@isikk/core 0.6.0 → 0.7.0

package/dist/drf/index.cjs

@@ -0,0 +1,55 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/drf/index.ts
+var drf_exports = {};
+__export(drf_exports, {
+  detailOf: () => detailOf,
+  messagesOf: () => messagesOf,
+  toFormErrors: () => toFormErrors
+});
+module.exports = __toCommonJS(drf_exports);
+function toFormErrors(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const errors = {};
+  for (const [field, value] of Object.entries(body)) {
+    if (field === "detail") continue;
+    if (typeof value === "string") errors[field] = [value];
+    else if (Array.isArray(value) && value.every((entry) => typeof entry === "string")) errors[field] = value;
+  }
+  return Object.keys(errors).length > 0 ? errors : void 0;
+}
+function detailOf(body) {
+  if (!body) return void 0;
+  const detail = body.detail;
+  return typeof detail === "string" ? detail : void 0;
+}
+function messagesOf(errors) {
+  if (!errors) return void 0;
+  const { non_field_errors: nonField = [], ...fields } = errors;
+  const messages = [...nonField, ...Object.values(fields).flat()];
+  return messages.length > 0 ? messages.join(" ") : void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  detailOf,
+  messagesOf,
+  toFormErrors
+});
+//# sourceMappingURL=index.cjs.map

package/dist/drf/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/drf/index.ts"],"sourcesContent":["export type FormErrors = Record<string, string[]> & { non_field_errors?: string[] }\n\n/**\n * DRF refuses in two shapes, and which one arrives is decided by the status.\n *\n * A 400 is a validation failure and carries the fields: `{name: [\"This field may not be blank.\"]}`,\n * with `non_field_errors` for anything about the form as a whole. Everything else - 401, 403, 404,\n * 409 - carries `{detail: \"one sentence\"}`, written for a person by whoever raised it.\n *\n * This reads the first shape; `detailOf` reads the second.\n */\nexport function toFormErrors(body: unknown): FormErrors | undefined {\n  if (!body || typeof body !== 'object' || Array.isArray(body)) return undefined\n\n  const errors: FormErrors = {}\n  for (const [field, value] of Object.entries(body as Record<string, unknown>)) {\n    // `detail` is the other shape, not a field. A serializer with a field genuinely called `detail`\n    // would lose it here - that is the price of keeping the two shapes apart.\n    if (field === 'detail') continue\n    if (typeof value === 'string') errors[field] = [value]\n    else if (Array.isArray(value) && value.every((entry) => typeof entry === 'string')) errors[field] = value\n  }\n  return Object.keys(errors).length > 0 ? errors : undefined\n}\n\n/** The sentence DRF wrote for a refusal that is not about a field. */\nexport function detailOf(body: unknown): string | undefined {\n  // `!body` is the whole guard: reading a property off a primitive is legal, and the two values that\n  // would throw are the two this catches.\n  if (!body) return undefined\n  const detail = (body as { detail?: unknown }).detail\n  return typeof detail === 'string' ? detail : undefined\n}\n\n/**\n * Every message in a refusal, as one line, for a caller with nowhere to put them per field.\n *\n * A button or a switch gets the same 400 body a form does. Keeping only `non_field_errors` there\n * would lose the only thing the server said.\n *\n * The field names are left out: they are the serializer's `snake_case`, and DRF's messages read as\n * whole sentences without them.\n */\nexport function messagesOf(errors: FormErrors | undefined): string | undefined {\n  if (!errors) return undefined\n  const { non_field_errors: nonField = [], ...fields } = errors\n  const messages = [...nonField, ...Object.values(fields).flat()]\n  return messages.length > 0 ? messages.join(' ') : undefined\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWO,SAAS,aAAa,MAAuC;AAClE,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AAErE,QAAM,SAAqB,CAAC;AAC5B,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAG5E,QAAI,UAAU,SAAU;AACxB,QAAI,OAAO,UAAU,SAAU,QAAO,KAAK,IAAI,CAAC,KAAK;AAAA,aAC5C,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ,EAAG,QAAO,KAAK,IAAI;AAAA,EACtG;AACA,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,SAAS;AACnD;AAGO,SAAS,SAAS,MAAmC;AAG1D,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,SAAU,KAA8B;AAC9C,SAAO,OAAO,WAAW,WAAW,SAAS;AAC/C;AAWO,SAAS,WAAW,QAAoD;AAC7E,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,kBAAkB,WAAW,CAAC,GAAG,GAAG,OAAO,IAAI;AACvD,QAAM,WAAW,CAAC,GAAG,UAAU,GAAG,OAAO,OAAO,MAAM,EAAE,KAAK,CAAC;AAC9D,SAAO,SAAS,SAAS,IAAI,SAAS,KAAK,GAAG,IAAI;AACpD;","names":[]}

package/dist/drf/index.d.cts

@@ -0,0 +1,27 @@
+type FormErrors = Record<string, string[]> & {
+    non_field_errors?: string[];
+};
+/**
+ * DRF refuses in two shapes, and which one arrives is decided by the status.
+ *
+ * A 400 is a validation failure and carries the fields: `{name: ["This field may not be blank."]}`,
+ * with `non_field_errors` for anything about the form as a whole. Everything else - 401, 403, 404,
+ * 409 - carries `{detail: "one sentence"}`, written for a person by whoever raised it.
+ *
+ * This reads the first shape; `detailOf` reads the second.
+ */
+declare function toFormErrors(body: unknown): FormErrors | undefined;
+/** The sentence DRF wrote for a refusal that is not about a field. */
+declare function detailOf(body: unknown): string | undefined;
+/**
+ * Every message in a refusal, as one line, for a caller with nowhere to put them per field.
+ *
+ * A button or a switch gets the same 400 body a form does. Keeping only `non_field_errors` there
+ * would lose the only thing the server said.
+ *
+ * The field names are left out: they are the serializer's `snake_case`, and DRF's messages read as
+ * whole sentences without them.
+ */
+declare function messagesOf(errors: FormErrors | undefined): string | undefined;
+
+export { type FormErrors, detailOf, messagesOf, toFormErrors };

package/dist/drf/index.d.ts

@@ -0,0 +1,27 @@
+type FormErrors = Record<string, string[]> & {
+    non_field_errors?: string[];
+};
+/**
+ * DRF refuses in two shapes, and which one arrives is decided by the status.
+ *
+ * A 400 is a validation failure and carries the fields: `{name: ["This field may not be blank."]}`,
+ * with `non_field_errors` for anything about the form as a whole. Everything else - 401, 403, 404,
+ * 409 - carries `{detail: "one sentence"}`, written for a person by whoever raised it.
+ *
+ * This reads the first shape; `detailOf` reads the second.
+ */
+declare function toFormErrors(body: unknown): FormErrors | undefined;
+/** The sentence DRF wrote for a refusal that is not about a field. */
+declare function detailOf(body: unknown): string | undefined;
+/**
+ * Every message in a refusal, as one line, for a caller with nowhere to put them per field.
+ *
+ * A button or a switch gets the same 400 body a form does. Keeping only `non_field_errors` there
+ * would lose the only thing the server said.
+ *
+ * The field names are left out: they are the serializer's `snake_case`, and DRF's messages read as
+ * whole sentences without them.
+ */
+declare function messagesOf(errors: FormErrors | undefined): string | undefined;
+
+export { type FormErrors, detailOf, messagesOf, toFormErrors };

package/dist/drf/index.js

@@ -0,0 +1,28 @@
+// src/drf/index.ts
+function toFormErrors(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const errors = {};
+  for (const [field, value] of Object.entries(body)) {
+    if (field === "detail") continue;
+    if (typeof value === "string") errors[field] = [value];
+    else if (Array.isArray(value) && value.every((entry) => typeof entry === "string")) errors[field] = value;
+  }
+  return Object.keys(errors).length > 0 ? errors : void 0;
+}
+function detailOf(body) {
+  if (!body) return void 0;
+  const detail = body.detail;
+  return typeof detail === "string" ? detail : void 0;
+}
+function messagesOf(errors) {
+  if (!errors) return void 0;
+  const { non_field_errors: nonField = [], ...fields } = errors;
+  const messages = [...nonField, ...Object.values(fields).flat()];
+  return messages.length > 0 ? messages.join(" ") : void 0;
+}
+export {
+  detailOf,
+  messagesOf,
+  toFormErrors
+};
+//# sourceMappingURL=index.js.map

package/dist/drf/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/drf/index.ts"],"sourcesContent":["export type FormErrors = Record<string, string[]> & { non_field_errors?: string[] }\n\n/**\n * DRF refuses in two shapes, and which one arrives is decided by the status.\n *\n * A 400 is a validation failure and carries the fields: `{name: [\"This field may not be blank.\"]}`,\n * with `non_field_errors` for anything about the form as a whole. Everything else - 401, 403, 404,\n * 409 - carries `{detail: \"one sentence\"}`, written for a person by whoever raised it.\n *\n * This reads the first shape; `detailOf` reads the second.\n */\nexport function toFormErrors(body: unknown): FormErrors | undefined {\n  if (!body || typeof body !== 'object' || Array.isArray(body)) return undefined\n\n  const errors: FormErrors = {}\n  for (const [field, value] of Object.entries(body as Record<string, unknown>)) {\n    // `detail` is the other shape, not a field. A serializer with a field genuinely called `detail`\n    // would lose it here - that is the price of keeping the two shapes apart.\n    if (field === 'detail') continue\n    if (typeof value === 'string') errors[field] = [value]\n    else if (Array.isArray(value) && value.every((entry) => typeof entry === 'string')) errors[field] = value\n  }\n  return Object.keys(errors).length > 0 ? errors : undefined\n}\n\n/** The sentence DRF wrote for a refusal that is not about a field. */\nexport function detailOf(body: unknown): string | undefined {\n  // `!body` is the whole guard: reading a property off a primitive is legal, and the two values that\n  // would throw are the two this catches.\n  if (!body) return undefined\n  const detail = (body as { detail?: unknown }).detail\n  return typeof detail === 'string' ? detail : undefined\n}\n\n/**\n * Every message in a refusal, as one line, for a caller with nowhere to put them per field.\n *\n * A button or a switch gets the same 400 body a form does. Keeping only `non_field_errors` there\n * would lose the only thing the server said.\n *\n * The field names are left out: they are the serializer's `snake_case`, and DRF's messages read as\n * whole sentences without them.\n */\nexport function messagesOf(errors: FormErrors | undefined): string | undefined {\n  if (!errors) return undefined\n  const { non_field_errors: nonField = [], ...fields } = errors\n  const messages = [...nonField, ...Object.values(fields).flat()]\n  return messages.length > 0 ? messages.join(' ') : undefined\n}\n"],"mappings":";AAWO,SAAS,aAAa,MAAuC;AAClE,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AAErE,QAAM,SAAqB,CAAC;AAC5B,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAG5E,QAAI,UAAU,SAAU;AACxB,QAAI,OAAO,UAAU,SAAU,QAAO,KAAK,IAAI,CAAC,KAAK;AAAA,aAC5C,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ,EAAG,QAAO,KAAK,IAAI;AAAA,EACtG;AACA,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,SAAS;AACnD;AAGO,SAAS,SAAS,MAAmC;AAG1D,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,SAAU,KAA8B;AAC9C,SAAO,OAAO,WAAW,WAAW,SAAS;AAC/C;AAWO,SAAS,WAAW,QAAoD;AAC7E,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,kBAAkB,WAAW,CAAC,GAAG,GAAG,OAAO,IAAI;AACvD,QAAM,WAAW,CAAC,GAAG,UAAU,GAAG,OAAO,OAAO,MAAM,EAAE,KAAK,CAAC;AAC9D,SAAO,SAAS,SAAS,IAAI,SAAS,KAAK,GAAG,IAAI;AACpD;","names":[]}

package/dist/next/request/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/next/request.ts"],"sourcesContent":["/**\n * Validates that `next` is safe to pass to `redirect()` as a post-auth (or similar) redirect\n * target: a same-origin relative path. Rejects anything that isn't a string, doesn't start with\n * `/`, or starts with `//` (protocol-relative, i.e. an off-site redirect) - falling back to\n * `fallback` otherwise, so callers always get a definite path back.\n */\nexport function getSafeRedirect(next: unknown, fallback: string = '/'): string {\n  if (typeof next !== 'string' || !next.startsWith('/') || next.startsWith('//')) {\n    return fallback\n  }\n  return next\n}\n\nconst DEFAULT_LOCAL_DEV_HOSTS: RegExp[] = [/^localhost(:\\d+)?$/, /^127\\.0\\.0\\.1(:\\d+)?$/]\n\nfunction isDefaultLocalDevHost(host: string): boolean {\n  return DEFAULT_LOCAL_DEV_HOSTS.some((pattern) => pattern.test(host))\n}\n\nexport interface GetRequestOriginOptions {\n  /** Overrides how a \"known local-dev host\" (assumed http, not https) is detected. */\n  isLocalDevHost?: (host: string) => boolean\n}\n\n/**\n * Resolves the true external origin (e.g. `https://real.host`) of an incoming request from its\n * `X-Forwarded-*` headers, for server-side code that needs to build an absolute URL back to\n * itself behind a reverse proxy. Trusts `X-Forwarded-Proto` when present; otherwise falls back to\n * `isLocalDevHost` to decide between `http`/`https`, since local dev typically has no proxy\n * setting that header. Throws if neither `X-Forwarded-Host` nor `Host` is present.\n */\nexport function getRequestOrigin(headers: Headers, options: GetRequestOriginOptions = {}): string {\n  const isLocalDevHost = options.isLocalDevHost ?? isDefaultLocalDevHost\n  const host = headers.get('x-forwarded-host') ?? headers.get('host')\n  if (!host) {\n    throw new Error('getRequestOrigin: request has neither an X-Forwarded-Host nor a Host header')\n  }\n\n  const protocol = headers.get('x-forwarded-proto') ?? (isLocalDevHost(host) ? 'http' : 'https')\n  return `${protocol}://${host}`\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMO,SAAS,gBAAgB,MAAe,WAAmB,KAAa;AAC7E,MAAI,OAAO,SAAS,YAAY,CAAC,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,IAAI,GAAG;AAC9E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,IAAM,0BAAoC,CAAC,sBAAsB,uBAAuB;AAExF,SAAS,sBAAsB,MAAuB;AACpD,SAAO,wBAAwB,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AACrE;AAcO,SAAS,iBAAiB,SAAkB,UAAmC,CAAC,GAAW;AAChG,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,OAAO,QAAQ,IAAI,kBAAkB,KAAK,QAAQ,IAAI,MAAM;AAClE,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AAEA,QAAM,WAAW,QAAQ,IAAI,mBAAmB,MAAM,eAAe,IAAI,IAAI,SAAS;AACtF,SAAO,GAAG,QAAQ,MAAM,IAAI;AAC9B;","names":[]}
+{"version":3,"sources":["../../../src/next/request.ts"],"sourcesContent":["/**\n * Only a same-origin relative path passes: `//host` is protocol-relative and would send the\n * visitor off-site, so a `next` query param can't be turned into an open redirect.\n */\nexport function getSafeRedirect(next: unknown, fallback: string = '/'): string {\n  if (typeof next !== 'string' || !next.startsWith('/') || next.startsWith('//')) {\n    return fallback\n  }\n  return next\n}\n\nconst DEFAULT_LOCAL_DEV_HOSTS: RegExp[] = [/^localhost(:\\d+)?$/, /^127\\.0\\.0\\.1(:\\d+)?$/]\n\nfunction isDefaultLocalDevHost(host: string): boolean {\n  return DEFAULT_LOCAL_DEV_HOSTS.some((pattern) => pattern.test(host))\n}\n\nexport interface GetRequestOriginOptions {\n  /** Overrides how a \"known local-dev host\" (assumed http, not https) is detected. */\n  isLocalDevHost?: (host: string) => boolean\n}\n\n/**\n * Resolves the true external origin (e.g. `https://real.host`) of an incoming request from its\n * `X-Forwarded-*` headers, for server-side code that needs to build an absolute URL back to\n * itself behind a reverse proxy. Trusts `X-Forwarded-Proto` when present; otherwise falls back to\n * `isLocalDevHost` to decide between `http`/`https`, since local dev typically has no proxy\n * setting that header. Throws if neither `X-Forwarded-Host` nor `Host` is present.\n */\nexport function getRequestOrigin(headers: Headers, options: GetRequestOriginOptions = {}): string {\n  const isLocalDevHost = options.isLocalDevHost ?? isDefaultLocalDevHost\n  const host = headers.get('x-forwarded-host') ?? headers.get('host')\n  if (!host) {\n    throw new Error('getRequestOrigin: request has neither an X-Forwarded-Host nor a Host header')\n  }\n\n  const protocol = headers.get('x-forwarded-proto') ?? (isLocalDevHost(host) ? 'http' : 'https')\n  return `${protocol}://${host}`\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,SAAS,gBAAgB,MAAe,WAAmB,KAAa;AAC7E,MAAI,OAAO,SAAS,YAAY,CAAC,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,IAAI,GAAG;AAC9E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,IAAM,0BAAoC,CAAC,sBAAsB,uBAAuB;AAExF,SAAS,sBAAsB,MAAuB;AACpD,SAAO,wBAAwB,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AACrE;AAcO,SAAS,iBAAiB,SAAkB,UAAmC,CAAC,GAAW;AAChG,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,OAAO,QAAQ,IAAI,kBAAkB,KAAK,QAAQ,IAAI,MAAM;AAClE,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AAEA,QAAM,WAAW,QAAQ,IAAI,mBAAmB,MAAM,eAAe,IAAI,IAAI,SAAS;AACtF,SAAO,GAAG,QAAQ,MAAM,IAAI;AAC9B;","names":[]}

package/dist/next/request/index.d.cts

@@ -1,8 +1,6 @@
 /**
- * Validates that `next` is safe to pass to `redirect()` as a post-auth (or similar) redirect
- * target: a same-origin relative path. Rejects anything that isn't a string, doesn't start with
- * `/`, or starts with `//` (protocol-relative, i.e. an off-site redirect) - falling back to
- * `fallback` otherwise, so callers always get a definite path back.
+ * Only a same-origin relative path passes: `//host` is protocol-relative and would send the
+ * visitor off-site, so a `next` query param can't be turned into an open redirect.
  */
 declare function getSafeRedirect(next: unknown, fallback?: string): string;
 interface GetRequestOriginOptions {

package/dist/next/request/index.d.ts

@@ -1,8 +1,6 @@
 /**
- * Validates that `next` is safe to pass to `redirect()` as a post-auth (or similar) redirect
- * target: a same-origin relative path. Rejects anything that isn't a string, doesn't start with
- * `/`, or starts with `//` (protocol-relative, i.e. an off-site redirect) - falling back to
- * `fallback` otherwise, so callers always get a definite path back.
+ * Only a same-origin relative path passes: `//host` is protocol-relative and would send the
+ * visitor off-site, so a `next` query param can't be turned into an open redirect.
  */
 declare function getSafeRedirect(next: unknown, fallback?: string): string;
 interface GetRequestOriginOptions {

package/dist/next/request/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/next/request.ts"],"sourcesContent":["/**\n * Validates that `next` is safe to pass to `redirect()` as a post-auth (or similar) redirect\n * target: a same-origin relative path. Rejects anything that isn't a string, doesn't start with\n * `/`, or starts with `//` (protocol-relative, i.e. an off-site redirect) - falling back to\n * `fallback` otherwise, so callers always get a definite path back.\n */\nexport function getSafeRedirect(next: unknown, fallback: string = '/'): string {\n  if (typeof next !== 'string' || !next.startsWith('/') || next.startsWith('//')) {\n    return fallback\n  }\n  return next\n}\n\nconst DEFAULT_LOCAL_DEV_HOSTS: RegExp[] = [/^localhost(:\\d+)?$/, /^127\\.0\\.0\\.1(:\\d+)?$/]\n\nfunction isDefaultLocalDevHost(host: string): boolean {\n  return DEFAULT_LOCAL_DEV_HOSTS.some((pattern) => pattern.test(host))\n}\n\nexport interface GetRequestOriginOptions {\n  /** Overrides how a \"known local-dev host\" (assumed http, not https) is detected. */\n  isLocalDevHost?: (host: string) => boolean\n}\n\n/**\n * Resolves the true external origin (e.g. `https://real.host`) of an incoming request from its\n * `X-Forwarded-*` headers, for server-side code that needs to build an absolute URL back to\n * itself behind a reverse proxy. Trusts `X-Forwarded-Proto` when present; otherwise falls back to\n * `isLocalDevHost` to decide between `http`/`https`, since local dev typically has no proxy\n * setting that header. Throws if neither `X-Forwarded-Host` nor `Host` is present.\n */\nexport function getRequestOrigin(headers: Headers, options: GetRequestOriginOptions = {}): string {\n  const isLocalDevHost = options.isLocalDevHost ?? isDefaultLocalDevHost\n  const host = headers.get('x-forwarded-host') ?? headers.get('host')\n  if (!host) {\n    throw new Error('getRequestOrigin: request has neither an X-Forwarded-Host nor a Host header')\n  }\n\n  const protocol = headers.get('x-forwarded-proto') ?? (isLocalDevHost(host) ? 'http' : 'https')\n  return `${protocol}://${host}`\n}\n"],"mappings":";AAMO,SAAS,gBAAgB,MAAe,WAAmB,KAAa;AAC7E,MAAI,OAAO,SAAS,YAAY,CAAC,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,IAAI,GAAG;AAC9E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,IAAM,0BAAoC,CAAC,sBAAsB,uBAAuB;AAExF,SAAS,sBAAsB,MAAuB;AACpD,SAAO,wBAAwB,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AACrE;AAcO,SAAS,iBAAiB,SAAkB,UAAmC,CAAC,GAAW;AAChG,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,OAAO,QAAQ,IAAI,kBAAkB,KAAK,QAAQ,IAAI,MAAM;AAClE,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AAEA,QAAM,WAAW,QAAQ,IAAI,mBAAmB,MAAM,eAAe,IAAI,IAAI,SAAS;AACtF,SAAO,GAAG,QAAQ,MAAM,IAAI;AAC9B;","names":[]}
+{"version":3,"sources":["../../../src/next/request.ts"],"sourcesContent":["/**\n * Only a same-origin relative path passes: `//host` is protocol-relative and would send the\n * visitor off-site, so a `next` query param can't be turned into an open redirect.\n */\nexport function getSafeRedirect(next: unknown, fallback: string = '/'): string {\n  if (typeof next !== 'string' || !next.startsWith('/') || next.startsWith('//')) {\n    return fallback\n  }\n  return next\n}\n\nconst DEFAULT_LOCAL_DEV_HOSTS: RegExp[] = [/^localhost(:\\d+)?$/, /^127\\.0\\.0\\.1(:\\d+)?$/]\n\nfunction isDefaultLocalDevHost(host: string): boolean {\n  return DEFAULT_LOCAL_DEV_HOSTS.some((pattern) => pattern.test(host))\n}\n\nexport interface GetRequestOriginOptions {\n  /** Overrides how a \"known local-dev host\" (assumed http, not https) is detected. */\n  isLocalDevHost?: (host: string) => boolean\n}\n\n/**\n * Resolves the true external origin (e.g. `https://real.host`) of an incoming request from its\n * `X-Forwarded-*` headers, for server-side code that needs to build an absolute URL back to\n * itself behind a reverse proxy. Trusts `X-Forwarded-Proto` when present; otherwise falls back to\n * `isLocalDevHost` to decide between `http`/`https`, since local dev typically has no proxy\n * setting that header. Throws if neither `X-Forwarded-Host` nor `Host` is present.\n */\nexport function getRequestOrigin(headers: Headers, options: GetRequestOriginOptions = {}): string {\n  const isLocalDevHost = options.isLocalDevHost ?? isDefaultLocalDevHost\n  const host = headers.get('x-forwarded-host') ?? headers.get('host')\n  if (!host) {\n    throw new Error('getRequestOrigin: request has neither an X-Forwarded-Host nor a Host header')\n  }\n\n  const protocol = headers.get('x-forwarded-proto') ?? (isLocalDevHost(host) ? 'http' : 'https')\n  return `${protocol}://${host}`\n}\n"],"mappings":";AAIO,SAAS,gBAAgB,MAAe,WAAmB,KAAa;AAC7E,MAAI,OAAO,SAAS,YAAY,CAAC,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,IAAI,GAAG;AAC9E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,IAAM,0BAAoC,CAAC,sBAAsB,uBAAuB;AAExF,SAAS,sBAAsB,MAAuB;AACpD,SAAO,wBAAwB,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AACrE;AAcO,SAAS,iBAAiB,SAAkB,UAAmC,CAAC,GAAW;AAChG,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,OAAO,QAAQ,IAAI,kBAAkB,KAAK,QAAQ,IAAI,MAAM;AAClE,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AAEA,QAAM,WAAW,QAAQ,IAAI,mBAAmB,MAAM,eAAe,IAAI,IAAI,SAAS;AACtF,SAAO,GAAG,QAAQ,MAAM,IAAI;AAC9B;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isikk/core",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Everyday TypeScript utilities.",
   "license": "MIT",
   "author": {
@@ -38,6 +38,11 @@
       "import": "./dist/hooks/index.js",
       "require": "./dist/hooks/index.cjs"
     },
+    "./drf": {
+      "types": "./dist/drf/index.d.ts",
+      "import": "./dist/drf/index.js",
+      "require": "./dist/drf/index.cjs"
+    },
     "./node": {
       "types": "./dist/node/index.d.ts",
       "import": "./dist/node/index.js",