@drhomet/mithaq 0.0.0-stage → 0.1.1

package/dist/asas/cli/mithaq.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/asas/cli/mithaq.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+// Each generator is imported when its word is asked for, so `better-auth/db` loads
+// only for `generate auth` and the `generate --check` sweep.
+import { realpathSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+import { Refusal } from '../../mithaq/refusal.js';
+const verbs = ['generate', 'lock', 'migrate', 'screens', 'upgrade'];
+const nouns = ['auth', 'messages', 'screens'];
+const usage = 'Usage: mithaq generate auth [--check] | mithaq generate messages [--check] [--no-data-scan] | mithaq generate screens [--check] | mithaq generate --check | mithaq lock [--check] | mithaq migrate [--check] [--name <slug>] | mithaq screens | mithaq upgrade --check | mithaq <target> <command> [--check]';
+// Run as a command, not imported. The bin is a symlink, so compare real paths.
+if (process.argv[1] && realpathSync(process.argv[1]) === import.meta.filename) {
+    try {
+        const [, , verb, noun, ...rest] = process.argv;
+        // Before anything reads the project: outside one there is no `src/asas.ts` to import.
+        if (verb === '--help' || verb === '-h') {
+            console.log(usage);
+            process.exit(0);
+        }
+        // `generate --check` takes no noun, so the word in the noun's place is a flag.
+        const flags = noun?.startsWith('--') ? [noun, ...rest] : rest;
+        const sweeping = verb === 'generate' && flags.includes('--check') && !nouns.includes(noun ?? '');
+        // `migrate` is a word of the bin's own wherever it stands first, so it takes flags
+        // and never a second word; a target named `migrate` is reached by no spelling.
+        const misplaced = (verb === 'migrate' || verb === 'upgrade') && noun !== undefined && !noun.startsWith('--');
+        const unchecked = verb === 'upgrade' && !flags.includes('--check');
+        if (verb === undefined || misplaced || unchecked || (verb === 'generate' && !(sweeping || nouns.includes(noun ?? '')))) {
+            console.error(usage);
+            process.exit(1);
+        }
+        const project = pathToFileURL(`${process.cwd()}/`);
+        const check = flags.includes('--check');
+        // The project saying it has no database to scan, which a check otherwise refuses to pass without.
+        const scan = !flags.includes('--no-data-scan');
+        const auth = async (checking) => (await import('../../auth/better-auth/generate.js')).run(project, checking);
+        const messages = async () => (await import('../../mithaq/generate-messages.js')).run({ project, check, dataScan: scan });
+        const screens = async () => (await import('../../screen/generate.js')).run(project, check);
+        const upgrade = async () => (await import('./upgrade.js')).run(project);
+        const lock = async (word, words) => (await import('../../mithaq/lock.js')).run({ project, noun: word, flags: words });
+        // Imported only where a target's command was asked for: `generate auth` runs against
+        // a project whose `src/asas.ts` may not import at all.
+        const asasOf = async () => (await import(__rewriteRelativeImportExtension(new URL('src/asas.ts', project).href))).asas;
+        // `Object.hasOwn`: a typed word would otherwise reach `Object.prototype`, and
+        // `mithaq drizzle constructor` would call `Object`.
+        const commandsOf = (asas, name) => (Object.hasOwn(asas.targets, name) ? asas.targets[name]?.commands : undefined) ?? {};
+        const commandIn = (commands, name) => Object.hasOwn(commands, name) ? commands[name] : undefined;
+        const everyCommand = (asas) => Object.entries(asas.targets).flatMap(([name, target]) => Object.entries(target?.commands ?? {}).map(([command, one]) => [`${name} ${command}`, one]));
+        const stopped = (name, code) => {
+            console.error(`\`mithaq ${name} --check\` answered ${code}, so the sweep stopped there.`);
+            process.exit(code);
+        };
+        // Every command but the lock's own and the sweep shows an unsigned language change first.
+        if (verb !== 'lock' && !(verb === 'generate' && sweeping))
+            await (await import('../../mithaq/lock.js')).warnLock(project);
+        if (verb === 'generate' && sweeping) {
+            // Stops at the first non-zero, so a pipeline reads which check failed. The lock goes first,
+            // and `migrate` before anything that reads rows, so an unmigrated database stops it by name.
+            const step = async (name, one) => {
+                const code = await one();
+                if (code)
+                    stopped(name, code);
+            };
+            await step('lock', () => lock(undefined, ['--check']));
+            await step('generate auth', () => auth(true));
+            // A command with no check to make answers 0 for the flag it does not know.
+            const asas = await asasOf();
+            const commands = everyCommand(asas);
+            const migrates = commands.filter(([name]) => name.endsWith(' migrate'));
+            const others = commands.filter(([name]) => !name.endsWith(' migrate'));
+            for (const [name, one] of migrates)
+                await step(name, () => one({ asas, flags }));
+            await step('generate messages', messages);
+            await step('generate screens', screens);
+            for (const [name, one] of others)
+                await step(name, () => one({ asas, flags }));
+            // A report, never a gate: a copy that differs from the registry is a file the project owns.
+            await upgrade().catch((error) => console.error(`upgrade --check could not read the copies: ${error.message}`));
+        }
+        else if (verb === 'lock') {
+            const code = await lock(noun?.startsWith('--') ? undefined : noun, flags);
+            if (code)
+                process.exit(code);
+        }
+        else if (verb === 'upgrade') {
+            const code = await upgrade();
+            if (code)
+                process.exit(code);
+        }
+        else if (verb === 'generate') {
+            const code = await (noun === 'messages' ? messages() : noun === 'screens' ? screens() : auth(check));
+            if (code)
+                process.exit(code);
+        }
+        else if (verb === 'screens') {
+            const { studioText, studioTree } = await import('../../screen/studio.js');
+            const targets = (await asasOf()).targets;
+            const trees = Object.entries(targets).flatMap(([name, target]) => (target?.capability === 'screen' ? [studioText(studioTree(name, target.client))] : []));
+            console.log(trees.join('\n\n'));
+        }
+        else {
+            const asas = await asasOf();
+            // Two stores that both declare `migrate` cannot be told apart by the bare word, so it is refused.
+            const aliased = verb === 'migrate';
+            const declared = aliased ? Object.keys(asas.targets).filter((name) => commandsOf(asas, name).migrate) : [];
+            if (aliased && declared.length === 0) {
+                throw new Refusal('No target of this language declares a `migrate` command, and that is what `mithaq migrate` runs. Name a store that declares one in `targets`, or migrate that store with its own tool.');
+            }
+            if (aliased && declared.length > 1) {
+                throw new Refusal(`${declared.join(', ')} each declare a \`migrate\` command, so \`mithaq migrate\` cannot say which one to run. Name the target: ${declared.map((name) => `\`mithaq ${name} migrate\``).join(', ')}.`);
+            }
+            const target = aliased ? declared[0] : verb;
+            const command = aliased ? 'migrate' : noun;
+            if (!Object.hasOwn(asas.targets, target)) {
+                throw new Refusal(`"${verb}" is neither a command of mithaq nor a target of this language. The commands are ${verbs.join(' and ')}; the targets are ${Object.keys(asas.targets).join(', ')}.`);
+            }
+            if (command === undefined || command.startsWith('--')) {
+                console.error(usage);
+                process.exit(1);
+            }
+            const one = commandIn(commandsOf(asas, target), command);
+            if (!one) {
+                const has = Object.keys(commandsOf(asas, target)).map((name) => `\`${name}\``);
+                throw new Refusal(`Target "${target}" declares no \`${command}\` command. It declares ${has.length ? has.join(', ') : 'none at all'}.`);
+            }
+            const code = await one({ asas, flags });
+            if (code)
+                process.exit(code);
+        }
+    }
+    catch (error) {
+        // Anything that is not a refusal is rethrown, so Node prints its stack, which is the whole
+        // diagnosis of a project's `src/asas.ts` failing to import.
+        if (!(error instanceof Refusal))
+            throw error;
+        console.error(error.message);
+        process.exit(1);
+    }
+}

package/dist/asas/cli/upgrade.d.ts

@@ -0,0 +1,20 @@
+/** The hash of a file as `shadcn add` writes it, without its marker. */
+export declare const hashOf: (text: string) => string;
+/** Appends the marker to every file of every item `shadcn build` wrote into `built`, the registry's `r/`. */
+export declare const mark: (built: URL) => Promise<void>;
+export type Copied = {
+    /** The file, relative to the project, or the target or item name that resolved outside it. */
+    path: string;
+    state: 'up to date' | 'up to date, edited' | 'differs' | 'differs, edited' | 'unknown' | 'outside' | 'removed';
+    /** The commit the copy's marker names, when it carries one. */
+    from?: string;
+    /** The commit the installed registry was built at. */
+    to?: string;
+};
+/**
+ * Every registry file the project holds where `shadcn add` writes it, with its state. Reads only;
+ * a path that climbs out of the project or the registry is listed as outside, never followed.
+ */
+export declare const upgradeCheck: (project: URL) => Promise<Copied[] | undefined>;
+/** `mithaq upgrade --check`: one line per copied file, and 1 where any differs. It never writes. */
+export declare const run: (project: URL) => Promise<number>;

package/dist/asas/cli/upgrade.js

@@ -0,0 +1,147 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { readdir, readFile, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+// The last line of every registry file: the commit it was built at and the hash of the
+// file above. Trailing, because `shadcn add` drops a file's leading comments only.
+const marker = /\n\/\/ mithaq-admin (\S+) ([0-9a-f]{64})\n?$/;
+// What `shadcn add` drops, so a hash is the same over the registry's text and the copy's.
+const leading = /^(?:\s+|\/\/[^\n]*|\/\*[\s\S]*?\*\/)*/;
+/** The hash of a file as `shadcn add` writes it, without its marker. */
+export const hashOf = (text) => createHash('sha256').update(text.replace(marker, '\n').replace(leading, '')).digest('hex');
+/** Appends the marker to every file of every item `shadcn build` wrote into `built`, the registry's `r/`. */
+export const mark = async (built) => {
+    let commit = 'unknown';
+    try {
+        commit = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: fileURLToPath(built), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    }
+    catch { }
+    for (const name of await readdir(built)) {
+        if (!name.endsWith('.json') || name === 'registry.json')
+            continue;
+        const item = JSON.parse(await readFile(new URL(name, built), 'utf8'));
+        for (const file of item.files ?? []) {
+            const body = file.content.replace(marker, '\n');
+            const text = body.endsWith('\n') ? body : `${body}\n`;
+            file.content = `${text}// mithaq-admin ${commit} ${hashOf(text)}\n`;
+        }
+        await writeFile(new URL(name, built), `${JSON.stringify(item, null, 2)}\n`);
+    }
+};
+// Beside `dist/` when published, at the same depth from this file.
+// Beside `dist/` when published; in this repository the apps read the workspace's `mithaq-admin`.
+const registry = new URL('../../../r/', import.meta.url);
+// The installed `mithaq-admin`'s `r/`, else the one this mithaq ships, else none.
+const registryOf = (project) => {
+    try {
+        return new URL('r/', pathToFileURL(createRequire(new URL('package.json', project)).resolve('mithaq-admin/package.json')));
+    }
+    catch {
+        return existsSync(new URL('registry.json', registry)) ? registry : undefined;
+    }
+};
+/**
+ * Every registry file the project holds where `shadcn add` writes it, with its state. Reads only;
+ * a path that climbs out of the project or the registry is listed as outside, never followed.
+ */
+export const upgradeCheck = async (project) => {
+    const components = JSON.parse(await readFile(new URL('components.json', project), 'utf8'));
+    const built = registryOf(project);
+    if (!built)
+        return undefined;
+    const { items } = JSON.parse(await readFile(new URL('registry.json', built), 'utf8'));
+    const src = existsSync(new URL('src/', project)) ? 'src/' : '';
+    const pathOf = (target) => {
+        if (target.startsWith('~/'))
+            return target.slice(2);
+        const [, alias = '', rest] = /^@([^/]+)\/(.+)$/.exec(target) ?? [];
+        // shadcn resolves an alias through the app's tsconfig `paths`; this reads `@/` as `src/`
+        // when the project has one and as its root otherwise, shadcn's own fallback.
+        const at = components.aliases?.[alias];
+        return at?.startsWith('@/') ? `${src}${at.slice(2)}/${rest}` : undefined;
+    };
+    const copied = [];
+    /** Every path an item names, copied or not, and the folders they sit in, which a file no item names any more is looked for in. */
+    const named = new Set();
+    const folders = new Set();
+    // `new URL` resolves every `..`, encoded or not, so a prefix is the whole test.
+    const within = (url, folder) => url.href.startsWith(folder.href);
+    for (const { name } of items) {
+        const source = new URL(`${name}.json`, built);
+        if (!within(source, built)) {
+            copied.push({ path: name, state: 'outside' });
+            continue;
+        }
+        const item = JSON.parse(await readFile(source, 'utf8'));
+        for (const file of item.files ?? []) {
+            const path = pathOf(file.target);
+            if (path && !within(new URL(path, project), project)) {
+                copied.push({ path: file.target, state: 'outside' });
+                continue;
+            }
+            if (path) {
+                named.add(path);
+                folders.add(path.slice(0, path.lastIndexOf('/') + 1));
+            }
+            const text = path && (await readFile(new URL(path, project), 'utf8').catch(() => undefined));
+            if (!path || text === undefined)
+                continue;
+            const [, from, hash] = marker.exec(text) ?? [];
+            const to = marker.exec(file.content)?.[1];
+            if (!hash) {
+                copied.push({ path, state: 'unknown', to });
+                continue;
+            }
+            const differs = hash !== hashOf(file.content);
+            const edited = hash !== hashOf(text);
+            copied.push({ path, state: `${differs ? 'differs' : 'up to date'}${edited ? ', edited' : ''}`, from, to });
+        }
+    }
+    // A marked file no item names any more: an item the registry dropped, which the project deletes.
+    for (const folder of folders) {
+        const entries = await readdir(new URL(folder || './', project), { withFileTypes: true }).catch(() => []);
+        for (const entry of entries) {
+            const path = `${folder}${entry.name}`;
+            if (!entry.isFile() || named.has(path))
+                continue;
+            const from = marker.exec(await readFile(new URL(path, project), 'utf8'))?.[1];
+            if (from)
+                copied.push({ path, state: 'removed', from });
+        }
+    }
+    return copied;
+};
+const sentence = ({ path, state, from = '', to = 'unknown' }, own) => ({
+    'up to date': `${path} is up to date.`,
+    'up to date, edited': `${path} is up to date, and edited since it was copied.`,
+    differs: `${path} differs from ${own ? 'the copy in the registry the installed mithaq ships' : "the installed mithaq-admin's copy"} (built at ${to.slice(0, 12)}), and is not edited since it was copied from ${from.slice(0, 12)}. A hash shows a difference, not which side is newer: diff the two${own ? '' : ', or rebuild mithaq-admin,'} before replacing it.`,
+    'differs, edited': `${path} differs from ${own ? 'the copy in the registry the installed mithaq ships' : "the installed mithaq-admin's copy"} (built at ${to.slice(0, 12)}), and is edited since it was copied from ${from.slice(0, 12)}: diff the two and merge by hand.`,
+    unknown: `${path} carries no mithaq-admin marker on its last line, so nothing says what it was copied from.`,
+    outside: `${path} resolves outside this project or the registry, so it was not read.`,
+    removed: `${path} was copied from mithaq-admin at ${from.slice(0, 12)}, and no item of the installed registry names it any more: it was removed from the registry, so delete it.`,
+})[state];
+/** `mithaq upgrade --check`: one line per copied file, and 1 where any differs. It never writes. */
+export const run = async (project) => {
+    if (!existsSync(new URL('components.json', project))) {
+        console.log('No components.json here, so nothing was copied with `shadcn add`.');
+        return 0;
+    }
+    const copied = await upgradeCheck(project);
+    if (!copied) {
+        console.log(`No mithaq-admin registry to check the copies against: none is installed here, and the installed mithaq ships no r/ at ${fileURLToPath(registry)}.`);
+        return 0;
+    }
+    const own = registryOf(project)?.href === registry.href;
+    if (!copied.length)
+        console.log('Nothing from mithaq-admin here.');
+    for (const one of copied)
+        console.log(sentence(one, own));
+    const differing = copied.filter((one) => one.state.startsWith('differs')).length;
+    if (differing) {
+        console.error(`${differing} ${differing === 1 ? 'file differs' : 'files differ'} from ${own ? 'the registry the installed mithaq ships' : 'the installed mithaq-admin'}.`);
+        return 1;
+    }
+    return 0;
+};

package/dist/asas/http/fetch.d.ts

@@ -0,0 +1,23 @@
+import type { HttpPlug, OperationTable } from '../build.ts';
+import type { StandardSchemaV1 } from '../../mithaq/standard-schema.ts';
+/** The Zod input decides which JSON strings represent dates on either HTTP plug. */
+export declare const decodeJson: (value: unknown, schema: StandardSchemaV1) => unknown;
+export declare const draftOptions: (request: Request) => {
+    draft?: boolean | undefined;
+    autosave?: boolean | undefined;
+    tenant?: string | undefined;
+};
+export type FetchHttpOptions = {
+    /**
+     * Builds the context every step of a served call reads, from the request and the actor.
+     * The plug reads no header or body key into it; a throw is answered 500.
+     */
+    context?: (request: Request, actor: unknown) => Promise<Record<string, unknown>> | Record<string, unknown>;
+    /** Handed every error that is not an `AsasError`, before the 500 goes out with its message replaced. Defaults to `console.error`. */
+    onError?: (error: unknown) => void;
+};
+/**
+ * The default HTTP plug: `POST /api/<kayan>/<operation>` with a JSON body, over
+ * `Request` and `Response` alone. The runner parses each operation's input.
+ */
+export declare const fetchHttp: ({ context, onError }?: FetchHttpOptions) => <View>(operations: OperationTable<View>) => HttpPlug;

package/dist/asas/http/fetch.js

@@ -0,0 +1,115 @@
+import { AfterCommitError, AsasError, afterCommitHeader, codes } from '../runner/errors.js';
+// The walk enters objects, arrays and the wrappers `unwrap()` opens, and nothing else.
+const datesFromJson = (value, schema) => {
+    if (schema.type === 'date' && typeof value === 'string') {
+        // Date.parse normalizes February 30, which the declared z.date must refuse.
+        const day = value.slice(0, 10);
+        if (/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{1,9})?(?:Z|[+-]\d\d:\d\d)$/.test(value)
+            && Number(value.slice(11, 13)) < 24) {
+            const parsed = new Date(value);
+            const midnight = new Date(`${day}T00:00:00Z`);
+            if (!Number.isNaN(parsed.getTime()) && !Number.isNaN(midnight.getTime()) && midnight.toISOString().slice(0, 10) === day)
+                return parsed;
+        }
+    }
+    if (['optional', 'nullable', 'default', 'prefault', 'nonoptional', 'readonly'].includes(schema.type ?? '')) {
+        return schema.unwrap ? datesFromJson(value, schema.unwrap()) : value;
+    }
+    if (schema.type === 'array' && Array.isArray(value) && schema.element) {
+        return value.map((one) => datesFromJson(one, schema.element));
+    }
+    if (schema.type === 'object' && value !== null && typeof value === 'object' && !Array.isArray(value) && schema.shape) {
+        const result = { ...value };
+        for (const [name, child] of Object.entries(schema.shape)) {
+            if (Object.hasOwn(result, name))
+                result[name] = datesFromJson(result[name], child);
+        }
+        return result;
+    }
+    return value;
+};
+/** The Zod input decides which JSON strings represent dates on either HTTP plug. */
+export const decodeJson = (value, schema) => schema['~standard'].vendor === 'zod' ? datesFromJson(value, schema) : value;
+// `?draft=true` saves or reads a draft, and `?autosave=true` beside it lets the
+// save overwrite an autosave. `?tenant=` is a read's reach, which the runner judges.
+export const draftOptions = (request) => {
+    const query = new URL(request.url).searchParams;
+    return {
+        ...(query.get('draft') === 'true' ? { draft: true } : {}),
+        ...(query.get('autosave') === 'true' ? { autosave: true } : {}),
+        ...(query.has('tenant') ? { tenant: query.get('tenant') } : {}),
+    };
+};
+/**
+ * The default HTTP plug: `POST /api/<kayan>/<operation>` with a JSON body, over
+ * `Request` and `Response` alone. The runner parses each operation's input.
+ */
+export const fetchHttp = ({ context, onError = console.error } = {}) => (operations) => {
+    const table = new Map(operations.map((one) => [`${one.kayan}/${one.name}`, one]));
+    return {
+        name: 'fetch',
+        // The operation table is the routes, already published as `asas.operations`.
+        router: undefined,
+        handle: async (request, actor) => {
+            if (request.method !== 'POST')
+                return null;
+            // Two segments under `/api` and no more, so another plug's three-segment prefix
+            // falls through. `null`, not a 404, so a host keeps its own routes.
+            const [api, kayan, name, ...rest] = new URL(request.url).pathname.split('/').slice(1);
+            if (api !== 'api' || !kayan || !name || rest.length > 0)
+                return null;
+            const operation = table.get(`${kayan}/${name}`);
+            if (!operation)
+                return null;
+            const body = await request.text();
+            // Keyless: refused before any operation, and the key names an operation's refusal.
+            const undecodable = (message) => Response.json({ code: codes[400], message }, { status: 400 });
+            let input = {};
+            if (body) {
+                try {
+                    input = JSON.parse(body);
+                }
+                catch {
+                    return undecodable('The request body is not JSON.');
+                }
+                // The runner reads fields off the input, so a body of `null` or `1` would be a
+                // 500 a caller provoked; every caller-provoked refusal is a 4xx.
+                if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+                    return undecodable('The request body is not a JSON object.');
+                }
+            }
+            try {
+                // Resolved after the match, so a host's own routes cost no session lookup.
+                const decoded = decodeJson(input, operation.input);
+                const who = await actor();
+                const result = await operation.call(decoded, { actor: who, context: await context?.(request, who), ...draftOptions(request) });
+                // Only a write says so, because the browser clears its banner on this value alone.
+                return Response.json(result, operation.effect === 'read' ? undefined : { headers: { [afterCommitHeader]: 'ok' } });
+            }
+            catch (thrown) {
+                if (thrown instanceof AfterCommitError) {
+                    try {
+                        onError?.(thrown.cause);
+                    }
+                    catch {
+                        // Reporting cannot change a committed result.
+                    }
+                    return Response.json(thrown.result, { headers: { [afterCommitHeader]: 'failed' } });
+                }
+                if (thrown instanceof AsasError) {
+                    // The cause is never serialized: a conflict's driver error names the column and
+                    // value the refusal's message withholds.
+                    return Response.json({ code: codes[thrown.status], data: { key: thrown.key, params: thrown.params }, message: thrown.message }, { status: thrown.status });
+                }
+                try {
+                    onError?.(thrown);
+                }
+                catch {
+                    // Deliberately empty: reporting may not change what is reported.
+                }
+                // Not an `AsasError` is the project's own fault, so its message is replaced.
+                return Response.json({ code: 'INTERNAL_SERVER_ERROR', message: 'Internal server error' }, { status: 500 });
+            }
+        },
+    };
+};

package/dist/asas/http/orpc.d.ts

@@ -0,0 +1,43 @@
+import type { Procedure, Schema } from '@orpc/server';
+import type { OperationTable } from '../build.ts';
+/** The context every procedure is handed, which defaults to the actor alone. */
+export type OrpcContext = {
+    actor: unknown;
+} & Record<string, unknown>;
+export type OrpcHttpOptions = {
+    /** Where the typed protocol answers. */
+    rpc?: `/${string}`;
+    /** Where plain HTTP answers, one route per operation. */
+    api?: `/${string}`;
+    /**
+     * Builds the context a procedure receives, once per request. The default is `{ actor }`;
+     * the `actor` it returns is the one the call runs as.
+     */
+    context?: (request: Request, actor: unknown) => Promise<OrpcContext> | OrpcContext;
+    /**
+     * Handed every error that is not an `AsasError`, before it is rethrown with its message replaced.
+     * A host's own deliberate `ORPCError` reaches it too, so a host logging only faults filters on the code.
+     */
+    onError?: (error: unknown) => void;
+};
+type OrpcProcedure<Method> = Method extends (...args: infer Args) => Promise<infer Answer> ? Procedure<OrpcContext, OrpcContext, Schema<Args[0], Args[0]>, Schema<Answer, Answer>, Record<never, never>, Record<never, never>> : never;
+/** The router, typed from the operation table: kayan, then operation. `RouterClient` over it needs no generated code. */
+export type OrpcRouter<View> = {
+    [Kayan in keyof View]: {
+        [Name in keyof View[Kayan]]: OrpcProcedure<View[Kayan][Name]>;
+    };
+};
+/**
+ * The oRPC plug: one procedure per operation, served over both the typed RPC protocol
+ * and plain HTTP. Needs `@orpc/server` and `@orpc/openapi`.
+ */
+export declare const orpcHttp: ({ rpc, api, context, onError, }?: OrpcHttpOptions) => <View>(operations: OperationTable<View>) => {
+    name: string;
+    router: OrpcRouter<View>;
+    /**
+     * `null` when neither prefix matched, so a host keeps its own routes. The path is matched
+     * before the actor thunk is called, so a host's own route runs no strategy.
+     */
+    handle: (request: Request, actor: () => Promise<unknown>) => Promise<Response | null>;
+};
+export {};

package/dist/asas/http/orpc.js

@@ -0,0 +1,135 @@
+// The only file that imports oRPC, so it is its own entry and oRPC stays an
+// optional peer a project that serves no HTTP never installs.
+import { OpenAPIHandler } from '@orpc/openapi/fetch';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { ORPCError, ValidationError, os } from '@orpc/server';
+import { RPCHandler } from '@orpc/server/fetch';
+import { AfterCommitError, AsasError, afterCommitHeader, codes } from '../runner/errors.js';
+import { issueRefusal, withoutPrototype } from '../runner/steps.js';
+import { decodeJson, draftOptions } from './fetch.js';
+// Matched on the `ValidationError` cause, not the shape of `data`, so a host's own
+// `BAD_REQUEST` keeps its message and data.
+const boundaryRefusal = (thrown) => thrown instanceof ORPCError && thrown.code === 'BAD_REQUEST' && thrown.cause instanceof ValidationError
+    ? issueRefusal(thrown.cause.issues)
+    : undefined;
+/**
+ * The oRPC plug: one procedure per operation, served over both the typed RPC protocol
+ * and plain HTTP. Needs `@orpc/server` and `@orpc/openapi`.
+ */
+export const orpcHttp = ({ rpc = '/api/rpc', api = '/api', context, onError, } = {}) => (operations) => {
+    // A reporter that throws must not replace the error the host has to see.
+    const report = (thrown) => {
+        try {
+            onError?.(thrown);
+        }
+        catch {
+            // Deliberately empty: reporting may not change what is reported.
+        }
+    };
+    // Per request, because a procedure's handler cannot read the request itself.
+    const warnings = new AsyncLocalStorage();
+    // The one place a refusal becomes a wire error, so both handlers share it.
+    const base = os.$context().use(async ({ next }) => {
+        try {
+            return await next();
+        }
+        catch (thrown) {
+            // oRPC validates the bound input inside this middleware, so its own refusal is
+            // re-emitted in the runner's shape: one shape answers every 400 a procedure raises.
+            const held = thrown instanceof AsasError ? thrown : boundaryRefusal(thrown);
+            if (!held) {
+                report(thrown);
+                throw thrown;
+            }
+            throw new ORPCError(codes[held.status], {
+                message: held.message,
+                data: { key: held.key, params: held.params },
+                // Never serialize the cause: a conflict's driver error names the column and value
+                // on its `detail`. It stays in process only because oRPC's `toJSON` never emits `cause`.
+                cause: held,
+            });
+        }
+    });
+    // No prototype, so a kayan or operation named `constructor` or `__proto__` is an own key.
+    const router = Object.create(null);
+    for (const operation of operations) {
+        const kayan = (router[operation.kayan] ??= Object.create(null));
+        const input = operation.input;
+        const zod = input['~standard'].vendor === 'zod';
+        // The published shape stays for the OpenAPI contract; only validation is skipped,
+        // because the runner parses every input before any store seal, and a draft against the draft shape.
+        const wireInput = Object.assign(Object.create(input), {
+            '~standard': {
+                ...input['~standard'],
+                validate: (value, options) => {
+                    const decoded = zod ? withoutPrototype(decodeJson(value, input)) : value;
+                    const object = decoded !== null && typeof decoded === 'object' && !Array.isArray(decoded);
+                    return warnings.getStore()?.options.draft && object ? { value: decoded } : input['~standard'].validate(decoded, options);
+                },
+            },
+        });
+        kayan[operation.name] = base
+            .input(wireInput)
+            .handler(async ({ context: held, input }) => {
+            try {
+                const { actor, ...rest } = held;
+                const result = await operation.call(input, { actor, context: context ? rest : undefined, ...warnings.getStore()?.options });
+                const warning = warnings.getStore();
+                if (warning && operation.effect !== 'read')
+                    warning.said = 'ok';
+                return result;
+            }
+            catch (thrown) {
+                if (!(thrown instanceof AfterCommitError))
+                    throw thrown;
+                report(thrown.cause);
+                const warning = warnings.getStore();
+                if (warning)
+                    warning.said = 'failed';
+                return thrown.result;
+            }
+        });
+    }
+    const handlers = [
+        [rpc, new RPCHandler(router)],
+        [api, new OpenAPIHandler(router)],
+    ];
+    return {
+        name: 'orpc',
+        router: router,
+        /**
+         * `null` when neither prefix matched, so a host keeps its own routes. The path is matched
+         * before the actor thunk is called, so a host's own route runs no strategy.
+         */
+        handle: async (request, actor) => {
+            const { pathname } = new URL(request.url);
+            const under = (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`);
+            if (!handlers.some(([prefix]) => under(prefix)))
+                return null;
+            // Built before any procedure runs, so a throw here is outside the middleware;
+            // it still reaches `onError`.
+            let held;
+            try {
+                const who = await actor();
+                held = context ? await context(request, who) : { actor: who };
+            }
+            catch (thrown) {
+                if (!(thrown instanceof AsasError))
+                    report(thrown);
+                throw thrown;
+            }
+            for (const [prefix, handler] of handlers) {
+                if (!under(prefix))
+                    continue;
+                const warning = { options: draftOptions(request) };
+                const answered = await warnings.run(warning, () => handler.handle(request, { context: held, prefix }));
+                if (answered.matched) {
+                    if (warning.said)
+                        answered.response.headers.set(afterCommitHeader, warning.said);
+                    return answered.response;
+                }
+            }
+            return null;
+        },
+    };
+};