@torpor/build 1.2.0 → 1.3.0

package/dist/MiddlewareFunction-BZilnEei.d.mts

@@ -0,0 +1,50 @@
+import { i as CookieHelper, n as HeaderHelper, r as FlashHelper, t as SessionHelper } from "./SessionHelper-MaodMaLU.mjs";
+//#region src/server/ServerEvent.d.ts
+declare class ServerEvent {
+  #private;
+  request: Request;
+  response: Response | undefined | void;
+  /**
+   * Set when the route handler (or a middleware enter hook) threw an
+   * error. Exit hooks can return a Response to handle it; if none does,
+   * the error is rethrown to the caller.
+   */
+  error: unknown;
+  params?: Record<string, string>;
+  adapter: any;
+  cookies: CookieHelper;
+  headers: HeaderHelper;
+  session: SessionHelper;
+  flash: FlashHelper;
+  /** The request URL, parsed lazily. */
+  get url(): URL;
+  constructor(request: Request, params?: Record<string, string>, url?: URL);
+  addHeaders(): void;
+  /**
+   * Reads the request body as JSON.
+   */
+  json(): Promise<unknown>;
+}
+//#endregion
+//#region src/server/types/MiddlewareFunction.d.ts
+type MiddlewareFunction = {
+  /**
+   * Called before the route handler. Middleware are run in the order they
+   * were added. Return a Response to short-circuit the request; the
+   * remaining middleware and the route handler are then skipped.
+   */
+  enter?: (ev: ServerEvent) => Response | void | Promise<Response | void>;
+  /**
+   * Called after the route handler (even if it threw), in reverse order.
+   * Return a Response to replace the response. Middleware that were skipped
+   * by a short-circuit don't get their exit hook run.
+   *
+   * If the route handler (or a later enter hook) threw, the error is
+   * available as `ev.error`; returning a Response handles the error and
+   * stops it from propagating.
+   */
+  exit?: (ev: ServerEvent) => Response | void | Promise<Response | void>;
+};
+//#endregion
+export { ServerEvent as n, MiddlewareFunction as t };
+//# sourceMappingURL=MiddlewareFunction-BZilnEei.d.mts.map

package/dist/MiddlewareFunction-BZilnEei.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MiddlewareFunction-BZilnEei.d.mts","names":[],"sources":["../src/server/ServerEvent.ts","../src/server/types/MiddlewareFunction.ts"],"mappings":";;cAMqB;;EACpB,SAAS;EACT,UAAU;;;;;;EAMV;EAEA,SAAS;EAET;EAEA,SAAS;EACT,SAAS;EACT,SAAS;EACT,OAAO;;MAOH,OAAO;EAIX,YAAY,SAAS,SAAS,SAAS,wBAAwB,MAAM;EAcrE;;;;EA8BA,QAAQ;;;;KC5EJ;;;;;;EAMJ,SAAS,IAAI,gBAAgB,kBAAkB,QAAQ;;;;;;;;;;EAUvD,QAAQ,IAAI,gBAAgB,kBAAkB,QAAQ"}

package/dist/{Router-COdQuVUi.d.mts → Router-dAu_5PlG.d.mts}

@@ -1,4 +1,4 @@
-import { t as ServerHook } from "./ServerHook-BlLArueW.mjs";
+import { t as ServerHook } from "./ServerHook-BTSGfLiJ.mjs";
 //#region src/types/ManifestRoute.d.ts
 interface ManifestRoute {
   path: string;
@@ -56,4 +56,4 @@ interface RouteMatch {
 }
 //#endregion
 export { Router as t };
-//# sourceMappingURL=Router-COdQuVUi.d.mts.map
+//# sourceMappingURL=Router-dAu_5PlG.d.mts.map

package/dist/{Router-COdQuVUi.d.mts.map → Router-dAu_5PlG.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"Router-COdQuVUi.d.mts","names":[],"sources":["../src/types/ManifestRoute.ts","../src/types/RouteLayoutHandler.ts","../src/types/RouteHandler.ts","../src/site/Router.ts"],"mappings":";;UAAyB;EACxB;EACA;EACA,gBAAgB;EAChB;;;;UCJwB;EACxB;EACA,gBAAgB;EAChB,uBAAuB;;;;;;;UCGC;EACxB;EACA;EACA,gBAAgB;EAChB;EAEA;EACA,UAAU;EACV,uBAAuB;EACvB,qBAAqB;EAIrB,gBAAgB;EAChB;EACA,gBAAgB,QAAQ;;;;;;;cCbJ;;EACpB,QAAQ;EAMR;EAOA,SAAS,QAAQ;EAQjB,QAAQ,cAAc,cAAc,gBAAgB,cAAc;EAuBlE,MAAM,cAAc,OAAO,kBAAkB;;cA2GxC;EACL;EACA,SAAS;EAET,YAAY,cAAc,SAAS;;UAM1B;EACT,SAAS;EACT,SAAS;EACT,OAAO"}
+{"version":3,"file":"Router-dAu_5PlG.d.mts","names":[],"sources":["../src/types/ManifestRoute.ts","../src/types/RouteLayoutHandler.ts","../src/types/RouteHandler.ts","../src/site/Router.ts"],"mappings":";;UAAyB;EACxB;EACA;EACA,gBAAgB;EAChB;;;;UCJwB;EACxB;EACA,gBAAgB;EAChB,uBAAuB;;;;;;;UCGC;EACxB;EACA;EACA,gBAAgB;EAChB;EAEA;EACA,UAAU;EACV,uBAAuB;EACvB,qBAAqB;EAIrB,gBAAgB;EAChB;EACA,gBAAgB,QAAQ;;;;;;;cCbJ;;EACpB,QAAQ;EAMR;EAOA,SAAS,QAAQ;EAQjB,QAAQ,cAAc,cAAc,gBAAgB,cAAc;EAuBlE,MAAM,cAAc,OAAO,kBAAkB;;cA2GxC;EACL;EACA,SAAS;EAET,YAAY,cAAc,SAAS;;UAM1B;EACT,SAAS;EACT,SAAS;EACT,OAAO"}

package/dist/{Server-Dr6yqVa5.mjs → Server-CSti9cvM.mjs}

@@ -1,5 +1,5 @@
 import { t as PathTrie } from "./pathTrie-D4Ax2Mu9.mjs";
-import { t as ServerEvent } from "./ServerEvent-gmOvC_Yf.mjs";
+import { t as ServerEvent } from "./ServerEvent-Bh9cEpro.mjs";
 //#region src/server/Server.ts
 /**
 * A Fetch API Request/Response server.
@@ -101,4 +101,4 @@ var RouteHandler = class {
 //#endregion
 export { Server as t };
 
-//# sourceMappingURL=Server-Dr6yqVa5.mjs.map
+//# sourceMappingURL=Server-CSti9cvM.mjs.map

package/dist/Server-CSti9cvM.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Server-CSti9cvM.mjs","names":["#trie","#sortRoutes"],"sources":["../src/server/Server.ts"],"sourcesContent":["import PathTrie from \"../utils/pathTrie\";\nimport ServerEvent from \"./ServerEvent\";\nimport type MiddlewareFunction from \"./types/MiddlewareFunction\";\nimport type ServerFunction from \"./types/ServerFunction\";\n\n/**\n * A Fetch API Request/Response server.\n */\nexport default class Server {\n\t// TODO: We don't use any of the routes, just add(\"*\") in runDev/runBuild...\n\troutes: RouteHandler[] = [];\n\t// Match index for the routes above\n\t#trie = new PathTrie<RouteHandler>();\n\t// TODO: We only use the Vite middleware here\n\tmiddleware: MiddlewareFunction[] = [];\n\n\tconstructor() {\n\t\tthis.routes = [];\n\t\tthis.middleware = [];\n\t}\n\n\t/**\n\t * The standard Fetch API method that should work in any runtime (including\n\t * Node with polyfills).\n\t * @returns\n\t */\n\tfetch = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {\n\t\t// Use the request as-is when we were given one, so that the adapter\n\t\t// doesn't pay for constructing it twice\n\t\tconst request = input instanceof Request && !init ? input : new Request(input, init);\n\t\tconst url = new URL(request.url);\n\t\tconst match = this.match(url.pathname);\n\t\tlet ev = new ServerEvent(request, match?.params, url);\n\n\t\tif (this.middleware.length) {\n\t\t\t// Route-scoped middleware is set on server endpoints (or globally on\n\t\t\t// `site.middleware`); this list is the low-level, per-Server primitive\n\t\t\tlet entered = 0;\n\t\t\tlet response: Response | undefined = undefined;\n\t\t\tlet error: unknown = undefined;\n\t\t\ttry {\n\t\t\t\tfor (; entered < this.middleware.length && !response; entered++) {\n\t\t\t\t\t// A middleware returns a Response to short-circuit the request\n\t\t\t\t\tconst result = await this.middleware[entered].enter?.(ev);\n\t\t\t\t\tif (result) {\n\t\t\t\t\t\tresponse = result;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (!response && match) {\n\t\t\t\t\tconst result = await match.fn(ev);\n\t\t\t\t\tif (result) {\n\t\t\t\t\t\tresponse = result;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (e) {\n\t\t\t\t// Exits can handle the error by returning a Response; if none\n\t\t\t\t// does, it is rethrown below\n\t\t\t\terror = e;\n\t\t\t\tev.error = e;\n\t\t\t} finally {\n\t\t\t\tif (response) {\n\t\t\t\t\tev.response = response;\n\t\t\t\t}\n\t\t\t\t// Run exit hooks in reverse order for the middleware that were\n\t\t\t\t// entered. An exit hook can return a Response to replace the\n\t\t\t\t// response, or to handle ev.error\n\t\t\t\twhile (entered > 0) {\n\t\t\t\t\tentered--;\n\t\t\t\t\tconst result = await this.middleware[entered].exit?.(ev);\n\t\t\t\t\tif (result) {\n\t\t\t\t\t\tresponse = result;\n\t\t\t\t\t\tev.response = result;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (error && !response) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t} else if (match) {\n\t\t\tev.response = await match.fn(ev);\n\t\t} else {\n\t\t\treturn new Response(null, { status: 404 });\n\t\t}\n\n\t\t// TODO: Should I be returning 200 if there's no response? Because it's not an error??\n\t\tev.response ??= new Response(null, { status: 200 });\n\t\tev.addHeaders();\n\n\t\treturn ev.response;\n\t};\n\n\t/**\n\t * Adds a server function at a route path.\n\t * @param path The route path pattern.\n\t * @param fn The function to call when the pattern is matched.\n\t * @returns\n\t */\n\tadd(path: string, fn: ServerFunction): Server {\n\t\tlet handler = new RouteHandler(path, fn);\n\t\tthis.routes.push(handler);\n\t\tthis.#trie.insert(path, handler);\n\t\tthis.#sortRoutes();\n\t\treturn this;\n\t}\n\n\tmatch(path: string): Match | undefined {\n\t\tconst found = this.#trie.match(path);\n\t\tif (found) {\n\t\t\treturn {\n\t\t\t\tfn: found.value.fn,\n\t\t\t\tparams: found.params,\n\t\t\t};\n\t\t}\n\t\tconsole.log(`Server path not found: ${path}`);\n\t}\n\n\t// TODO:\n\t//use(path: string, ...fn: MiddlewareFunction[])\n\tuse(...fn: MiddlewareFunction[]): Server {\n\t\tthis.middleware = this.middleware.concat(fn);\n\t\treturn this;\n\t}\n\n\t#sortRoutes() {\n\t\tthis.routes = this.routes.sort((a, b) => {\n\t\t\t// Sort [param]s after paths\n\t\t\t// There might be a quicker/easier way to do this\n\t\t\tfor (let i = 0; i < Math.min(a.path.length, b.path.length); i++) {\n\t\t\t\tif (a.path[i] === \"[\" && b.path[i] !== \"[\") {\n\t\t\t\t\treturn 1;\n\t\t\t\t} else if (b.path[i] === \"[\" && a.path[i] !== \"[\") {\n\t\t\t\t\treturn -1;\n\t\t\t\t} else if (a.path[i] === b.path[i]) {\n\t\t\t\t\t// Keep going...\n\t\t\t\t} else {\n\t\t\t\t\treturn a.path[i].localeCompare(b.path[i]);\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn a.path.length - b.path.length;\n\t\t});\n\t}\n}\n\nclass RouteHandler {\n\tpath: string;\n\tfn: ServerFunction;\n\n\tconstructor(path: string, fn: ServerFunction) {\n\t\tthis.path = path;\n\t\tthis.fn = fn;\n\t}\n}\n\n//class MiddlewareHandler {\n//\tpath: string;\n//\tregex: RegExp;\n//\tfn: MiddlewareFunction;\n//\n//\tconstructor(path: string, fn: MiddlewareFunction) {\n//\t\tthis.path = path;\n//\t\tthis.regex = pathToRegex(path);\n//\t\tthis.fn = fn;\n//\t}\n//}\n\ninterface Match {\n\tfn: ServerFunction;\n\tparams?: Record<string, string>;\n}\n"],"mappings":";;;;;;AAQA,IAAqB,SAArB,MAA4B;CAE3B,SAAyB,CAAC;CAE1B,QAAQ,IAAI,SAAuB;CAEnC,aAAmC,CAAC;CAEpC,cAAc;EACb,KAAK,SAAS,CAAC;EACf,KAAK,aAAa,CAAC;CACpB;;;;;;CAOA,QAAQ,OAAO,OAA0B,SAA0C;EAGlF,MAAM,UAAU,iBAAiB,WAAW,CAAC,OAAO,QAAQ,IAAI,QAAQ,OAAO,IAAI;EACnF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,QAAQ,KAAK,MAAM,IAAI,QAAQ;EACrC,IAAI,KAAK,IAAI,YAAY,SAAS,OAAO,QAAQ,GAAG;EAEpD,IAAI,KAAK,WAAW,QAAQ;GAG3B,IAAI,UAAU;GACd,IAAI,WAAiC,KAAA;GACrC,IAAI,QAAiB,KAAA;GACrB,IAAI;IACH,OAAO,UAAU,KAAK,WAAW,UAAU,CAAC,UAAU,WAAW;KAEhE,MAAM,SAAS,MAAM,KAAK,WAAW,QAAQ,CAAC,QAAQ,EAAE;KACxD,IAAI,QACH,WAAW;IAEb;IACA,IAAI,CAAC,YAAY,OAAO;KACvB,MAAM,SAAS,MAAM,MAAM,GAAG,EAAE;KAChC,IAAI,QACH,WAAW;IAEb;GACD,SAAS,GAAG;IAGX,QAAQ;IACR,GAAG,QAAQ;GACZ,UAAU;IACT,IAAI,UACH,GAAG,WAAW;IAKf,OAAO,UAAU,GAAG;KACnB;KACA,MAAM,SAAS,MAAM,KAAK,WAAW,QAAQ,CAAC,OAAO,EAAE;KACvD,IAAI,QAAQ;MACX,WAAW;MACX,GAAG,WAAW;KACf;IACD;GACD;GACA,IAAI,SAAS,CAAC,UACb,MAAM;EAER,OAAO,IAAI,OACV,GAAG,WAAW,MAAM,MAAM,GAAG,EAAE;OAE/B,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;EAI1C,GAAG,aAAa,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;EAClD,GAAG,WAAW;EAEd,OAAO,GAAG;CACX;;;;;;;CAQA,IAAI,MAAc,IAA4B;EAC7C,IAAI,UAAU,IAAI,aAAa,MAAM,EAAE;EACvC,KAAK,OAAO,KAAK,OAAO;EACxB,KAAKA,MAAM,OAAO,MAAM,OAAO;EAC/B,KAAKC,YAAY;EACjB,OAAO;CACR;CAEA,MAAM,MAAiC;EACtC,MAAM,QAAQ,KAAKD,MAAM,MAAM,IAAI;EACnC,IAAI,OACH,OAAO;GACN,IAAI,MAAM,MAAM;GAChB,QAAQ,MAAM;EACf;EAED,QAAQ,IAAI,0BAA0B,MAAM;CAC7C;CAIA,IAAI,GAAG,IAAkC;EACxC,KAAK,aAAa,KAAK,WAAW,OAAO,EAAE;EAC3C,OAAO;CACR;CAEA,cAAc;EACb,KAAK,SAAS,KAAK,OAAO,MAAM,GAAG,MAAM;GAGxC,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,KAAK,MAAM,GAAG,KAC3D,IAAI,EAAE,KAAK,OAAO,OAAO,EAAE,KAAK,OAAO,KACtC,OAAO;QACD,IAAI,EAAE,KAAK,OAAO,OAAO,EAAE,KAAK,OAAO,KAC7C,OAAO;QACD,IAAI,EAAE,KAAK,OAAO,EAAE,KAAK,IAAI,CAEpC,OACC,OAAO,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE;GAG1C,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK;EAC/B,CAAC;CACF;AACD;AAEA,IAAM,eAAN,MAAmB;CAClB;CACA;CAEA,YAAY,MAAc,IAAoB;EAC7C,KAAK,OAAO;EACZ,KAAK,KAAK;CACX;AACD"}

package/dist/{Server-Cler2w5O.d.mts → Server-qn5Ws_d0.d.mts}

@@ -1,24 +1,4 @@
-import { t as ServerEvent } from "./ServerEvent-CTx3Q-hk.mjs";
-//#region src/server/types/MiddlewareFunction.d.ts
-type MiddlewareFunction = {
-  /**
-   * Called before the route handler. Middleware are run in the order they
-   * were added. Return a Response to short-circuit the request; the
-   * remaining middleware and the route handler are then skipped.
-   */
-  enter?: (ev: ServerEvent) => Response | void | Promise<Response | void>;
-  /**
-   * Called after the route handler (even if it threw), in reverse order.
-   * Return a Response to replace the response. Middleware that were skipped
-   * by a short-circuit don't get their exit hook run.
-   *
-   * If the route handler (or a later enter hook) threw, the error is
-   * available as `ev.error`; returning a Response handles the error and
-   * stops it from propagating.
-   */
-  exit?: (ev: ServerEvent) => Response | void | Promise<Response | void>;
-};
-//#endregion
+import { n as ServerEvent, t as MiddlewareFunction } from "./MiddlewareFunction-BZilnEei.mjs";
 //#region src/server/types/ServerFunction.d.ts
 type ServerFunction = (e: ServerEvent) => Response | undefined | void | Promise<Response | undefined | void>;
 //#endregion
@@ -57,5 +37,5 @@ interface Match {
   params?: Record<string, string>;
 }
 //#endregion
-export { MiddlewareFunction as n, Server as t };
-//# sourceMappingURL=Server-Cler2w5O.d.mts.map
+export { Server as t };
+//# sourceMappingURL=Server-qn5Ws_d0.d.mts.map

package/dist/Server-qn5Ws_d0.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Server-qn5Ws_d0.d.mts","names":[],"sources":["../src/server/types/ServerFunction.ts","../src/server/Server.ts"],"mappings":";;KAEK,kBACJ,GAAG,gBACC,8BAA8B,QAAQ;;;;;;cCItB;;EAEpB,QAAQ;EAIR,YAAY;EAEZ;;;;;;EAUA,QAAe,OAAO,cAAc,KAAK,OAAO,gBAAc,QAAQ;;;;;;;EAuEtE,IAAI,cAAc,IAAI,iBAAiB;EAQvC,MAAM,eAAe;EAarB,OAAO,IAAI,uBAAuB;;cAyB7B;EACL;EACA,IAAI;EAEJ,YAAY,cAAc,IAAI;;UAkBrB;EACT,IAAI;EACJ,SAAS"}

package/dist/ServerEvent-Bh9cEpro.mjs

@@ -0,0 +1,335 @@
+import { t as env } from "./env-C2SUAwAq.mjs";
+import { n as getBasePath, t as addBaseToPath } from "./basePath-DQnbHc7o.mjs";
+import { parseCookie, stringifySetCookie } from "cookie";
+//#region src/server/CookieHelper.ts
+var CookieHelper = class {
+	request;
+	cookies = /* @__PURE__ */ new Map();
+	constructor(request) {
+		this.request = request;
+	}
+	get(name) {
+		if (this.cookies.has(name)) return parseCookie(this.cookies.get(name))[name];
+		const header = this.request.headers.get("Cookie");
+		return parseCookie(header ?? "")[name];
+	}
+	set(name, value, options) {
+		options ??= {};
+		options.httpOnly ??= true;
+		options.secure ??= true;
+		options.sameSite ??= "lax";
+		this.cookies.set(name, stringifySetCookie({
+			name,
+			value,
+			...options
+		}));
+	}
+	delete(name, options) {
+		options ??= {};
+		options.httpOnly ??= true;
+		options.secure ??= true;
+		options.sameSite ??= "lax";
+		options.expires = /* @__PURE__ */ new Date(0);
+		this.cookies.set(name, stringifySetCookie({
+			name,
+			value: "",
+			...options
+		}));
+	}
+};
+//#endregion
+//#region src/server/FlashHelper.ts
+const COOKIE_NAME$1 = "torpor-flash";
+/**
+* A one-time values store set in a form action and shown on the next page
+* render, which survives the redirect. Available as `event.flash`; the
+* framework reads it into `$page.flash` when a page is rendered, so
+* components display it reactively:
+*
+* ```ts
+* actions: {
+* 	save: async (event) => {
+* 		// ...save...
+* 		event.flash.set("Project saved"); // { message: "Project saved" }
+* 		event.flash.set({ error: "Import failed", retryable: true });
+* 		return seeOther(`/projects/${id}`);
+* 	},
+* }
+* ```
+*
+* ```torp
+* @if ($page.flash?.message) {
+* 	<p class="flash">{$page.flash.message}</p>
+* }
+* ```
+*
+* The values ride in a (session-lifetime) cookie that is deleted when it is
+* read, so a page refresh shows them once. No signing: the only person who
+* can fake a flash is the one seeing it, and values are rendered as text.
+* They must be JSON-safe and small enough to fit in the cookie (~4KB). A
+* common shape for a styled banner is `{ type, message }`, for use e.g.
+* with the Notification component -- but the framework only requires the
+* values to be an object. Without cookies the message is simply lost --
+* the action itself still completes.
+*/
+var FlashHelper = class {
+	#cookies;
+	constructor(cookies) {
+		this.#cookies = cookies;
+	}
+	/**
+	* Reads the flash values, if any, and clears them: the same response
+	* deletes the cookie, so the message shows exactly once. (When the
+	* message was set during this same request, e.g. a form action that
+	* re-renders instead of redirecting, the cookie is consumed without it
+	* ever reaching the browser.)
+	*/
+	get() {
+		const cookie = this.#cookies.get(COOKIE_NAME$1);
+		if (!cookie) return void 0;
+		this.#cookies.delete(COOKIE_NAME$1, { path: "/" });
+		try {
+			const decoded = JSON.parse(decodeURIComponent(cookie));
+			if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) return;
+			return decoded;
+		} catch {
+			return;
+		}
+	}
+	/**
+	* Sets the flash values. A string is stored as `{ message: value }`, an
+	* object as-is, e.g. `flash.set({ error: "Import failed" })`.
+	*/
+	set(value) {
+		const data = typeof value === "string" ? { message: value } : value;
+		this.#cookies.set(COOKIE_NAME$1, encodeURIComponent(JSON.stringify(data)), { path: "/" });
+	}
+	/**
+	* Clears an unread flash message, e.g. so it isn't shown on a later
+	* re-render of the same page.
+	*/
+	clear() {
+		this.#cookies.delete(COOKIE_NAME$1, { path: "/" });
+	}
+};
+//#endregion
+//#region src/server/HeaderHelper.ts
+var HeaderHelper = class {
+	request;
+	headers = /* @__PURE__ */ new Map();
+	constructor(request) {
+		this.request = request;
+	}
+	get(name) {
+		if (this.headers.has(name)) return this.headers.get(name);
+		return this.request.headers.get(name) ?? void 0;
+	}
+	set(name, value) {
+		this.headers.set(name, value);
+	}
+	delete(name) {
+		this.headers.delete(name);
+	}
+};
+//#endregion
+//#region src/server/SessionHelper.ts
+const COOKIE_NAME = "torpor-session";
+const DEFAULT_MAX_AGE = 2592e3;
+const keys = /* @__PURE__ */ new Map();
+/**
+* A helper for reading and writing the signed session cookie, available as
+* `event.session` in load functions, actions, +server endpoints and hooks.
+*
+* The value is signed with HMAC-SHA256 using `TORPOR_SESSION_SECRET` from
+* the environment, so it can't be forged or tampered with -- but it is
+* still client-side storage: everything rides in the cookie, it can't be
+* revoked individually, and it is limited to ~4KB. When you need
+* revocation, store `session.id` in your database, check it on each
+* authed request (e.g. in a `_hook.server.ts`), and delete the row to
+* revoke.
+*
+* ```ts
+* // Login action
+* const user = await checkPassword(event.form());
+* await event.session.regenerate({ userId: user.id });
+*
+* // Root hook
+* const session = await event.session.get();
+* if (session) {
+* 	event.appData.user = await getUser(session.userId);
+* }
+* ```
+*/
+var SessionHelper = class {
+	#cookies;
+	#id;
+	constructor(cookies) {
+		this.#cookies = cookies;
+	}
+	/**
+	* The id embedded in the current session cookie, or undefined when
+	* there is no valid session. Stable across `set` calls, so it can be
+	* used as a database key; `regenerate` mints a new one.
+	*/
+	get id() {
+		return this.#id;
+	}
+	/**
+	* Reads and verifies the session, returning its data, or undefined when
+	* there is no cookie, the signature doesn't match, or the session has
+	* expired.
+	*/
+	async get() {
+		const value = this.#cookies.get(COOKIE_NAME);
+		if (!value) return void 0;
+		const payload = await verifyValue(value);
+		if (!payload) return void 0;
+		this.#id = payload.id;
+		return payload.data;
+	}
+	/**
+	* Writes the session, signing the data and setting the cookie. Keeps
+	* the current session id, minting one when there isn't a valid session
+	* yet. Call `regenerate` instead when the session's identity should
+	* change (e.g. at login, to prevent session fixation).
+	*/
+	async set(data, options) {
+		const id = this.#id ?? crypto.randomUUID();
+		this.#id = id;
+		await this.#write(id, data, options);
+	}
+	/**
+	* Writes the session with a fresh id, replacing any existing one. Use
+	* it when a session's privilege level changes (login, permission
+	* upgrade), so a cookie that was set before the change can't be reused.
+	*/
+	async regenerate(data = {}, options) {
+		const id = crypto.randomUUID();
+		this.#id = id;
+		await this.#write(id, data, options);
+	}
+	/**
+	* Deletes the session cookie. Note that a server-side record (if you
+	* keep one) must be deleted or revoked separately.
+	*/
+	async destroy() {
+		this.#id = void 0;
+		this.#cookies.delete(COOKIE_NAME, { path: "/" });
+	}
+	async #write(id, data, options) {
+		const maxAge = options?.maxAge ?? DEFAULT_MAX_AGE;
+		const payload = {
+			id,
+			data,
+			exp: Date.now() + maxAge * 1e3
+		};
+		const encoded = encodeBase64Url(new TextEncoder().encode(JSON.stringify(payload)));
+		const signature = await sign(encoded);
+		this.#cookies.set(COOKIE_NAME, `${encoded}.${signature}`, {
+			path: "/",
+			maxAge
+		});
+	}
+};
+function secret() {
+	const value = env().TORPOR_SESSION_SECRET;
+	if (!value) throw new Error("TORPOR_SESSION_SECRET is not set. Add it to the environment (or to a .env file in dev and preview) to use sessions.");
+	return value;
+}
+function signingKey() {
+	const value = secret();
+	let key = keys.get(value);
+	if (!key) {
+		key = crypto.subtle.importKey("raw", new TextEncoder().encode(value), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["sign", "verify"]);
+		keys.set(value, key);
+	}
+	return key;
+}
+async function sign(payload) {
+	const signature = await crypto.subtle.sign("HMAC", await signingKey(), new TextEncoder().encode(payload));
+	return encodeBase64Url(new Uint8Array(signature));
+}
+async function verifyValue(value) {
+	const dot = value.lastIndexOf(".");
+	if (dot === -1) return void 0;
+	const encoded = value.slice(0, dot);
+	if (!await crypto.subtle.verify("HMAC", await signingKey(), decodeBase64Url(value.slice(dot + 1)), new TextEncoder().encode(encoded))) return void 0;
+	let payload;
+	try {
+		payload = JSON.parse(new TextDecoder().decode(decodeBase64Url(encoded)));
+	} catch {
+		return;
+	}
+	if (typeof payload?.id !== "string" || typeof payload?.exp !== "number" || typeof payload?.data !== "object" || payload.data === null || payload.exp < Date.now()) return;
+	return payload;
+}
+function encodeBase64Url(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i += 4096) binary += String.fromCharCode(...bytes.subarray(i, i + 4096));
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function decodeBase64Url(value) {
+	const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/"));
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+//#endregion
+//#region src/server/ServerEvent.ts
+var ServerEvent = class {
+	request;
+	response;
+	/**
+	* Set when the route handler (or a middleware enter hook) threw an
+	* error. Exit hooks can return a Response to handle it; if none does,
+	* the error is rethrown to the caller.
+	*/
+	error;
+	params;
+	adapter;
+	cookies;
+	headers;
+	session;
+	flash;
+	#url;
+	/** The request URL, parsed lazily. */
+	get url() {
+		return this.#url ??= new URL(this.request.url);
+	}
+	constructor(request, params, url) {
+		this.request = request;
+		this.params = params;
+		this.#url = url;
+		this.cookies = new CookieHelper(request);
+		this.headers = new HeaderHelper(request);
+		this.session = new SessionHelper(this.cookies);
+		this.flash = new FlashHelper(this.cookies);
+		this.adapter = globalThis.adapter;
+	}
+	addHeaders() {
+		if (!this.response) throw new Error("Response not created yet");
+		for (let cookie of this.cookies.cookies.values()) this.response.headers.append("set-cookie", cookie);
+		for (let header of this.headers.headers.entries()) this.response.headers.append(header[0], header[1]);
+		const base = getBasePath();
+		if (base) {
+			const location = this.response.headers.get("Location");
+			if (location) {
+				const rewritten = addBaseToPath(location, base);
+				if (rewritten !== location) this.response.headers.set("Location", rewritten);
+			}
+		}
+	}
+	/**
+	* Reads the request body as JSON.
+	*/
+	json() {
+		return this.request.json();
+	}
+};
+//#endregion
+export { HeaderHelper as n, CookieHelper as r, ServerEvent as t };
+
+//# sourceMappingURL=ServerEvent-Bh9cEpro.mjs.map

package/dist/ServerEvent-Bh9cEpro.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServerEvent-Bh9cEpro.mjs","names":["COOKIE_NAME","#cookies","#cookies","#id","#write","#url"],"sources":["../src/server/CookieHelper.ts","../src/server/FlashHelper.ts","../src/server/HeaderHelper.ts","../src/server/SessionHelper.ts","../src/server/ServerEvent.ts"],"sourcesContent":["import { type SerializeOptions, parseCookie, stringifySetCookie } from \"cookie\";\n\nexport default class CookieHelper {\n\trequest: Request;\n\tcookies: Map<string, string> = new Map();\n\n\tconstructor(request: Request) {\n\t\tthis.request = request;\n\t}\n\n\tget(name: string): string | undefined {\n\t\t// If it's been set, return the value from the map\n\t\tif (this.cookies.has(name)) {\n\t\t\t// The stored value is a serialized Set-Cookie header; pull the\n\t\t\t// \"name=value\" prefix off and re-parse to get just the value\n\t\t\treturn parseCookie(this.cookies.get(name)!)[name];\n\t\t}\n\n\t\t// Otherwise, return the value from the `cookie` header\n\t\tconst header = this.request.headers.get(\"Cookie\");\n\t\treturn parseCookie(header ?? \"\")[name];\n\t}\n\n\tset(name: string, value: string, options?: SerializeOptions): void {\n\t\t// Set a cookie header with some default values for security\n\t\toptions ??= {};\n\t\toptions.httpOnly ??= true;\n\t\toptions.secure ??= true;\n\t\toptions.sameSite ??= \"lax\";\n\n\t\tthis.cookies.set(name, stringifySetCookie({ name, value, ...options }));\n\t}\n\n\tdelete(name: string, options?: SerializeOptions): void {\n\t\t// Set a cookie header with an empty value and an immediate expiry date.\n\t\t// Apply the same secure defaults as `set` so a previously-set Secure\n\t\t// cookie is actually overridden by the deletion.\n\t\toptions ??= {};\n\t\toptions.httpOnly ??= true;\n\t\toptions.secure ??= true;\n\t\toptions.sameSite ??= \"lax\";\n\t\toptions.expires = new Date(0);\n\n\t\tthis.cookies.set(name, stringifySetCookie({ name, value: \"\", ...options }));\n\t}\n}\n","import CookieHelper from \"./CookieHelper\";\n\nconst COOKIE_NAME = \"torpor-flash\";\n\n/**\n * A one-time values store set in a form action and shown on the next page\n * render, which survives the redirect. Available as `event.flash`; the\n * framework reads it into `$page.flash` when a page is rendered, so\n * components display it reactively:\n *\n * ```ts\n * actions: {\n * \tsave: async (event) => {\n * \t\t// ...save...\n * \t\tevent.flash.set(\"Project saved\"); // { message: \"Project saved\" }\n * \t\tevent.flash.set({ error: \"Import failed\", retryable: true });\n * \t\treturn seeOther(`/projects/${id}`);\n * \t},\n * }\n * ```\n *\n * ```torp\n * @if ($page.flash?.message) {\n * \t<p class=\"flash\">{$page.flash.message}</p>\n * }\n * ```\n *\n * The values ride in a (session-lifetime) cookie that is deleted when it is\n * read, so a page refresh shows them once. No signing: the only person who\n * can fake a flash is the one seeing it, and values are rendered as text.\n * They must be JSON-safe and small enough to fit in the cookie (~4KB). A\n * common shape for a styled banner is `{ type, message }`, for use e.g.\n * with the Notification component -- but the framework only requires the\n * values to be an object. Without cookies the message is simply lost --\n * the action itself still completes.\n */\nexport default class FlashHelper {\n\t#cookies: CookieHelper;\n\n\tconstructor(cookies: CookieHelper) {\n\t\tthis.#cookies = cookies;\n\t}\n\n\t/**\n\t * Reads the flash values, if any, and clears them: the same response\n\t * deletes the cookie, so the message shows exactly once. (When the\n\t * message was set during this same request, e.g. a form action that\n\t * re-renders instead of redirecting, the cookie is consumed without it\n\t * ever reaching the browser.)\n\t */\n\tget(): Record<string, unknown> | undefined {\n\t\tconst cookie = this.#cookies.get(COOKIE_NAME);\n\t\tif (!cookie) return undefined;\n\t\tthis.#cookies.delete(COOKIE_NAME, { path: \"/\" });\n\t\ttry {\n\t\t\tconst decoded = JSON.parse(decodeURIComponent(cookie));\n\t\t\tif (typeof decoded !== \"object\" || decoded === null || Array.isArray(decoded)) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\treturn decoded as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t/**\n\t * Sets the flash values. A string is stored as `{ message: value }`, an\n\t * object as-is, e.g. `flash.set({ error: \"Import failed\" })`.\n\t */\n\tset(value: string | Record<string, unknown>): void {\n\t\tconst data = typeof value === \"string\" ? { message: value } : value;\n\t\tthis.#cookies.set(COOKIE_NAME, encodeURIComponent(JSON.stringify(data)), { path: \"/\" });\n\t}\n\n\t/**\n\t * Clears an unread flash message, e.g. so it isn't shown on a later\n\t * re-render of the same page.\n\t */\n\tclear(): void {\n\t\tthis.#cookies.delete(COOKIE_NAME, { path: \"/\" });\n\t}\n}\n","export default class HeaderHelper {\n\trequest: Request;\n\theaders: Map<string, string> = new Map();\n\n\tconstructor(request: Request) {\n\t\tthis.request = request;\n\t}\n\n\tget(name: string): string | undefined {\n\t\t// If it's been set, return the updated value\n\t\tif (this.headers.has(name)) {\n\t\t\treturn this.headers.get(name);\n\t\t}\n\t\t// Otherwise, return the value from the header\n\t\treturn this.request.headers.get(name) ?? undefined;\n\t}\n\n\tset(name: string, value: string): void {\n\t\tthis.headers.set(name, value);\n\t}\n\n\tdelete(name: string): void {\n\t\tthis.headers.delete(name);\n\t}\n}\n","import env from \"../env\";\nimport CookieHelper from \"./CookieHelper\";\n\nconst COOKIE_NAME = \"torpor-session\";\nconst DEFAULT_MAX_AGE = 30 * 24 * 60 * 60; // 30 days, in seconds\n\n/**\n * The data stored in the session. Must be JSON-safe, and small enough to\n * fit in a cookie (4KB) along with the id, expiry and signature.\n */\ntype SessionData = Record<string, unknown>;\n\ntype SessionPayload = {\n\tid: string;\n\tdata: SessionData;\n\t/** Expiry, as a Unix epoch in milliseconds */\n\texp: number;\n};\n\n// The imported signing key, cached per secret so repeated calls (per\n// request) don't re-import\nconst keys = new Map<string, Promise<CryptoKey>>();\n\n/**\n * A helper for reading and writing the signed session cookie, available as\n * `event.session` in load functions, actions, +server endpoints and hooks.\n *\n * The value is signed with HMAC-SHA256 using `TORPOR_SESSION_SECRET` from\n * the environment, so it can't be forged or tampered with -- but it is\n * still client-side storage: everything rides in the cookie, it can't be\n * revoked individually, and it is limited to ~4KB. When you need\n * revocation, store `session.id` in your database, check it on each\n * authed request (e.g. in a `_hook.server.ts`), and delete the row to\n * revoke.\n *\n * ```ts\n * // Login action\n * const user = await checkPassword(event.form());\n * await event.session.regenerate({ userId: user.id });\n *\n * // Root hook\n * const session = await event.session.get();\n * if (session) {\n * \tevent.appData.user = await getUser(session.userId);\n * }\n * ```\n */\nexport default class SessionHelper {\n\t#cookies: CookieHelper;\n\t#id: string | undefined;\n\n\tconstructor(cookies: CookieHelper) {\n\t\tthis.#cookies = cookies;\n\t}\n\n\t/**\n\t * The id embedded in the current session cookie, or undefined when\n\t * there is no valid session. Stable across `set` calls, so it can be\n\t * used as a database key; `regenerate` mints a new one.\n\t */\n\tget id(): string | undefined {\n\t\treturn this.#id;\n\t}\n\n\t/**\n\t * Reads and verifies the session, returning its data, or undefined when\n\t * there is no cookie, the signature doesn't match, or the session has\n\t * expired.\n\t */\n\tasync get(): Promise<SessionData | undefined> {\n\t\tconst value = this.#cookies.get(COOKIE_NAME);\n\t\tif (!value) return undefined;\n\t\tconst payload = await verifyValue(value);\n\t\tif (!payload) return undefined;\n\t\tthis.#id = payload.id;\n\t\treturn payload.data;\n\t}\n\n\t/**\n\t * Writes the session, signing the data and setting the cookie. Keeps\n\t * the current session id, minting one when there isn't a valid session\n\t * yet. Call `regenerate` instead when the session's identity should\n\t * change (e.g. at login, to prevent session fixation).\n\t */\n\tasync set(data: SessionData, options?: { maxAge?: number }): Promise<void> {\n\t\tconst id = this.#id ?? crypto.randomUUID();\n\t\tthis.#id = id;\n\t\tawait this.#write(id, data, options);\n\t}\n\n\t/**\n\t * Writes the session with a fresh id, replacing any existing one. Use\n\t * it when a session's privilege level changes (login, permission\n\t * upgrade), so a cookie that was set before the change can't be reused.\n\t */\n\tasync regenerate(data: SessionData = {}, options?: { maxAge?: number }): Promise<void> {\n\t\tconst id = crypto.randomUUID();\n\t\tthis.#id = id;\n\t\tawait this.#write(id, data, options);\n\t}\n\n\t/**\n\t * Deletes the session cookie. Note that a server-side record (if you\n\t * keep one) must be deleted or revoked separately.\n\t */\n\tasync destroy(): Promise<void> {\n\t\tthis.#id = undefined;\n\t\tthis.#cookies.delete(COOKIE_NAME, { path: \"/\" });\n\t}\n\n\tasync #write(\n\t\tid: string,\n\t\tdata: SessionData,\n\t\toptions: { maxAge?: number } | undefined,\n\t): Promise<void> {\n\t\tconst maxAge = options?.maxAge ?? DEFAULT_MAX_AGE;\n\t\tconst payload: SessionPayload = { id, data, exp: Date.now() + maxAge * 1000 };\n\t\tconst encoded = encodeBase64Url(new TextEncoder().encode(JSON.stringify(payload)));\n\t\tconst signature = await sign(encoded);\n\t\tthis.#cookies.set(COOKIE_NAME, `${encoded}.${signature}`, { path: \"/\", maxAge });\n\t}\n}\n\nfunction secret(): string {\n\tconst value = env().TORPOR_SESSION_SECRET;\n\tif (!value) {\n\t\tthrow new Error(\n\t\t\t\"TORPOR_SESSION_SECRET is not set. Add it to the environment (or to a .env \" +\n\t\t\t\t\"file in dev and preview) to use sessions.\",\n\t\t);\n\t}\n\treturn value;\n}\n\nfunction signingKey(): Promise<CryptoKey> {\n\tconst value = secret();\n\tlet key = keys.get(value);\n\tif (!key) {\n\t\tkey = crypto.subtle.importKey(\n\t\t\t\"raw\",\n\t\t\tnew TextEncoder().encode(value),\n\t\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\t\tfalse,\n\t\t\t[\"sign\", \"verify\"],\n\t\t);\n\t\tkeys.set(value, key);\n\t}\n\treturn key;\n}\n\nasync function sign(payload: string): Promise<string> {\n\tconst signature = await crypto.subtle.sign(\n\t\t\"HMAC\",\n\t\tawait signingKey(),\n\t\tnew TextEncoder().encode(payload),\n\t);\n\treturn encodeBase64Url(new Uint8Array(signature));\n}\n\nasync function verifyValue(value: string): Promise<SessionPayload | undefined> {\n\tconst dot = value.lastIndexOf(\".\");\n\tif (dot === -1) return undefined;\n\tconst encoded = value.slice(0, dot);\n\tconst valid = await crypto.subtle.verify(\n\t\t\"HMAC\",\n\t\tawait signingKey(),\n\t\tdecodeBase64Url(value.slice(dot + 1)),\n\t\tnew TextEncoder().encode(encoded),\n\t);\n\tif (!valid) return undefined;\n\n\tlet payload: SessionPayload;\n\ttry {\n\t\tpayload = JSON.parse(new TextDecoder().decode(decodeBase64Url(encoded)));\n\t} catch {\n\t\treturn undefined;\n\t}\n\tif (\n\t\ttypeof payload?.id !== \"string\" ||\n\t\ttypeof payload?.exp !== \"number\" ||\n\t\ttypeof payload?.data !== \"object\" ||\n\t\tpayload.data === null ||\n\t\tpayload.exp < Date.now()\n\t) {\n\t\treturn undefined;\n\t}\n\treturn payload;\n}\n\nfunction encodeBase64Url(bytes: Uint8Array): string {\n\t// btoa can't take raw bytes, and long argument lists overflow, so\n\t// convert in chunks\n\tlet binary = \"\";\n\tfor (let i = 0; i < bytes.length; i += 0x1000) {\n\t\tbinary += String.fromCharCode(...bytes.subarray(i, i + 0x1000));\n\t}\n\treturn btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\n\nfunction decodeBase64Url(value: string): Uint8Array<ArrayBuffer> {\n\tconst binary = atob(value.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\"));\n\tconst bytes = new Uint8Array(binary.length);\n\tfor (let i = 0; i < binary.length; i++) {\n\t\tbytes[i] = binary.charCodeAt(i);\n\t}\n\treturn bytes;\n}\n","import { addBaseToPath, getBasePath } from \"../site/basePath\";\nimport CookieHelper from \"./CookieHelper\";\nimport FlashHelper from \"./FlashHelper\";\nimport HeaderHelper from \"./HeaderHelper\";\nimport SessionHelper from \"./SessionHelper\";\n\nexport default class ServerEvent {\n\trequest: Request;\n\tresponse: Response | undefined | void;\n\t/**\n\t * Set when the route handler (or a middleware enter hook) threw an\n\t * error. Exit hooks can return a Response to handle it; if none does,\n\t * the error is rethrown to the caller.\n\t */\n\terror: unknown;\n\t// TODO: Should we cast types??\n\tparams?: Record<string, string>;\n\n\tadapter: any;\n\n\tcookies: CookieHelper;\n\theaders: HeaderHelper;\n\tsession: SessionHelper;\n\tflash: FlashHelper;\n\n\t// Parsed once per request; Server.fetch passes the URL it already needed\n\t// for matching so it isn't parsed twice\n\t#url: URL | undefined;\n\n\t/** The request URL, parsed lazily. */\n\tget url(): URL {\n\t\treturn (this.#url ??= new URL(this.request.url));\n\t}\n\n\tconstructor(request: Request, params?: Record<string, string>, url?: URL) {\n\t\tthis.request = request;\n\t\tthis.params = params;\n\t\tthis.#url = url;\n\t\tthis.cookies = new CookieHelper(request);\n\t\tthis.headers = new HeaderHelper(request);\n\t\tthis.session = new SessionHelper(this.cookies);\n\t\tthis.flash = new FlashHelper(this.cookies);\n\n\t\t// Adapters may have added the `adapter` property to globalThis\n\t\t// @ts-ignore\n\t\tthis.adapter = globalThis.adapter;\n\t}\n\n\taddHeaders(): void {\n\t\tif (!this.response) {\n\t\t\tthrow new Error(\"Response not created yet\");\n\t\t}\n\n\t\tfor (let cookie of this.cookies.cookies.values()) {\n\t\t\tthis.response.headers.append(\"set-cookie\", cookie);\n\t\t}\n\n\t\tfor (let header of this.headers.headers.entries()) {\n\t\t\tthis.response.headers.append(header[0], header[1]);\n\t\t}\n\n\t\t// Redirect locations are written base-free, so that user code isn't\n\t\t// aware of the base path\n\t\tconst base = getBasePath();\n\t\tif (base) {\n\t\t\tconst location = this.response.headers.get(\"Location\");\n\t\t\tif (location) {\n\t\t\t\tconst rewritten = addBaseToPath(location, base);\n\t\t\t\tif (rewritten !== location) {\n\t\t\t\t\tthis.response.headers.set(\"Location\", rewritten);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Reads the request body as JSON.\n\t */\n\tjson(): Promise<unknown> {\n\t\treturn this.request.json();\n\t}\n}\n"],"mappings":";;;;AAEA,IAAqB,eAArB,MAAkC;CACjC;CACA,0BAA+B,IAAI,IAAI;CAEvC,YAAY,SAAkB;EAC7B,KAAK,UAAU;CAChB;CAEA,IAAI,MAAkC;EAErC,IAAI,KAAK,QAAQ,IAAI,IAAI,GAGxB,OAAO,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAE,CAAC,CAAC;EAI7C,MAAM,SAAS,KAAK,QAAQ,QAAQ,IAAI,QAAQ;EAChD,OAAO,YAAY,UAAU,EAAE,CAAC,CAAC;CAClC;CAEA,IAAI,MAAc,OAAe,SAAkC;EAElE,YAAY,CAAC;EACb,QAAQ,aAAa;EACrB,QAAQ,WAAW;EACnB,QAAQ,aAAa;EAErB,KAAK,QAAQ,IAAI,MAAM,mBAAmB;GAAE;GAAM;GAAO,GAAG;EAAQ,CAAC,CAAC;CACvE;CAEA,OAAO,MAAc,SAAkC;EAItD,YAAY,CAAC;EACb,QAAQ,aAAa;EACrB,QAAQ,WAAW;EACnB,QAAQ,aAAa;EACrB,QAAQ,0BAAU,IAAI,KAAK,CAAC;EAE5B,KAAK,QAAQ,IAAI,MAAM,mBAAmB;GAAE;GAAM,OAAO;GAAI,GAAG;EAAQ,CAAC,CAAC;CAC3E;AACD;;;AC3CA,MAAMA,gBAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCpB,IAAqB,cAArB,MAAiC;CAChC;CAEA,YAAY,SAAuB;EAClC,KAAKC,WAAW;CACjB;;;;;;;;CASA,MAA2C;EAC1C,MAAM,SAAS,KAAKA,SAAS,IAAID,aAAW;EAC5C,IAAI,CAAC,QAAQ,OAAO,KAAA;EACpB,KAAKC,SAAS,OAAOD,eAAa,EAAE,MAAM,IAAI,CAAC;EAC/C,IAAI;GACH,MAAM,UAAU,KAAK,MAAM,mBAAmB,MAAM,CAAC;GACrD,IAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,GAC3E;GAED,OAAO;EACR,QAAQ;GACP;EACD;CACD;;;;;CAMA,IAAI,OAA+C;EAClD,MAAM,OAAO,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAI;EAC9D,KAAKC,SAAS,IAAID,eAAa,mBAAmB,KAAK,UAAU,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;CACvF;;;;;CAMA,QAAc;EACb,KAAKC,SAAS,OAAOD,eAAa,EAAE,MAAM,IAAI,CAAC;CAChD;AACD;;;ACjFA,IAAqB,eAArB,MAAkC;CACjC;CACA,0BAA+B,IAAI,IAAI;CAEvC,YAAY,SAAkB;EAC7B,KAAK,UAAU;CAChB;CAEA,IAAI,MAAkC;EAErC,IAAI,KAAK,QAAQ,IAAI,IAAI,GACxB,OAAO,KAAK,QAAQ,IAAI,IAAI;EAG7B,OAAO,KAAK,QAAQ,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC1C;CAEA,IAAI,MAAc,OAAqB;EACtC,KAAK,QAAQ,IAAI,MAAM,KAAK;CAC7B;CAEA,OAAO,MAAoB;EAC1B,KAAK,QAAQ,OAAO,IAAI;CACzB;AACD;;;ACrBA,MAAM,cAAc;AACpB,MAAM,kBAAkB;AAiBxB,MAAM,uBAAO,IAAI,IAAgC;;;;;;;;;;;;;;;;;;;;;;;;;AA0BjD,IAAqB,gBAArB,MAAmC;CAClC;CACA;CAEA,YAAY,SAAuB;EAClC,KAAKE,WAAW;CACjB;;;;;;CAOA,IAAI,KAAyB;EAC5B,OAAO,KAAKC;CACb;;;;;;CAOA,MAAM,MAAwC;EAC7C,MAAM,QAAQ,KAAKD,SAAS,IAAI,WAAW;EAC3C,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,MAAM,UAAU,MAAM,YAAY,KAAK;EACvC,IAAI,CAAC,SAAS,OAAO,KAAA;EACrB,KAAKC,MAAM,QAAQ;EACnB,OAAO,QAAQ;CAChB;;;;;;;CAQA,MAAM,IAAI,MAAmB,SAA8C;EAC1E,MAAM,KAAK,KAAKA,OAAO,OAAO,WAAW;EACzC,KAAKA,MAAM;EACX,MAAM,KAAKC,OAAO,IAAI,MAAM,OAAO;CACpC;;;;;;CAOA,MAAM,WAAW,OAAoB,CAAC,GAAG,SAA8C;EACtF,MAAM,KAAK,OAAO,WAAW;EAC7B,KAAKD,MAAM;EACX,MAAM,KAAKC,OAAO,IAAI,MAAM,OAAO;CACpC;;;;;CAMA,MAAM,UAAyB;EAC9B,KAAKD,MAAM,KAAA;EACX,KAAKD,SAAS,OAAO,aAAa,EAAE,MAAM,IAAI,CAAC;CAChD;CAEA,MAAME,OACL,IACA,MACA,SACgB;EAChB,MAAM,SAAS,SAAS,UAAU;EAClC,MAAM,UAA0B;GAAE;GAAI;GAAM,KAAK,KAAK,IAAI,IAAI,SAAS;EAAK;EAC5E,MAAM,UAAU,gBAAgB,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,OAAO,CAAC,CAAC;EACjF,MAAM,YAAY,MAAM,KAAK,OAAO;EACpC,KAAKF,SAAS,IAAI,aAAa,GAAG,QAAQ,GAAG,aAAa;GAAE,MAAM;GAAK;EAAO,CAAC;CAChF;AACD;AAEA,SAAS,SAAiB;CACzB,MAAM,QAAQ,IAAI,CAAC,CAAC;CACpB,IAAI,CAAC,OACJ,MAAM,IAAI,MACT,qHAED;CAED,OAAO;AACR;AAEA,SAAS,aAAiC;CACzC,MAAM,QAAQ,OAAO;CACrB,IAAI,MAAM,KAAK,IAAI,KAAK;CACxB,IAAI,CAAC,KAAK;EACT,MAAM,OAAO,OAAO,UACnB,OACA,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,GAC9B;GAAE,MAAM;GAAQ,MAAM;EAAU,GAChC,OACA,CAAC,QAAQ,QAAQ,CAClB;EACA,KAAK,IAAI,OAAO,GAAG;CACpB;CACA,OAAO;AACR;AAEA,eAAe,KAAK,SAAkC;CACrD,MAAM,YAAY,MAAM,OAAO,OAAO,KACrC,QACA,MAAM,WAAW,GACjB,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CACjC;CACA,OAAO,gBAAgB,IAAI,WAAW,SAAS,CAAC;AACjD;AAEA,eAAe,YAAY,OAAoD;CAC9E,MAAM,MAAM,MAAM,YAAY,GAAG;CACjC,IAAI,QAAQ,IAAI,OAAO,KAAA;CACvB,MAAM,UAAU,MAAM,MAAM,GAAG,GAAG;CAOlC,IAAI,CAAC,MANe,OAAO,OAAO,OACjC,QACA,MAAM,WAAW,GACjB,gBAAgB,MAAM,MAAM,MAAM,CAAC,CAAC,GACpC,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CACjC,GACY,OAAO,KAAA;CAEnB,IAAI;CACJ,IAAI;EACH,UAAU,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,gBAAgB,OAAO,CAAC,CAAC;CACxE,QAAQ;EACP;CACD;CACA,IACC,OAAO,SAAS,OAAO,YACvB,OAAO,SAAS,QAAQ,YACxB,OAAO,SAAS,SAAS,YACzB,QAAQ,SAAS,QACjB,QAAQ,MAAM,KAAK,IAAI,GAEvB;CAED,OAAO;AACR;AAEA,SAAS,gBAAgB,OAA2B;CAGnD,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,MACtC,UAAU,OAAO,aAAa,GAAG,MAAM,SAAS,GAAG,IAAI,IAAM,CAAC;CAE/D,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,EAAE;AACjF;AAEA,SAAS,gBAAgB,OAAwC;CAChE,MAAM,SAAS,KAAK,MAAM,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC;CACnE,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAClC,MAAM,KAAK,OAAO,WAAW,CAAC;CAE/B,OAAO;AACR;;;ACxMA,IAAqB,cAArB,MAAiC;CAChC;CACA;;;;;;CAMA;CAEA;CAEA;CAEA;CACA;CACA;CACA;CAIA;;CAGA,IAAI,MAAW;EACd,OAAQ,KAAKG,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG;CAC/C;CAEA,YAAY,SAAkB,QAAiC,KAAW;EACzE,KAAK,UAAU;EACf,KAAK,SAAS;EACd,KAAKA,OAAO;EACZ,KAAK,UAAU,IAAI,aAAa,OAAO;EACvC,KAAK,UAAU,IAAI,aAAa,OAAO;EACvC,KAAK,UAAU,IAAI,cAAc,KAAK,OAAO;EAC7C,KAAK,QAAQ,IAAI,YAAY,KAAK,OAAO;EAIzC,KAAK,UAAU,WAAW;CAC3B;CAEA,aAAmB;EAClB,IAAI,CAAC,KAAK,UACT,MAAM,IAAI,MAAM,0BAA0B;EAG3C,KAAK,IAAI,UAAU,KAAK,QAAQ,QAAQ,OAAO,GAC9C,KAAK,SAAS,QAAQ,OAAO,cAAc,MAAM;EAGlD,KAAK,IAAI,UAAU,KAAK,QAAQ,QAAQ,QAAQ,GAC/C,KAAK,SAAS,QAAQ,OAAO,OAAO,IAAI,OAAO,EAAE;EAKlD,MAAM,OAAO,YAAY;EACzB,IAAI,MAAM;GACT,MAAM,WAAW,KAAK,SAAS,QAAQ,IAAI,UAAU;GACrD,IAAI,UAAU;IACb,MAAM,YAAY,cAAc,UAAU,IAAI;IAC9C,IAAI,cAAc,UACjB,KAAK,SAAS,QAAQ,IAAI,YAAY,SAAS;GAEjD;EACD;CACD;;;;CAKA,OAAyB;EACxB,OAAO,KAAK,QAAQ,KAAK;CAC1B;AACD"}

package/dist/ServerHook-BTSGfLiJ.d.mts

@@ -0,0 +1,21 @@
+import { r as ServerLoadEvent } from "./ServerLoadEvent-DzbxxkF8.mjs";
+//#region src/types/ServerHook.d.ts
+/**
+ * For _hook.server.
+ */
+interface ServerHook<Route extends string | undefined = undefined> {
+  /**
+   * Called before each server request is handled. Return a Response to
+   * short-circuit the request, skipping the load, action or view rendering
+   * (e.g. a redirect for unauthenticated users).
+   */
+  enter?: (event: ServerLoadEvent<Route>) => Promise<Response | void> | Response | void;
+  /**
+   * Called after the request has been handled, even if the handler threw
+   * an error or the enter hook short-circuited it.
+   */
+  exit?: (event: ServerLoadEvent<Route>) => Promise<void> | void;
+}
+//#endregion
+export { ServerHook as t };
+//# sourceMappingURL=ServerHook-BTSGfLiJ.d.mts.map

package/dist/ServerHook-BTSGfLiJ.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServerHook-BTSGfLiJ.d.mts","names":[],"sources":["../src/types/ServerHook.ts"],"mappings":";;;;;UAKyB,WAAW;;;;;;EAMnC,SAAS,OAAO,gBAAgB,WAAW,QAAQ,mBAAmB;;;;;EAKtE,QAAQ,OAAO,gBAAgB,WAAW"}

package/dist/{ServerHook-BlLArueW.d.mts → ServerLoadEvent-DzbxxkF8.d.mts}

@@ -1,4 +1,4 @@
-import { n as HeaderHelper, r as CookieHelper } from "./ServerEvent-CTx3Q-hk.mjs";
+import { i as CookieHelper, n as HeaderHelper, r as FlashHelper, t as SessionHelper } from "./SessionHelper-MaodMaLU.mjs";
 import { a as RouteParamsOf } from "./ParseRouteParams-DBmqlmLh.mjs";
 //#region src/types/ServerLoadEvent.d.ts
 /**
@@ -60,32 +60,24 @@ interface ServerLoadEvent<Route extends string | undefined = undefined, Body = u
    */
   cookies: CookieHelper;
   /**
-   * A helper for getting and setting headers.
+   * A helper for reading and writing the signed session cookie. See
+   * [Sessions](/build/sessions).
    */
-  headers: HeaderHelper;
+  session: SessionHelper;
   /**
-   * An optional adapter object, containing adapter-specific functionality.
+   * A helper for setting one-time flash messages, shown on the next page
+   * render as `$page.flash = { type, message }`.
    */
-  adapter: Record<PropertyKey, any>;
-}
-//#endregion
-//#region src/types/ServerHook.d.ts
-/**
- * For _hook.server.
- */
-interface ServerHook<Route extends string | undefined = undefined> {
+  flash: FlashHelper;
   /**
-   * Called before each server request is handled. Return a Response to
-   * short-circuit the request, skipping the load, action or view rendering
-   * (e.g. a redirect for unauthenticated users).
+   * A helper for getting and setting headers.
    */
-  enter?: (event: ServerLoadEvent<Route>) => Promise<Response | void> | Response | void;
+  headers: HeaderHelper;
   /**
-   * Called after the request has been handled, even if the handler threw
-   * an error or the enter hook short-circuited it.
+   * An optional adapter object, containing adapter-specific functionality.
    */
-  exit?: (event: ServerLoadEvent<Route>) => Promise<void> | void;
+  adapter: Record<PropertyKey, any>;
 }
 //#endregion
-export { ServerLoadEvent as i, FormDataRecord as n, QueryRecord as r, ServerHook as t };
-//# sourceMappingURL=ServerHook-BlLArueW.d.mts.map
+export { QueryRecord as n, ServerLoadEvent as r, FormDataRecord as t };
+//# sourceMappingURL=ServerLoadEvent-DzbxxkF8.d.mts.map

package/dist/ServerLoadEvent-DzbxxkF8.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServerLoadEvent-DzbxxkF8.d.mts","names":[],"sources":["../src/types/ServerLoadEvent.ts"],"mappings":";;;;;;;KAUY,iBAAiB,eAAe,qBAAqB;;;;;KAMrD,cAAc;;;;;;;;UASD,gBACxB,8CACA,gBACA,WAAW,gBACX,YAAY,aACZ,SAAS,cAAc;;;;EAKvB,KAAK;;;;;;EAML,QAAQ;;;;;EAOR,SAAS;;;;EAIT,SAAS;;;;EAKT,YAAY,QAAQ;;;;;;EAMpB,YAAY,QAAQ;;;;;;;EAOpB,aAAa,QAAQ;;;;EAIrB,SAAS;;;;;EAKT,SAAS;;;;;EAKT,OAAO;;;;EAIP,SAAS;;;;EAIT,SAAS,OAAO"}