@orkestrel/middleware 0.0.5 → 0.0.6

package/dist/src/core/index.cjs

@@ -306,6 +306,26 @@ function detectEncodings(candidates) {
 	return supported;
 }
 /**
+* Compress bytes with the host-independent `CompressionStream` primitive.
+*
+* @param bytes - The uncompressed response bytes
+* @param encoding - The negotiated actionable coding
+* @returns The compressed bytes, or the original bytes when the platform
+* stream unexpectedly has no readable body
+*
+* @example
+* ```ts
+* const bytes = new TextEncoder().encode('compress me')
+* const compressed = await compressBytes(bytes, 'gzip')
+* ```
+*/
+async function compressBytes(bytes, encoding) {
+	const source = new Response(bytes).body;
+	if (source === null) return bytes;
+	const compressed = await new Response(source.pipeThrough(new CompressionStream(encoding))).arrayBuffer();
+	return new Uint8Array(compressed);
+}
+/**
 * Whether a response is eligible for the compression/ETag buffering pipeline
 * (ruling J) — the shared cheap-skip predicate both batteries apply before
 * ever touching `response.arrayBuffer()`.
@@ -569,7 +589,7 @@ function isPreflight(method, headers) {
 * ```
 */
 function buildClientInfo(ip) {
-	return { ip };
+	return { ...ip !== void 0 ? { ip } : {} };
 }
 /**
 * Constant-time string equality — `createCSRF`'s double-submit token
@@ -665,6 +685,34 @@ function restoreSession(value) {
 	return session;
 }
 //#endregion
+//#region src/core/shapers.ts
+/**
+* The `@orkestrel/database` column shape for a
+* {@link import('./types.js').SessionRow} table — pass as-is to
+* `createDatabase({ tables: { sessions: sessionColumns } })` so an app
+* declaring a durable session table never hand-writes the shape.
+*
+* @remarks
+* `lastSeen`/`createdAt` are `integerShape({ min: 0 })` — the table validates
+* them as integers, so
+* {@link import('./stores/DatabaseSessionStore.js').DatabaseSessionStore}'s
+* `now` clock must yield integer milliseconds (`Date.now()`, the implicit
+* default `createSession` clock). A fractional clock (`performance.now()`)
+* fails the write with a validation error; `MemorySessionStore` carries no
+* such column shape and accepts a fractional clock without complaint.
+*
+* @example
+* ```ts
+* const db = createDatabase({ driver, tables: { sessions: sessionColumns } })
+* ```
+*/
+var sessionColumns = {
+	id: (0, _orkestrel_contract.stringShape)(),
+	session: (0, _orkestrel_contract.jsonShape)(),
+	lastSeen: (0, _orkestrel_contract.integerShape)({ min: 0 }),
+	createdAt: (0, _orkestrel_contract.integerShape)({ min: 0 })
+};
+//#endregion
 //#region src/core/stores/MemorySessionStore.ts
 /**
 * The default in-process {@link SessionStoreInterface} — a `Map`-backed store
@@ -742,8 +790,8 @@ var MemorySessionStore = class {
 	}
 	#expired(entry, now) {
 		return sessionExpired(entry, now, {
-			ttl: this.#ttl,
-			lifetime: this.#lifetime
+			...this.#ttl !== void 0 ? { ttl: this.#ttl } : {},
+			...this.#lifetime !== void 0 ? { lifetime: this.#lifetime } : {}
 		});
 	}
 	#reserve(now) {
@@ -816,8 +864,8 @@ var DatabaseSessionStore = class {
 		const row = await this.#table.get(id);
 		if (row === void 0) return void 0;
 		if (sessionExpired(row, now, {
-			ttl: this.#ttl,
-			lifetime: this.#lifetime
+			...this.#ttl !== void 0 ? { ttl: this.#ttl } : {},
+			...this.#lifetime !== void 0 ? { lifetime: this.#lifetime } : {}
 		})) {
 			await this.#table.remove(id);
 			return;
@@ -932,18 +980,12 @@ function createCompression(options) {
 	const threshold = options?.threshold ?? 1024;
 	const encodings = detectEncodings(options?.encodings ?? DEFAULT_COMPRESSION_ENCODINGS);
 	const filter = options?.filter;
-	const compress = async (bytes, encoding) => {
-		const source = new Response(bytes).body;
-		if (source === null) return bytes;
-		const compressed = await new Response(source.pipeThrough(new CompressionStream(encoding))).arrayBuffer();
-		return new Uint8Array(compressed);
-	};
 	return async (request, context, next) => {
 		return compressResponse(request, context, await next(), {
 			threshold,
-			filter,
+			...filter !== void 0 ? { filter } : {},
 			encodings,
-			compress
+			compress: compressBytes
 		});
 	};
 }
@@ -989,7 +1031,7 @@ function createSecurity(options) {
 		if (identifierEnabled) {
 			const incoming = request.headers.get(DEFAULT_IDENTIFIER_HEADER);
 			identifier = trust && incoming !== null && (0, _orkestrel_server.isValidRequestId)(incoming) ? incoming : crypto.randomUUID();
-			context.state.identifier = identifier;
+			Object.assign(context.state, { identifier });
 		}
 		const response = await next();
 		response.headers.set("x-content-type-options", "nosniff");
@@ -1122,7 +1164,7 @@ function createForwarded(options) {
 	const trust = hasProxies ? { proxies: options.proxies } : { trusted: options.trusted };
 	return async (request, context, next) => {
 		const ip = resolveForwardedFor(request.headers.get("x-forwarded-for") ?? void 0, trust) ?? context.state.connection?.ip;
-		context.state.client = buildClientInfo(ip);
+		Object.assign(context.state, { client: buildClientInfo(ip) });
 		return next();
 	};
 }
@@ -1196,7 +1238,7 @@ function createBearer(options) {
 		}
 		const verified = await (0, _orkestrel_server.verifyToken)(candidate, secret);
 		if (verified === void 0) throw new _orkestrel_server.HTTPError(401, "invalid token");
-		context.state.token = verified;
+		Object.assign(context.state, { token: verified });
 		return next();
 	};
 }
@@ -1225,20 +1267,14 @@ function createLimiter(options) {
 	const max = options.max;
 	const window = options.window;
 	const capacity = options.capacity ?? 1e4;
-	const deriveKey = options.key ?? ((context) => resolveKey(context.state));
+	const deriveKey = options.key;
 	const message = options.message ?? "rate limit exceeded";
 	const clock = options.clock ?? Date.now;
 	const policy = options.policy ?? false;
 	const evict = options.evict;
-	const notify = (evictedKey) => {
-		if (evict === void 0) return;
-		try {
-			evict(evictedKey);
-		} catch {}
-	};
 	const buckets = /* @__PURE__ */ new Map();
 	return async (request, context, next) => {
-		const key = deriveKey(context);
+		const key = deriveKey === void 0 ? resolveKey(context.state) : deriveKey(context);
 		const now = clock();
 		let bucket = buckets.get(key);
 		if (bucket === void 0) {
@@ -1246,13 +1282,15 @@ function createLimiter(options) {
 				const oldest = buckets.keys().next().value;
 				if (oldest !== void 0) {
 					buckets.delete(oldest);
-					notify(oldest);
+					if (evict !== void 0) try {
+						evict(oldest);
+					} catch {}
 				}
 			}
 			bucket = {
 				budget: (0, _orkestrel_budget.createBudget)({
 					max,
-					consume: (value) => value
+					consume: Number
 				}),
 				resetAt: now + window
 			};
@@ -1306,7 +1344,7 @@ function createLimiter(options) {
 function createBody() {
 	return async (request, context, next) => {
 		const body = await context.body();
-		context.state.body = body;
+		if (body !== void 0) Object.assign(context.state, { body });
 		const contentType = request.headers.get("content-type");
 		if (contentType !== null && contentType.toLowerCase().startsWith("application/json") && body === void 0) throw new _orkestrel_server.HTTPError(400, "invalid json");
 		return next();
@@ -1341,12 +1379,12 @@ function createSession(options) {
 	const transport = options.transport;
 	const clock = options.clock ?? Date.now;
 	const store = options.store ?? new MemorySessionStore({
-		ttl: options.ttl,
-		lifetime: options.lifetime,
-		capacity: options.capacity,
-		evict: options.evict
+		...options.ttl !== void 0 ? { ttl: options.ttl } : {},
+		...options.lifetime !== void 0 ? { lifetime: options.lifetime } : {},
+		...options.capacity !== void 0 ? { capacity: options.capacity } : {},
+		...options.evict !== void 0 ? { evict: options.evict } : {}
 	});
-	const create = options.create ?? ((id) => new Session(id));
+	const create = options.create;
 	const mint = options.mint;
 	const requireSession = options.require ?? false;
 	const ends = options.ends ?? false;
@@ -1363,18 +1401,19 @@ function createSession(options) {
 		if (session === void 0) {
 			if (mint !== void 0 ? await mint(context) : true) {
 				const id = crypto.randomUUID();
-				session = create(id);
+				session = create === void 0 ? new Session(id) : create(id);
 				minted = true;
 			} else if (requireSession) throw new _orkestrel_server.HTTPError(404, "session required");
 		}
 		let destroyed = false;
 		let regenerated;
 		const activeSession = session;
-		if (activeSession !== void 0) {
-			const control = {
+		if (activeSession !== void 0) Object.assign(context.state, {
+			session: activeSession,
+			control: {
 				regenerate() {
 					if (destroyed) return;
-					const newSession = create(crypto.randomUUID());
+					const newSession = create === void 0 ? new Session(crypto.randomUUID()) : create(crypto.randomUUID());
 					transferSessionData(activeSession, newSession);
 					regenerated = newSession;
 				},
@@ -1382,10 +1421,8 @@ function createSession(options) {
 					destroyed = true;
 					regenerated = void 0;
 				}
-			};
-			context.state.session = activeSession;
-			context.state.control = control;
-		}
+			}
+		});
 		const response = await next();
 		if (activeSession !== void 0) if (destroyed) {
 			await store.delete(activeSession.id);
@@ -1429,7 +1466,7 @@ function createCSRF(options) {
 	return async (request, context, next) => {
 		if (safe.includes(context.method)) {
 			const token = await (0, _orkestrel_server.signToken)(context.state.session?.id ?? crypto.randomUUID(), { secret });
-			context.state.csrf = token;
+			Object.assign(context.state, { csrf: token });
 			const response = await next();
 			const secure = (0, _orkestrel_server.resolveSecure)(void 0, context.state.connection?.encrypted ?? false);
 			await (0, _orkestrel_server.writeSignedCookie)(response.headers, cookieName, token, secret, {
@@ -1587,30 +1624,6 @@ function createMemorySessionStore(options) {
 	return new MemorySessionStore(options);
 }
 /**
-* The `@orkestrel/database` column shape for a {@link SessionRow} table — pass
-* as-is to `createDatabase({ tables: { sessions: sessionColumns } })` so an
-* app declaring a durable session table never hand-writes the shape.
-*
-* @remarks
-* `lastSeen`/`createdAt` are `integerShape({ min: 0 })` — the table VALIDATES
-* them as integers, so `DatabaseSessionStore`'s `now` clock must yield
-* integer milliseconds (`Date.now()`, the implicit default `createSession`
-* clock). A fractional clock (`performance.now()`) fails the write with a
-* validation error; `MemorySessionStore` carries no such column shape and
-* accepts a fractional clock without complaint.
-*
-* @example
-* ```ts
-* const db = createDatabase({ driver, tables: { sessions: sessionColumns } })
-* ```
-*/
-var sessionColumns = {
-	id: (0, _orkestrel_contract.stringShape)(),
-	session: (0, _orkestrel_contract.jsonShape)(),
-	lastSeen: (0, _orkestrel_contract.integerShape)({ min: 0 }),
-	createdAt: (0, _orkestrel_contract.integerShape)({ min: 0 })
-};
-/**
 * Create a {@link DatabaseSessionStore} as a {@link SessionStoreInterface} —
 * the durable counterpart to `createMemorySessionStore`, over a caller-opened
 * `@orkestrel/database` table (declare it with {@link sessionColumns}).
@@ -1668,6 +1681,7 @@ exports.buildClientInfo = buildClientInfo;
 exports.buildRateLimitField = buildRateLimitField;
 exports.buildRateLimitPolicyField = buildRateLimitPolicyField;
 exports.buildRetryAfter = buildRetryAfter;
+exports.compressBytes = compressBytes;
 exports.compressResponse = compressResponse;
 exports.createBearer = createBearer;
 exports.createBody = createBody;