@procedures/weather 0.28.0 → 0.29.0

package/dist/module.d.ts

@@ -2,8 +2,14 @@
  * The procedures of @procedures/weather as data. Importing this file registers nothing.
  */
 import { type ProcedureModule, type ProcedureRegistry } from "@procedures/client";
+import { type WeatherProceduresOptions } from "./procedures.js";
 export declare const weatherModule: ProcedureModule;
 export default weatherModule;
+/**
+ * This function gives the module with the settings of the host: the `fetch` of the requests.
+ * Without options, it gives `weatherModule`.
+ */
+export declare function createWeatherModule(options?: WeatherProceduresOptions): ProcedureModule;
 /**
  * This function registers the procedures of @procedures/weather in a registry. The default is the
  * global registry.

package/dist/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAqD,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGrI,eAAO,MAAM,aAAa,EAAE,eAAwE,CAAC;eAEtF,aAAa;AAE5B;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,GAAE,iBAAsC,GAAG,IAAI,CAEhG"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAqD,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACrI,OAAO,EAA8C,KAAK,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAE5G,eAAO,MAAM,aAAa,EAAE,eAAwE,CAAC;eAEtF,aAAa;AAE5B;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,wBAA6B,GAAG,eAAe,CAG3F;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,GAAE,iBAAsC,GAAG,IAAI,CAEhG"}

package/dist/module.js

@@ -2,9 +2,18 @@
  * The procedures of @procedures/weather as data. Importing this file registers nothing.
  */
 import { defineModule, registerModules, PROCEDURE_REGISTRY } from "@procedures/client";
-import { weatherProcedures } from "./procedures.js";
+import { createWeatherProcedures, weatherProcedures } from "./procedures.js";
 export const weatherModule = defineModule("@procedures/weather", weatherProcedures);
 export default weatherModule;
+/**
+ * This function gives the module with the settings of the host: the `fetch` of the requests.
+ * Without options, it gives `weatherModule`.
+ */
+export function createWeatherModule(options = {}) {
+    if (options.fetch === undefined)
+        return weatherModule;
+    return defineModule("@procedures/weather", createWeatherProcedures(options));
+}
 /**
  * This function registers the procedures of @procedures/weather in a registry. The default is the
  * global registry.

package/dist/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAgD,MAAM,oBAAoB,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,CAAC,MAAM,aAAa,GAAoB,YAAY,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;AAErG,eAAe,aAAa,CAAC;AAE7B;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAQ,GAAsB,kBAAkB;IACxF,eAAe,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAgD,MAAM,oBAAoB,CAAC;AACrI,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAiC,MAAM,iBAAiB,CAAC;AAE5G,MAAM,CAAC,MAAM,aAAa,GAAoB,YAAY,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;AAErG,eAAe,aAAa,CAAC;AAE7B;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAO,GAA6B,EAAE;IACxE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,OAAO,YAAY,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAQ,GAAsB,kBAAkB;IACxF,eAAe,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/procedures.d.ts

@@ -1,7 +1,35 @@
 /**
  * The procedure of `@procedures/weather`: `weather.forecast`.
+ *
+ * The request goes through the host policy of `@procedures/http` (audit pass 2, O55). The policy
+ * refuses a `baseUrl` on a loopback, private or link-local address, unless the host allows it.
  */
 import { type AnyProcedure } from "@procedures/client";
-export declare const weatherForecastProcedure: AnyProcedure;
+/**
+ * The part of `fetch` that `weather.forecast` uses. The default is `createHostFetch()` of
+ * `@procedures/http`: each public host, and no other host.
+ */
+export type FetchForecast = (url: string, init: {
+    headers: Record<string, string>;
+    signal: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+}>;
+/** The settings of the host for the procedures of this package. The procedure input cannot change them. */
+export interface WeatherProceduresOptions {
+    /**
+     * The function that sends the request. The default is `createHostFetch()`. A host with its own
+     * Open-Meteo server on a private address gives `createHostFetch({ allow: ["10.0.0.5:8080"] })`.
+     */
+    readonly fetch?: FetchForecast | undefined;
+}
+/**
+ * This function gives the procedures of this package with the settings of the host. Without
+ * options, the requests go through the default host policy of `@procedures/http`.
+ */
+export declare function createWeatherProcedures(options?: WeatherProceduresOptions): AnyProcedure[];
 export declare const weatherProcedures: AnyProcedure[];
+export declare const weatherForecastProcedure: AnyProcedure;
 //# sourceMappingURL=procedures.d.ts.map

package/dist/procedures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"procedures.d.ts","sourceRoot":"","sources":["../src/procedures.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAA+B,KAAK,YAAY,EAAyB,MAAM,oBAAoB,CAAC;AAkC3G,eAAO,MAAM,wBAAwB,EAAE,YAqBb,CAAC;AAE3B,eAAO,MAAM,iBAAiB,EAAE,YAAY,EAA+B,CAAC"}
+{"version":3,"file":"procedures.d.ts","sourceRoot":"","sources":["../src/procedures.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAA+B,KAAK,YAAY,EAAyB,MAAM,oBAAoB,CAAC;AAK3G;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,KAC3D,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAExE,2GAA2G;AAC3G,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAC5C;AAmCD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,wBAA6B,GAAG,YAAY,EAAE,CA2B9F;AAED,eAAO,MAAM,iBAAiB,EAAE,YAAY,EAA8B,CAAC;AAE3E,eAAO,MAAM,wBAAwB,EAAE,YAAoC,CAAC"}

package/dist/procedures.js

@@ -1,7 +1,11 @@
 /**
  * The procedure of `@procedures/weather`: `weather.forecast`.
+ *
+ * The request goes through the host policy of `@procedures/http` (audit pass 2, O55). The policy
+ * refuses a `baseUrl` on a loopback, private or link-local address, unless the host allows it.
  */
 import { createProcedure, zodAdapter } from "@procedures/client";
+import { createHostFetch, isHostNotAllowed } from "@procedures/http";
 import { z } from "zod";
 import { forecastUrl, readForecast } from "./weather.js";
 const ForecastInputSchema = z.object({
@@ -10,7 +14,10 @@ const ForecastInputSchema = z.object({
     days: z.number().int().min(1).max(16).default(7).describe("The number of days (default: 7, at most 16)"),
     units: z.enum(["metric", "imperial"]).default("metric").describe("metric (°C, km/h) or imperial (°F, mph); default: metric"),
     hourly: z.boolean().default(false).describe("Also give each hour (default: false)"),
-    baseUrl: z.url().optional().describe("Another Open-Meteo server (default: the public server)"),
+    baseUrl: z
+        .url()
+        .optional()
+        .describe("Another Open-Meteo server (default: the public server). The host policy refuses a loopback, private or link-local address."),
     timeoutMs: z.number().int().positive().max(120_000).default(20_000).describe("The time limit, in milliseconds (default: 20000)"),
 });
 const nullableNumber = z.number().nullable();
@@ -29,29 +36,41 @@ const ForecastOutputSchema = z.object({
         .array(z.object({ time: z.string(), temperature: nullableNumber, precipitationProbability: nullableNumber, weatherCode: nullableNumber }))
         .optional(),
 });
-export const weatherForecastProcedure = createProcedure()
-    .path(["weather", "forecast"])
-    .input(zodAdapter(ForecastInputSchema))
-    .output(zodAdapter(ForecastOutputSchema))
-    .meta({
-    description: "Give the weather forecast of a point for each day, and optionally each hour (Open-Meteo)",
-    output: "json",
-    effects: { reads: ["network"], writes: [] },
-})
-    .handler(async (input, ctx) => {
-    const signals = [AbortSignal.timeout(input.timeoutMs), ...(ctx?.signal ? [ctx.signal] : [])];
-    let response;
-    try {
-        response = await fetch(forecastUrl(input), { signal: AbortSignal.any(signals), headers: { accept: "application/json" } });
-    }
-    catch (error) {
-        const reason = error.name === "TimeoutError" ? `no answer in ${input.timeoutMs} ms` : "the request failed";
-        throw new Error(`Open-Meteo did not answer: ${reason}`);
-    }
-    if (!response.ok)
-        throw new Error(`Open-Meteo gave HTTP ${response.status}`);
-    return readForecast(await response.json(), input.hourly);
-})
-    .build();
-export const weatherProcedures = [weatherForecastProcedure];
+/**
+ * This function gives the procedures of this package with the settings of the host. Without
+ * options, the requests go through the default host policy of `@procedures/http`.
+ */
+export function createWeatherProcedures(options = {}) {
+    const fetchForecast = options.fetch ?? createHostFetch();
+    const forecast = createProcedure()
+        .path(["weather", "forecast"])
+        .input(zodAdapter(ForecastInputSchema))
+        .output(zodAdapter(ForecastOutputSchema))
+        .meta({
+        description: "Give the weather forecast of a point for each day, and optionally each hour (Open-Meteo)",
+        output: "json",
+        effects: { reads: ["network"], writes: [] },
+    })
+        .handler(async (input, ctx) => {
+        const signals = [AbortSignal.timeout(input.timeoutMs), ...(ctx?.signal ? [ctx.signal] : [])];
+        let response;
+        try {
+            response = await fetchForecast(forecastUrl(input), { signal: AbortSignal.any(signals), headers: { accept: "application/json" } });
+        }
+        catch (error) {
+            // A refusal of the host policy keeps its code and its reason
+            if (isHostNotAllowed(error))
+                throw error;
+            const reason = error.name === "TimeoutError" ? `no answer in ${input.timeoutMs} ms` : "the request failed";
+            throw new Error(`Open-Meteo did not answer: ${reason}`);
+        }
+        if (!response.ok)
+            throw new Error(`Open-Meteo gave HTTP ${response.status}`);
+        return readForecast(await response.json(), input.hourly);
+    })
+        .build();
+    return [forecast];
+}
+export const weatherProcedures = createWeatherProcedures();
+export const weatherForecastProcedure = weatherProcedures[0];
 //# sourceMappingURL=procedures.js.map

package/dist/procedures.js.map

@@ -1 +1 @@
-{"version":3,"file":"procedures.js","sourceRoot":"","sources":["../src/procedures.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAA4C,MAAM,oBAAoB,CAAC;AAC3G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAiB,MAAM,cAAc,CAAC;AAExE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAClF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACrF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IACxG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IAC5H,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnF,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;IAC9F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,kDAAkD,CAAC;CACjI,CAAC,CAAC;AAGH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AAC7C,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnE,KAAK,EAAE,CAAC,CAAC,KAAK,CACZ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,cAAc,EAAE,cAAc;QAC9B,cAAc,EAAE,cAAc;QAC9B,wBAAwB,EAAE,cAAc;QACxC,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,cAAc;KAC5B,CAAC,CACH;IACD,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,wBAAwB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;SACzI,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAiB,eAAe,EAAE;KACpE,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;KAC7B,KAAK,CAAC,UAAU,CAAgB,mBAAmB,CAAC,CAAC;KACrD,MAAM,CAAC,UAAU,CAAW,oBAAoB,CAAC,CAAC;KAClD,IAAI,CAAC;IACJ,WAAW,EAAE,0FAA0F;IACvG,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;CAC5C,CAAC;KACD,OAAO,CAAC,KAAK,EAAE,KAAoB,EAAE,GAAsB,EAAqB,EAAE;IACjF,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC5H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAI,KAA2B,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAClI,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,YAAY,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC,CAAC;KACD,KAAK,EAAkB,CAAC;AAE3B,MAAM,CAAC,MAAM,iBAAiB,GAAmB,CAAC,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"procedures.js","sourceRoot":"","sources":["../src/procedures.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAA4C,MAAM,oBAAoB,CAAC;AAC3G,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAiB,MAAM,cAAc,CAAC;AAoBxE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAClF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACrF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IACxG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IAC5H,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnF,OAAO,EAAE,CAAC;SACP,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,4HAA4H,CAAC;IACzI,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,kDAAkD,CAAC;CACjI,CAAC,CAAC;AAGH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AAC7C,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnE,KAAK,EAAE,CAAC,CAAC,KAAK,CACZ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,cAAc,EAAE,cAAc;QAC9B,cAAc,EAAE,cAAc;QAC9B,wBAAwB,EAAE,cAAc;QACxC,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,cAAc;KAC5B,CAAC,CACH;IACD,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,wBAAwB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;SACzI,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAO,GAA6B,EAAE;IAC5E,MAAM,aAAa,GAAkB,OAAO,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,eAAe,EAAE;SAC/B,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;SAC7B,KAAK,CAAC,UAAU,CAAgB,mBAAmB,CAAC,CAAC;SACrD,MAAM,CAAC,UAAU,CAAW,oBAAoB,CAAC,CAAC;SAClD,IAAI,CAAC;QACJ,WAAW,EAAE,0FAA0F;QACvG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;KAC5C,CAAC;SACD,OAAO,CAAC,KAAK,EAAE,KAAoB,EAAE,GAAsB,EAAqB,EAAE;QACjF,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7F,IAAI,QAA4C,CAAC;QACjD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACpI,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,IAAI,gBAAgB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzC,MAAM,MAAM,GAAI,KAA2B,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAClI,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,OAAO,YAAY,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC,CAAC;SACD,KAAK,EAAkB,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAmB,uBAAuB,EAAE,CAAC;AAE3E,MAAM,CAAC,MAAM,wBAAwB,GAAiB,iBAAiB,CAAC,CAAC,CAAE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package",
   "name": "@procedures/weather",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "A weather forecast for a point from Open-Meteo, without a key: each day and each hour, metric or imperial.",
   "keywords": [
     "weather",
@@ -56,7 +56,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@procedures/client": "0.28.0",
+    "@procedures/client": "0.29.0",
+    "@procedures/http": "0.29.0",
     "zod": "^4.6.5"
   },
   "devDependencies": {

package/src/module.ts

@@ -3,12 +3,21 @@
  */
 
 import { defineModule, registerModules, PROCEDURE_REGISTRY, type ProcedureModule, type ProcedureRegistry } from "@procedures/client";
-import { weatherProcedures } from "./procedures.js";
+import { createWeatherProcedures, weatherProcedures, type WeatherProceduresOptions } from "./procedures.js";
 
 export const weatherModule: ProcedureModule = defineModule("@procedures/weather", weatherProcedures);
 
 export default weatherModule;
 
+/**
+ * This function gives the module with the settings of the host: the `fetch` of the requests.
+ * Without options, it gives `weatherModule`.
+ */
+export function createWeatherModule(options: WeatherProceduresOptions = {}): ProcedureModule {
+  if (options.fetch === undefined) return weatherModule;
+  return defineModule("@procedures/weather", createWeatherProcedures(options));
+}
+
 /**
  * This function registers the procedures of @procedures/weather in a registry. The default is the
  * global registry.

package/src/procedures.ts

@@ -1,18 +1,43 @@
 /**
  * The procedure of `@procedures/weather`: `weather.forecast`.
+ *
+ * The request goes through the host policy of `@procedures/http` (audit pass 2, O55). The policy
+ * refuses a `baseUrl` on a loopback, private or link-local address, unless the host allows it.
  */
 
 import { createProcedure, zodAdapter, type AnyProcedure, type ProcedureContext } from "@procedures/client";
+import { createHostFetch, isHostNotAllowed } from "@procedures/http";
 import { z } from "zod";
 import { forecastUrl, readForecast, type Forecast } from "./weather.js";
 
+/**
+ * The part of `fetch` that `weather.forecast` uses. The default is `createHostFetch()` of
+ * `@procedures/http`: each public host, and no other host.
+ */
+export type FetchForecast = (
+  url: string,
+  init: { headers: Record<string, string>; signal: AbortSignal }
+) => Promise<{ ok: boolean; status: number; json(): Promise<unknown> }>;
+
+/** The settings of the host for the procedures of this package. The procedure input cannot change them. */
+export interface WeatherProceduresOptions {
+  /**
+   * The function that sends the request. The default is `createHostFetch()`. A host with its own
+   * Open-Meteo server on a private address gives `createHostFetch({ allow: ["10.0.0.5:8080"] })`.
+   */
+  readonly fetch?: FetchForecast | undefined;
+}
+
 const ForecastInputSchema = z.object({
   lat: z.number().min(-90).max(90).describe("The latitude of the point, in degrees"),
   lon: z.number().min(-180).max(180).describe("The longitude of the point, in degrees"),
   days: z.number().int().min(1).max(16).default(7).describe("The number of days (default: 7, at most 16)"),
   units: z.enum(["metric", "imperial"]).default("metric").describe("metric (°C, km/h) or imperial (°F, mph); default: metric"),
   hourly: z.boolean().default(false).describe("Also give each hour (default: false)"),
-  baseUrl: z.url().optional().describe("Another Open-Meteo server (default: the public server)"),
+  baseUrl: z
+    .url()
+    .optional()
+    .describe("Another Open-Meteo server (default: the public server). The host policy refuses a loopback, private or link-local address."),
   timeoutMs: z.number().int().positive().max(120_000).default(20_000).describe("The time limit, in milliseconds (default: 20000)"),
 });
 type ForecastInput = z.infer<typeof ForecastInputSchema>;
@@ -36,27 +61,39 @@ const ForecastOutputSchema = z.object({
     .optional(),
 });
 
-export const weatherForecastProcedure: AnyProcedure = createProcedure()
-  .path(["weather", "forecast"])
-  .input(zodAdapter<ForecastInput>(ForecastInputSchema))
-  .output(zodAdapter<Forecast>(ForecastOutputSchema))
-  .meta({
-    description: "Give the weather forecast of a point for each day, and optionally each hour (Open-Meteo)",
-    output: "json",
-    effects: { reads: ["network"], writes: [] },
-  })
-  .handler(async (input: ForecastInput, ctx?: ProcedureContext): Promise<Forecast> => {
-    const signals = [AbortSignal.timeout(input.timeoutMs), ...(ctx?.signal ? [ctx.signal] : [])];
-    let response: Response;
-    try {
-      response = await fetch(forecastUrl(input), { signal: AbortSignal.any(signals), headers: { accept: "application/json" } });
-    } catch (error) {
-      const reason = (error as { name?: string }).name === "TimeoutError" ? `no answer in ${input.timeoutMs} ms` : "the request failed";
-      throw new Error(`Open-Meteo did not answer: ${reason}`);
-    }
-    if (!response.ok) throw new Error(`Open-Meteo gave HTTP ${response.status}`);
-    return readForecast(await response.json(), input.hourly);
-  })
-  .build() as AnyProcedure;
-
-export const weatherProcedures: AnyProcedure[] = [weatherForecastProcedure];
+/**
+ * This function gives the procedures of this package with the settings of the host. Without
+ * options, the requests go through the default host policy of `@procedures/http`.
+ */
+export function createWeatherProcedures(options: WeatherProceduresOptions = {}): AnyProcedure[] {
+  const fetchForecast: FetchForecast = options.fetch ?? createHostFetch();
+  const forecast = createProcedure()
+    .path(["weather", "forecast"])
+    .input(zodAdapter<ForecastInput>(ForecastInputSchema))
+    .output(zodAdapter<Forecast>(ForecastOutputSchema))
+    .meta({
+      description: "Give the weather forecast of a point for each day, and optionally each hour (Open-Meteo)",
+      output: "json",
+      effects: { reads: ["network"], writes: [] },
+    })
+    .handler(async (input: ForecastInput, ctx?: ProcedureContext): Promise<Forecast> => {
+      const signals = [AbortSignal.timeout(input.timeoutMs), ...(ctx?.signal ? [ctx.signal] : [])];
+      let response: Awaited<ReturnType<FetchForecast>>;
+      try {
+        response = await fetchForecast(forecastUrl(input), { signal: AbortSignal.any(signals), headers: { accept: "application/json" } });
+      } catch (error) {
+        // A refusal of the host policy keeps its code and its reason
+        if (isHostNotAllowed(error)) throw error;
+        const reason = (error as { name?: string }).name === "TimeoutError" ? `no answer in ${input.timeoutMs} ms` : "the request failed";
+        throw new Error(`Open-Meteo did not answer: ${reason}`);
+      }
+      if (!response.ok) throw new Error(`Open-Meteo gave HTTP ${response.status}`);
+      return readForecast(await response.json(), input.hourly);
+    })
+    .build() as AnyProcedure;
+  return [forecast];
+}
+
+export const weatherProcedures: AnyProcedure[] = createWeatherProcedures();
+
+export const weatherForecastProcedure: AnyProcedure = weatherProcedures[0]!;