@wooksjs/http-body 0.7.25 → 0.7.27

package/dist/index.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 let _wooksjs_event_core = require("@wooksjs/event-core");
 let _wooksjs_event_http = require("@wooksjs/event-http");
+let buffer = require("buffer");
 
 //#region packages/http-body/src/utils/safe-json.ts
 const ILLEGAL_KEYS = [
@@ -8,9 +9,15 @@ const ILLEGAL_KEYS = [
 	"constructor",
 	"prototype"
 ];
+/**
+* `JSON.parse` that rejects `__proto__` / `constructor` / `prototype` keys (400).
+*
+* A parsed key can only spell an illegal name when the source contains that name literally
+* or uses a `\u` escape, so the key walk is skipped for sources that contain neither.
+*/
 function safeJsonParse(src) {
 	const parsed = JSON.parse(src);
-	assertNoProtoKeys(parsed);
+	if (src.includes("__proto__") || src.includes("constructor") || src.includes("prototype") || src.includes("\\u")) assertNoProtoKeys(parsed);
 	return parsed;
 }
 function assertNoProtoKeys(obj) {
@@ -37,14 +44,11 @@ const CONTENT_TYPE_MAP = {
 	"form-data": "multipart/form-data",
 	urlencoded: "application/x-www-form-urlencoded"
 };
-const contentIsSlot = (0, _wooksjs_event_core.cachedBy)((type, ctx) => {
-	const contentType = (0, _wooksjs_event_http.useHeaders)(ctx)["content-type"] || "";
-	const mime = CONTENT_TYPE_MAP[type] || type;
-	return contentType.includes(mime);
-});
+/** The body's content type: the request's `content-type` header, or what {@link seedBody} set. */
+const contentTypeSlot = (0, _wooksjs_event_core.cached)((ctx) => (0, _wooksjs_event_http.useHeaders)(ctx)["content-type"] || "");
 const parsedBodySlot = (0, _wooksjs_event_core.cached)(async (ctx) => {
 	const { rawBody } = (0, _wooksjs_event_http.useRequest)(ctx);
-	const contentType = (0, _wooksjs_event_http.useHeaders)(ctx)["content-type"] || "";
+	const contentType = ctx.get(contentTypeSlot);
 	const contentIs = (type) => contentType.includes(type);
 	const sBody = (await rawBody()).toString();
 	if (contentIs("application/json")) return jsonParser(sBody);
@@ -131,14 +135,66 @@ function urlEncodedParser(v) {
 *
 * @returns Object with `is(type)` checker, `parseBody` function, and `rawBody` accessor.
 */
-const useBody = (0, _wooksjs_event_core.defineWook)((ctx) => {
+const useBody = (0, _wooksjs_event_core.defineWook)((ctx) => bodyApi(ctx, false));
+/** `ownParse`: parse in `ctx` itself, never reading a parent's parsed body through. */
+function bodyApi(ctx, ownParse) {
 	const { rawBody } = (0, _wooksjs_event_http.useRequest)(ctx);
 	return {
-		is: (type) => contentIsSlot(type, ctx),
-		parseBody: () => ctx.get(parsedBodySlot),
+		is: (type) => ctx.get(contentTypeSlot).includes(CONTENT_TYPE_MAP[type] || type),
+		parseBody: () => ownParse ? ctx.getOwn(parsedBodySlot) : ctx.get(parsedBodySlot),
 		rawBody
 	};
-});
+}
+/**
+* Seeds the request body of `ctx` with an already parsed value: `useBody(ctx).parseBody()`
+* resolves to `body`, `useBody(ctx).rawBody()` / `useRequest(ctx).rawBody()` to its raw bytes,
+* and `useBody(ctx).is()` checks the seeded content type — the incoming request stream is never
+* read.
+*
+* Use it for a child event context (`new EventContext({ logger, parent })`) that runs a handler
+* with its own payload: everything else (request, headers, auth) is still read through the
+* parent, the body never is. Call it before anything in the child reads the body.
+*
+* @param ctx - The context to seed — usually a child of the current HTTP event
+* @param body - The parsed body value
+* @param opts - Raw bytes and content type (see {@link TSeedBodyOptions})
+*
+* @example
+* ```ts
+* const child = new EventContext({ logger: parent.logger, parent })
+* seedBody(child, { ids: [1, 2] })
+* await run(child, async () => {
+*   await useBody().parseBody() // { ids: [1, 2] }
+*   useBody().is('json') // true
+* })
+* ```
+*/
+function seedBody(ctx, body, opts) {
+	const defaults = seedDefaults(body, opts?.raw);
+	(0, _wooksjs_event_http.seedRawBody)(ctx, defaults.raw);
+	const contentType = opts?.contentType ?? defaults.contentType;
+	if (contentType !== void 0) ctx.setOwn(contentTypeSlot, contentType);
+	const parseRaw = body === void 0 && opts?.raw !== void 0;
+	if (!parseRaw) ctx.setOwn(parsedBodySlot, Promise.resolve(body));
+	if (parseRaw || ctx.parent) ctx.setOwn(useBody._slot, bodyApi(ctx, true));
+}
+/** The raw bytes (`raw`, else derived from `body`) and default content type of a seeded body. */
+function seedDefaults(body, raw) {
+	if (body === void 0) return { raw: raw ?? "" };
+	if (typeof body === "string") return {
+		raw: raw ?? body,
+		contentType: CONTENT_TYPE_MAP.text
+	};
+	if (buffer.Buffer.isBuffer(body)) return {
+		raw: raw ?? body,
+		contentType: CONTENT_TYPE_MAP.binary
+	};
+	return {
+		raw: raw ?? JSON.stringify(body) ?? "",
+		contentType: CONTENT_TYPE_MAP.json
+	};
+}
 
 //#endregion
+exports.seedBody = seedBody;
 exports.useBody = useBody;

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 import * as _wooksjs_event_core from '@wooksjs/event-core';
+import { EventContext } from '@wooksjs/event-core';
+import { Buffer } from 'buffer';
 
 /** Short names for common Content-Type values. */
 type KnownContentType = 'json' | 'html' | 'xml' | 'text' | 'binary' | 'form-data' | 'urlencoded';
@@ -23,6 +25,47 @@ declare const useBody: _wooksjs_event_core.WookComposable<{
     parseBody: <T>() => Promise<T>;
     rawBody: () => Promise<Buffer<ArrayBufferLike>>;
 }>;
+/** Options for {@link seedBody}. */
+interface TSeedBodyOptions {
+    /**
+     * The raw bytes `rawBody()` returns. Default: `body` itself when it is a string or a
+     * `Buffer`, otherwise `JSON.stringify(body)`. With `body` `undefined`, `parseBody()` parses
+     * these bytes by the content type (as for a real request).
+     */
+    raw?: Buffer | string;
+    /**
+     * The content type `useBody().is()` checks against (and `parseBody()` parses `raw` by).
+     * Default: `'text/plain'` for a string, `'application/octet-stream'` for a `Buffer`,
+     * `'application/json'` for other values; with `body` `undefined`, the request's
+     * `Content-Type`. Request headers (`useHeaders()`) are not changed.
+     */
+    contentType?: string;
+}
+/**
+ * Seeds the request body of `ctx` with an already parsed value: `useBody(ctx).parseBody()`
+ * resolves to `body`, `useBody(ctx).rawBody()` / `useRequest(ctx).rawBody()` to its raw bytes,
+ * and `useBody(ctx).is()` checks the seeded content type — the incoming request stream is never
+ * read.
+ *
+ * Use it for a child event context (`new EventContext({ logger, parent })`) that runs a handler
+ * with its own payload: everything else (request, headers, auth) is still read through the
+ * parent, the body never is. Call it before anything in the child reads the body.
+ *
+ * @param ctx - The context to seed — usually a child of the current HTTP event
+ * @param body - The parsed body value
+ * @param opts - Raw bytes and content type (see {@link TSeedBodyOptions})
+ *
+ * @example
+ * ```ts
+ * const child = new EventContext({ logger: parent.logger, parent })
+ * seedBody(child, { ids: [1, 2] })
+ * await run(child, async () => {
+ *   await useBody().parseBody() // { ids: [1, 2] }
+ *   useBody().is('json') // true
+ * })
+ * ```
+ */
+declare function seedBody(ctx: EventContext, body: unknown, opts?: TSeedBodyOptions): void;
 
-export { useBody };
-export type { KnownContentType };
+export { seedBody, useBody };
+export type { KnownContentType, TSeedBodyOptions };

package/dist/index.mjs

@@ -1,5 +1,6 @@
-import { cached, cachedBy, defineWook } from "@wooksjs/event-core";
-import { EHttpStatusCode, HttpError, WooksURLSearchParams, useHeaders, useRequest } from "@wooksjs/event-http";
+import { cached, defineWook } from "@wooksjs/event-core";
+import { EHttpStatusCode, HttpError, WooksURLSearchParams, seedRawBody, useHeaders, useRequest } from "@wooksjs/event-http";
+import { Buffer } from "buffer";
 
 //#region packages/http-body/src/utils/safe-json.ts
 const ILLEGAL_KEYS = [
@@ -7,9 +8,15 @@ const ILLEGAL_KEYS = [
 	"constructor",
 	"prototype"
 ];
+/**
+* `JSON.parse` that rejects `__proto__` / `constructor` / `prototype` keys (400).
+*
+* A parsed key can only spell an illegal name when the source contains that name literally
+* or uses a `\u` escape, so the key walk is skipped for sources that contain neither.
+*/
 function safeJsonParse(src) {
 	const parsed = JSON.parse(src);
-	assertNoProtoKeys(parsed);
+	if (src.includes("__proto__") || src.includes("constructor") || src.includes("prototype") || src.includes("\\u")) assertNoProtoKeys(parsed);
 	return parsed;
 }
 function assertNoProtoKeys(obj) {
@@ -36,14 +43,11 @@ const CONTENT_TYPE_MAP = {
 	"form-data": "multipart/form-data",
 	urlencoded: "application/x-www-form-urlencoded"
 };
-const contentIsSlot = cachedBy((type, ctx) => {
-	const contentType = useHeaders(ctx)["content-type"] || "";
-	const mime = CONTENT_TYPE_MAP[type] || type;
-	return contentType.includes(mime);
-});
+/** The body's content type: the request's `content-type` header, or what {@link seedBody} set. */
+const contentTypeSlot = cached((ctx) => useHeaders(ctx)["content-type"] || "");
 const parsedBodySlot = cached(async (ctx) => {
 	const { rawBody } = useRequest(ctx);
-	const contentType = useHeaders(ctx)["content-type"] || "";
+	const contentType = ctx.get(contentTypeSlot);
 	const contentIs = (type) => contentType.includes(type);
 	const sBody = (await rawBody()).toString();
 	if (contentIs("application/json")) return jsonParser(sBody);
@@ -130,14 +134,65 @@ function urlEncodedParser(v) {
 *
 * @returns Object with `is(type)` checker, `parseBody` function, and `rawBody` accessor.
 */
-const useBody = defineWook((ctx) => {
+const useBody = defineWook((ctx) => bodyApi(ctx, false));
+/** `ownParse`: parse in `ctx` itself, never reading a parent's parsed body through. */
+function bodyApi(ctx, ownParse) {
 	const { rawBody } = useRequest(ctx);
 	return {
-		is: (type) => contentIsSlot(type, ctx),
-		parseBody: () => ctx.get(parsedBodySlot),
+		is: (type) => ctx.get(contentTypeSlot).includes(CONTENT_TYPE_MAP[type] || type),
+		parseBody: () => ownParse ? ctx.getOwn(parsedBodySlot) : ctx.get(parsedBodySlot),
 		rawBody
 	};
-});
+}
+/**
+* Seeds the request body of `ctx` with an already parsed value: `useBody(ctx).parseBody()`
+* resolves to `body`, `useBody(ctx).rawBody()` / `useRequest(ctx).rawBody()` to its raw bytes,
+* and `useBody(ctx).is()` checks the seeded content type — the incoming request stream is never
+* read.
+*
+* Use it for a child event context (`new EventContext({ logger, parent })`) that runs a handler
+* with its own payload: everything else (request, headers, auth) is still read through the
+* parent, the body never is. Call it before anything in the child reads the body.
+*
+* @param ctx - The context to seed — usually a child of the current HTTP event
+* @param body - The parsed body value
+* @param opts - Raw bytes and content type (see {@link TSeedBodyOptions})
+*
+* @example
+* ```ts
+* const child = new EventContext({ logger: parent.logger, parent })
+* seedBody(child, { ids: [1, 2] })
+* await run(child, async () => {
+*   await useBody().parseBody() // { ids: [1, 2] }
+*   useBody().is('json') // true
+* })
+* ```
+*/
+function seedBody(ctx, body, opts) {
+	const defaults = seedDefaults(body, opts?.raw);
+	seedRawBody(ctx, defaults.raw);
+	const contentType = opts?.contentType ?? defaults.contentType;
+	if (contentType !== void 0) ctx.setOwn(contentTypeSlot, contentType);
+	const parseRaw = body === void 0 && opts?.raw !== void 0;
+	if (!parseRaw) ctx.setOwn(parsedBodySlot, Promise.resolve(body));
+	if (parseRaw || ctx.parent) ctx.setOwn(useBody._slot, bodyApi(ctx, true));
+}
+/** The raw bytes (`raw`, else derived from `body`) and default content type of a seeded body. */
+function seedDefaults(body, raw) {
+	if (body === void 0) return { raw: raw ?? "" };
+	if (typeof body === "string") return {
+		raw: raw ?? body,
+		contentType: CONTENT_TYPE_MAP.text
+	};
+	if (Buffer.isBuffer(body)) return {
+		raw: raw ?? body,
+		contentType: CONTENT_TYPE_MAP.binary
+	};
+	return {
+		raw: raw ?? JSON.stringify(body) ?? "",
+		contentType: CONTENT_TYPE_MAP.json
+	};
+}
 
 //#endregion
-export { useBody };
+export { seedBody, useBody };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wooksjs/http-body",
-  "version": "0.7.25",
+  "version": "0.7.27",
   "description": "@wooksjs/http-body",
   "keywords": [
     "api",
@@ -42,12 +42,12 @@
   "devDependencies": {
     "typescript": "^5.9.3",
     "vitest": "^3.2.7",
-    "@wooksjs/event-core": "^0.7.25",
-    "@wooksjs/event-http": "^0.7.25"
+    "@wooksjs/event-core": "^0.7.27",
+    "@wooksjs/event-http": "^0.7.27"
   },
   "peerDependencies": {
-    "@wooksjs/event-core": "^0.7.25",
-    "@wooksjs/event-http": "^0.7.25"
+    "@wooksjs/event-http": "^0.7.27",
+    "@wooksjs/event-core": "^0.7.27"
   },
   "scripts": {
     "build": "rolldown -c ../../rolldown.config.mjs"