNameToProvide as HostNameToProvide, ɵHostName as HostName, ɵHostTag as HostTag, ɵTrackTags as TrackTags, type TrackTag, ɵinjectHostName as injectHostName, ɵinjectTrackTags as injectTrackTags, ɵprovideHostName as provideHostName, ɵprovideTrackTags as provideTrackTags, } from './craft-service';
-//# sourceMappingURL=host-tag.d.ts.map
+export { type CraftTrackTags, ɵHOST_NAME_META_DATA as HOST_NAME_META_DATA, ɵHOST_TAG_LIST as HOST_TAG_LIST, ɵTRACK_TAGS_LIST as TRACK_TAGS_LIST, ɵHostNameToProvide as HostNameToProvide, ɵHostName as HostName, ɵHostTag as HostTag, ɵTrackTags as TrackTags, type TrackTag, ɵinjectHostName as injectHostName, ɵinjectTrackTags as injectTrackTags, ɵprovideHostName as provideHostName, ɵprovideTrackTags as provideTrackTags, } from './craft-service.js';

package/src/lib/host-tag.js

@@ -1,2 +1 @@
-export { ɵHOST_NAME_META_DATA as HOST_NAME_META_DATA, ɵHOST_TAG_LIST as HOST_TAG_LIST, ɵTRACK_TAGS_LIST as TRACK_TAGS_LIST, ɵHostNameToProvide as HostNameToProvide, ɵHostName as HostName, ɵHostTag as HostTag, ɵTrackTags as TrackTags, ɵinjectHostName as injectHostName, ɵinjectTrackTags as injectTrackTags, ɵprovideHostName as provideHostName, ɵprovideTrackTags as provideTrackTags, } from './craft-service';
-//# sourceMappingURL=host-tag.js.map
+export { ɵHOST_NAME_META_DATA as HOST_NAME_META_DATA, ɵHOST_TAG_LIST as HOST_TAG_LIST, ɵTRACK_TAGS_LIST as TRACK_TAGS_LIST, ɵHostNameToProvide as HostNameToProvide, ɵHostName as HostName, ɵHostTag as HostTag, ɵTrackTags as TrackTags, ɵinjectHostName as injectHostName, ɵinjectTrackTags as injectTrackTags, ɵprovideHostName as provideHostName, ɵprovideTrackTags as provideTrackTags, } from './craft-service.js';

package/src/lib/http-server.d.ts

@@ -0,0 +1,156 @@
+export type HttpMethod = 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS';
+export type CachePolicy = 'no-store' | 'no-cache' | 'private' | 'public';
+export type RequestLogger = Readonly<{
+    debug(event: string, data?: Readonly<Record<string, unknown>>): void;
+    info(event: string, data?: Readonly<Record<string, unknown>>): void;
+    warn(event: string, data?: Readonly<Record<string, unknown>>): void;
+    error(event: string, data?: Readonly<Record<string, unknown>>): void;
+}>;
+export type HttpMetricsEntry = Readonly<{
+    method: string;
+    path: string;
+    status: number;
+    durationMs: number;
+}>;
+export type HttpMetricsSnapshot = Readonly<{
+    requests: number;
+    errors: number;
+    totalDurationMs: number;
+    maxDurationMs: number;
+    statusCounts: Readonly<Record<string, number>>;
+}>;
+export type HttpMetrics = Readonly<{
+    record(entry: HttpMetricsEntry): void;
+    snapshot(): HttpMetricsSnapshot;
+    reset(): void;
+}>;
+export type RateLimitDecision = Readonly<{
+    allowed: boolean;
+    limit: number;
+    remaining: number;
+    resetAt: number;
+}>;
+export type RateLimitStore = Readonly<{
+    consume(key: string, limit: number, windowMs: number, now: number): RateLimitDecision;
+}>;
+export type RateLimitMiddlewareOptions<User = unknown, Services = unknown> = Readonly<{
+    limit: number;
+    windowMs: number;
+    /**
+     * Identifie l'appelant (IP validée par le proxy, identifiant de session…).
+     * Obligatoire : une clé constante ferait qu'un seul client épuise le quota
+     * de tous les autres.
+     */
+    key: (request: Request, context: RequestContext<User, Services>) => string;
+    skip?: (request: Request) => boolean;
+    store?: RateLimitStore;
+    now?: () => number;
+}>;
+export type RequestContext<User = unknown, Services = unknown> = Readonly<{
+    request: Request;
+    requestId: string;
+    signal: AbortSignal;
+    /** Résolu après les gardes d'entrée, jamais avant. */
+    user?: User;
+    services?: Services;
+    params: Readonly<Record<string, string>>;
+    logger: RequestLogger;
+    /** Nonce par requête, à reporter dans la CSP et sur les styles rendus. */
+    cspNonce: string;
+}>;
+export type ServerRoute<User = unknown, Services = unknown> = Readonly<{
+    method: HttpMethod;
+    path: string;
+    handler: (request: Request, context: RequestContext<User, Services>) => Response | Promise<Response>;
+    auth?: 'public' | 'required';
+    csrf?: boolean;
+    cache?: CachePolicy;
+}>;
+export type ServerMiddleware<User = unknown, Services = unknown> = (request: Request, context: RequestContext<User, Services>, next: () => Promise<Response>) => Response | Promise<Response>;
+export type HttpServerOptions<User = unknown, Services = unknown> = Readonly<{
+    routes?: readonly ServerRoute<User, Services>[];
+    middleware?: readonly ServerMiddleware<User, Services>[];
+    handler?: (request: Request, context: RequestContext<User, Services>) => Response | Promise<Response>;
+    user?: (request: Request) => User | Promise<User | undefined>;
+    services?: Services | ((request: Request) => Services | Promise<Services>);
+    allowedOrigins?: readonly string[];
+    /**
+     * Hôtes que le serveur accepte de servir. L'origine d'une requête est
+     * calculée à partir de son URL, elle-même construite depuis l'en-tête Host
+     * par les adapters : sans allowlist, un client peut se déclarer
+     * « same-origin » et contourner les contrôles CSRF.
+     */
+    trustedHosts?: readonly string[];
+    /**
+     * `'strict'` (défaut) refuse toute mutation dont l'origine est étrangère.
+     * `'off'` réserve la décision aux middlewares de l'application.
+     */
+    csrf?: 'strict' | 'off';
+    maxBodyBytes?: number;
+    timeoutMs?: number;
+    /**
+     * Requêtes traitées simultanément. Au-delà, le serveur répond 503 plutôt
+     * que d'accepter une charge qu'il ne peut pas rendre : un rendu SSR ou une
+     * server function réserve de la mémoire pour toute sa durée.
+     */
+    maxConcurrentRequests?: number;
+    logger?: RequestLogger;
+    loggerSink?: (entry: Readonly<Record<string, unknown>>) => void;
+    metrics?: HttpMetrics;
+}>;
+export type HttpServer = Readonly<{
+    handle(request: Request): Promise<Response>;
+    metrics: HttpMetrics;
+}>;
+export declare class HttpRequestError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, status: number, message: string);
+}
+export declare function createHttpServer<User = unknown, Services = unknown>(options: HttpServerOptions<User, Services>): HttpServer;
+export declare function createHttpMetrics(): HttpMetrics;
+export declare function createRateLimitMiddleware<User = unknown, Services = unknown>(options: RateLimitMiddlewareOptions<User, Services>): ServerMiddleware<User, Services>;
+export declare function createInMemoryRateLimitStore(): RateLimitStore;
+export declare function composeServerMiddleware<User, Services>(middleware: readonly ServerMiddleware<User, Services>[], terminal: (request: Request, context: RequestContext<User, Services>) => Response | Promise<Response>): (request: Request, context: RequestContext<User, Services>) => Promise<Response>;
+export declare function matchServerRoute<User = unknown, Services = unknown>(request: Request, routes: readonly ServerRoute<User, Services>[]): {
+    readonly route: ServerRoute<User, Services>;
+    readonly params: Readonly<Record<string, string>>;
+} | undefined;
+export declare function createRequestGuardMiddleware<User, Services>(options: Pick<HttpServerOptions<User, Services>, 'allowedOrigins' | 'maxBodyBytes' | 'trustedHosts' | 'csrf'>): ServerMiddleware<User, Services>;
+/**
+ * Résout l'identité et les services de la requête à l'intérieur du pipeline,
+ * pour qu'une session illisible produise une réponse d'erreur propre au lieu
+ * de rejeter la promesse du serveur.
+ */
+export declare function createIdentityMiddleware<User, Services>(options: Pick<HttpServerOptions<User, Services>, 'user' | 'services'>): ServerMiddleware<User, Services>;
+export declare function createCorsMiddleware(allowedOrigins: readonly string[]): ServerMiddleware;
+export type SecurityMiddlewareOptions = Readonly<{
+    readonly allowedOrigins?: readonly string[];
+    /** Ajoute HSTS et redirige le trafic clair vers HTTPS. */
+    readonly forceHttps?: boolean;
+    /**
+     * Reporte le nonce de la requête dans `style-src`/`script-src`. Sans lui, la
+     * politique doit tolérer `'unsafe-inline'` pour les styles rendus par le SSR,
+     * ce qui vide la CSP d'une partie de son intérêt.
+     */
+    readonly useNonce?: boolean;
+    /** Sources supplémentaires, par directive, ajoutées à la politique de base. */
+    readonly directives?: Readonly<Record<string, readonly string[]>>;
+}>;
+export declare function createSecurityMiddleware(options?: SecurityMiddlewareOptions): ServerMiddleware;
+/**
+ * Politique de base. Les domaines appartiennent au projet : `directives`
+ * ajoute des sources, la lib ne décide que du socle restrictif.
+ */
+export declare function contentSecurityPolicy(nonce?: string, directives?: Readonly<Record<string, readonly string[]>>): string;
+/** Nonce par requête, au format base64 accepté par `provideCraftCspNonce`. */
+export declare function createCspNonce(): string;
+export declare function createCsrfMiddleware(options?: Readonly<{
+    readonly allowedOrigins?: readonly string[];
+}>): ServerMiddleware;
+/**
+ * Une mutation est acceptée quand elle ne vient pas d'un autre site. Une
+ * origine absente est refusée sur une requête porteuse de cookie : c'est le
+ * cas d'un POST de formulaire cross-site, et un client légitime en envoie une.
+ */
+export declare function isSameSiteMutation(request: Request, allowedOrigins?: readonly string[]): boolean;