@swimmesberger/elarion-jsonrpc-client-generator 0.2.11 → 0.2.12

package/README.md

@@ -125,14 +125,22 @@ The core client stays framework-neutral, but you can opt into a framework adapte
 npx elarion-jsonrpc-client-generator --schema rpc-schema.json --out src/generated --framework tanstack-start
 ```
 
-It exports `createStartRpcApi` — a `createRpcApi` with request-scoped cookie forwarding pre-wired for SSR — and
-`forwardRequestCookie`, the isomorphic headers function on its own. The core client never imports the adapter, so
-consumers that don't opt in stay framework-neutral and their output is byte-identical.
+It exports `createStartRpcApi` — a `createRpcApi` with request-scoped header forwarding pre-wired for SSR (the
+`cookie` by default) — plus the isomorphic headers functions on their own: `forwardRequestHeaders(names)` and
+`forwardRequestCookie`. The core client never imports the adapter, so consumers that don't opt in stay
+framework-neutral and their output is byte-identical.
 
 ```ts
 import { createStartRpcApi } from './generated/start-adapter'
 
 export const rpc = createStartRpcApi({ url: '/rpc' })
+
+// Behind an authenticating reverse proxy, forward its identity header too. The list replaces the default,
+// so keep 'cookie' in it when the session cookie should still travel.
+export const proxiedRpc = createStartRpcApi({
+  url: '/rpc',
+  forwardHeaders: ['cookie', 'cf-access-jwt-assertion'], // e.g. Cloudflare Access
+})
 ```
 
 ## Client-side tracing

package/dist/start-adapter-source.d.ts

@@ -6,7 +6,9 @@ export interface GenerateStartAdapterSourceOptions {
 }
 /**
  * Emits the opt-in TanStack Start adapter (`start-adapter.ts`), produced only with `--framework tanstack-start`.
- * It imports the framework-specific pieces (`@tanstack/react-start`) so the core generated client never does —
- * a non-Start consumer neither installs nor imports this file, keeping the client's framework-neutral boundary.
+ * It forwards incoming request headers (the `cookie` by default, or the configured `forwardHeaders`) to API calls
+ * made during SSR. It imports the framework-specific pieces (`@tanstack/react-start`) so the core generated client
+ * never does — a non-Start consumer neither installs nor imports this file, keeping the client's framework-neutral
+ * boundary.
  */
 export declare function generateStartAdapterSource(options: GenerateStartAdapterSourceOptions): string;

package/dist/start-adapter-source.js

@@ -1,8 +1,10 @@
 import { moduleSpecifier } from './rpc-client-source.js';
 /**
  * Emits the opt-in TanStack Start adapter (`start-adapter.ts`), produced only with `--framework tanstack-start`.
- * It imports the framework-specific pieces (`@tanstack/react-start`) so the core generated client never does —
- * a non-Start consumer neither installs nor imports this file, keeping the client's framework-neutral boundary.
+ * It forwards incoming request headers (the `cookie` by default, or the configured `forwardHeaders`) to API calls
+ * made during SSR. It imports the framework-specific pieces (`@tanstack/react-start`) so the core generated client
+ * never does — a non-Start consumer neither installs nor imports this file, keeping the client's framework-neutral
+ * boundary.
  */
 export function generateStartAdapterSource(options) {
     const clientImport = moduleSpecifier(options.clientFileName);
@@ -17,29 +19,49 @@ export function generateStartAdapterSource(options) {
         "import { getRequestHeader } from '@tanstack/react-start/server'",
         `import { createRpcApi, type RpcApi, type RpcClientOptions, type RpcHeadersInit } from '${clientImport}'`,
         '',
-        "// Forwards the incoming request's `cookie` during SSR so the RPC call runs as the signed-in user, and",
-        '// returns nothing in the browser. The read is isolated inside `createIsomorphicFn().server(...)` so the',
-        '// TanStack Start compiler strips both the read and the `@tanstack/react-start/server` import from the',
-        '// client bundle — a plain import (even one behind a `typeof window` guard) would fail `vite build` with',
-        '// `[import-protection] Import denied`.',
-        'export const forwardRequestCookie = createIsomorphicFn()',
-        '  .server((): RpcHeadersInit => {',
-        "    const cookie = getRequestHeader('cookie')",
-        '    return cookie ? { cookie } : {}',
+        "// Forwards the named headers of the incoming request during SSR (names are matched case-insensitively and",
+        "// emitted lower-case; a header the request does not carry is skipped), and returns nothing in the browser.",
+        "// The read is isolated inside `createIsomorphicFn().server(...)` so the TanStack Start compiler strips both",
+        "// the read and the `@tanstack/react-start/server` import from the client bundle — a plain import (even one",
+        "// behind a `typeof window` guard) would fail `vite build` with `[import-protection] Import denied`.",
+        'export const forwardRequestHeaders = createIsomorphicFn()',
+        '  .server((names: readonly string[]): RpcHeadersInit => {',
+        '    const forwarded: Record<string, string> = {}',
+        '    for (const name of names) {',
+        '      const value = getRequestHeader(name)',
+        '      if (value) {',
+        '        forwarded[name.toLowerCase()] = value',
+        '      }',
+        '    }',
+        '    return forwarded',
         '  })',
-        '  .client((): RpcHeadersInit => ({}))',
+        '  .client((_names: readonly string[]): RpcHeadersInit => ({}))',
+        '',
+        "// Forwards the incoming request's `cookie` during SSR so the RPC call runs as the signed-in user.",
+        "export const forwardRequestCookie = (): RpcHeadersInit => forwardRequestHeaders(['cookie'])",
+        '',
+        '/** Options for {@link createStartRpcApi}: the core client options plus the request headers forwarded during SSR. */',
+        'export interface StartRpcClientOptions extends RpcClientOptions {',
+        '  /**',
+        "   * Incoming request headers to forward on every call made during SSR (default `['cookie']`). The list",
+        "   * replaces the default, so include `'cookie'` when you still want the session cookie forwarded; an empty",
+        '   * list forwards nothing. Forward identity or correlation headers only — never hop-by-hop or',
+        '   * framing headers such as `host`, `connection`, or `content-length`.',
+        '   */',
+        '  readonly forwardHeaders?: readonly string[]',
+        '}',
         '',
-        '// Turnkey `createRpcApi` for a TanStack Start app: request-scoped cookie forwarding is pre-wired, and any',
-        '// `headers` you pass are layered on top (yours win on a conflict). Everything else in RpcClientOptions',
-        '// (url, fetch, idempotency, instrumentation, …) passes through unchanged.',
-        'export function createStartRpcApi(options: RpcClientOptions): RpcApi {',
-        '  const provided = options.headers',
+        '// Turnkey `createRpcApi` for a TanStack Start app: request-scoped header forwarding (the `cookie` by',
+        '// default) is pre-wired, and any `headers` you pass are layered on top (yours win on a conflict).',
+        '// Everything else in RpcClientOptions (url, fetch, idempotency, instrumentation, …) passes through unchanged.',
+        'export function createStartRpcApi(options: StartRpcClientOptions): RpcApi {',
+        "  const { forwardHeaders = ['cookie'], headers: provided, ...rest } = options",
         '  return createRpcApi({',
-        '    ...options,',
+        '    ...rest,',
         '    headers: async (context) => {',
-        '      const cookie = await forwardRequestCookie()',
+        '      const forwarded = await forwardRequestHeaders(forwardHeaders)',
         "      const extra = typeof provided === 'function' ? await provided(context) : provided",
-        '      return { ...toHeaderRecord(cookie), ...toHeaderRecord(extra) }',
+        '      return { ...toHeaderRecord(forwarded), ...toHeaderRecord(extra) }',
         '    },',
         '  })',
         '}',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swimmesberger/elarion-jsonrpc-client-generator",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "Generate TypeScript RPC contracts, Zod schemas, and a fetch client from Elarion JSON-RPC schema exports.",
   "license": "Apache-2.0",
   "type": "module",