@volter/world-core 2.0.37 → 3.0.1

package/dist/src/client-bundle.js

@@ -1,6 +1,5 @@
-// A mirror's browser client from its `client/<name>.tsx` entry, runtime-neutral (the serve seam's helpers,
-// docs/contributing/architecture.md#the-serve-seam): under Bun the same `Bun.build` every mirror ran at
-// serve time; under Node the PREBUILT `<name>.bundle.js` beside the entry, written at pack time
+// A page's browser client from its `client/<name>.tsx` entry (the console's, the platform's), runtime-neutral (the
+// serve seam's helpers, docs/contributing/architecture.md#the-serve-seam): under Bun a `Bun.build` at serve time; under Node the PREBUILT `<name>.bundle.js` beside the entry, written at pack time
 // by scripts/publish/build.mjs into dist/client/. Built once per process and kept; a failed build
 // is retried on the next call. Nothing here runs at module scope.
 import { existsSync, readFileSync } from 'node:fs';

package/dist/src/cors.d.ts

@@ -0,0 +1,15 @@
+/** The vendor's CORS: `origin` `*`, or `echo` (the request's Origin, as a gateway that allows credentials must); the
+ *  methods, request headers and exposed headers it allows, each as the header's text; how long a preflight holds. */
+export type CorsDecl = {
+    origin: '*' | 'echo';
+    credentials?: boolean;
+    methods: string;
+    headers: string;
+    expose?: string;
+    maxAge?: number;
+};
+/** The CORS headers an answer to `request` carries under `decl`. */
+export declare function corsHeaders(decl: CorsDecl, request: Request): Record<string, string>;
+/** `fetch` behind the vendor's CORS: a preflight (OPTIONS) answered 204 with the headers, whatever its path, and every
+ *  other answer given the headers it does not set itself. */
+export declare function withCors<F extends (request: Request) => Promise<Response>>(decl: CorsDecl, fetch: F): F;

package/dist/src/cors.js

@@ -0,0 +1,31 @@
+// A vendor's CORS, as its gateway answers a browser (architecture.md, "What an author writes": the values are the
+// pack's, the answering the kernel's). Side-effect free (a browser bundle imports it).
+/** The CORS headers an answer to `request` carries under `decl`. */
+export function corsHeaders(decl, request) {
+    const origin = decl.origin === 'echo' ? (request.headers.get('origin') ?? '*') : '*';
+    return {
+        'access-control-allow-origin': origin,
+        ...(decl.origin === 'echo' ? { vary: 'Origin' } : {}),
+        ...(decl.credentials ? { 'access-control-allow-credentials': 'true' } : {}),
+        'access-control-allow-methods': decl.methods,
+        'access-control-allow-headers': decl.headers,
+        ...(decl.expose ? { 'access-control-expose-headers': decl.expose } : {}),
+        ...(decl.maxAge !== undefined ? { 'access-control-max-age': String(decl.maxAge) } : {}),
+    };
+}
+/** `fetch` behind the vendor's CORS: a preflight (OPTIONS) answered 204 with the headers, whatever its path, and every
+ *  other answer given the headers it does not set itself. */
+export function withCors(decl, fetch) {
+    const wrapped = async (request) => {
+        const headers = corsHeaders(decl, request);
+        if (request.method === 'OPTIONS')
+            return new Response(null, { status: 204, headers });
+        const answer = await fetch(request);
+        const merged = new Headers(answer.headers);
+        for (const [k, v] of Object.entries(headers))
+            if (!merged.has(k))
+                merged.set(k, v);
+        return new Response(answer.body, { status: answer.status, statusText: answer.statusText, headers: merged });
+    };
+    return Object.assign(wrapped, fetch);
+}