@drhomet/mithaq 0.1.1 → 0.2.1

package/dist/asas/cli/upgrade.js

@@ -1,59 +1,56 @@
-import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
-import { readdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-// The last line of every registry file: the commit it was built at and the hash of the
-// file above. Trailing, because `shadcn add` drops a file's leading comments only.
+import { pathToFileURL } from 'node:url';
+// The last line of every ejected file: the version (or, for a copy `shadcn add` made, the commit) it came from and the
+// hash of the file above. Trailing, because `shadcn add` dropped a file's leading comments only.
 const marker = /\n\/\/ mithaq-admin (\S+) ([0-9a-f]{64})\n?$/;
-// What `shadcn add` drops, so a hash is the same over the registry's text and the copy's.
+// What `shadcn add` dropped, so a hash is the same over the package's text and a copy it made.
 const leading = /^(?:\s+|\/\/[^\n]*|\/\*[\s\S]*?\*\/)*/;
-/** The hash of a file as `shadcn add` writes it, without its marker. */
-export const hashOf = (text) => createHash('sha256').update(text.replace(marker, '\n').replace(leading, '')).digest('hex');
-/** Appends the marker to every file of every item `shadcn build` wrote into `built`, the registry's `r/`. */
-export const mark = async (built) => {
-    let commit = 'unknown';
-    try {
-        commit = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: fileURLToPath(built), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-    }
-    catch { }
-    for (const name of await readdir(built)) {
-        if (!name.endsWith('.json') || name === 'registry.json')
-            continue;
-        const item = JSON.parse(await readFile(new URL(name, built), 'utf8'));
-        for (const file of item.files ?? []) {
-            const body = file.content.replace(marker, '\n');
-            const text = body.endsWith('\n') ? body : `${body}\n`;
-            file.content = `${text}// mithaq-admin ${commit} ${hashOf(text)}\n`;
-        }
-        await writeFile(new URL(name, built), `${JSON.stringify(item, null, 2)}\n`);
-    }
+/** What an eject writes above the marker: the file's text, ending in a newline. */
+const bodyOf = (text) => {
+    const body = text.replace(marker, '\n');
+    return body.endsWith('\n') ? body : `${body}\n`;
+};
+const sha = (text) => createHash('sha256').update(text).digest('hex');
+/** The hash of a copy `shadcn add` made, without its marker and the leading comments it dropped. */
+export const hashOf = (text) => sha(bodyOf(text).replace(leading, ''));
+/**
+ * The hash a marker from `from` holds: of the whole text above it for an eject, which writes byte for byte, so an edit
+ * to a leading pragma is an edit; without leading comments only for a copy made at a commit, as `shadcn add` wrote it.
+ */
+const madeByShadcn = (from) => /^(?:[0-9a-f]{40}|unknown)$/.test(from);
+const hashFrom = (from) => (text) => (madeByShadcn(from) ? hashOf(text) : sha(bodyOf(text)));
+/** A held file's state against the package's text of it, read as `upgrade --check` reads it. */
+export const stateOf = (text, source) => {
+    const [, from, hash] = marker.exec(text) ?? [];
+    if (!hash)
+        return 'unknown';
+    const hashed = hashFrom(from);
+    return `${hash !== hashed(source) ? 'differs' : 'up to date'}${hash !== hashed(text) ? ', edited' : ''}`;
 };
-// Beside `dist/` when published, at the same depth from this file.
-// Beside `dist/` when published; in this repository the apps read the workspace's `mithaq-admin`.
-const registry = new URL('../../../r/', import.meta.url);
-// The installed `mithaq-admin`'s `r/`, else the one this mithaq ships, else none.
-const registryOf = (project) => {
+/** The `mithaq-admin` the project installed: its folder, its version and its items, or none. */
+const installedOf = async (project) => {
+    let manifest;
     try {
-        return new URL('r/', pathToFileURL(createRequire(new URL('package.json', project)).resolve('mithaq-admin/package.json')));
+        manifest = pathToFileURL(createRequire(new URL('package.json', project)).resolve('mithaq-admin/package.json'));
     }
     catch {
-        return existsSync(new URL('registry.json', registry)) ? registry : undefined;
+        return undefined;
     }
+    const root = new URL('./', manifest);
+    const { version } = JSON.parse(await readFile(manifest, 'utf8'));
+    const { items } = JSON.parse(await readFile(new URL('registry.json', root), 'utf8'));
+    return { root, version, items };
 };
-/**
- * Every registry file the project holds where `shadcn add` writes it, with its state. Reads only;
- * a path that climbs out of the project or the registry is listed as outside, never followed.
- */
-export const upgradeCheck = async (project) => {
+// `new URL` resolves every `..`, encoded or not, so a prefix is the whole test.
+const within = (url, folder) => url.href.startsWith(folder.href);
+/** Where the project keeps each target: `@<alias>/…` through `components.json`, `~/…` from the project's root. */
+const targetsOf = async (project) => {
     const components = JSON.parse(await readFile(new URL('components.json', project), 'utf8'));
-    const built = registryOf(project);
-    if (!built)
-        return undefined;
-    const { items } = JSON.parse(await readFile(new URL('registry.json', built), 'utf8'));
     const src = existsSync(new URL('src/', project)) ? 'src/' : '';
-    const pathOf = (target) => {
+    return (target) => {
         if (target.startsWith('~/'))
             return target.slice(2);
         const [, alias = '', rest] = /^@([^/]+)\/(.+)$/.exec(target) ?? [];
@@ -62,44 +59,49 @@ export const upgradeCheck = async (project) => {
         const at = components.aliases?.[alias];
         return at?.startsWith('@/') ? `${src}${at.slice(2)}/${rest}` : undefined;
     };
+};
+const folderOf = (path) => path.slice(0, path.lastIndexOf('/') + 1);
+/** The folders a piece the package serves (`registry/<file>`) is ejected into: what `eject --prune` sweeps. */
+const ejectedFolders = (items, pathOf) => new Set(items.flatMap((item) => item.files.filter((file) => !file.path.slice('registry/'.length).includes('/')).flatMap((file) => { const path = pathOf(file.target); return path ? folderOf(path) : []; })));
+/**
+ * Every package file the project holds at its target, ejected or always the project's, with its state. Reads only;
+ * a path that climbs out of the project or the package is listed as outside, never followed.
+ */
+export const upgradeCheck = async (project) => {
+    const pathOf = await targetsOf(project);
+    const installed = await installedOf(project);
+    if (!installed)
+        return undefined;
     const copied = [];
-    /** Every path an item names, copied or not, and the folders they sit in, which a file no item names any more is looked for in. */
+    /** Every path an item names, held or not, and the folders they sit in, which a file no item names any more is looked for in. */
     const named = new Set();
     const folders = new Set();
-    // `new URL` resolves every `..`, encoded or not, so a prefix is the whole test.
-    const within = (url, folder) => url.href.startsWith(folder.href);
-    for (const { name } of items) {
-        const source = new URL(`${name}.json`, built);
-        if (!within(source, built)) {
-            copied.push({ path: name, state: 'outside' });
-            continue;
-        }
-        const item = JSON.parse(await readFile(source, 'utf8'));
-        for (const file of item.files ?? []) {
+    const ejected = ejectedFolders(installed.items, pathOf);
+    for (const { name, files } of installed.items) {
+        for (const file of files) {
+            const source = new URL(file.path, installed.root);
             const path = pathOf(file.target);
+            if (!within(source, installed.root)) {
+                copied.push({ path: file.path, state: 'outside' });
+                continue;
+            }
             if (path && !within(new URL(path, project), project)) {
                 copied.push({ path: file.target, state: 'outside' });
                 continue;
             }
             if (path) {
                 named.add(path);
-                folders.add(path.slice(0, path.lastIndexOf('/') + 1));
+                folders.add(folderOf(path));
             }
             const text = path && (await readFile(new URL(path, project), 'utf8').catch(() => undefined));
             if (!path || text === undefined)
                 continue;
-            const [, from, hash] = marker.exec(text) ?? [];
-            const to = marker.exec(file.content)?.[1];
-            if (!hash) {
-                copied.push({ path, state: 'unknown', to });
-                continue;
-            }
-            const differs = hash !== hashOf(file.content);
-            const edited = hash !== hashOf(text);
-            copied.push({ path, state: `${differs ? 'differs' : 'up to date'}${edited ? ', edited' : ''}`, from, to });
+            const state = stateOf(text, await readFile(source, 'utf8'));
+            const to = installed.version;
+            copied.push(state === 'unknown' ? { path, state, to } : { path, state, from: marker.exec(text)[1], to, ...(!ejected.has(folderOf(path)) && { item: name }) });
         }
     }
-    // A marked file no item names any more: an item the registry dropped, which the project deletes.
+    // A marked file no item names any more: an item the package dropped, which the project deletes.
     for (const folder of folders) {
         const entries = await readdir(new URL(folder || './', project), { withFileTypes: true }).catch(() => []);
         for (const entry of entries) {
@@ -113,35 +115,142 @@ export const upgradeCheck = async (project) => {
     }
     return copied;
 };
-const sentence = ({ path, state, from = '', to = 'unknown' }, own) => ({
+const sentence = ({ path, state, from = '', to = 'unknown', item }) => ({
     'up to date': `${path} is up to date.`,
-    'up to date, edited': `${path} is up to date, and edited since it was copied.`,
-    differs: `${path} differs from ${own ? 'the copy in the registry the installed mithaq ships' : "the installed mithaq-admin's copy"} (built at ${to.slice(0, 12)}), and is not edited since it was copied from ${from.slice(0, 12)}. A hash shows a difference, not which side is newer: diff the two${own ? '' : ', or rebuild mithaq-admin,'} before replacing it.`,
-    'differs, edited': `${path} differs from ${own ? 'the copy in the registry the installed mithaq ships' : "the installed mithaq-admin's copy"} (built at ${to.slice(0, 12)}), and is edited since it was copied from ${from.slice(0, 12)}: diff the two and merge by hand.`,
-    unknown: `${path} carries no mithaq-admin marker on its last line, so nothing says what it was copied from.`,
-    outside: `${path} resolves outside this project or the registry, so it was not read.`,
-    removed: `${path} was copied from mithaq-admin at ${from.slice(0, 12)}, and no item of the installed registry names it any more: it was removed from the registry, so delete it.`,
+    'up to date, edited': `${path} is up to date, and edited since it was ejected.`,
+    differs: `${path} differs from the installed mithaq-admin's file (${to}), and is not edited since it was ejected from ${from.slice(0, 12)}. A hash shows a difference, not which side is newer: diff the two before replacing it, or ${item ? `delete it and run \`mithaq eject ${item}\` to take the package's` : 'delete it to draw the package\'s'}.`,
+    'differs, edited': `${path} differs from the installed mithaq-admin's file (${to}), and is edited since it was ejected from ${from.slice(0, 12)}: diff the two and merge by hand.`,
+    unknown: `${path} carries no mithaq-admin marker on its last line, so nothing says what it was ejected from.`,
+    outside: `${path} resolves outside this project or the package, so it was not read.`,
+    removed: `${path} was ejected from mithaq-admin ${from.slice(0, 12)}, and no item of the installed package names it any more: it was removed from the package, so delete it.`,
 })[state];
-/** `mithaq upgrade --check`: one line per copied file, and 1 where any differs. It never writes. */
+const noComponents = 'No components.json here, so nothing says where mithaq-admin files go.';
+const noPackage = 'No mithaq-admin is installed here.';
+/** `mithaq upgrade --check`: one line per file the project holds, and 1 where any differs. It never writes. */
 export const run = async (project) => {
     if (!existsSync(new URL('components.json', project))) {
-        console.log('No components.json here, so nothing was copied with `shadcn add`.');
+        console.log(noComponents);
         return 0;
     }
     const copied = await upgradeCheck(project);
     if (!copied) {
-        console.log(`No mithaq-admin registry to check the copies against: none is installed here, and the installed mithaq ships no r/ at ${fileURLToPath(registry)}.`);
+        console.log(`${noPackage} Nothing to check the files against.`);
         return 0;
     }
-    const own = registryOf(project)?.href === registry.href;
     if (!copied.length)
         console.log('Nothing from mithaq-admin here.');
     for (const one of copied)
-        console.log(sentence(one, own));
+        console.log(sentence(one));
     const differing = copied.filter((one) => one.state.startsWith('differs')).length;
     if (differing) {
-        console.error(`${differing} ${differing === 1 ? 'file differs' : 'files differ'} from ${own ? 'the registry the installed mithaq ships' : 'the installed mithaq-admin'}.`);
+        console.error(`${differing} ${differing === 1 ? 'file differs' : 'files differ'} from the installed mithaq-admin.`);
         return 1;
     }
     return 0;
 };
+/**
+ * `mithaq eject <item>`: writes the item's own files where the project keeps them, each byte for byte with a marker,
+ * and never over a file already there. It copies no other item and installs nothing: the package serves every
+ * sibling, so it only names a primitive or an npm package the project lacks.
+ */
+export const eject = async (project, name) => {
+    if (!existsSync(new URL('components.json', project))) {
+        console.error(noComponents);
+        return 1;
+    }
+    const pathOf = await targetsOf(project);
+    const installed = await installedOf(project);
+    if (!installed) {
+        console.error(`${noPackage} Install it at the version of mithaq, then eject.`);
+        return 1;
+    }
+    const wanted = `mithaq-${name.replace(/\.tsx?$/, '').replace(/^mithaq-/, '')}`;
+    const item = installed.items.find((one) => one.name === wanted);
+    if (!item) {
+        console.error(`mithaq-admin has no item "${name}". Its items are: ${installed.items.map((one) => one.name).join(', ')}.`);
+        return 1;
+    }
+    const files = item.files.map((file) => ({ source: new URL(file.path, installed.root), path: pathOf(file.target), target: file.target }));
+    const refused = files.filter(({ source, path }) => !within(source, installed.root) || !path || !within(new URL(path, project), project));
+    if (refused.length) {
+        console.error(`${refused.map((one) => one.target).join(', ')} resolves outside this project or the package, so nothing was written.`);
+        return 1;
+    }
+    const ejected = ejectedFolders(installed.items, pathOf);
+    for (const { source, path } of files) {
+        const at = new URL(path, project);
+        const text = await readFile(source, 'utf8');
+        await mkdir(new URL('./', at), { recursive: true });
+        // `wx` fails on a file already there, so an eject never overwrites, whatever raced it.
+        const body = bodyOf(text);
+        const written = await writeFile(at, `${body}// mithaq-admin ${installed.version} ${sha(body)}\n`, { flag: 'wx' }).then(() => true, (error) => {
+            if (error.code === 'EEXIST')
+                return false;
+            throw error;
+        });
+        // A file the project always holds (the host, storage, a step) is never deleted: the app needs it.
+        const drawn = ejected.has(folderOf(path)) ? '; delete it to draw mithaq-admin\'s again' : '';
+        console.log(written ? `${path} is ejected. Edit it in place${drawn}.` : `${path} is already ejected, so it was left as it is.`);
+    }
+    for (const primitive of item.registryDependencies ?? []) {
+        const path = pathOf(`@ui/${primitive}.tsx`);
+        if (path && !existsSync(new URL(path, project)))
+            console.log(`${path} is missing: run shadcn add ${primitive}`);
+    }
+    const require = createRequire(new URL('package.json', project));
+    for (const dependency of item.dependencies ?? []) {
+        const npm = /^(@?[^@]+)/.exec(dependency)[1];
+        try {
+            require.resolve(npm);
+        }
+        catch (error) {
+            if (error.code === 'MODULE_NOT_FOUND')
+                console.log(`${npm} is not installed: install ${dependency}`);
+        }
+    }
+    return 0;
+};
+/**
+ * `mithaq eject --prune`: deletes every marked file in the folders pieces are ejected into whose text still hashes
+ * to its marker, so the package draws it again. Never an edited, unmarked or `~/` file.
+ */
+export const prune = async (project) => {
+    if (!existsSync(new URL('components.json', project))) {
+        console.error(noComponents);
+        return 1;
+    }
+    const pathOf = await targetsOf(project);
+    const installed = await installedOf(project);
+    if (!installed) {
+        console.error(noPackage);
+        return 1;
+    }
+    // The package's file at each path, whose leading comments a copy `shadcn add` made may hold and no more.
+    const sources = new Map(installed.items.flatMap((item) => item.files.flatMap((file) => {
+        const path = pathOf(file.target);
+        return path ? [[path, new URL(file.path, installed.root)]] : [];
+    })));
+    const leadOf = (text) => leading.exec(bodyOf(text))[0];
+    for (const folder of ejectedFolders(installed.items, pathOf)) {
+        if (!within(new URL(folder, project), project))
+            continue;
+        const entries = await readdir(new URL(folder, project), { withFileTypes: true }).catch(() => []);
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            const path = `${folder}${entry.name}`;
+            const text = await readFile(new URL(path, project), 'utf8');
+            const [, from, hash] = marker.exec(text) ?? [];
+            if (!hash || hash !== hashFrom(from)(text))
+                continue;
+            // A commit's hash leaves leading comments out, so a pragma written above one is an edit the hash cannot see.
+            const source = sources.get(path);
+            const lead = leadOf(text);
+            if (madeByShadcn(from) && lead && lead !== (source && within(source, installed.root) ? leadOf(await readFile(source, 'utf8').catch(() => '')) : ''))
+                continue;
+            await rm(new URL(path, project));
+            console.log(`${path} was not edited since it was ejected, so it is deleted and mithaq-admin draws its own.`);
+        }
+    }
+    return 0;
+};

package/dist/asas/http/fetch.d.ts

@@ -7,17 +7,35 @@ export declare const draftOptions: (request: Request) => {
     autosave?: boolean | undefined;
     tenant?: string | undefined;
 };
+/**
+ * The largest request body a plug reads, which a project names as `maxBodyBytes`: room for a
+ * json field's `defaultJsonMaxBytes` written in any script. A file never comes this way.
+ */
+export declare const defaultMaxBodyBytes: number;
+/**
+ * The body, or the answer that refuses it: 413 once it passes `limit` bytes, and 499 to a client
+ * that went away mid-body, which is no fault of the server's. Counted as it arrives, since a
+ * `content-length` may be absent or wrong, and the rest is never read.
+ */
+export declare const boundedBody: (request: Request, limit: number) => Promise<Blob | Response>;
+/** Refused by name, since core holds no limit of its own. */
+export declare const assertMaxBodyBytes: (owner: string, value: unknown) => void;
+/** Refused by name, as `auth.onError` and `storage.onError` are: core reports no fault of its own. */
+export declare const assertOnError: (owner: string, value: unknown) => void;
+export declare const tooLarge: (limit: number) => Response;
 export type FetchHttpOptions = {
+    /** The largest body a call takes, answered 413 past it: `defaultMaxBodyBytes` or the project's own. Required. */
+    maxBodyBytes: number;
     /**
      * Builds the context every step of a served call reads, from the request and the actor.
      * The plug reads no header or body key into it; a throw is answered 500.
      */
     context?: (request: Request, actor: unknown) => Promise<Record<string, unknown>> | Record<string, unknown>;
-    /** Handed every error that is not an `AsasError`, before the 500 goes out with its message replaced. Defaults to `console.error`. */
-    onError?: (error: unknown) => void;
+    /** Handed every error that is not an `AsasError`, before the 500 goes out with its message replaced. Required. */
+    onError: (error: unknown) => void;
 };
 /**
  * The default HTTP plug: `POST /api/<kayan>/<operation>` with a JSON body, over
  * `Request` and `Response` alone. The runner parses each operation's input.
  */
-export declare const fetchHttp: ({ context, onError }?: FetchHttpOptions) => <View>(operations: OperationTable<View>) => HttpPlug;
+export declare const fetchHttp: (options: FetchHttpOptions) => <View>(operations: OperationTable<View>) => HttpPlug;

package/dist/asas/http/fetch.js

@@ -1,4 +1,4 @@
-import { AfterCommitError, AsasError, afterCommitHeader, codes } from '../runner/errors.js';
+import { AfterCommitError, AsasError, afterCommitHeader, codes, retryConflict } from '../runner/errors.js';
 // The walk enters objects, arrays and the wrappers `unwrap()` opens, and nothing else.
 const datesFromJson = (value, schema) => {
     if (schema.type === 'date' && typeof value === 'string') {
@@ -40,76 +40,139 @@ export const draftOptions = (request) => {
         ...(query.has('tenant') ? { tenant: query.get('tenant') } : {}),
     };
 };
+/**
+ * The largest request body a plug reads, which a project names as `maxBodyBytes`: room for a
+ * json field's `defaultJsonMaxBytes` written in any script. A file never comes this way.
+ */
+export const defaultMaxBodyBytes = 4 * 1024 * 1024;
+/**
+ * The body, or the answer that refuses it: 413 once it passes `limit` bytes, and 499 to a client
+ * that went away mid-body, which is no fault of the server's. Counted as it arrives, since a
+ * `content-length` may be absent or wrong, and the rest is never read.
+ */
+export const boundedBody = async (request, limit) => {
+    const reader = request.body?.getReader();
+    const refused = () => {
+        // Not awaited: a clone's cancel settles only once its twin is cancelled too, which the
+        // caller does after this returns.
+        reader?.cancel().catch(() => { });
+        return tooLarge(limit);
+    };
+    if (Number(request.headers.get('content-length')) > limit)
+        return refused();
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+        let read;
+        try {
+            read = (await reader?.read()) ?? { done: true, value: undefined };
+        }
+        catch (thrown) {
+            if (request.signal.aborted)
+                return new Response(null, { status: 499 });
+            throw thrown;
+        }
+        if (read.done)
+            return new Blob(chunks);
+        size += read.value.byteLength;
+        if (size > limit)
+            return refused();
+        chunks.push(read.value);
+    }
+};
+/** Refused by name, since core holds no limit of its own. */
+export const assertMaxBodyBytes = (owner, value) => {
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new Error(`${owner} names no "maxBodyBytes", the largest request body in bytes it reads, as a whole number above 0. Name the project's own, such as defaultMaxBodyBytes from mithaq.`);
+    }
+};
+/** Refused by name, as `auth.onError` and `storage.onError` are: core reports no fault of its own. */
+export const assertOnError = (owner, value) => {
+    if (typeof value !== 'function') {
+        throw new Error(`${owner} names no "onError" function, which it hands every error that is no refusal before it answers 500. Name the project's own, such as console.error.`);
+    }
+};
+export const tooLarge = (limit) => Response.json({ code: codes[413], message: `The request body holds at most ${limit} bytes.` }, { status: 413 });
 /**
  * The default HTTP plug: `POST /api/<kayan>/<operation>` with a JSON body, over
  * `Request` and `Response` alone. The runner parses each operation's input.
  */
-export const fetchHttp = ({ context, onError = console.error } = {}) => (operations) => {
-    const table = new Map(operations.map((one) => [`${one.kayan}/${one.name}`, one]));
-    return {
-        name: 'fetch',
-        // The operation table is the routes, already published as `asas.operations`.
-        router: undefined,
-        handle: async (request, actor) => {
-            if (request.method !== 'POST')
-                return null;
-            // Two segments under `/api` and no more, so another plug's three-segment prefix
-            // falls through. `null`, not a 404, so a host keeps its own routes.
-            const [api, kayan, name, ...rest] = new URL(request.url).pathname.split('/').slice(1);
-            if (api !== 'api' || !kayan || !name || rest.length > 0)
-                return null;
-            const operation = table.get(`${kayan}/${name}`);
-            if (!operation)
-                return null;
-            const body = await request.text();
-            // Keyless: refused before any operation, and the key names an operation's refusal.
-            const undecodable = (message) => Response.json({ code: codes[400], message }, { status: 400 });
-            let input = {};
-            if (body) {
-                try {
-                    input = JSON.parse(body);
-                }
-                catch {
-                    return undecodable('The request body is not JSON.');
-                }
-                // The runner reads fields off the input, so a body of `null` or `1` would be a
-                // 500 a caller provoked; every caller-provoked refusal is a 4xx.
-                if (input === null || typeof input !== 'object' || Array.isArray(input)) {
-                    return undecodable('The request body is not a JSON object.');
-                }
-            }
-            try {
-                // Resolved after the match, so a host's own routes cost no session lookup.
-                const decoded = decodeJson(input, operation.input);
-                const who = await actor();
-                const result = await operation.call(decoded, { actor: who, context: await context?.(request, who), ...draftOptions(request) });
-                // Only a write says so, because the browser clears its banner on this value alone.
-                return Response.json(result, operation.effect === 'read' ? undefined : { headers: { [afterCommitHeader]: 'ok' } });
-            }
-            catch (thrown) {
-                if (thrown instanceof AfterCommitError) {
+export const fetchHttp = (options) => {
+    // Read off `options?`, since a JavaScript caller may hand nothing, and is refused by name.
+    assertMaxBodyBytes('fetchHttp', options?.maxBodyBytes);
+    assertOnError('fetchHttp', options.onError);
+    const { context, onError, maxBodyBytes } = options;
+    return (operations) => {
+        const table = new Map(operations.map((one) => [`${one.kayan}/${one.name}`, one]));
+        return {
+            name: 'fetch',
+            // The operation table is the routes, already published as `asas.operations`.
+            router: undefined,
+            handle: async (request, actor) => {
+                if (request.method !== 'POST')
+                    return null;
+                // Two segments under `/api` and no more, so another plug's three-segment prefix
+                // falls through. `null`, not a 404, so a host keeps its own routes.
+                const [api, kayan, name, ...rest] = new URL(request.url).pathname.split('/').slice(1);
+                if (api !== 'api' || !kayan || !name || rest.length > 0)
+                    return null;
+                const operation = table.get(`${kayan}/${name}`);
+                if (!operation)
+                    return null;
+                const read = await boundedBody(request, maxBodyBytes);
+                if (read instanceof Response)
+                    return read;
+                const body = await read.text();
+                // Keyless: refused before any operation, and the key names an operation's refusal.
+                const undecodable = (message) => Response.json({ code: codes[400], message }, { status: 400 });
+                let input = {};
+                if (body) {
                     try {
-                        onError?.(thrown.cause);
+                        input = JSON.parse(body);
                     }
                     catch {
-                        // Reporting cannot change a committed result.
+                        return undecodable('The request body is not JSON.');
+                    }
+                    // The runner reads fields off the input, so a body of `null` or `1` would be a
+                    // 500 a caller provoked; every caller-provoked refusal is a 4xx.
+                    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+                        return undecodable('The request body is not a JSON object.');
                     }
-                    return Response.json(thrown.result, { headers: { [afterCommitHeader]: 'failed' } });
-                }
-                if (thrown instanceof AsasError) {
-                    // The cause is never serialized: a conflict's driver error names the column and
-                    // value the refusal's message withholds.
-                    return Response.json({ code: codes[thrown.status], data: { key: thrown.key, params: thrown.params }, message: thrown.message }, { status: thrown.status });
                 }
                 try {
-                    onError?.(thrown);
+                    // Resolved after the match, so a host's own routes cost no session lookup.
+                    const decoded = decodeJson(input, operation.input);
+                    const who = await actor();
+                    const result = await operation.call(decoded, { actor: who, context: await context?.(request, who), ...draftOptions(request) });
+                    // Only a write says so, because the browser clears its banner on this value alone.
+                    return Response.json(result, operation.effect === 'read' ? undefined : { headers: { [afterCommitHeader]: 'ok' } });
                 }
-                catch {
-                    // Deliberately empty: reporting may not change what is reported.
+                catch (thrown) {
+                    if (thrown instanceof AfterCommitError) {
+                        try {
+                            onError(thrown.cause);
+                        }
+                        catch {
+                            // Reporting cannot change a committed result.
+                        }
+                        return Response.json(thrown.result, { headers: { [afterCommitHeader]: 'failed' } });
+                    }
+                    thrown = retryConflict(thrown);
+                    if (thrown instanceof AsasError) {
+                        // The cause is never serialized: a conflict's driver error names the column and
+                        // value the refusal's message withholds.
+                        return Response.json({ code: codes[thrown.status], data: { key: thrown.key, params: thrown.params }, message: thrown.message }, { status: thrown.status });
+                    }
+                    try {
+                        onError(thrown);
+                    }
+                    catch {
+                        // Deliberately empty: reporting may not change what is reported.
+                    }
+                    // Not an `AsasError` is the project's own fault, so its message is replaced.
+                    return Response.json({ code: 'INTERNAL_SERVER_ERROR', message: 'Internal server error' }, { status: 500 });
                 }
-                // Not an `AsasError` is the project's own fault, so its message is replaced.
-                return Response.json({ code: 'INTERNAL_SERVER_ERROR', message: 'Internal server error' }, { status: 500 });
-            }
-        },
+            },
+        };
     };
 };

package/dist/asas/http/orpc.d.ts

@@ -16,9 +16,11 @@ export type OrpcHttpOptions = {
     context?: (request: Request, actor: unknown) => Promise<OrpcContext> | OrpcContext;
     /**
      * Handed every error that is not an `AsasError`, before it is rethrown with its message replaced.
-     * A host's own deliberate `ORPCError` reaches it too, so a host logging only faults filters on the code.
+     * A host's own deliberate `ORPCError` reaches it too, so a host logging only faults filters on the code. Required.
      */
-    onError?: (error: unknown) => void;
+    onError: (error: unknown) => void;
+    /** The largest body a call takes, answered 413 past it: `defaultMaxBodyBytes` or the project's own. Required. */
+    maxBodyBytes: number;
 };
 type OrpcProcedure<Method> = Method extends (...args: infer Args) => Promise<infer Answer> ? Procedure<OrpcContext, OrpcContext, Schema<Args[0], Args[0]>, Schema<Answer, Answer>, Record<never, never>, Record<never, never>> : never;
 /** The router, typed from the operation table: kayan, then operation. `RouterClient` over it needs no generated code. */
@@ -31,7 +33,7 @@ export type OrpcRouter<View> = {
  * The oRPC plug: one procedure per operation, served over both the typed RPC protocol
  * and plain HTTP. Needs `@orpc/server` and `@orpc/openapi`.
  */
-export declare const orpcHttp: ({ rpc, api, context, onError, }?: OrpcHttpOptions) => <View>(operations: OperationTable<View>) => {
+export declare const orpcHttp: (options: OrpcHttpOptions) => <View>(operations: OperationTable<View>) => {
     name: string;
     router: OrpcRouter<View>;
     /**