@fougere/state-cookie 0.0.0-stage → 0.26.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fougere contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,16 @@
-# Temporary Holding Version
+# @fougere/state-cookie
+> A caller's state, kept in a cookie
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+An op reads and writes the caller's state by name (`state: State`); `state:` in `fougere.config.ts`
+says how each name is kept. Importing this package makes `cookie` one of the ways:
+
+```ts
+import '@fougere/state-cookie';
+
+export default defineFougere({
+  state: { cart: { cookie: { maxAge: 604800 } } },   // HttpOnly, SameSite=Lax, Path=/ unless said otherwise
+});
+```
+
+Core signs every value before it leaves (`FOUGERE_STATE_KEY`): the caller can read its cookie, and a
+changed one reads as absent. Every HTTP door carries it — REST, GraphQL, and the envelope a page calls.

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+import { Format, type Accepted } from '@fougere/schema';
+/** What `state: { cart: { cookie: { … } } }` may say — what a `Set-Cookie` line says, by the same names. */
+declare const COOKIE: Format<{
+    domain?: string | undefined;
+    httpOnly?: boolean | undefined;
+    maxAge?: number | undefined;
+    path?: string | undefined;
+    sameSite?: "lax" | "none" | "strict" | undefined;
+    secure?: boolean | undefined;
+}>;
+export type CookieOptions = Accepted<typeof COOKIE>;
+declare module '@fougere/core' {
+    interface FougereStates {
+        cookie: CookieOptions;
+    }
+}
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAExD,4GAA4G;AAC5G,QAAA,MAAM,MAAM;;;;;;;EAOD,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,MAAM,CAAC,CAAC;AAEpD,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,aAAa;QACrB,MAAM,EAAE,aAAa,CAAC;KACvB;CACF"}

package/dist/index.js

@@ -0,0 +1,49 @@
+/** `cookie` — a caller's state kept in a cookie, registered at import. */
+import { States } from '@fougere/core';
+import { Format } from '@fougere/schema';
+/** What `state: { cart: { cookie: { … } } }` may say — what a `Set-Cookie` line says, by the same names. */
+const COOKIE = Format.of('state/cookie')
+    .key('maxAge', Format.count)
+    .key('path', Format.text)
+    .key('domain', Format.text)
+    .key('sameSite', Format.tokens(['lax', 'strict', 'none']))
+    .key('secure', Format.flag)
+    .key('httpOnly', Format.flag)
+    .closed();
+/** The values a `Cookie` header carries, by name. */
+function cookiesOf(header) {
+    return new Map((header ?? '').split(';').flatMap((pair) => {
+        const at = pair.indexOf('=');
+        return at <= 0 ? [] : [[pair.slice(0, at).trim(), pair.slice(at + 1).trim()]];
+    }));
+}
+/**
+ * One `Set-Cookie` line. A script on the page may not read it and a request from another site does
+ * not carry it, unless the entry says otherwise; with no `maxAge` it lasts as long as the browser.
+ */
+function lineOf(name, token, options) {
+    const { path = '/', sameSite = 'lax', httpOnly = true, secure, domain, maxAge } = options;
+    return [
+        `${name}=${token ?? ''}`,
+        `Path=${path}`,
+        `SameSite=${sameSite[0].toUpperCase()}${sameSite.slice(1)}`,
+        ...(httpOnly ? ['HttpOnly'] : []),
+        ...(secure || sameSite === 'none' ? ['Secure'] : []),
+        ...(domain ? [`Domain=${domain}`] : []),
+        ...(token === undefined ? ['Max-Age=0'] : maxAge !== undefined ? [`Max-Age=${maxAge}`] : []),
+    ].join('; ');
+}
+States.register('cookie', {
+    over: 'http',
+    format: COOKIE,
+    read: (carrier, names) => {
+        const cookies = cookiesOf(carrier.request.get('cookie'));
+        return new Map(names.flatMap(({ name }) => (cookies.has(name) ? [[name, cookies.get(name)]] : [])));
+    },
+    write: (carrier, written) => {
+        for (const { name, token, options } of written) {
+            carrier.response.append('set-cookie', lineOf(name, token, options));
+        }
+    },
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,OAAO,EAAE,MAAM,EAAiB,MAAM,iBAAiB,CAAC;AAExD,4GAA4G;AAC5G,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC;KACrC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC;KAC3B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;KACxB,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;KAC1B,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC,CAAC;KAClE,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;KAC1B,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;KAC5B,MAAM,EAAE,CAAC;AAUZ,qDAAqD;AACrD,SAAS,SAAS,CAAC,MAAqB;IACtC,OAAO,IAAI,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE7B,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAU,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,SAAS,MAAM,CAAC,IAAY,EAAE,KAAyB,EAAE,OAAsB;IAC7E,MAAM,EAAE,IAAI,GAAG,GAAG,EAAE,QAAQ,GAAG,KAAK,EAAE,QAAQ,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE1F,OAAO;QACL,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE;QACxB,QAAQ,IAAI,EAAE;QACd,YAAY,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAC5D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,IAAI,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACxB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,SAAS,CAAE,OAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE1E,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAE,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChH,CAAC;IACD,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;YAC9C,OAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAwB,CAAC,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@fougere/state-cookie",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.26.0-alpha.0",
+  "description": "A caller's state kept in a cookie — what `state: { cart: { cookie: {} } }` names, signed by core, carried by every HTTP door.",
+  "keywords": [
+    "fougere",
+    "typescript",
+    "state",
+    "cookie"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chok/fougere.git",
+    "directory": "packages/state/cookie"
+  },
+  "type": "module",
+  "sideEffects": [
+    "./dist/index.js"
+  ],
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "dependencies": {
+    "@fougere/core": "0.26.0-alpha.0",
+    "@fougere/http": "0.26.0-alpha.0",
+    "@fougere/schema": "0.26.0-alpha.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit -p tsconfig.test.json"
+  }
 }

package/src/index.ts

@@ -0,0 +1,64 @@
+/** `cookie` — a caller's state kept in a cookie, registered at import. */
+import { States } from '@fougere/core';
+import type { HttpCarrier } from '@fougere/http';
+import { Format, type Accepted } from '@fougere/schema';
+
+/** What `state: { cart: { cookie: { … } } }` may say — what a `Set-Cookie` line says, by the same names. */
+const COOKIE = Format.of('state/cookie')
+  .key('maxAge', Format.count)
+  .key('path', Format.text)
+  .key('domain', Format.text)
+  .key('sameSite', Format.tokens(['lax', 'strict', 'none'] as const))
+  .key('secure', Format.flag)
+  .key('httpOnly', Format.flag)
+  .closed();
+
+export type CookieOptions = Accepted<typeof COOKIE>;
+
+declare module '@fougere/core' {
+  interface FougereStates {
+    cookie: CookieOptions;
+  }
+}
+
+/** The values a `Cookie` header carries, by name. */
+function cookiesOf(header: string | null): Map<string, string> {
+  return new Map((header ?? '').split(';').flatMap((pair) => {
+    const at = pair.indexOf('=');
+
+    return at <= 0 ? [] : [[pair.slice(0, at).trim(), pair.slice(at + 1).trim()] as const];
+  }));
+}
+
+/**
+ * One `Set-Cookie` line. A script on the page may not read it and a request from another site does
+ * not carry it, unless the entry says otherwise; with no `maxAge` it lasts as long as the browser.
+ */
+function lineOf(name: string, token: string | undefined, options: CookieOptions): string {
+  const { path = '/', sameSite = 'lax', httpOnly = true, secure, domain, maxAge } = options;
+
+  return [
+    `${name}=${token ?? ''}`,
+    `Path=${path}`,
+    `SameSite=${sameSite[0]!.toUpperCase()}${sameSite.slice(1)}`,
+    ...(httpOnly ? ['HttpOnly'] : []),
+    ...(secure || sameSite === 'none' ? ['Secure'] : []),
+    ...(domain ? [`Domain=${domain}`] : []),
+    ...(token === undefined ? ['Max-Age=0'] : maxAge !== undefined ? [`Max-Age=${maxAge}`] : []),
+  ].join('; ');
+}
+
+States.register('cookie', {
+  over: 'http',
+  format: COOKIE,
+  read: (carrier, names) => {
+    const cookies = cookiesOf((carrier as HttpCarrier).request.get('cookie'));
+
+    return new Map(names.flatMap(({ name }) => (cookies.has(name) ? [[name, cookies.get(name)!] as const] : [])));
+  },
+  write: (carrier, written) => {
+    for (const { name, token, options } of written) {
+      (carrier as HttpCarrier).response.append('set-cookie', lineOf(name, token, options as CookieOptions));
+    }
+  },
+});