@sixthsummit/ship-cli 1.2.0 → 1.3.0-alpha-20261023234220

package/lib/release-manifest.json

@@ -2,18 +2,18 @@
   "schemaVersion": 1,
   "packageManager": "pnpm@10.34.6",
   "packages": {
-    "@sixthsummit/ship-core": "1.1.1",
-    "@sixthsummit/ship-hono": "1.2.0",
-    "@sixthsummit/ship-contract": "1.3.0"
+    "@sixthsummit/ship-core": "1.2.0-alpha-20261023234220",
+    "@sixthsummit/ship-hono": "1.3.0-alpha-20261023234220",
+    "@sixthsummit/ship-contract": "1.4.0-alpha-20261023234220"
   },
   "dependencies": {
     "@hono/node-server": "^1.19.14",
-    "hono": "4.13.7",
-    "zod": "^4.3.6"
+    "hono": "^4.13.13",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@biomejs/biome": "2.3.11",
-    "@sixthsummit/ship-cli": "1.2.0",
+    "@sixthsummit/ship-cli": "1.3.0-alpha-20261023234220",
     "@types/node": "^24.1.0",
     "@vitest/coverage-v8": "^4.1.8",
     "tsx": "^4.20.3",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixthsummit/ship-cli",
-  "version": "1.2.0",
+  "version": "1.3.0-alpha-20261023234220",
   "description": "Deterministic application graph and API contract tools for Ship projects",
   "type": "module",
   "main": "./lib/index.js",
@@ -39,17 +39,17 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@sixthsummit/ship-contract": "^1.3.0",
+    "@sixthsummit/ship-contract": "^1.4.0-alpha-20261023234220",
     "commander": "^12.0.0",
     "tsx": "^4.20.3"
   },
   "peerDependencies": {
-    "@sixthsummit/ship-core": "^1.1.1"
+    "@sixthsummit/ship-core": "^1.2.0-alpha-20261023234220"
   },
   "devDependencies": {
-    "@sixthsummit/ship-core": "1.1.1",
-    "@sixthsummit/ship-hono": "^1.2.0",
-    "zod": "^4.3.6"
+    "@sixthsummit/ship-core": "1.2.0-alpha-20261023234220",
+    "@sixthsummit/ship-hono": "^1.3.0-alpha-20261023234220",
+    "zod": "^4.6.7"
   },
   "engines": {
     "node": ">=22"

package/templates/operation/README.md

@@ -14,6 +14,24 @@ pnpm run dev
 `GET http://localhost:3000/health` executes `system.health` through the Hono
 adapter. The same operation runs without HTTP in `src/application.test.ts`.
 
+## Browser clients on another origin
+
+`src/http.ts` builds the adapter with a cross-origin policy from the
+`CORS_ORIGINS` environment variable, a comma-separated allowlist:
+
+```sh
+CORS_ORIGINS=https://app.example.com,https://admin.example.com pnpm run dev
+```
+
+Listed origins may send credentials (cookies, `Authorization`), preflights are
+answered for every route, and `X-Request-Id` is exposed to the browser. Leave it
+unset when no browser calls the API from another origin. `CORS_ORIGINS=*` is
+refused at boot: browsers reject a wildcard with credentials, and a server that
+emits it anyway is a CSRF bypass waiting for a lenient client. Change the policy
+(for example `exposeHeaders` for headers your operations set) in `src/http.ts`;
+the `hono` dependency is yours to pin, within the range `@sixthsummit/ship-hono`
+declares as a peer, so the app and the adapter always share one Hono copy.
+
 ## Extend
 
 Add a bounded directory under `src/modules/`. Declare operations with stable IDs,

package/templates/operation/src/http.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, it } from "vitest";
+import { corsFromEnv, createHttp } from "./http.js";
+
+const ORIGIN = "https://app.example.test";
+
+describe("{{PROJECT_NAME}} HTTP", () => {
+  it("parses the CORS_ORIGINS allowlist", () => {
+    expect(corsFromEnv(undefined)).toBeUndefined();
+    expect(corsFromEnv(" , ")).toBeUndefined();
+    expect(corsFromEnv(` ${ORIGIN}, https://admin.example.test `)).toEqual({
+      origin: [ORIGIN, "https://admin.example.test"],
+      credentials: true,
+    });
+  });
+
+  it("answers a cross-origin preflight for a listed origin", async () => {
+    const http = createHttp({ CORS_ORIGINS: ORIGIN });
+
+    const preflight = await http.request("/health", {
+      method: "OPTIONS",
+      headers: { origin: ORIGIN, "access-control-request-method": "GET" },
+    });
+    expect(preflight.status).toBe(204);
+    expect(preflight.headers.get("access-control-allow-origin")).toBe(ORIGIN);
+    expect(preflight.headers.get("access-control-allow-credentials")).toBe("true");
+
+    const response = await http.request("/health", { headers: { origin: ORIGIN } });
+    expect(response.status).toBe(200);
+    expect(response.headers.get("access-control-allow-origin")).toBe(ORIGIN);
+    expect(response.headers.get("access-control-expose-headers")).toContain("X-Request-Id");
+  });
+
+  it("emits no cross-origin headers without an allowlist", async () => {
+    const response = await createHttp({}).request("/health", { headers: { origin: ORIGIN } });
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("access-control-allow-origin")).toBeNull();
+  });
+
+  it("refuses a wildcard allowlist because credentials are enabled", () => {
+    expect(() => createHttp({ CORS_ORIGINS: "*" })).toThrow(/credentials: true/u);
+  });
+});

package/templates/operation/src/http.ts

@@ -0,0 +1,25 @@
+import { createHonoAdapter, type HonoCorsOptions } from "@sixthsummit/ship-hono";
+import { app } from "./application.js";
+
+/**
+ * Browser origins allowed to call this API, from a comma-separated
+ * `CORS_ORIGINS` allowlist (`https://app.example.com,https://admin.example.com`).
+ *
+ * Unset or empty means no cross-origin policy: a browser on another origin is
+ * refused. Credentials (cookies, `Authorization`) are allowed for the listed
+ * origins, so `*` is rejected at boot; list every origin explicitly.
+ */
+export function corsFromEnv(value: string | undefined): HonoCorsOptions | undefined {
+  const origins = (value ?? "")
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter((entry) => entry.length > 0);
+  if (origins.length === 0) return undefined;
+  return { origin: origins, credentials: true };
+}
+
+/** The HTTP projection of the application graph, with CORS from the environment. */
+export function createHttp(env: { readonly CORS_ORIGINS?: string } = process.env) {
+  const cors = corsFromEnv(env.CORS_ORIGINS);
+  return createHonoAdapter(app, cors ? { cors } : {});
+}

package/templates/operation/src/server.ts

@@ -1,13 +1,13 @@
 import { serve } from "@hono/node-server";
-import { createHonoAdapter } from "@sixthsummit/ship-hono";
-import { app } from "./application.js";
+import { createHttp } from "./http.js";
 
 const port = Number.parseInt(process.env.PORT ?? "3000", 10);
 if (!Number.isSafeInteger(port) || port < 1 || port > 65_535) {
   throw new Error("PORT must be an integer between 1 and 65535");
 }
 
-const http = createHonoAdapter(app);
+// CORS comes from the CORS_ORIGINS allowlist; see src/http.ts.
+const http = createHttp();
 serve({ fetch: http.fetch, port }, ({ port: listeningPort }) => {
   process.stdout.write(`{{PACKAGE_NAME}} listening on ${listeningPort}\n`);
 });