@procedures/weather 0.28.0 → 0.28.1

package/dist/module.d.ts

@@ -2,8 +2,14 @@
  * The procedures of @procedures/weather as data. Importing this file registers nothing.
  */
 import { type ProcedureModule, type ProcedureRegistry } from "@procedures/client";
+import { type WeatherProceduresOptions } from "./procedures.js";
 export declare const weatherModule: ProcedureModule;
 export default weatherModule;
+/**
+ * This function gives the module with the settings of the host: the `fetch` of the requests.
+ * Without options, it gives `weatherModule`.
+ */
+export declare function createWeatherModule(options?: WeatherProceduresOptions): ProcedureModule;
 /**
  * This function registers the procedures of @procedures/weather in a registry. The default is the
  * global registry.

package/dist/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAqD,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGrI,eAAO,MAAM,aAAa,EAAE,eAAwE,CAAC;eAEtF,aAAa;AAE5B;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,GAAE,iBAAsC,GAAG,IAAI,CAEhG"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAqD,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACrI,OAAO,EAA8C,KAAK,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAE5G,eAAO,MAAM,aAAa,EAAE,eAAwE,CAAC;eAEtF,aAAa;AAE5B;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,wBAA6B,GAAG,eAAe,CAG3F;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,GAAE,iBAAsC,GAAG,IAAI,CAEhG"}

package/dist/module.js

@@ -2,9 +2,18 @@
  * The procedures of @procedures/weather as data. Importing this file registers nothing.
  */
 import { defineModule, registerModules, PROCEDURE_REGISTRY } from "@procedures/client";
-import { weatherProcedures } from "./procedures.js";
+import { createWeatherProcedures, weatherProcedures } from "./procedures.js";
 export const weatherModule = defineModule("@procedures/weather", weatherProcedures);
 export default weatherModule;
+/**
+ * This function gives the module with the settings of the host: the `fetch` of the requests.
+ * Without options, it gives `weatherModule`.
+ */
+export function createWeatherModule(options = {}) {
+    if (options.fetch === undefined)
+        return weatherModule;
+    return defineModule("@procedures/weather", createWeatherProcedures(options));
+}
 /**
  * This function registers the procedures of @procedures/weather in a registry. The default is the
  * global registry.

package/dist/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAgD,MAAM,oBAAoB,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,CAAC,MAAM,aAAa,GAAoB,YAAY,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;AAErG,eAAe,aAAa,CAAC;AAE7B;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAQ,GAAsB,kBAAkB;IACxF,eAAe,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAgD,MAAM,oBAAoB,CAAC;AACrI,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAiC,MAAM,iBAAiB,CAAC;AAE5G,MAAM,CAAC,MAAM,aAAa,GAAoB,YAAY,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;AAErG,eAAe,aAAa,CAAC;AAE7B;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAO,GAA6B,EAAE;IACxE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,OAAO,YAAY,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAQ,GAAsB,kBAAkB;IACxF,eAAe,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/procedures.d.ts

@@ -1,7 +1,44 @@
 /**
  * The procedure of `@procedures/weather`: `weather.forecast`.
+ *
+ * The request goes through the host policy of `@procedures/http` (audit pass 2, O55). In 0.28, a
+ * `baseUrl` on a loopback, private or link-local address still works, with a deprecation notice.
+ * Version 0.29.0 refuses it, unless the host allows it.
  */
 import { type AnyProcedure } from "@procedures/client";
-export declare const weatherForecastProcedure: AnyProcedure;
+import { type DeprecationNotice } from "@procedures/http";
+/**
+ * The deprecation notice of the default module: a `baseUrl` on a host that the host policy refuses.
+ * The default module sends the request with the global `fetch`, as before. Version 0.29.0 refuses it.
+ */
+export declare const WEATHER_PRIVATE_HOST_NOTICE: DeprecationNotice;
+/**
+ * The part of `fetch` that `weather.forecast` uses. The default is `createHostFetch()` of
+ * `@procedures/http`, with the notice `WEATHER_PRIVATE_HOST_NOTICE` for a refused host.
+ */
+export type FetchForecast = (url: string, init: {
+    headers: Record<string, string>;
+    signal: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+}>;
+/** The settings of the host for the procedures of this package. The procedure input cannot change them. */
+export interface WeatherProceduresOptions {
+    /**
+     * The function that sends the request. The default is `createHostFetch()` with a notice for a
+     * refused host. A host with its own Open-Meteo server on a private address gives
+     * `createHostFetch({ allow: ["10.0.0.5:8080"] })`.
+     */
+    readonly fetch?: FetchForecast | undefined;
+}
+/**
+ * This function gives the procedures of this package with the settings of the host. Without
+ * options, the requests go through the default host policy of `@procedures/http`, and a refused
+ * host gets the notice `WEATHER_PRIVATE_HOST_NOTICE`.
+ */
+export declare function createWeatherProcedures(options?: WeatherProceduresOptions): AnyProcedure[];
 export declare const weatherProcedures: AnyProcedure[];
+export declare const weatherForecastProcedure: AnyProcedure;
 //# sourceMappingURL=procedures.d.ts.map

package/dist/procedures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"procedures.d.ts","sourceRoot":"","sources":["../src/procedures.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAA+B,KAAK,YAAY,EAAyB,MAAM,oBAAoB,CAAC;AAkC3G,eAAO,MAAM,wBAAwB,EAAE,YAqBb,CAAC;AAE3B,eAAO,MAAM,iBAAiB,EAAE,YAAY,EAA+B,CAAC"}
+{"version":3,"file":"procedures.d.ts","sourceRoot":"","sources":["../src/procedures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAA+B,KAAK,YAAY,EAAyB,MAAM,oBAAoB,CAAC;AAC3G,OAAO,EAAqC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAI7F;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAE,iBAKzC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,KAC3D,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAExE,2GAA2G;AAC3G,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAC5C;AAgCD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,wBAA6B,GAAG,YAAY,EAAE,CA2B9F;AAED,eAAO,MAAM,iBAAiB,EAAE,YAAY,EAA8B,CAAC;AAE3E,eAAO,MAAM,wBAAwB,EAAE,YAAoC,CAAC"}

package/dist/procedures.js

@@ -1,9 +1,23 @@
 /**
  * The procedure of `@procedures/weather`: `weather.forecast`.
+ *
+ * The request goes through the host policy of `@procedures/http` (audit pass 2, O55). In 0.28, a
+ * `baseUrl` on a loopback, private or link-local address still works, with a deprecation notice.
+ * Version 0.29.0 refuses it, unless the host allows it.
  */
 import { createProcedure, zodAdapter } from "@procedures/client";
+import { createHostFetch, isHostNotAllowed } from "@procedures/http";
 import { z } from "zod";
 import { forecastUrl, readForecast } from "./weather.js";
+/**
+ * The deprecation notice of the default module: a `baseUrl` on a host that the host policy refuses.
+ * The default module sends the request with the global `fetch`, as before. Version 0.29.0 refuses it.
+ */
+export const WEATHER_PRIVATE_HOST_NOTICE = {
+    code: "PROCEDURES_WEATHER_PRIVATE_HOST",
+    message: "weather.forecast sent a request to a loopback, private or link-local host. @procedures/weather 0.29.0 refuses such a host. " +
+        "To keep this server, give createWeatherModule({ fetch: createHostFetch({ allow: [...] }) }) with the host and port of the server.",
+};
 const ForecastInputSchema = z.object({
     lat: z.number().min(-90).max(90).describe("The latitude of the point, in degrees"),
     lon: z.number().min(-180).max(180).describe("The longitude of the point, in degrees"),
@@ -29,29 +43,42 @@ const ForecastOutputSchema = z.object({
         .array(z.object({ time: z.string(), temperature: nullableNumber, precipitationProbability: nullableNumber, weatherCode: nullableNumber }))
         .optional(),
 });
-export const weatherForecastProcedure = createProcedure()
-    .path(["weather", "forecast"])
-    .input(zodAdapter(ForecastInputSchema))
-    .output(zodAdapter(ForecastOutputSchema))
-    .meta({
-    description: "Give the weather forecast of a point for each day, and optionally each hour (Open-Meteo)",
-    output: "json",
-    effects: { reads: ["network"], writes: [] },
-})
-    .handler(async (input, ctx) => {
-    const signals = [AbortSignal.timeout(input.timeoutMs), ...(ctx?.signal ? [ctx.signal] : [])];
-    let response;
-    try {
-        response = await fetch(forecastUrl(input), { signal: AbortSignal.any(signals), headers: { accept: "application/json" } });
-    }
-    catch (error) {
-        const reason = error.name === "TimeoutError" ? `no answer in ${input.timeoutMs} ms` : "the request failed";
-        throw new Error(`Open-Meteo did not answer: ${reason}`);
-    }
-    if (!response.ok)
-        throw new Error(`Open-Meteo gave HTTP ${response.status}`);
-    return readForecast(await response.json(), input.hourly);
-})
-    .build();
-export const weatherProcedures = [weatherForecastProcedure];
+/**
+ * This function gives the procedures of this package with the settings of the host. Without
+ * options, the requests go through the default host policy of `@procedures/http`, and a refused
+ * host gets the notice `WEATHER_PRIVATE_HOST_NOTICE`.
+ */
+export function createWeatherProcedures(options = {}) {
+    const fetchForecast = options.fetch ?? createHostFetch({ warnOnRefusal: WEATHER_PRIVATE_HOST_NOTICE });
+    const forecast = createProcedure()
+        .path(["weather", "forecast"])
+        .input(zodAdapter(ForecastInputSchema))
+        .output(zodAdapter(ForecastOutputSchema))
+        .meta({
+        description: "Give the weather forecast of a point for each day, and optionally each hour (Open-Meteo)",
+        output: "json",
+        effects: { reads: ["network"], writes: [] },
+    })
+        .handler(async (input, ctx) => {
+        const signals = [AbortSignal.timeout(input.timeoutMs), ...(ctx?.signal ? [ctx.signal] : [])];
+        let response;
+        try {
+            response = await fetchForecast(forecastUrl(input), { signal: AbortSignal.any(signals), headers: { accept: "application/json" } });
+        }
+        catch (error) {
+            // A refusal of the host policy keeps its code and its reason
+            if (isHostNotAllowed(error))
+                throw error;
+            const reason = error.name === "TimeoutError" ? `no answer in ${input.timeoutMs} ms` : "the request failed";
+            throw new Error(`Open-Meteo did not answer: ${reason}`);
+        }
+        if (!response.ok)
+            throw new Error(`Open-Meteo gave HTTP ${response.status}`);
+        return readForecast(await response.json(), input.hourly);
+    })
+        .build();
+    return [forecast];
+}
+export const weatherProcedures = createWeatherProcedures();
+export const weatherForecastProcedure = weatherProcedures[0];
 //# sourceMappingURL=procedures.js.map

package/dist/procedures.js.map

@@ -1 +1 @@
-{"version":3,"file":"procedures.js","sourceRoot":"","sources":["../src/procedures.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAA4C,MAAM,oBAAoB,CAAC;AAC3G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAiB,MAAM,cAAc,CAAC;AAExE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAClF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACrF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IACxG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IAC5H,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnF,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;IAC9F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,kDAAkD,CAAC;CACjI,CAAC,CAAC;AAGH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AAC7C,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnE,KAAK,EAAE,CAAC,CAAC,KAAK,CACZ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,cAAc,EAAE,cAAc;QAC9B,cAAc,EAAE,cAAc;QAC9B,wBAAwB,EAAE,cAAc;QACxC,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,cAAc;KAC5B,CAAC,CACH;IACD,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,wBAAwB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;SACzI,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAiB,eAAe,EAAE;KACpE,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;KAC7B,KAAK,CAAC,UAAU,CAAgB,mBAAmB,CAAC,CAAC;KACrD,MAAM,CAAC,UAAU,CAAW,oBAAoB,CAAC,CAAC;KAClD,IAAI,CAAC;IACJ,WAAW,EAAE,0FAA0F;IACvG,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;CAC5C,CAAC;KACD,OAAO,CAAC,KAAK,EAAE,KAAoB,EAAE,GAAsB,EAAqB,EAAE;IACjF,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC5H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAI,KAA2B,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAClI,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,YAAY,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC,CAAC;KACD,KAAK,EAAkB,CAAC;AAE3B,MAAM,CAAC,MAAM,iBAAiB,GAAmB,CAAC,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"procedures.js","sourceRoot":"","sources":["../src/procedures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAA4C,MAAM,oBAAoB,CAAC;AAC3G,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAA0B,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAiB,MAAM,cAAc,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,IAAI,EAAE,iCAAiC;IACvC,OAAO,EACL,6HAA6H;QAC7H,mIAAmI;CACtI,CAAC;AAqBF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAClF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACrF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IACxG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IAC5H,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnF,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;IAC9F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,kDAAkD,CAAC;CACjI,CAAC,CAAC;AAGH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AAC7C,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnE,KAAK,EAAE,CAAC,CAAC,KAAK,CACZ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,cAAc,EAAE,cAAc;QAC9B,cAAc,EAAE,cAAc;QAC9B,wBAAwB,EAAE,cAAc;QACxC,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,cAAc;KAC5B,CAAC,CACH;IACD,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,wBAAwB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;SACzI,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAO,GAA6B,EAAE;IAC5E,MAAM,aAAa,GAAkB,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,EAAE,aAAa,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACtH,MAAM,QAAQ,GAAG,eAAe,EAAE;SAC/B,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;SAC7B,KAAK,CAAC,UAAU,CAAgB,mBAAmB,CAAC,CAAC;SACrD,MAAM,CAAC,UAAU,CAAW,oBAAoB,CAAC,CAAC;SAClD,IAAI,CAAC;QACJ,WAAW,EAAE,0FAA0F;QACvG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;KAC5C,CAAC;SACD,OAAO,CAAC,KAAK,EAAE,KAAoB,EAAE,GAAsB,EAAqB,EAAE;QACjF,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7F,IAAI,QAA4C,CAAC;QACjD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACpI,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,IAAI,gBAAgB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzC,MAAM,MAAM,GAAI,KAA2B,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAClI,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,OAAO,YAAY,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC,CAAC;SACD,KAAK,EAAkB,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAmB,uBAAuB,EAAE,CAAC;AAE3E,MAAM,CAAC,MAAM,wBAAwB,GAAiB,iBAAiB,CAAC,CAAC,CAAE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package",
   "name": "@procedures/weather",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "A weather forecast for a point from Open-Meteo, without a key: each day and each hour, metric or imperial.",
   "keywords": [
     "weather",
@@ -56,7 +56,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@procedures/client": "0.28.0",
+    "@procedures/client": "0.28.1",
+    "@procedures/http": "0.28.1",
     "zod": "^4.6.5"
   },
   "devDependencies": {

package/src/module.ts

@@ -3,12 +3,21 @@
  */
 
 import { defineModule, registerModules, PROCEDURE_REGISTRY, type ProcedureModule, type ProcedureRegistry } from "@procedures/client";
-import { weatherProcedures } from "./procedures.js";
+import { createWeatherProcedures, weatherProcedures, type WeatherProceduresOptions } from "./procedures.js";
 
 export const weatherModule: ProcedureModule = defineModule("@procedures/weather", weatherProcedures);
 
 export default weatherModule;
 
+/**
+ * This function gives the module with the settings of the host: the `fetch` of the requests.
+ * Without options, it gives `weatherModule`.
+ */
+export function createWeatherModule(options: WeatherProceduresOptions = {}): ProcedureModule {
+  if (options.fetch === undefined) return weatherModule;
+  return defineModule("@procedures/weather", createWeatherProcedures(options));
+}
+
 /**
  * This function registers the procedures of @procedures/weather in a registry. The default is the
  * global registry.

package/src/procedures.ts

@@ -1,11 +1,46 @@
 /**
  * The procedure of `@procedures/weather`: `weather.forecast`.
+ *
+ * The request goes through the host policy of `@procedures/http` (audit pass 2, O55). In 0.28, a
+ * `baseUrl` on a loopback, private or link-local address still works, with a deprecation notice.
+ * Version 0.29.0 refuses it, unless the host allows it.
  */
 
 import { createProcedure, zodAdapter, type AnyProcedure, type ProcedureContext } from "@procedures/client";
+import { createHostFetch, isHostNotAllowed, type DeprecationNotice } from "@procedures/http";
 import { z } from "zod";
 import { forecastUrl, readForecast, type Forecast } from "./weather.js";
 
+/**
+ * The deprecation notice of the default module: a `baseUrl` on a host that the host policy refuses.
+ * The default module sends the request with the global `fetch`, as before. Version 0.29.0 refuses it.
+ */
+export const WEATHER_PRIVATE_HOST_NOTICE: DeprecationNotice = {
+  code: "PROCEDURES_WEATHER_PRIVATE_HOST",
+  message:
+    "weather.forecast sent a request to a loopback, private or link-local host. @procedures/weather 0.29.0 refuses such a host. " +
+    "To keep this server, give createWeatherModule({ fetch: createHostFetch({ allow: [...] }) }) with the host and port of the server.",
+};
+
+/**
+ * The part of `fetch` that `weather.forecast` uses. The default is `createHostFetch()` of
+ * `@procedures/http`, with the notice `WEATHER_PRIVATE_HOST_NOTICE` for a refused host.
+ */
+export type FetchForecast = (
+  url: string,
+  init: { headers: Record<string, string>; signal: AbortSignal }
+) => Promise<{ ok: boolean; status: number; json(): Promise<unknown> }>;
+
+/** The settings of the host for the procedures of this package. The procedure input cannot change them. */
+export interface WeatherProceduresOptions {
+  /**
+   * The function that sends the request. The default is `createHostFetch()` with a notice for a
+   * refused host. A host with its own Open-Meteo server on a private address gives
+   * `createHostFetch({ allow: ["10.0.0.5:8080"] })`.
+   */
+  readonly fetch?: FetchForecast | undefined;
+}
+
 const ForecastInputSchema = z.object({
   lat: z.number().min(-90).max(90).describe("The latitude of the point, in degrees"),
   lon: z.number().min(-180).max(180).describe("The longitude of the point, in degrees"),
@@ -36,27 +71,40 @@ const ForecastOutputSchema = z.object({
     .optional(),
 });
 
-export const weatherForecastProcedure: AnyProcedure = createProcedure()
-  .path(["weather", "forecast"])
-  .input(zodAdapter<ForecastInput>(ForecastInputSchema))
-  .output(zodAdapter<Forecast>(ForecastOutputSchema))
-  .meta({
-    description: "Give the weather forecast of a point for each day, and optionally each hour (Open-Meteo)",
-    output: "json",
-    effects: { reads: ["network"], writes: [] },
-  })
-  .handler(async (input: ForecastInput, ctx?: ProcedureContext): Promise<Forecast> => {
-    const signals = [AbortSignal.timeout(input.timeoutMs), ...(ctx?.signal ? [ctx.signal] : [])];
-    let response: Response;
-    try {
-      response = await fetch(forecastUrl(input), { signal: AbortSignal.any(signals), headers: { accept: "application/json" } });
-    } catch (error) {
-      const reason = (error as { name?: string }).name === "TimeoutError" ? `no answer in ${input.timeoutMs} ms` : "the request failed";
-      throw new Error(`Open-Meteo did not answer: ${reason}`);
-    }
-    if (!response.ok) throw new Error(`Open-Meteo gave HTTP ${response.status}`);
-    return readForecast(await response.json(), input.hourly);
-  })
-  .build() as AnyProcedure;
-
-export const weatherProcedures: AnyProcedure[] = [weatherForecastProcedure];
+/**
+ * This function gives the procedures of this package with the settings of the host. Without
+ * options, the requests go through the default host policy of `@procedures/http`, and a refused
+ * host gets the notice `WEATHER_PRIVATE_HOST_NOTICE`.
+ */
+export function createWeatherProcedures(options: WeatherProceduresOptions = {}): AnyProcedure[] {
+  const fetchForecast: FetchForecast = options.fetch ?? createHostFetch({ warnOnRefusal: WEATHER_PRIVATE_HOST_NOTICE });
+  const forecast = createProcedure()
+    .path(["weather", "forecast"])
+    .input(zodAdapter<ForecastInput>(ForecastInputSchema))
+    .output(zodAdapter<Forecast>(ForecastOutputSchema))
+    .meta({
+      description: "Give the weather forecast of a point for each day, and optionally each hour (Open-Meteo)",
+      output: "json",
+      effects: { reads: ["network"], writes: [] },
+    })
+    .handler(async (input: ForecastInput, ctx?: ProcedureContext): Promise<Forecast> => {
+      const signals = [AbortSignal.timeout(input.timeoutMs), ...(ctx?.signal ? [ctx.signal] : [])];
+      let response: Awaited<ReturnType<FetchForecast>>;
+      try {
+        response = await fetchForecast(forecastUrl(input), { signal: AbortSignal.any(signals), headers: { accept: "application/json" } });
+      } catch (error) {
+        // A refusal of the host policy keeps its code and its reason
+        if (isHostNotAllowed(error)) throw error;
+        const reason = (error as { name?: string }).name === "TimeoutError" ? `no answer in ${input.timeoutMs} ms` : "the request failed";
+        throw new Error(`Open-Meteo did not answer: ${reason}`);
+      }
+      if (!response.ok) throw new Error(`Open-Meteo gave HTTP ${response.status}`);
+      return readForecast(await response.json(), input.hourly);
+    })
+    .build() as AnyProcedure;
+  return [forecast];
+}
+
+export const weatherProcedures: AnyProcedure[] = createWeatherProcedures();
+
+export const weatherForecastProcedure: AnyProcedure = weatherProcedures[0]!;