@volter/world-core 2.0.37 → 3.0.1

package/src/client-bundle.ts

@@ -1,6 +1,5 @@
-// A mirror's browser client from its `client/<name>.tsx` entry, runtime-neutral (the serve seam's helpers,
-// docs/contributing/architecture.md#the-serve-seam): under Bun the same `Bun.build` every mirror ran at
-// serve time; under Node the PREBUILT `<name>.bundle.js` beside the entry, written at pack time
+// A page's browser client from its `client/<name>.tsx` entry (the console's, the platform's), runtime-neutral (the
+// serve seam's helpers, docs/contributing/architecture.md#the-serve-seam): under Bun a `Bun.build` at serve time; under Node the PREBUILT `<name>.bundle.js` beside the entry, written at pack time
 // by scripts/publish/build.mjs into dist/client/. Built once per process and kept; a failed build
 // is retried on the next call. Nothing here runs at module scope.
 import { existsSync, readFileSync } from 'node:fs';

package/src/cors.ts

@@ -0,0 +1,34 @@
+// A vendor's CORS, as its gateway answers a browser (architecture.md, "What an author writes": the values are the
+// pack's, the answering the kernel's). Side-effect free (a browser bundle imports it).
+
+/** The vendor's CORS: `origin` `*`, or `echo` (the request's Origin, as a gateway that allows credentials must); the
+ *  methods, request headers and exposed headers it allows, each as the header's text; how long a preflight holds. */
+export type CorsDecl = { origin: '*' | 'echo'; credentials?: boolean; methods: string; headers: string; expose?: string; maxAge?: number };
+
+/** The CORS headers an answer to `request` carries under `decl`. */
+export function corsHeaders(decl: CorsDecl, request: Request): Record<string, string> {
+  const origin = decl.origin === 'echo' ? (request.headers.get('origin') ?? '*') : '*';
+  return {
+    'access-control-allow-origin': origin,
+    ...(decl.origin === 'echo' ? { vary: 'Origin' } : {}),
+    ...(decl.credentials ? { 'access-control-allow-credentials': 'true' } : {}),
+    'access-control-allow-methods': decl.methods,
+    'access-control-allow-headers': decl.headers,
+    ...(decl.expose ? { 'access-control-expose-headers': decl.expose } : {}),
+    ...(decl.maxAge !== undefined ? { 'access-control-max-age': String(decl.maxAge) } : {}),
+  };
+}
+
+/** `fetch` behind the vendor's CORS: a preflight (OPTIONS) answered 204 with the headers, whatever its path, and every
+ *  other answer given the headers it does not set itself. */
+export function withCors<F extends (request: Request) => Promise<Response>>(decl: CorsDecl, fetch: F): F {
+  const wrapped = async (request: Request): Promise<Response> => {
+    const headers = corsHeaders(decl, request);
+    if (request.method === 'OPTIONS') return new Response(null, { status: 204, headers });
+    const answer = await fetch(request);
+    const merged = new Headers(answer.headers);
+    for (const [k, v] of Object.entries(headers)) if (!merged.has(k)) merged.set(k, v);
+    return new Response(answer.body, { status: answer.status, statusText: answer.statusText, headers: merged });
+  };
+  return Object.assign(wrapped, fetch) as F;
+}