@loutrejs/loutre 0.4.1 → 0.6.0

package/dist/http/auth.d.ts

@@ -0,0 +1,46 @@
+import type { HttpExecutionResult, HttpMiddleware, HttpMiddlewareContext } from './extension.js';
+export interface BasicAuthCredentials {
+    readonly username: string;
+    readonly password: string;
+}
+export interface HttpAuthenticationFailure<TResponse extends string, TBody> {
+    readonly response: TResponse;
+    readonly body: TBody;
+}
+export type BasicAuthUnauthorized<TResponse extends string, TBody> = HttpAuthenticationFailure<TResponse, TBody>;
+export type BearerAuthUnauthorized<TResponse extends string, TBody> = HttpAuthenticationFailure<TResponse, TBody>;
+export interface BasicAuthContext {
+    readonly input: {
+        readonly headers: Readonly<Record<string, string | undefined>>;
+    };
+}
+export interface BearerAuthContext {
+    readonly input: {
+        readonly headers: Readonly<Record<string, string | undefined>>;
+    };
+}
+type AuthenticationChallengeHeaders = {
+    readonly 'www-authenticate': string;
+};
+type AuthenticationShortCircuit<TResponse extends string, TBody> = HttpExecutionResult<TResponse, TBody, AuthenticationChallengeHeaders>;
+export interface BasicAuthDefinition<TContribution extends object, TResponse extends string, TUnauthorizedBody> {
+    readonly name?: string;
+    readonly realm: string;
+    readonly factory: () => BasicAuthRuntime<TContribution, TResponse, TUnauthorizedBody>;
+}
+export interface BasicAuthRuntime<TContribution extends object, TResponse extends string, TUnauthorizedBody> {
+    authenticate(credentials: BasicAuthCredentials): TContribution | null | undefined | Promise<TContribution | null | undefined>;
+    unauthorized(): HttpAuthenticationFailure<TResponse, TUnauthorizedBody>;
+}
+export declare function basicAuth<const TContribution extends object, const TResponse extends string, TUnauthorizedBody>(definition: BasicAuthDefinition<TContribution, TResponse, TUnauthorizedBody>): HttpMiddleware<TContribution, HttpMiddlewareContext, AuthenticationShortCircuit<TResponse, TUnauthorizedBody>>;
+export interface BearerAuthDefinition<TContribution extends object, TResponse extends string, TUnauthorizedBody> {
+    readonly name?: string;
+    readonly realm: string;
+    readonly factory: () => BearerAuthRuntime<TContribution, TResponse, TUnauthorizedBody>;
+}
+export interface BearerAuthRuntime<TContribution extends object, TResponse extends string, TUnauthorizedBody> {
+    authenticate(token: string): TContribution | null | undefined | Promise<TContribution | null | undefined>;
+    unauthorized(): HttpAuthenticationFailure<TResponse, TUnauthorizedBody>;
+}
+export declare function bearerAuth<const TContribution extends object, const TResponse extends string, TUnauthorizedBody>(definition: BearerAuthDefinition<TContribution, TResponse, TUnauthorizedBody>): HttpMiddleware<TContribution, HttpMiddlewareContext, AuthenticationShortCircuit<TResponse, TUnauthorizedBody>>;
+export {};

package/dist/http/auth.js

@@ -0,0 +1,96 @@
+import { defineLayer } from '../core/index.js';
+export function basicAuth(definition) {
+    const challenge = formatBasicChallenge(definition.realm);
+    return defineLayer({
+        name: definition.name ?? 'basicAuth',
+        factory: () => {
+            const runtime = definition.factory();
+            return async (context, next) => {
+                const credentials = decodeBasicCredentials(context.request.headers.get('authorization'));
+                if (!credentials) {
+                    return authenticationFailure(runtime.unauthorized(), challenge);
+                }
+                const contribution = await runtime.authenticate(credentials);
+                if (contribution == null) {
+                    return authenticationFailure(runtime.unauthorized(), challenge);
+                }
+                await next(contribution);
+            };
+        },
+    });
+}
+export function bearerAuth(definition) {
+    const challenge = formatBearerChallenge(definition.realm);
+    return defineLayer({
+        name: definition.name ?? 'bearerAuth',
+        factory: () => {
+            const runtime = definition.factory();
+            return async (context, next) => {
+                const token = readBearerToken(context.request.headers.get('authorization'));
+                if (!token) {
+                    return authenticationFailure(runtime.unauthorized(), challenge);
+                }
+                const contribution = await runtime.authenticate(token);
+                if (contribution == null) {
+                    return authenticationFailure(runtime.unauthorized(), challenge);
+                }
+                await next(contribution);
+            };
+        },
+    });
+}
+function authenticationFailure(failure, challenge) {
+    return {
+        kind: 'http-result',
+        response: failure.response,
+        body: failure.body,
+        headers: { 'www-authenticate': challenge },
+    };
+}
+function formatBasicChallenge(realm) {
+    assertValidRealm(realm, 'Basic');
+    return `Basic realm="${escapeChallengeValue(realm)}", charset="UTF-8"`;
+}
+function formatBearerChallenge(realm) {
+    assertValidRealm(realm, 'Bearer');
+    return `Bearer realm="${escapeChallengeValue(realm)}"`;
+}
+function assertValidRealm(realm, scheme) {
+    if (realm.length === 0 || containsControlCharacter(realm)) {
+        throw new TypeError(`${scheme} authentication realm cannot be empty or contain control characters`);
+    }
+}
+function containsControlCharacter(value) {
+    for (const character of value) {
+        const code = character.charCodeAt(0);
+        if (code <= 0x1f || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+function decodeBasicCredentials(authorization) {
+    const encoded = /^Basic +([A-Za-z0-9+/]+={0,2})$/i.exec(authorization ?? '')?.[1];
+    if (!encoded)
+        return undefined;
+    try {
+        const binary = atob(encoded);
+        const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+        const decoded = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        const separator = decoded.indexOf(':');
+        if (separator < 0)
+            return undefined;
+        return {
+            username: decoded.slice(0, separator),
+            password: decoded.slice(separator + 1),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function readBearerToken(authorization) {
+    return /^Bearer +([^\s]+)$/i.exec(authorization ?? '')?.[1];
+}
+function escapeChallengeValue(value) {
+    return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
+}

package/dist/http/client.d.ts

@@ -1,13 +1,12 @@
-import { type ContractDefinition, type ProcedureDefinition, type SchemaInput, type SchemaOutput, type StandardSchemaV1 } from '../core/index.js';
-import type { HttpHeaders, HttpParamsSchemas, HttpProtocol, HttpProtocolDefinition, HttpRequestBodyDefinition, HttpResponseDefinition } from './definitions.js';
-import { type PathParamNames, type RawPathParams } from './path.js';
+import { type SchemaInput, type SchemaOutput, type StandardSchemaV1 } from '../core/index.js';
+import type { HttpContract, HttpExecutionResponseDefinition, HttpExecutionRouteDefinition, HttpHeaders } from './extension.js';
+import { type PathParamNames } from './path.js';
 export interface HttpClientTransportRequest {
     readonly method: string;
     readonly path: string;
     readonly query?: unknown;
     readonly headers?: unknown;
     readonly body?: unknown;
-    readonly contentType?: string;
 }
 export interface HttpClientTransportResponse {
     readonly status: number;
@@ -15,45 +14,43 @@ export interface HttpClientTransportResponse {
     readonly headers?: HttpHeaders;
 }
 export type HttpClientTransport = (request: HttpClientTransportRequest) => Promise<HttpClientTransportResponse>;
-type HttpProtocolOf<TProcedure extends ProcedureDefinition> = TProcedure['protocols'] extends {
-    readonly http: infer TProtocol;
-} ? TProtocol extends HttpProtocol<infer TDefinition> ? HttpProtocol<TDefinition> : never : never;
-type HttpProcedureNames<TContract extends ContractDefinition> = {
-    [TProcedure in keyof TContract['procedures'] & string]: HttpProtocolOf<TContract['procedures'][TProcedure]> extends never ? never : TProcedure;
-}[keyof TContract['procedures'] & string];
-type HttpDefinitionOf<TContract extends ContractDefinition, TProcedure extends HttpProcedureNames<TContract>> = HttpProtocolOf<TContract['procedures'][TProcedure]>['definition'];
-type RequestBodySchema<TBody> = TBody extends HttpRequestBodyDefinition<infer TSchema> ? TSchema : never;
-type PathParamsInput<TDefinition extends HttpProtocolDefinition> = PathParamNames<TDefinition['path']> extends never ? never : TDefinition['request'] extends {
-    readonly params: infer TSchemas extends HttpParamsSchemas;
+type PathParamsInput<TDefinition extends HttpExecutionRouteDefinition> = PathParamNames<TDefinition['path']> extends never ? never : TDefinition['request'] extends {
+    readonly params: infer TSchemas extends Readonly<Record<string, StandardSchemaV1>>;
 } ? Readonly<{
     [TName in keyof TSchemas]: SchemaInput<TSchemas[TName]>;
-}> : RawPathParams<TDefinition['path']>;
-type RequestPartInput<TDefinition extends HttpProtocolDefinition, TPart extends 'query' | 'headers'> = TDefinition['request'] extends infer TRequest ? TRequest extends Record<TPart, infer TSchema extends StandardSchemaV1> ? SchemaInput<TSchema> : never : never;
-type RequestBodyInput<TDefinition extends HttpProtocolDefinition> = TDefinition['request'] extends {
-    readonly body: infer TBody extends HttpRequestBodyDefinition;
-} ? SchemaInput<RequestBodySchema<TBody>> : never;
+}> : Readonly<{
+    [TName in PathParamNames<TDefinition['path']>]: string;
+}>;
+type RequestPartInput<TDefinition extends HttpExecutionRouteDefinition, TPart extends 'query' | 'headers'> = TDefinition['request'] extends infer TRequest ? TRequest extends Record<TPart, infer TSchema extends StandardSchemaV1> ? SchemaInput<TSchema> : never : never;
+type RequestBodyInput<TDefinition extends HttpExecutionRouteDefinition> = TDefinition['request'] extends {
+    readonly body: infer TBody extends StandardSchemaV1;
+} ? SchemaInput<TBody> : never;
 type RequestField<TName extends string, TValue> = [TValue] extends [never] ? object : undefined extends TValue ? {
     readonly [TKey in TName]?: Exclude<TValue, undefined>;
 } : {
     readonly [TKey in TName]: TValue;
 };
-export type HttpClientRequest<TDefinition extends HttpProtocolDefinition> = RequestField<'params', PathParamsInput<TDefinition>> & RequestField<'query', RequestPartInput<TDefinition, 'query'>> & RequestField<'headers', RequestPartInput<TDefinition, 'headers'>> & RequestField<'body', RequestBodyInput<TDefinition>>;
-type ResponseBodyOutput<TResponse extends HttpResponseDefinition> = TResponse extends {
+export type HttpClientRequest<TDefinition extends HttpExecutionRouteDefinition> = RequestField<'params', PathParamsInput<TDefinition>> & RequestField<'query', RequestPartInput<TDefinition, 'query'>> & RequestField<'headers', RequestPartInput<TDefinition, 'headers'>> & RequestField<'body', RequestBodyInput<TDefinition>>;
+type ResponseBodyOutput<TResponse extends HttpExecutionResponseDefinition> = TResponse extends {
     readonly stream: 'server';
-} ? AsyncIterable<SchemaOutput<TResponse['body']>> : SchemaOutput<TResponse['body']>;
-type ResponseHeadersOutput<TResponse extends HttpResponseDefinition> = TResponse extends {
-    readonly headers: infer THeaders extends StandardSchemaV1;
-} ? SchemaOutput<THeaders> : HttpHeaders;
-export type HttpClientResponse<TDefinition extends HttpProtocolDefinition> = {
-    [TVariant in keyof TDefinition['responses'] & string]: NonNullable<TDefinition['responses'][TVariant]> extends infer TResponse extends HttpResponseDefinition ? {
+    readonly body: infer TBody extends StandardSchemaV1;
+} ? AsyncIterable<SchemaOutput<TBody>> : TResponse['body'] extends StandardSchemaV1 ? SchemaOutput<TResponse['body']> : undefined;
+type ResponseHeadersSchema<TResponse extends HttpExecutionResponseDefinition> = TResponse extends {
+    readonly headers: infer THeaders;
+} ? THeaders extends StandardSchemaV1 ? THeaders : THeaders extends {
+    readonly schema: infer TSchema extends StandardSchemaV1;
+} ? TSchema : never : never;
+type ResponseHeadersOutput<TResponse extends HttpExecutionResponseDefinition> = ResponseHeadersSchema<TResponse> extends infer TSchema ? [TSchema] extends [never] ? HttpHeaders : TSchema extends StandardSchemaV1 ? SchemaOutput<TSchema> : HttpHeaders : HttpHeaders;
+export type HttpClientResponse<TDefinition extends HttpExecutionRouteDefinition> = {
+    [TVariant in keyof TDefinition['responses'] & string]: TDefinition['responses'][TVariant] extends infer TResponse extends HttpExecutionResponseDefinition ? {
         readonly status: TResponse['status'];
         readonly body: ResponseBodyOutput<TResponse>;
         readonly headers: ResponseHeadersOutput<TResponse>;
     } : never;
 }[keyof TDefinition['responses'] & string];
-type HttpClientMethod<TDefinition extends HttpProtocolDefinition> = keyof HttpClientRequest<TDefinition> extends never ? () => Promise<HttpClientResponse<TDefinition>> : (request: HttpClientRequest<TDefinition>) => Promise<HttpClientResponse<TDefinition>>;
-export type HttpClient<TContract extends ContractDefinition> = {
-    readonly [TProcedure in HttpProcedureNames<TContract>]: HttpClientMethod<HttpDefinitionOf<TContract, TProcedure>>;
+type HttpClientMethod<TDefinition extends HttpExecutionRouteDefinition> = keyof HttpClientRequest<TDefinition> extends never ? () => Promise<HttpClientResponse<TDefinition>> : (request: HttpClientRequest<TDefinition>) => Promise<HttpClientResponse<TDefinition>>;
+export type HttpClient<TContract extends HttpContract> = {
+    readonly [TName in keyof TContract['routes']]: HttpClientMethod<TContract['routes'][TName]>;
 };
 export declare class HttpClientResponseError extends Error {
     readonly status: number;
@@ -62,7 +59,7 @@ export declare class HttpClientResponseError extends Error {
     readonly procedure: string;
     constructor(status: number, method: string, path: string, procedure: string, message: string, options?: ErrorOptions);
 }
-export declare function createHttpClient<const TContract extends ContractDefinition>(contract: TContract, transport: HttpClientTransport): HttpClient<TContract>;
+export declare function createHttpClient<const TContract extends HttpContract>(contract: TContract, transport: HttpClientTransport): HttpClient<TContract>;
 export interface FetchHttpTransportOptions {
     readonly baseUrl: string | URL;
     readonly fetch?: typeof globalThis.fetch;

package/dist/http/client.js

@@ -1,5 +1,5 @@
 import { SchemaValidationError, validateSchema, } from '../core/index.js';
-import { parseHttpPath, } from './path.js';
+import { parseHttpPath } from './path.js';
 export class HttpClientResponseError extends Error {
     status;
     method;
@@ -16,10 +16,7 @@ export class HttpClientResponseError extends Error {
 }
 export function createHttpClient(contract, transport) {
     const client = {};
-    for (const [procedureName, procedure] of Object.entries(contract.procedures)) {
-        const definition = httpDefinitionOf(procedure);
-        if (!definition)
-            continue;
+    for (const [procedureName, definition] of Object.entries(contract.routes)) {
         client[procedureName] = async (request = {}) => {
             const response = await transport({
                 method: definition.method,
@@ -27,24 +24,12 @@ export function createHttpClient(contract, transport) {
                 ...(request.query === undefined ? {} : { query: request.query }),
                 ...(request.headers === undefined ? {} : { headers: request.headers }),
                 ...(request.body === undefined ? {} : { body: request.body }),
-                ...(definition.request?.body === undefined
-                    ? {}
-                    : { contentType: definition.request.body.contentType }),
             });
             return decodeResponse(procedureName, definition, response);
         };
     }
     return Object.freeze(client);
 }
-function httpDefinitionOf(procedure) {
-    const protocol = procedure.protocols.http;
-    if (!protocol ||
-        protocol.protocol !== 'http' ||
-        !('definition' in protocol)) {
-        return undefined;
-    }
-    return protocol.definition;
-}
 function interpolatePath(path, params) {
     const segments = parseHttpPath(path);
     if (segments.length === 0)
@@ -70,11 +55,23 @@ async function decodeResponse(procedure, definition, response) {
     let lastValidationError;
     for (const candidate of candidates) {
         try {
-            const body = candidate.stream
-                ? validatedResponseStream(candidate.body, response.body, procedure, definition, response.status)
-                : await validateSchema(candidate.body, response.body);
-            const headers = candidate.headers
-                ? await validateSchema(candidate.headers, response.headers ?? {})
+            let body;
+            if (candidate.stream === 'server') {
+                if (!candidate.body)
+                    continue;
+                body = validatedResponseStream(candidate.body, response.body, procedure, definition, response.status);
+            }
+            else if (candidate.body) {
+                body = await validateSchema(candidate.body, response.body);
+            }
+            else {
+                if (response.body !== undefined && response.body !== null)
+                    continue;
+                body = undefined;
+            }
+            const headerSchema = responseHeadersSchema(candidate.headers);
+            const headers = headerSchema
+                ? await validateSchema(headerSchema, response.headers ?? {})
                 : (response.headers ?? {});
             return Object.freeze({ status: response.status, body, headers });
         }
@@ -86,6 +83,22 @@ async function decodeResponse(procedure, definition, response) {
     }
     throw new HttpClientResponseError(response.status, definition.method, definition.path, procedure, `${target} returned a response that does not match its Contract`, lastValidationError ? { cause: lastValidationError } : undefined);
 }
+function responseHeadersSchema(headers) {
+    if (isStandardSchema(headers))
+        return headers;
+    if (isResponseHeadersWithDefaults(headers))
+        return headers.schema;
+    return undefined;
+}
+function isStandardSchema(value) {
+    return typeof value === 'object' && value !== null && '~standard' in value;
+}
+function isResponseHeadersWithDefaults(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'schema' in value &&
+        isStandardSchema(value.schema));
+}
 function validatedResponseStream(schema, value, procedure, definition, status) {
     const target = describeHttpTarget(definition, procedure);
     if (!isAsyncIterable(value)) {
@@ -119,15 +132,18 @@ export function fetchHttpTransport(options) {
         appendQuery(url.searchParams, request.query);
         const headers = new Headers(options.headers);
         appendHeaders(headers, request.headers);
-        if (request.contentType && !headers.has('content-type')) {
-            headers.set('content-type', request.contentType);
+        const contentType = headers.get('content-type') ?? undefined;
+        const body = request.body === undefined
+            ? undefined
+            : encodeBody(request.body, contentType);
+        if (body instanceof FormData &&
+            normalizeMediaType(contentType) === 'multipart/form-data') {
+            headers.delete('content-type');
         }
         const response = await fetchImplementation(url, {
             method: request.method,
             headers,
-            ...(request.body === undefined
-                ? {}
-                : { body: encodeBody(request.body, request.contentType) }),
+            ...(body === undefined ? {} : { body }),
         });
         return {
             status: response.status,
@@ -189,8 +205,12 @@ function encodeBody(body, contentType) {
     return body;
 }
 async function decodeFetchBody(response) {
-    if (response.status === 204 || response.status === 205)
+    if (response.body === null ||
+        response.status === 204 ||
+        response.status === 205 ||
+        response.status === 304) {
         return undefined;
+    }
     const mediaType = normalizeMediaType(response.headers.get('content-type'));
     if (mediaType === 'text/event-stream') {
         if (!response.body) {
@@ -212,16 +232,25 @@ async function* decodeServerSentEvents(stream) {
     const decoder = new TextDecoder();
     let buffer = '';
     let completed = false;
+    let pendingCarriageReturn = false;
+    const appendDecoded = (value, final) => {
+        let decoded = pendingCarriageReturn ? `\r${value}` : value;
+        pendingCarriageReturn = false;
+        if (!final && decoded.endsWith('\r')) {
+            pendingCarriageReturn = true;
+            decoded = decoded.slice(0, -1);
+        }
+        buffer += normalizeEventStreamNewlines(decoded);
+    };
     try {
         while (true) {
             const next = await reader.read();
             if (next.done) {
                 completed = true;
-                buffer += decoder.decode();
+                appendDecoded(decoder.decode(), true);
                 break;
             }
-            buffer += decoder.decode(next.value, { stream: true });
-            buffer = normalizeEventStreamNewlines(buffer);
+            appendDecoded(decoder.decode(next.value, { stream: true }), false);
             let boundary = buffer.indexOf('\n\n');
             while (boundary >= 0) {
                 const event = buffer.slice(0, boundary);
@@ -236,16 +265,6 @@ async function* decodeServerSentEvents(stream) {
                 boundary = buffer.indexOf('\n\n');
             }
         }
-        buffer = normalizeEventStreamNewlines(buffer).trim();
-        if (buffer.length > 0) {
-            const data = buffer
-                .split('\n')
-                .filter((line) => line.startsWith('data:'))
-                .map((line) => line.slice('data:'.length).trimStart())
-                .join('\n');
-            if (data.length > 0)
-                yield JSON.parse(data);
-        }
     }
     finally {
         if (!completed)

package/dist/http/cors-internal.d.ts

@@ -0,0 +1,29 @@
+export type CorsOrigin = string | readonly string[] | ((origin: string) => boolean | Promise<boolean>);
+export interface CorsPolicyOptions {
+    readonly origin?: CorsOrigin;
+    readonly allowMethods?: readonly string[];
+    readonly allowHeaders?: readonly string[];
+    readonly exposeHeaders?: readonly string[];
+    readonly credentials?: boolean;
+    readonly maxAge?: number;
+}
+export type CorsPolicy = Readonly<{
+    origin: {
+        readonly kind: 'wildcard';
+    } | {
+        readonly kind: 'exact';
+        readonly origins: ReadonlySet<string>;
+    } | {
+        readonly kind: 'predicate';
+        readonly predicate: (origin: string) => boolean | Promise<boolean>;
+    };
+    allowMethods: readonly string[] | undefined;
+    allowHeaders: readonly string[] | undefined;
+    exposeHeaders: readonly string[];
+    credentials: boolean;
+    maxAge: number | undefined;
+}>;
+export declare function normalizeCorsPolicy(options: CorsPolicyOptions): CorsPolicy;
+export declare function registerCorsPolicy(middleware: object, policy: CorsPolicy): void;
+export declare function createCorsActualResponseHeaders(middlewares: readonly object[], request: Request): Promise<Headers | undefined>;
+export declare function createCorsPreflightResponseHeaders(middlewares: readonly object[], request: Request, targetMethod: string): Promise<Headers | undefined>;

package/dist/http/cors-internal.js

@@ -0,0 +1,160 @@
+const policies = new WeakMap();
+const httpToken = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+export function normalizeCorsPolicy(options) {
+    const credentials = options.credentials ?? false;
+    return Object.freeze({
+        origin: normalizeOrigin(options.origin ?? '*', credentials),
+        allowMethods: options.allowMethods === undefined
+            ? undefined
+            : normalizeTokens(options.allowMethods, 'allowMethods', true),
+        allowHeaders: options.allowHeaders === undefined
+            ? undefined
+            : normalizeTokens(options.allowHeaders, 'allowHeaders', false),
+        exposeHeaders: normalizeTokens(options.exposeHeaders ?? [], 'exposeHeaders', false),
+        credentials,
+        maxAge: normalizeMaxAge(options.maxAge),
+    });
+}
+export function registerCorsPolicy(middleware, policy) {
+    policies.set(middleware, policy);
+}
+export async function createCorsActualResponseHeaders(middlewares, request) {
+    const policy = corsPolicyOfMiddlewares(middlewares);
+    if (!policy)
+        return undefined;
+    const origin = request.headers.get('origin');
+    const headers = new Headers();
+    if (policy.origin.kind !== 'wildcard')
+        appendVary(headers, 'Origin');
+    if (origin === null)
+        return headers;
+    await applyOrigin(headers, policy, origin);
+    if (!headers.has('access-control-allow-origin'))
+        return headers;
+    if (policy.credentials) {
+        headers.set('access-control-allow-credentials', 'true');
+    }
+    if (policy.exposeHeaders.length > 0) {
+        headers.set('access-control-expose-headers', policy.exposeHeaders.join(', '));
+    }
+    return headers;
+}
+export async function createCorsPreflightResponseHeaders(middlewares, request, targetMethod) {
+    const policy = corsPolicyOfMiddlewares(middlewares);
+    if (!policy)
+        return undefined;
+    const headers = new Headers();
+    appendVary(headers, 'Access-Control-Request-Method');
+    const origin = request.headers.get('origin');
+    if (origin === null)
+        return headers;
+    await applyOrigin(headers, policy, origin);
+    if (!headers.has('access-control-allow-origin'))
+        return headers;
+    if (policy.credentials) {
+        headers.set('access-control-allow-credentials', 'true');
+    }
+    const methods = policy.allowMethods ?? [targetMethod.toUpperCase()];
+    if (methods.length > 0) {
+        headers.set('access-control-allow-methods', methods.join(', '));
+    }
+    if (policy.allowHeaders === undefined) {
+        const requested = request.headers.get('access-control-request-headers');
+        if (requested !== null && requested.trim().length > 0) {
+            headers.set('access-control-allow-headers', requested);
+            appendVary(headers, 'Access-Control-Request-Headers');
+        }
+    }
+    else if (policy.allowHeaders.length > 0) {
+        headers.set('access-control-allow-headers', policy.allowHeaders.join(', '));
+    }
+    if (policy.maxAge !== undefined) {
+        headers.set('access-control-max-age', String(policy.maxAge));
+    }
+    return headers;
+}
+function corsPolicyOfMiddlewares(middlewares) {
+    let found;
+    for (const middleware of middlewares) {
+        const policy = policies.get(middleware);
+        if (policy)
+            found = policy;
+    }
+    return found;
+}
+async function applyOrigin(headers, policy, origin) {
+    if (policy.origin.kind === 'wildcard') {
+        headers.set('access-control-allow-origin', '*');
+        return;
+    }
+    appendVary(headers, 'Origin');
+    const allowed = policy.origin.kind === 'exact'
+        ? policy.origin.origins.has(origin)
+        : await policy.origin.predicate(origin);
+    if (allowed)
+        headers.set('access-control-allow-origin', origin);
+}
+function normalizeOrigin(origin, credentials) {
+    if (typeof origin === 'function') {
+        return Object.freeze({ kind: 'predicate', predicate: origin });
+    }
+    const origins = typeof origin === 'string' ? [origin] : [...origin];
+    if (origins.length === 0) {
+        return Object.freeze({ kind: 'exact', origins: new Set() });
+    }
+    for (const value of origins) {
+        if (value.length === 0 || containsControlCharacter(value)) {
+            throw new TypeError('CORS origin cannot be empty or contain control characters');
+        }
+    }
+    if (origins.includes('*')) {
+        if (credentials) {
+            throw new TypeError('CORS origin cannot be a wildcard when credentials are enabled');
+        }
+        return Object.freeze({ kind: 'wildcard' });
+    }
+    return Object.freeze({
+        kind: 'exact',
+        origins: new Set(origins),
+    });
+}
+function containsControlCharacter(value) {
+    for (const character of value) {
+        const code = character.charCodeAt(0);
+        if (code <= 0x1f || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+function normalizeTokens(values, option, uppercase) {
+    return Object.freeze(values.map((value) => {
+        const token = value.trim();
+        if (!httpToken.test(token)) {
+            throw new TypeError(`CORS ${option} contains an invalid HTTP token`);
+        }
+        return uppercase ? token.toUpperCase() : token;
+    }));
+}
+function normalizeMaxAge(maxAge) {
+    if (maxAge === undefined)
+        return undefined;
+    if (!Number.isSafeInteger(maxAge) || maxAge < 0) {
+        throw new TypeError('CORS maxAge must be a non-negative safe integer');
+    }
+    return maxAge;
+}
+function appendVary(headers, value) {
+    const current = headers.get('vary');
+    if (current === null) {
+        headers.set('vary', value);
+        return;
+    }
+    const values = current
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean);
+    if (!values.some((item) => item.toLowerCase() === value.toLowerCase())) {
+        values.push(value);
+    }
+    headers.set('vary', values.join(', '));
+}

package/dist/http/cors.d.ts

@@ -1,5 +1,6 @@
-import { type LayerDescriptor, type PipelineItem } from '../core/index.js';
-export type CorsOrigin = string | readonly string[] | ((origin: string) => boolean | Promise<boolean>);
+import { type CorsOrigin } from './cors-internal.js';
+import type { HttpExecutionResult, HttpMiddlewareContext } from './extension.js';
+export type { CorsOrigin } from './cors-internal.js';
 export interface CorsOptions {
     readonly origin?: CorsOrigin;
     readonly allowMethods?: readonly string[];
@@ -9,9 +10,5 @@ export interface CorsOptions {
     readonly maxAge?: number;
     readonly name?: string;
 }
-export interface CorsLayerDescriptor extends LayerDescriptor<readonly [], readonly [], never, readonly [], string, 'framework', readonly [], object> {
-    readonly role: 'framework';
-}
-export declare function cors(options?: CorsOptions): CorsLayerDescriptor;
-export declare function createCorsActualResponseHeaders(pipeline: readonly PipelineItem[], request: Request): Promise<Headers | undefined>;
-export declare function createCorsPreflightResponseHeaders(pipeline: readonly PipelineItem[], request: Request, targetMethod: string): Promise<Headers | undefined>;
+export declare function cors(options?: CorsOptions): import("../core/generic-layer.js").GenericLayer<HttpMiddlewareContext, {}, HttpExecutionResult>;
+export type CorsLayerDescriptor = ReturnType<typeof cors>;