@rsc-kit/core 0.30.37 → 0.30.39

package/dist/flash.d.ts

@@ -0,0 +1,18 @@
+import { type FlashKind } from "./flashCookie.js";
+export type { FlashKind, FlashMessage } from "./flashCookie.js";
+/**
+ * A message for the next page the visitor sees: "Saved." after a save that
+ * redirects to the list. Call it in a server action, middleware or a
+ * route.ts - anywhere a cookie can still be set - and show it with
+ * useFlash() from @rsc-kit/core/useFlash.
+ *
+ * A cookie the browser takes, not one the server reads. A page that read it
+ * would be a page that can never be stored or cached at the edge, and a
+ * render cannot clear it anyway: its headers leave before it starts. So the
+ * page is the same for everyone, and the browser picks the message up after
+ * the navigation and clears it, once.
+ *
+ * Two calls in one request are two messages. Unread, it lapses after a
+ * minute, so a message never turns up on some later, unrelated page.
+ */
+export declare function flash(message: string, kind?: FlashKind): Promise<void>;

package/dist/flash.js

@@ -0,0 +1,29 @@
+import { cookies } from "./request.js";
+import { FLASH_COOKIE, readFlash } from "./flashCookie.js";
+/**
+ * A message for the next page the visitor sees: "Saved." after a save that
+ * redirects to the list. Call it in a server action, middleware or a
+ * route.ts - anywhere a cookie can still be set - and show it with
+ * useFlash() from @rsc-kit/core/useFlash.
+ *
+ * A cookie the browser takes, not one the server reads. A page that read it
+ * would be a page that can never be stored or cached at the edge, and a
+ * render cannot clear it anyway: its headers leave before it starts. So the
+ * page is the same for everyone, and the browser picks the message up after
+ * the navigation and clears it, once.
+ *
+ * Two calls in one request are two messages. Unread, it lapses after a
+ * minute, so a message never turns up on some later, unrelated page.
+ */
+export async function flash(message, kind = "success") {
+    const jar = await cookies();
+    const queued = readFlash(jar.get(FLASH_COOKIE)?.value);
+    // Readable by script on purpose (no HttpOnly): the browser is what takes it.
+    // It holds a message the app chose, never data.
+    jar.set(FLASH_COOKIE, JSON.stringify([...queued, { message, kind }]), {
+        path: "/",
+        maxAge: 60,
+        sameSite: "lax",
+    });
+}
+//# sourceMappingURL=flash.js.map

package/dist/flash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flash.js","sourceRoot":"","sources":["../src/flash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAkB,MAAM,kBAAkB,CAAC;AAI3E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAe,EAAE,IAAI,GAAc,SAAS;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IAEvD,6EAA6E;IAC7E,gDAAgD;IAChD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACpE,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { cookies } from \"./request.js\";\nimport { FLASH_COOKIE, readFlash, type FlashKind } from \"./flashCookie.js\";\n\nexport type { FlashKind, FlashMessage } from \"./flashCookie.js\";\n\n/**\n * A message for the next page the visitor sees: \"Saved.\" after a save that\n * redirects to the list. Call it in a server action, middleware or a\n * route.ts - anywhere a cookie can still be set - and show it with\n * useFlash() from @rsc-kit/core/useFlash.\n *\n * A cookie the browser takes, not one the server reads. A page that read it\n * would be a page that can never be stored or cached at the edge, and a\n * render cannot clear it anyway: its headers leave before it starts. So the\n * page is the same for everyone, and the browser picks the message up after\n * the navigation and clears it, once.\n *\n * Two calls in one request are two messages. Unread, it lapses after a\n * minute, so a message never turns up on some later, unrelated page.\n */\nexport async function flash(message: string, kind: FlashKind = \"success\"): Promise<void> {\n  const jar = await cookies();\n  const queued = readFlash(jar.get(FLASH_COOKIE)?.value);\n\n  // Readable by script on purpose (no HttpOnly): the browser is what takes it.\n  // It holds a message the app chose, never data.\n  jar.set(FLASH_COOKIE, JSON.stringify([...queued, { message, kind }]), {\n    path: \"/\",\n    maxAge: 60,\n    sameSite: \"lax\",\n  });\n}\n"]}

package/dist/flashCookie.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The one-time message's cookie, shared by the server that writes it and the
+ * browser that takes it. No imports: the hook that reads it is in the
+ * browser bundle, and request.ts must never be.
+ */
+export declare const FLASH_COOKIE = "rsc-flash";
+export type FlashKind = "success" | "error" | "info" | "warning";
+export interface FlashMessage {
+    message: string;
+    kind: FlashKind;
+}
+/**
+ * What a cookie value holds, keeping only well-formed messages. The value
+ * crossed the network and could have been written by anything that shares
+ * the domain, so nothing here trusts it beyond being text.
+ */
+export declare function readFlash(value: string | undefined | null): FlashMessage[];

package/dist/flashCookie.js

@@ -0,0 +1,36 @@
+/**
+ * The one-time message's cookie, shared by the server that writes it and the
+ * browser that takes it. No imports: the hook that reads it is in the
+ * browser bundle, and request.ts must never be.
+ */
+export const FLASH_COOKIE = "rsc-flash";
+const KINDS = new Set(["success", "error", "info", "warning"]);
+/**
+ * What a cookie value holds, keeping only well-formed messages. The value
+ * crossed the network and could have been written by anything that shares
+ * the domain, so nothing here trusts it beyond being text.
+ */
+export function readFlash(value) {
+    if (!value)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(parsed))
+        return [];
+    return parsed.flatMap((entry) => {
+        if (typeof entry !== "object" || entry === null)
+            return [];
+        const { message, kind } = entry;
+        if (typeof message !== "string" || message === "")
+            return [];
+        return [
+            { message, kind: typeof kind === "string" && KINDS.has(kind) ? kind : "info" },
+        ];
+    });
+}
+//# sourceMappingURL=flashCookie.js.map

package/dist/flashCookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flashCookie.js","sourceRoot":"","sources":["../src/flashCookie.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AASxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAgC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAkB,EAAE;QAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAE3D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAgC,CAAC;QAE3D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAE7D,OAAO;YACL,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAkB,CAAC,CAAC,CAAC,MAAM,EAAE;SAC9F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * The one-time message's cookie, shared by the server that writes it and the\n * browser that takes it. No imports: the hook that reads it is in the\n * browser bundle, and request.ts must never be.\n */\nexport const FLASH_COOKIE = \"rsc-flash\";\n\nexport type FlashKind = \"success\" | \"error\" | \"info\" | \"warning\";\n\nexport interface FlashMessage {\n  message: string;\n  kind: FlashKind;\n}\n\nconst KINDS = new Set<string>([\"success\", \"error\", \"info\", \"warning\"]);\n\n/**\n * What a cookie value holds, keeping only well-formed messages. The value\n * crossed the network and could have been written by anything that shares\n * the domain, so nothing here trusts it beyond being text.\n */\nexport function readFlash(value: string | undefined | null): FlashMessage[] {\n  if (!value) return [];\n\n  let parsed: unknown;\n\n  try {\n    parsed = JSON.parse(value);\n  } catch {\n    return [];\n  }\n\n  if (!Array.isArray(parsed)) return [];\n\n  return parsed.flatMap((entry): FlashMessage[] => {\n    if (typeof entry !== \"object\" || entry === null) return [];\n\n    const { message, kind } = entry as Record<string, unknown>;\n\n    if (typeof message !== \"string\" || message === \"\") return [];\n\n    return [\n      { message, kind: typeof kind === \"string\" && KINDS.has(kind) ? (kind as FlashKind) : \"info\" },\n    ];\n  });\n}\n"]}

package/dist/host.js

@@ -128,6 +128,19 @@ function isNavigation(request) {
         return mode === "navigate";
     return (request.headers.get("accept") ?? "").includes("text/html");
 }
+/**
+ * A redirect out of a form a browser posted to a page, as See Other.
+ *
+ * Whatever status redirect() was given. A 307 or 308 tells the browser to
+ * repeat the request - the same POST, the same body - at the destination, and
+ * that body still names the action, which runs at any page's url. So a
+ * save that redirected to its list ran again there, redirected again, and
+ * looped until the browser gave up, writing a record on every pass. 303 is
+ * the answer a form post is meant to get: go there, with a GET.
+ */
+function afterFormPost(to) {
+    return { ...to, status: 303 };
+}
 function redirectResponse(to, isPayloadRequest) {
     if (isPayloadRequest) {
         return new Response(null, {
@@ -955,7 +968,7 @@ export function createRscHandler(options) {
                     // destination sitting in a scope nobody read.
                     const refused = taken();
                     if (refused)
-                        return redirectResponse(refused, false);
+                        return redirectResponse(formPost ? afterFormPost(refused) : refused, false);
                     // The page said this url names nothing. Null rather than a rendered
                     // 404: null is already how this host says "not mine", and the caller
                     // in front answers it with not-found.tsx and the right status. One
@@ -977,7 +990,7 @@ export function createRscHandler(options) {
                 const early = taken();
                 if (early) {
                     letGo();
-                    return redirectResponse(early, false);
+                    return redirectResponse(formPost ? afterFormPost(early) : early, false);
                 }
                 // Above every boundary, so the shell resolving means the page did not
                 // refuse itself. Deeper than that and the shell is already on the wire