@nexus_js/server 0.6.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nexus Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,17 @@
+# @nexus_js/server
+
+Nexus HTTP server — SSR, Server Actions, Edge-ready.
+
+## Documentation
+
+All guides, API reference, and examples live on **[nexusjs.dev](https://nexusjs.dev)**.
+
+## Links
+
+- **Website:** [https://nexusjs.dev](https://nexusjs.dev)
+- **Repository:** [github.com/bierfor/nexus](https://github.com/bierfor/nexus) (see `packages/server/`)
+- **Issues:** [github.com/bierfor/nexus/issues](https://github.com/bierfor/nexus/issues)
+
+## License
+
+MIT © Nexus contributors

package/dist/actions.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Nexus Server Actions — type-safe, race-condition-safe server mutations.
+ *
+ * Race Condition Problem:
+ *   User clicks "Save" three times in rapid succession.
+ *   Request 1 arrives, starts processing (200ms).
+ *   Request 2 arrives, starts processing (180ms) — finishes FIRST.
+ *   Request 3 arrives, starts processing (150ms) — finishes SECOND.
+ *   Request 1 finishes LAST — overwrites the results of 2 and 3. 💥
+ *
+ * Solutions implemented:
+ *
+ *   1. Idempotency key deduplication:
+ *      Client sends X-Nexus-Idempotency: <uuid> with each action call.
+ *      If the same key arrives again while the first is in flight,
+ *      the server returns the SAME response (cached for 30s).
+ *
+ *   2. Per-island action mutex:
+ *      Each island tracks its in-flight actions per action name.
+ *      Configurable behavior: 'cancel' | 'queue' | 'reject' | 'ignore'.
+ *
+ *   3. AbortController propagation:
+ *      The signal is passed into the action context. Actions that
+ *      call external APIs should check ctx.signal.aborted.
+ *      If the client disconnects, the signal fires automatically.
+ *
+ *   4. Client-side: $optimistic with built-in race guard.
+ *      The createOptimistic() pending flag blocks double-submit.
+ */
+import type { NexusContext } from './context.js';
+import { type RateLimitConfig } from './rate-limit.js';
+export type ActionFn<TInput = FormData, TOutput = void> = (input: TInput, ctx: NexusContext & {
+    signal: AbortSignal;
+}) => Promise<TOutput>;
+export type RaceStrategy = 'cancel' | 'queue' | 'reject' | 'ignore';
+export interface ActionOptions {
+    /**
+     * How to handle concurrent calls to the same action from the same client.
+     *   'cancel'  — abort the previous call, run the new one (default for mutations)
+     *   'queue'   — run calls sequentially in order
+     *   'reject'  — reject the new call if one is already in flight
+     *   'ignore'  — let all calls run in parallel (default for idempotent reads)
+     */
+    race?: RaceStrategy;
+    /**
+     * Mark as idempotent — same idempotency key returns cached result.
+     * Set to true for safe retries (GET-like mutations).
+     */
+    idempotent?: boolean;
+    /**
+     * Timeout in ms. Aborts the action if it takes too long.
+     * Default: 30000 (30s)
+     */
+    timeout?: number;
+    /**
+     * Retry on network failure (not on logic errors).
+     * Default: 0
+     */
+    retries?: number;
+    /**
+     * Per-action rate limiting.
+     * Example: { window: '1m', max: 3 } → 3 calls per minute per IP.
+     * Override the key with keyFn: { window: '1m', max: 3, keyFn: r => userId }
+     */
+    rateLimit?: RateLimitConfig;
+    /**
+     * Require a valid CSRF action token in the x-nexus-action-token header.
+     * Default: true for all state-mutating actions.
+     * Set to false for read-only or public actions.
+     */
+    csrf?: boolean;
+    /**
+     * A Zod-compatible schema for input validation.
+     * If provided, the action will reject requests with invalid input before
+     * calling the handler. Prevents SQL injection and type coercion attacks.
+     */
+    schema?: {
+        parse: (data: unknown) => unknown;
+    };
+}
+export interface ActionResult<T = unknown> {
+    data?: T;
+    error?: string;
+    status: number;
+    /** Echoed back to client for deduplication */
+    idempotencyKey?: string;
+    /** Server-side execution time in ms */
+    duration?: number;
+}
+/**
+ * Defines a Server Action with integrated security, rate limiting, and
+ * race-condition management. The returned object is registered automatically
+ * and ready to be called by the client.
+ *
+ * Security layers applied (in order):
+ *   1. CSRF token validation (x-nexus-action-token header)
+ *   2. Rate limiting (sliding window, per-IP or per-user)
+ *   3. Input schema validation (Zod or any .parse() compatible schema)
+ *   4. AbortController (client disconnect + timeout)
+ *   5. Idempotency deduplication
+ *   6. Race condition strategy (cancel | queue | reject | ignore)
+ *
+ * @example
+ * export const capture = createAction({
+ *   rateLimit: { window: '1m', max: 3, keyFn: (req) => req.headers.get('x-user-id') ?? extractIP(req) },
+ *   schema: z.object({ pokemonId: z.number().int().min(1).max(1010) }),
+ *   race: 'cancel',
+ *   async handler(data, ctx) {
+ *     const { pokemonId } = data;
+ *     await db.captures.create({ userId: ctx.user.id, pokemonId });
+ *   },
+ * });
+ */
+export declare function createAction<TInput = FormData, TOutput = void>(optsOrFn: ActionFn<TInput, TOutput> | (ActionOptions & {
+    handler: ActionFn<TInput, TOutput>;
+}), legacyOpts?: ActionOptions): ActionFn<TInput, TOutput>;
+export declare function registerAction(name: string, fn: ActionFn<unknown, unknown>, opts?: ActionOptions): void;
+export declare class ActionError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    constructor(message: string, status?: number, code?: string | undefined);
+}
+export declare class ActionAbortedError extends ActionError {
+    constructor();
+}
+/**
+ * Main HTTP handler for /_nexus/action/:name
+ * This is where all the race-condition logic runs.
+ */
+export declare function handleActionRequest(request: Request): Promise<Response>;
+/**
+ * Validates that a request comes from a trusted Nexus client.
+ * Checks x-nexus-action header and CSRF token.
+ */
+export declare function validateRequest(ctx: NexusContext): Promise<void>;
+export { generateActionToken, validateActionToken, extractSessionId, generateSessionId } from './csrf.js';
+export { createRateLimiter, RateLimitError, parseWindow } from './rate-limit.js';
+export type { RateLimitConfig, RateLimitResult, RateLimiter } from './rate-limit.js';
+/**
+ * Client-side AbortController factory.
+ * Use this in island code to cancel in-flight action fetches
+ * when the user triggers a new one.
+ *
+ * @example
+ * const guard = createActionGuard('save', 'cancel');
+ * async function save(formData) {
+ *   const signal = guard.arm();
+ *   const result = await callAction('savePost', formData, { signal });
+ *   if (!guard.aborted) updateUI(result);
+ * }
+ */
+export declare function createActionGuard(name: string, strategy?: RaceStrategy): {
+    arm: () => AbortSignal;
+    abort: () => void;
+    aborted: boolean;
+    pending: boolean;
+};
+//# sourceMappingURL=actions.d.ts.map

package/dist/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAOjD,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,OAAO,GAAG,IAAI,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,YAAY,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,KACxC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;KACnC,CAAC;CACH;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA+BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,YAAY,CAAC,MAAM,GAAG,QAAQ,EAAE,OAAO,GAAG,IAAI,EAC5D,QAAQ,EACJ,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,GACzB,CAAC,aAAa,GAAG;IAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAC5D,UAAU,GAAE,aAAkB,GAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAqC3B;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAC9B,IAAI,GAAE,aAAkB,GACvB,IAAI,CAIN;AAED,qBAAa,WAAY,SAAQ,KAAK;aAGlB,MAAM,EAAE,MAAM;aACd,IAAI,CAAC,EAAE,MAAM;gBAF7B,OAAO,EAAE,MAAM,EACC,MAAM,GAAE,MAAY,EACpB,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,kBAAmB,SAAQ,WAAW;;CAIlD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmM7E;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtE;AAGD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjF,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAIrF;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,YAAuB,GAChC;IACD,GAAG,EAAE,MAAM,WAAW,CAAC;IACvB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB,CAyBA"}

package/dist/actions.js

@@ -0,0 +1,396 @@
+/**
+ * Nexus Server Actions — type-safe, race-condition-safe server mutations.
+ *
+ * Race Condition Problem:
+ *   User clicks "Save" three times in rapid succession.
+ *   Request 1 arrives, starts processing (200ms).
+ *   Request 2 arrives, starts processing (180ms) — finishes FIRST.
+ *   Request 3 arrives, starts processing (150ms) — finishes SECOND.
+ *   Request 1 finishes LAST — overwrites the results of 2 and 3. 💥
+ *
+ * Solutions implemented:
+ *
+ *   1. Idempotency key deduplication:
+ *      Client sends X-Nexus-Idempotency: <uuid> with each action call.
+ *      If the same key arrives again while the first is in flight,
+ *      the server returns the SAME response (cached for 30s).
+ *
+ *   2. Per-island action mutex:
+ *      Each island tracks its in-flight actions per action name.
+ *      Configurable behavior: 'cancel' | 'queue' | 'reject' | 'ignore'.
+ *
+ *   3. AbortController propagation:
+ *      The signal is passed into the action context. Actions that
+ *      call external APIs should check ctx.signal.aborted.
+ *      If the client disconnects, the signal fires automatically.
+ *
+ *   4. Client-side: $optimistic with built-in race guard.
+ *      The createOptimistic() pending flag blocks double-submit.
+ */
+import { createContext } from './context.js';
+import { serialize, deserialize } from '@nexus_js/serialize';
+import { validateActionToken, extractSessionId, ACTION_TOKEN_HEADER, } from './csrf.js';
+import { createRateLimiter, registerLimiter, RateLimitError, } from './rate-limit.js';
+const ACTION_PREFIX = '/_nexus/action/';
+const idempotencyCache = new Map();
+const IDEMPOTENCY_TTL = 30_000; // 30 seconds
+// ── In-flight action tracking ─────────────────────────────────────────────────
+// Map: `${islandId}:${actionName}` → AbortController
+const inFlightActions = new Map();
+const actionQueues = new Map();
+const actionRegistry = new Map();
+// ── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Defines a Server Action with integrated security, rate limiting, and
+ * race-condition management. The returned object is registered automatically
+ * and ready to be called by the client.
+ *
+ * Security layers applied (in order):
+ *   1. CSRF token validation (x-nexus-action-token header)
+ *   2. Rate limiting (sliding window, per-IP or per-user)
+ *   3. Input schema validation (Zod or any .parse() compatible schema)
+ *   4. AbortController (client disconnect + timeout)
+ *   5. Idempotency deduplication
+ *   6. Race condition strategy (cancel | queue | reject | ignore)
+ *
+ * @example
+ * export const capture = createAction({
+ *   rateLimit: { window: '1m', max: 3, keyFn: (req) => req.headers.get('x-user-id') ?? extractIP(req) },
+ *   schema: z.object({ pokemonId: z.number().int().min(1).max(1010) }),
+ *   race: 'cancel',
+ *   async handler(data, ctx) {
+ *     const { pokemonId } = data;
+ *     await db.captures.create({ userId: ctx.user.id, pokemonId });
+ *   },
+ * });
+ */
+export function createAction(optsOrFn, legacyOpts = {}) {
+    // Support both createAction(fn, opts) and createAction({ handler, ...opts })
+    const fn = typeof optsOrFn === 'function' ? optsOrFn : optsOrFn.handler;
+    const opts = typeof optsOrFn === 'function' ? legacyOpts : optsOrFn;
+    // Wire up rate limiter at definition time (not per-request)
+    const limiter = opts.rateLimit ? createRateLimiter(opts.rateLimit) : null;
+    return async (input, ctx) => {
+        // 1. CSRF validation
+        if (opts.csrf !== false) {
+            await validateRequest(ctx);
+        }
+        // 2. Rate limiting
+        if (limiter) {
+            const result = limiter.check(ctx.request);
+            if (!result.allowed) {
+                throw new RateLimitError(result);
+            }
+        }
+        // 3. Schema validation
+        if (opts.schema) {
+            try {
+                input = opts.schema.parse(input);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : 'Input validation failed';
+                throw new ActionError(`Invalid input: ${msg}`, 400, 'VALIDATION_ERROR');
+            }
+        }
+        return fn(input, ctx);
+    };
+}
+export function registerAction(name, fn, opts = {}) {
+    const limiter = opts.rateLimit ? createRateLimiter(opts.rateLimit) : null;
+    if (limiter)
+        registerLimiter(name, limiter);
+    actionRegistry.set(name, { fn, opts, name });
+}
+export class ActionError extends Error {
+    status;
+    code;
+    constructor(message, status = 400, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'ActionError';
+    }
+}
+export class ActionAbortedError extends ActionError {
+    constructor() {
+        super('Action was superseded by a newer request', 409, 'ABORTED');
+    }
+}
+/**
+ * Main HTTP handler for /_nexus/action/:name
+ * This is where all the race-condition logic runs.
+ */
+export async function handleActionRequest(request) {
+    const url = new URL(request.url);
+    if (!url.pathname.startsWith(ACTION_PREFIX)) {
+        return new Response('Not Found', { status: 404 });
+    }
+    if (request.method !== 'POST') {
+        return new Response('Method Not Allowed', {
+            status: 405,
+            headers: { allow: 'POST' },
+        });
+    }
+    const actionName = url.pathname.slice(ACTION_PREFIX.length);
+    const registered = actionRegistry.get(actionName);
+    if (!registered) {
+        return jsonResponse({ error: `Action "${actionName}" not found`, status: 404 }, 404);
+    }
+    const { fn, opts } = registered;
+    const race = opts.race ?? 'cancel';
+    const timeout = opts.timeout ?? 30_000;
+    // ── CSRF token validation ──────────────────────────────────────────────────
+    if (opts.csrf !== false) {
+        const token = request.headers.get(ACTION_TOKEN_HEADER);
+        const secret = process.env['NEXUS_SECRET'] ?? 'nexus-dev-secret-change-me';
+        const sessionId = extractSessionId(request);
+        if (!token) {
+            return jsonResponse({
+                error: 'Missing action token — possible CSRF attack',
+                status: 403,
+                code: 'MISSING_CSRF_TOKEN',
+            }, 403);
+        }
+        const validation = validateActionToken(token, sessionId, actionName, secret);
+        if (!validation.valid) {
+            return jsonResponse({
+                error: validation.reason ?? 'Invalid action token',
+                status: 403,
+                code: validation.replayed ? 'REPLAY_ATTACK' : 'INVALID_CSRF_TOKEN',
+            }, 403);
+        }
+    }
+    // ── Rate limiting ──────────────────────────────────────────────────────────
+    if (opts.rateLimit) {
+        const limiter = createRateLimiter(opts.rateLimit);
+        const result = limiter.check(request);
+        if (!result.allowed) {
+            return new Response(JSON.stringify({
+                error: `Rate limit exceeded. Retry in ${result.retryAfter}s.`,
+                status: 429,
+                code: 'RATE_LIMITED',
+                retryAfter: result.retryAfter,
+                resetAt: result.resetAt,
+            }), {
+                status: 429,
+                headers: {
+                    'content-type': 'application/json',
+                    ...limiter.headers(result),
+                },
+            });
+        }
+    }
+    // ── Idempotency check ──────────────────────────────────────────────────────
+    const idempotencyKey = request.headers.get('x-nexus-idempotency');
+    if (idempotencyKey && opts.idempotent) {
+        const cached = idempotencyCache.get(idempotencyKey);
+        if (cached && Date.now() < cached.expiresAt) {
+            return jsonResponse({ data: cached.result, status: cached.status, idempotencyKey }, cached.status);
+        }
+    }
+    // ── Race condition management ──────────────────────────────────────────────
+    const islandId = request.headers.get('x-nexus-island') ?? 'global';
+    const raceKey = `${islandId}:${actionName}`;
+    if (race === 'reject') {
+        if (inFlightActions.has(raceKey)) {
+            return jsonResponse({
+                error: 'Action already in progress',
+                status: 409,
+                code: 'CONCURRENT_ACTION',
+            }, 409);
+        }
+    }
+    if (race === 'cancel') {
+        const existing = inFlightActions.get(raceKey);
+        if (existing) {
+            existing.abort(new ActionAbortedError());
+        }
+    }
+    if (race === 'queue') {
+        await waitInQueue(raceKey);
+    }
+    // ── AbortController setup ──────────────────────────────────────────────────
+    const controller = new AbortController();
+    // Chain with client disconnect signal
+    request.signal?.addEventListener('abort', () => {
+        controller.abort(new Error('Client disconnected'));
+    });
+    // Timeout
+    const timeoutId = setTimeout(() => {
+        controller.abort(new Error(`Action timeout after ${timeout}ms`));
+    }, timeout);
+    inFlightActions.set(raceKey, controller);
+    // ── Execute ───────────────────────────────────────────────────────────────
+    const ctx = createContext(request);
+    const ctxWithSignal = Object.assign(ctx, { signal: controller.signal });
+    const startTime = Date.now();
+    try {
+        // Deserialize input using Nexus transport (preserves Date, Map, Set, etc.)
+        const input = await deserializeInput(request);
+        let result;
+        let attempts = 0;
+        const maxAttempts = 1 + (opts.retries ?? 0);
+        while (attempts < maxAttempts) {
+            try {
+                result = await fn(input, ctxWithSignal);
+                break;
+            }
+            catch (err) {
+                attempts++;
+                if (err instanceof ActionError || err instanceof ActionAbortedError)
+                    throw err;
+                if (attempts >= maxAttempts)
+                    throw err;
+                await delay(100 * attempts); // exponential backoff
+            }
+        }
+        const duration = Date.now() - startTime;
+        // Cache idempotent results
+        if (idempotencyKey && opts.idempotent) {
+            idempotencyCache.set(idempotencyKey, {
+                result,
+                status: 200,
+                expiresAt: Date.now() + IDEMPOTENCY_TTL,
+            });
+            // Cleanup old entries periodically
+            cleanIdempotencyCache();
+        }
+        // Serialize response with Nexus transport
+        const serialized = serialize({ data: result, status: 200, duration, idempotencyKey });
+        return new Response(serialized, {
+            status: 200,
+            headers: {
+                'content-type': 'application/json',
+                'x-nexus-duration': String(duration),
+                ...(idempotencyKey ? { 'x-nexus-idempotency': idempotencyKey } : {}),
+            },
+        });
+    }
+    catch (err) {
+        clearTimeout(timeoutId);
+        inFlightActions.delete(raceKey);
+        releaseQueue(raceKey);
+        if (controller.signal.aborted) {
+            return jsonResponse({
+                error: 'Action was cancelled',
+                status: 409,
+                code: 'CANCELLED',
+            }, 409);
+        }
+        if (err instanceof ActionError) {
+            return jsonResponse({ error: err.message, status: err.status, code: err.code }, err.status);
+        }
+        console.error(`[Nexus Action] "${actionName}" failed:`, err);
+        return jsonResponse({ error: 'Internal Server Error', status: 500 }, 500);
+    }
+    finally {
+        clearTimeout(timeoutId);
+        inFlightActions.delete(raceKey);
+        releaseQueue(raceKey);
+    }
+}
+/**
+ * Validates that a request comes from a trusted Nexus client.
+ * Checks x-nexus-action header and CSRF token.
+ */
+export async function validateRequest(ctx) {
+    const nexusHeader = ctx.request.headers.get('x-nexus-action');
+    if (!nexusHeader) {
+        throw new ActionError('Missing Nexus action header', 403, 'MISSING_HEADER');
+    }
+}
+// Re-export security primitives for use in app code
+export { generateActionToken, validateActionToken, extractSessionId, generateSessionId } from './csrf.js';
+export { createRateLimiter, RateLimitError, parseWindow } from './rate-limit.js';
+// ── Client-side race guard ────────────────────────────────────────────────────
+/**
+ * Client-side AbortController factory.
+ * Use this in island code to cancel in-flight action fetches
+ * when the user triggers a new one.
+ *
+ * @example
+ * const guard = createActionGuard('save', 'cancel');
+ * async function save(formData) {
+ *   const signal = guard.arm();
+ *   const result = await callAction('savePost', formData, { signal });
+ *   if (!guard.aborted) updateUI(result);
+ * }
+ */
+export function createActionGuard(name, strategy = 'cancel') {
+    let currentController = null;
+    let _pending = false;
+    return {
+        arm() {
+            if (strategy === 'cancel' && currentController) {
+                currentController.abort();
+            }
+            currentController = new AbortController();
+            _pending = true;
+            currentController.signal.addEventListener('abort', () => { _pending = false; });
+            return currentController.signal;
+        },
+        abort() {
+            currentController?.abort();
+            _pending = false;
+        },
+        get aborted() {
+            return currentController?.signal.aborted ?? false;
+        },
+        get pending() {
+            return _pending;
+        },
+    };
+}
+// ── Helpers ───────────────────────────────────────────────────────────────────
+async function deserializeInput(request) {
+    const contentType = request.headers.get('content-type') ?? '';
+    if (contentType.includes('application/json')) {
+        const text = await request.text();
+        try {
+            return deserialize(text);
+        }
+        catch {
+            return JSON.parse(text);
+        }
+    }
+    if (contentType.includes('multipart/form-data') ||
+        contentType.includes('application/x-www-form-urlencoded')) {
+        return request.formData();
+    }
+    return request.text();
+}
+function jsonResponse(body, status) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+async function waitInQueue(key) {
+    return new Promise((resolve) => {
+        const queue = actionQueues.get(key) ?? [];
+        queue.push({ resolve });
+        actionQueues.set(key, queue);
+        if (queue.length === 1)
+            resolve(); // First in queue — go immediately
+    });
+}
+function releaseQueue(key) {
+    const queue = actionQueues.get(key);
+    if (!queue || queue.length === 0)
+        return;
+    queue.shift(); // Remove the completed action
+    const next = queue[0];
+    if (next)
+        next.resolve(); // Unblock the next queued action
+}
+function cleanIdempotencyCache() {
+    const now = Date.now();
+    for (const [key, entry] of idempotencyCache.entries()) {
+        if (now > entry.expiresAt)
+            idempotencyCache.delete(key);
+    }
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=actions.js.map

package/dist/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,GAEf,MAAM,iBAAiB,CAAC;AAiEzB,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAQxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;AAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,aAAa;AAE7C,iFAAiF;AACjF,qDAAqD;AACrD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;AAI3D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAC;AAQrD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE3D,iFAAiF;AAEjF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,YAAY,CAC1B,QAE4D,EAC5D,aAA4B,EAAE;IAE9B,6EAA6E;IAC7E,MAAM,EAAE,GAAK,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEpE,4DAA4D;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,OAAO,KAAK,EACV,KAAa,EACb,GAA2C,EACzB,EAAE;QACpB,qBAAqB;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,mBAAmB;QACnB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC;gBAC3E,MAAM,IAAI,WAAW,CAAC,kBAAkB,GAAG,EAAE,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,EAA8B,EAC9B,OAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,OAAO;QAAE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB;IACA;IAHlB,YACE,OAAe,EACC,SAAiB,GAAG,EACpB,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAc;QACpB,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD;QACE,KAAK,CAAC,0CAA0C,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgB;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAElD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,UAAU,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IAChC,MAAM,IAAI,GAAM,IAAI,CAAC,IAAI,IAAO,QAAQ,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IAEvC,8EAA8E;IAC9E,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,4BAA4B,CAAC;QAC9E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAG,6CAA6C;gBACrD,MAAM,EAAE,GAAG;gBACX,IAAI,EAAI,oBAAoB;aAC7B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAG,UAAU,CAAC,MAAM,IAAI,sBAAsB;gBACnD,MAAM,EAAE,GAAG;gBACX,IAAI,EAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;aACrE,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,MAAM,GAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAQ,iCAAiC,MAAM,CAAC,UAAU,IAAI;gBACnE,MAAM,EAAO,GAAG;gBAChB,IAAI,EAAS,cAAc;gBAC3B,UAAU,EAAG,MAAM,CAAC,UAAU;gBAC9B,OAAO,EAAM,MAAM,CAAC,OAAO;aAC5B,CAAC,EACF;gBACE,MAAM,EAAG,GAAG;gBACZ,OAAO,EAAE;oBACP,cAAc,EAAG,kBAAkB;oBACnC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;iBAC3B;aACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClE,IAAI,cAAc,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,YAAY,CACjB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,EAC9D,MAAM,CAAC,MAAM,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC;IACnE,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;IAE5C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAE,4BAA4B;gBACnC,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,mBAAmB;aAC1B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,sCAAsC;IACtC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;QAC7C,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,UAAU;IACV,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;QAChC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAEzC,6EAA6E;IAC7E,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE9C,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QAE5C,OAAO,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;gBACxC,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,EAAE,CAAC;gBACX,IAAI,GAAG,YAAY,WAAW,IAAI,GAAG,YAAY,kBAAkB;oBAAE,MAAM,GAAG,CAAC;gBAC/E,IAAI,QAAQ,IAAI,WAAW;oBAAE,MAAM,GAAG,CAAC;gBACvC,MAAM,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,sBAAsB;YACrD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,2BAA2B;QAC3B,IAAI,cAAc,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE;gBACnC,MAAM;gBACN,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe;aACxC,CAAC,CAAC;YACH,mCAAmC;YACnC,qBAAqB,EAAE,CAAC;QAC1B,CAAC;QAED,0CAA0C;QAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;YAC9B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC;gBACpC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,WAAW;aAClB,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9F,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,mBAAmB,UAAU,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB;IACrD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CAAC,6BAA6B,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGjF,iFAAiF;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,WAAyB,QAAQ;IAOjC,IAAI,iBAAiB,GAA2B,IAAI,CAAC;IACrD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO;QACL,GAAG;YACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,EAAE,CAAC;gBAC/C,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;YAC1C,QAAQ,GAAG,IAAI,CAAC;YAChB,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,OAAO,iBAAiB,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,KAAK;YACH,iBAAiB,EAAE,KAAK,EAAE,CAAC;YAC3B,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,IAAI,OAAO;YACT,OAAO,iBAAiB,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,CAAC;QACD,IAAI,OAAO;YACT,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAE9D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,IACE,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC3C,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EACzD,CAAC;QACD,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACxB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,kCAAkC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACzC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,8BAA8B;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,IAAI;QAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,iCAAiC;AAC7D,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS;YAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/context.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Nexus Request Context — passed to every page, layout and server action.
+ * Inspired by SvelteKit's RequestEvent and Next.js's Request/Response pattern.
+ */
+export interface NexusContext {
+    request: Request;
+    params: Record<string, string>;
+    url: URL;
+    headers: Headers;
+    locals: Record<string, unknown>;
+    /** Set a response header */
+    setHeader: (key: string, value: string) => void;
+    /** Set a cookie */
+    setCookie: (name: string, value: string, opts?: CookieOptions) => void;
+    /** Get a cookie value */
+    getCookie: (name: string) => string | undefined;
+    /** Redirect — throws, so use `return redirect(...)` pattern */
+    redirect: (location: string, status?: 301 | 302 | 303 | 307 | 308) => never;
+    /** Return a not-found response */
+    notFound: () => never;
+}
+export interface CookieOptions {
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+    expires?: Date;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'Strict' | 'Lax' | 'None';
+}
+/** Internal redirect signal */
+export declare class RedirectSignal {
+    readonly location: string;
+    readonly status: number;
+    constructor(location: string, status: number);
+}
+/** Internal not-found signal */
+export declare class NotFoundSignal {
+}
+export declare function createContext(request: Request, params?: Record<string, string>): NexusContext;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,4BAA4B;IAC5B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,mBAAmB;IACnB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,KAAK,IAAI,CAAC;IACvE,yBAAyB;IACzB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAChD,+DAA+D;IAC/D,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,KAAK,KAAK,CAAC;IAC5E,kCAAkC;IAClC,QAAQ,EAAE,MAAM,KAAK,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED,+BAA+B;AAC/B,qBAAa,cAAc;aAEP,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;gBADd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAEjC;AAED,gCAAgC;AAChC,qBAAa,cAAc;CAAG;AAE9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,YAAY,CAwCd"}