@getstrata/core 2.2.41 → 2.2.42

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @getstrata/core changelog
 
+## 2.2.42
+
+Generate auth JSON and forms with explicit private, no-store cache policy. Add privateJsonResponse and typed view namespace header defaults while preserving normal public defaults, native cookies, per-response overrides and HTMX representation behavior. Cover packed APIs and actual generated cookie/token/JWT/CSRF/profile/form HTTP responses.
+
+Use the canonical error serializer for core JSON admission denials so authentication, policy/admin/ability, verification, password confirmation and body-limit failures retain no-store. Preserve exact status/message contracts, keep checker details private and retain HTML redirects/throws and successful response headers. Add packed producer regressions and a native detail-projection case.
+
 ## 2.2.41
 
 Make framework HTML/JSON error responses non-storeable, including configured/fallback renderers and custom-body 404 responses; retain success-response cache policy and add packed header regressions.

package/dist/core/http/response.d.ts

@@ -1,5 +1,7 @@
 import type { Middleware } from "./middleware";
 declare function jsonResponse(data: unknown, init?: ResponseInit): Response;
+/** Explicit private payloads (identity, credentials and CSRF); public JSON defaults stay unchanged. */
+declare function privateJsonResponse(data: unknown, init?: ResponseInit): Response;
 declare function createdResponse(data: unknown, init?: ResponseInit): Response;
 declare function noContentResponse(): Response;
 declare function errorResponse(error: unknown): Response;
@@ -9,4 +11,4 @@ declare function withJsonErrorHandling<THandler extends (request: Request) => Re
 declare function withJsonErrorHandling<TArgs extends unknown[]>(handler: (...args: TArgs) => Response | Promise<Response>): (...args: TArgs) => Promise<Response>;
 declare function createJsonErrorMiddleware(): Middleware;
 declare function createWebErrorMiddleware(): Middleware;
-export { createdResponse, createJsonErrorMiddleware, createWebErrorMiddleware, errorResponse, jsonResponse, noContentResponse, withErrorHandling, withJsonErrorHandling, };
+export { createdResponse, createJsonErrorMiddleware, createWebErrorMiddleware, errorResponse, jsonResponse, noContentResponse, privateJsonResponse, withErrorHandling, withJsonErrorHandling, };

package/dist/core/view/index.d.ts

@@ -2,7 +2,7 @@ export type { LayoutDataResolver, RenderOptions } from "./etaViewEngine";
 export { DEFAULT_VIEWS_DIRECTORY, EtaViewEngine } from "./etaViewEngine";
 export { htmlResponse, isHtmxRequest, redirectResponse, rssResponse, textResponse, xmlResponse, } from "./htmlResponse";
 export type { ViewEngine } from "./viewEngine";
-export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewResponseOptions, } from "./viewRenderer";
+export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewNamespaceOptions, ViewResponseOptions, } from "./viewRenderer";
 export { CORE_VIEW_RENDERER_TOKEN, ViewRenderer } from "./viewRenderer";
 export type { WebErrorViewInput, WebErrorViewOptions } from "./webErrorView";
 export { configureWebErrorView, errorTemplateName, htmlErrorResponse, notFoundHtmlResponse, renderKernelErrorChrome, renderWebErrorHtml, } from "./webErrorView";

package/dist/core/view/viewRenderer.d.ts

@@ -10,6 +10,10 @@ interface HtmxViewResponseOptions extends ViewResponseOptions {
     /** Optional fragment template; otherwise render the page template without its layout. */
     fragment?: string;
 }
+interface ViewNamespaceOptions {
+    /** Copied response defaults. Per-render headers override defaults with the same name. */
+    headers?: ConstructorParameters<typeof Headers>[0];
+}
 interface NamespacedViewRenderer {
     render: ViewRenderer["render"];
     renderHtmx: ViewRenderer["renderHtmx"];
@@ -20,11 +24,11 @@ declare class ViewRenderer {
     private readonly defaultLayout?;
     constructor(engine: ViewEngine, defaultLayout?: string | false | undefined);
     /** Explicit template prefix; layout names and response contracts remain unchanged. */
-    namespace(prefix: string): NamespacedViewRenderer;
+    namespace(prefix: string, defaults?: ViewNamespaceOptions): NamespacedViewRenderer;
     render(name: string, data?: Record<string, unknown>, options?: ViewResponseOptions): Promise<Response>;
     /** Opt-in representation selection; auth/CSRF/tenancy remain the route's responsibility. */
     renderHtmx(name: string, data?: Record<string, unknown>, options?: HtmxViewResponseOptions): Promise<Response>;
 }
 declare const CORE_VIEW_RENDERER_TOKEN: import("../contracts/container").ServiceToken<ViewRenderer>;
-export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewResponseOptions };
+export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewNamespaceOptions, ViewResponseOptions, };
 export { CORE_VIEW_RENDERER_TOKEN, ViewRenderer };

package/dist/entries/http/authorizeMiddleware.js

@@ -2,12 +2,13 @@
 // ../../src/core/http/authorizeMiddleware.ts
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { ForbiddenError } from "@getstrata/core/errors/http";
+import { errorResponse } from "@getstrata/core/http/response";
 function createAuthorizeMiddleware(gate, auth, resource, action) {
   return async (request, next) => {
     const user = currentAuthUser() ?? await auth.resolve(request);
     if (!gate.allows(resource, action, user)) {
       const error = new ForbiddenError;
-      return Response.json({ error: error.message }, { status: error.status });
+      return errorResponse(error);
     }
     return await next();
   };

package/dist/entries/http/bodySizeLimitMiddleware.js

@@ -1,6 +1,7 @@
 // @bun
 // ../../src/core/http/bodySizeLimitMiddleware.ts
 import { PayloadTooLargeError } from "@getstrata/core/errors/http";
+import { errorResponse } from "@getstrata/core/http/response";
 var guards = new WeakMap;
 function guardBody(request, maxBytes) {
   const existing = guards.get(request);
@@ -76,7 +77,7 @@ function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
   return async (request, next) => {
     const tooLarge = () => {
       const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
-      return Response.json({ error: error.message }, { status: error.status });
+      return errorResponse(error);
     };
     const length = Number(request.headers.get("content-length"));
     if (Number.isFinite(length) && length > maxBytes)

package/dist/entries/http/requireAbilityMiddleware.js

@@ -1,7 +1,8 @@
 // @bun
 // ../../src/core/http/requireAbilityMiddleware.ts
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
-import { ForbiddenError } from "@getstrata/core/errors/http";
+import { ForbiddenError, HttpError } from "@getstrata/core/errors/http";
+import { errorResponse } from "@getstrata/core/http/response";
 
 // ../../src/core/runtime/frontendMode.ts
 var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
@@ -80,7 +81,7 @@ function createRequireAbilityMiddleware(abilityChecker) {
           if (isViewsEnabled() && !requestPrefersJson(request)) {
             throw error;
           }
-          return Response.json({ error: error.message }, { status: error.status });
+          return errorResponse(new HttpError(error.status, error.message));
         }
         throw error;
       }

package/dist/entries/http/requireAuthMiddleware.js

@@ -1,11 +1,12 @@
 // @bun
 // ../../src/core/http/requireAuthMiddleware.ts
 import { UnauthorizedError } from "@getstrata/core/errors/http";
+import { errorResponse } from "@getstrata/core/http/response";
 function createRequireAuthMiddleware(auth) {
   return async (request, next) => {
     if (!await auth.check(request)) {
       const error = new UnauthorizedError;
-      return Response.json({ error: error.message }, { status: error.status });
+      return errorResponse(error);
     }
     return await next();
   };

package/dist/entries/http/requireGlobalAdminMiddleware.js

@@ -3,6 +3,7 @@
 import { isGlobalAdmin } from "@getstrata/core/auth/accessControl";
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { ForbiddenError } from "@getstrata/core/errors/http";
+import { errorResponse } from "@getstrata/core/http/response";
 import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
 function createRequireGlobalAdminMiddleware() {
   return async (_request, next) => {
@@ -13,7 +14,7 @@ function createRequireGlobalAdminMiddleware() {
         path: new URL(_request.url).pathname
       });
       const error = new ForbiddenError("Platform admin access required.");
-      return Response.json({ error: error.message }, { status: error.status });
+      return errorResponse(error);
     }
     return await next();
   };

package/dist/entries/http/requirePasswordConfirmMiddleware.js

@@ -3,6 +3,8 @@
 import { resolveUserId } from "@getstrata/core/auth/accessControl";
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { hasFreshPasswordConfirmation } from "@getstrata/core/auth/passwordConfirmCookie";
+import { HttpError, UnauthorizedError } from "@getstrata/core/errors/http";
+import { errorResponse } from "@getstrata/core/http/response";
 
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {
@@ -101,7 +103,7 @@ function createRequirePasswordConfirmMiddleware() {
     const user = currentAuthUser();
     if (!user) {
       if (requestPrefersJson(request)) {
-        return Response.json({ error: "Authentication required." }, { status: 401 });
+        return errorResponse(new UnauthorizedError("Authentication required."));
       }
       return Response.redirect("/login", 302);
     }
@@ -110,7 +112,7 @@ function createRequirePasswordConfirmMiddleware() {
       return await next();
     }
     if (requestPrefersJson(request)) {
-      return Response.json({ error: PASSWORD_CONFIRM_MESSAGE }, { status: 423 });
+      return errorResponse(new HttpError(423, PASSWORD_CONFIRM_MESSAGE));
     }
     const url = new URL(request.url);
     const intended = request.method === "GET" ? `${url.pathname}${url.search}` : "/account";

package/dist/entries/http/requireVerifiedMiddleware.js

@@ -6,6 +6,8 @@ import {
   isEmailVerificationRequired
 } from "@getstrata/core/auth/emailVerification";
 import { createIntendedUrlCookieFromRequest } from "@getstrata/core/auth/intendedUrlCookie";
+import { ForbiddenError } from "@getstrata/core/errors/http";
+import { errorResponse } from "@getstrata/core/http/response";
 
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {
@@ -46,7 +48,7 @@ function createRequireVerifiedMiddleware(auth) {
       return await next();
     }
     if (requestPrefersJson(request)) {
-      return Response.json({ error: UNVERIFIED_MESSAGE }, { status: 403 });
+      return errorResponse(new ForbiddenError(UNVERIFIED_MESSAGE));
     }
     const headers = new Headers({ Location: VERIFY_NOTICE_PATH });
     const intended = createIntendedUrlCookieFromRequest(request);

package/dist/entries/http/response.js

@@ -266,6 +266,11 @@ function jsonResponse(data, init = {}) {
     headers: init.headers
   });
 }
+function privateJsonResponse(data, init = {}) {
+  const response = jsonResponse(data, init);
+  response.headers.set("Cache-Control", "private, no-store");
+  return response;
+}
 function createdResponse(data, init = {}) {
   return jsonResponse(data, { ...init, status: init.status ?? 201 });
 }
@@ -325,6 +330,7 @@ export {
   errorResponse,
   jsonResponse,
   noContentResponse,
+  privateJsonResponse,
   withErrorHandling,
   withJsonErrorHandling
 };

package/dist/framework/public-api.d.ts

@@ -106,7 +106,7 @@ export { createRequireAbilityMiddleware } from "../core/http/requireAbilityMiddl
 export { createRequireGlobalAdminMiddleware } from "../core/http/requireGlobalAdminMiddleware.ts";
 export { createRequireWebAuthMiddleware } from "../core/http/requireWebAuthMiddleware.ts";
 export { JsonResource, ResourceCollection, serializeDate, toPaginatedResourceCollection, toResourceCollection, whenLoaded, } from "../core/http/resources.ts";
-export { createdResponse, errorResponse, jsonResponse, noContentResponse, withErrorHandling, } from "../core/http/response.ts";
+export { createdResponse, errorResponse, jsonResponse, noContentResponse, privateJsonResponse, withErrorHandling, } from "../core/http/response.ts";
 export type { ResourceActions, ResourceMemberHandler, ResourceRouteMap, RouteRequest, } from "../core/http/route.ts";
 export { getRouteParams, mergeRouteMaps, resourceRoutes } from "../core/http/route.ts";
 export { loginRedirectLocation, safeInternalRedirectPath, sanitizeInternalPath, } from "../core/http/safeInternalPath.ts";
@@ -171,5 +171,5 @@ export type { ValidationRule, ValidationSchema } from "../core/validation/rules.
 export { emailRule, maxLength, minLength, required, stringRule, validateObject, } from "../core/validation/rules.ts";
 export { CORE_VIEW_RENDERER_TOKEN, configureWebErrorView, configureWebLayoutData, createWebLayoutDataResolver, DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, errorTemplateName, htmlErrorResponse, htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, renderKernelErrorChrome, renderWebErrorHtml, resolveWebLayoutData, rssResponse, textResponse, ViewRenderer, xmlResponse, } from "../core/view/index.ts";
 export type { ViewEngine } from "../core/view/viewEngine.ts";
-export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewResponseOptions, } from "../core/view/viewRenderer.ts";
+export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewNamespaceOptions, ViewResponseOptions, } from "../core/view/viewRenderer.ts";
 export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey, } from "../core/view/webLayoutData.ts";