better-call 0.0.0-experimental.01ff4b77

package/dist/plugins/http/attrs.cjs

@@ -0,0 +1,91 @@
+const require_error = require("../../error.cjs");
+const require_schema = require("../../schema.cjs");
+//#region src/plugins/http/attrs.ts
+/** Mark a field as unusable over the wire - HTTP / capability edges
+* reject it if present; in-process callers may still pass it. */
+const serverOnly = (schema) => require_schema.withAttrs(schema, "http", { serverOnly: true });
+const isServerOnly = (schema) => require_schema.attrsOf(schema, "http")?.serverOnly === true;
+/**
+* Drop fields (and nested object keys) marked {@link serverOnly}. Used
+* for OpenAPI / client contracts; {@link InferArgs} on the original
+* schema stays the full shape.
+*/
+const clientSchema = (schema) => {
+	if (require_schema.isVar(schema)) {
+		const v = schema;
+		return {
+			...schema,
+			schema: v.schema === void 0 ? void 0 : clientSchema(v.schema)
+		};
+	}
+	const def = require_schema.asType(schema);
+	if (def.name === "object" && def.shape !== void 0) {
+		const shape = {};
+		for (const [key, child] of Object.entries(def.shape)) {
+			if (isServerOnly(child)) continue;
+			shape[key] = clientSchema(child);
+		}
+		return {
+			...def,
+			shape
+		};
+	}
+	if (def.name === "array" && def.shape !== void 0) return {
+		...def,
+		shape: clientSchema(def.shape)
+	};
+	if (def.name === "union" && Array.isArray(def.shape)) return {
+		...def,
+		shape: def.shape.map((option) => clientSchema(option))
+	};
+	return schema;
+};
+/**
+* Throw if any {@link serverOnly} field is present on `value` (own key).
+* Object validation otherwise strips unknown keys, so this is what stops
+* wire callers from smuggling server-only values.
+*/
+const rejectServerOnly = (schema, value, path = "input") => {
+	if (value === null || value === void 0) return;
+	const def = require_schema.asType(require_schema.isVar(schema) ? schema.schema ?? {} : schema);
+	if (def.name === "object" && def.shape !== void 0) {
+		if (require_schema.typeOf(value) !== "object") return;
+		const record = value;
+		for (const [key, child] of Object.entries(def.shape)) {
+			if (isServerOnly(child) && Object.hasOwn(record, key)) throw new require_error.ValidationError(`${path}.${key}`, "server-only field is not allowed over the wire");
+			if (Object.hasOwn(record, key)) rejectServerOnly(child, record[key], `${path}.${key}`);
+		}
+		return;
+	}
+	if (def.name === "array" && def.shape !== void 0 && Array.isArray(value)) {
+		for (let i = 0; i < value.length; i++) rejectServerOnly(def.shape, value[i], `${path}[${i}]`);
+		return;
+	}
+	if (def.name === "union" && Array.isArray(def.shape)) for (const option of def.shape) rejectServerOnly(option, value, path);
+};
+/**
+* Wire-side input gate: reject smuggled server-only keys, then validate
+* against {@link clientSchema}.
+*/
+const wireInput = (schema, value, path = "input") => {
+	rejectServerOnly(schema, value, path);
+	return require_schema.validate(require_schema.asType(clientSchema(schema)), value, path);
+};
+/** Parse a JSON request body and run it through {@link wireInput}. */
+const fromJsonBody = async (request, schema, path = "body") => {
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		throw new require_error.ValidationError(path, "expected a JSON body");
+	}
+	return wireInput(schema, body, path);
+};
+//#endregion
+exports.clientSchema = clientSchema;
+exports.fromJsonBody = fromJsonBody;
+exports.rejectServerOnly = rejectServerOnly;
+exports.serverOnly = serverOnly;
+exports.wireInput = wireInput;
+
+//# sourceMappingURL=attrs.cjs.map

package/dist/plugins/http/attrs.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"attrs.cjs","names":["withAttrs","attrsOf","isVar","asType","typeOf","ValidationError","validate"],"sources":["../../../src/plugins/http/attrs.ts"],"sourcesContent":["import { ValidationError } from \"../../error\";\nimport {\n\tasType,\n\tattrsOf,\n\tisVar,\n\ttypeOf,\n\tvalidate,\n\twithAttrs,\n} from \"../../schema\";\n\n/** Mark a field as unusable over the wire - HTTP / capability edges\n * reject it if present; in-process callers may still pass it. */\nexport const serverOnly = <S>(schema: S): S =>\n\twithAttrs(schema, \"http\", { serverOnly: true });\n\nconst isServerOnly = (schema: unknown) =>\n\tattrsOf(schema, \"http\")?.serverOnly === true;\n\n/**\n * Drop fields (and nested object keys) marked {@link serverOnly}. Used\n * for OpenAPI / client contracts; {@link InferArgs} on the original\n * schema stays the full shape.\n */\nexport const clientSchema = <S>(schema: S): S => {\n\tif (isVar(schema)) {\n\t\tconst v = schema as { schema?: unknown };\n\t\treturn {\n\t\t\t...(schema as object),\n\t\t\tschema: v.schema === undefined ? undefined : clientSchema(v.schema as S),\n\t\t} as S;\n\t}\n\tconst def = asType(schema);\n\tif (def.name === \"object\" && def.shape !== undefined) {\n\t\tconst shape: Record<string, unknown> = {};\n\t\tfor (const [key, child] of Object.entries(\n\t\t\tdef.shape as Record<string, unknown>,\n\t\t)) {\n\t\t\tif (isServerOnly(child)) continue;\n\t\t\tshape[key] = clientSchema(child);\n\t\t}\n\t\treturn { ...def, shape } as S;\n\t}\n\tif (def.name === \"array\" && def.shape !== undefined) {\n\t\treturn { ...def, shape: clientSchema(def.shape) } as S;\n\t}\n\tif (def.name === \"union\" && Array.isArray(def.shape)) {\n\t\treturn {\n\t\t\t...def,\n\t\t\tshape: (def.shape as unknown[]).map((option) => clientSchema(option)),\n\t\t} as S;\n\t}\n\treturn schema;\n};\n\n/**\n * Throw if any {@link serverOnly} field is present on `value` (own key).\n * Object validation otherwise strips unknown keys, so this is what stops\n * wire callers from smuggling server-only values.\n */\nexport const rejectServerOnly = (\n\tschema: unknown,\n\tvalue: unknown,\n\tpath = \"input\",\n): void => {\n\tif (value === null || value === undefined) return;\n\tconst root = isVar(schema)\n\t\t? ((schema as { schema?: unknown }).schema ?? {})\n\t\t: schema;\n\tconst def = asType(root);\n\tif (def.name === \"object\" && def.shape !== undefined) {\n\t\tif (typeOf(value) !== \"object\") return;\n\t\tconst record = value as Record<string, unknown>;\n\t\tfor (const [key, child] of Object.entries(\n\t\t\tdef.shape as Record<string, unknown>,\n\t\t)) {\n\t\t\tif (isServerOnly(child) && Object.hasOwn(record, key)) {\n\t\t\t\tthrow new ValidationError(\n\t\t\t\t\t`${path}.${key}`,\n\t\t\t\t\t\"server-only field is not allowed over the wire\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (Object.hasOwn(record, key)) {\n\t\t\t\trejectServerOnly(child, record[key], `${path}.${key}`);\n\t\t\t}\n\t\t}\n\t\treturn;\n\t}\n\tif (def.name === \"array\" && def.shape !== undefined && Array.isArray(value)) {\n\t\tfor (let i = 0; i < value.length; i++) {\n\t\t\trejectServerOnly(def.shape, value[i], `${path}[${i}]`);\n\t\t}\n\t\treturn;\n\t}\n\tif (def.name === \"union\" && Array.isArray(def.shape)) {\n\t\tfor (const option of def.shape as unknown[]) {\n\t\t\trejectServerOnly(option, value, path);\n\t\t}\n\t}\n};\n\n/**\n * Wire-side input gate: reject smuggled server-only keys, then validate\n * against {@link clientSchema}.\n */\nexport const wireInput = <S>(\n\tschema: S,\n\tvalue: unknown,\n\tpath = \"input\",\n): unknown => {\n\trejectServerOnly(schema, value, path);\n\treturn validate(asType(clientSchema(schema)), value, path);\n};\n\n/** Parse a JSON request body and run it through {@link wireInput}. */\nexport const fromJsonBody = async <S>(\n\trequest: Request,\n\tschema: S,\n\tpath = \"body\",\n): Promise<unknown> => {\n\tlet body: unknown;\n\ttry {\n\t\tbody = await request.json();\n\t} catch {\n\t\tthrow new ValidationError(path, \"expected a JSON body\");\n\t}\n\treturn wireInput(schema, body, path);\n};\n"],"mappings":";;;;;AAYA,MAAa,cAAiB,WAC7BA,eAAAA,UAAU,QAAQ,QAAQ,EAAE,YAAY,KAAK,CAAC;AAE/C,MAAM,gBAAgB,WACrBC,eAAAA,QAAQ,QAAQ,MAAM,CAAC,EAAE,eAAe;;;;;;AAOzC,MAAa,gBAAmB,WAAiB;CAChD,IAAIC,eAAAA,MAAM,MAAM,GAAG;EAClB,MAAM,IAAI;EACV,OAAO;GACN,GAAI;GACJ,QAAQ,EAAE,WAAW,KAAA,IAAY,KAAA,IAAY,aAAa,EAAE,MAAW;EACxE;CACD;CACA,MAAM,MAAMC,eAAAA,OAAO,MAAM;CACzB,IAAI,IAAI,SAAS,YAAY,IAAI,UAAU,KAAA,GAAW;EACrD,MAAM,QAAiC,CAAC;EACxC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QACjC,IAAI,KACL,GAAG;GACF,IAAI,aAAa,KAAK,GAAG;GACzB,MAAM,OAAO,aAAa,KAAK;EAChC;EACA,OAAO;GAAE,GAAG;GAAK;EAAM;CACxB;CACA,IAAI,IAAI,SAAS,WAAW,IAAI,UAAU,KAAA,GACzC,OAAO;EAAE,GAAG;EAAK,OAAO,aAAa,IAAI,KAAK;CAAE;CAEjD,IAAI,IAAI,SAAS,WAAW,MAAM,QAAQ,IAAI,KAAK,GAClD,OAAO;EACN,GAAG;EACH,OAAQ,IAAI,MAAoB,KAAK,WAAW,aAAa,MAAM,CAAC;CACrE;CAED,OAAO;AACR;;;;;;AAOA,MAAa,oBACZ,QACA,OACA,OAAO,YACG;CACV,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW;CAI3C,MAAM,MAAMA,eAAAA,OAHCD,eAAAA,MAAM,MAAM,IACpB,OAAgC,UAAU,CAAC,IAC7C,MACoB;CACvB,IAAI,IAAI,SAAS,YAAY,IAAI,UAAU,KAAA,GAAW;EACrD,IAAIE,eAAAA,OAAO,KAAK,MAAM,UAAU;EAChC,MAAM,SAAS;EACf,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QACjC,IAAI,KACL,GAAG;GACF,IAAI,aAAa,KAAK,KAAK,OAAO,OAAO,QAAQ,GAAG,GACnD,MAAM,IAAIC,cAAAA,gBACT,GAAG,KAAK,GAAG,OACX,gDACD;GAED,IAAI,OAAO,OAAO,QAAQ,GAAG,GAC5B,iBAAiB,OAAO,OAAO,MAAM,GAAG,KAAK,GAAG,KAAK;EAEvD;EACA;CACD;CACA,IAAI,IAAI,SAAS,WAAW,IAAI,UAAU,KAAA,KAAa,MAAM,QAAQ,KAAK,GAAG;EAC5E,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KACjC,iBAAiB,IAAI,OAAO,MAAM,IAAI,GAAG,KAAK,GAAG,EAAE,EAAE;EAEtD;CACD;CACA,IAAI,IAAI,SAAS,WAAW,MAAM,QAAQ,IAAI,KAAK,GAClD,KAAK,MAAM,UAAU,IAAI,OACxB,iBAAiB,QAAQ,OAAO,IAAI;AAGvC;;;;;AAMA,MAAa,aACZ,QACA,OACA,OAAO,YACM;CACb,iBAAiB,QAAQ,OAAO,IAAI;CACpC,OAAOC,eAAAA,SAASH,eAAAA,OAAO,aAAa,MAAM,CAAC,GAAG,OAAO,IAAI;AAC1D;;AAGA,MAAa,eAAe,OAC3B,SACA,QACA,OAAO,WACe;CACtB,IAAI;CACJ,IAAI;EACH,OAAO,MAAM,QAAQ,KAAK;CAC3B,QAAQ;EACP,MAAM,IAAIE,cAAAA,gBAAgB,MAAM,sBAAsB;CACvD;CACA,OAAO,UAAU,QAAQ,MAAM,IAAI;AACpC"}

package/dist/plugins/http/attrs.d.cts

@@ -0,0 +1,26 @@
+//#region src/plugins/http/attrs.d.ts
+/** Mark a field as unusable over the wire - HTTP / capability edges
+ * reject it if present; in-process callers may still pass it. */
+declare const serverOnly: <S>(schema: S) => S;
+/**
+ * Drop fields (and nested object keys) marked {@link serverOnly}. Used
+ * for OpenAPI / client contracts; {@link InferArgs} on the original
+ * schema stays the full shape.
+ */
+declare const clientSchema: <S>(schema: S) => S;
+/**
+ * Throw if any {@link serverOnly} field is present on `value` (own key).
+ * Object validation otherwise strips unknown keys, so this is what stops
+ * wire callers from smuggling server-only values.
+ */
+declare const rejectServerOnly: (schema: unknown, value: unknown, path?: string) => void;
+/**
+ * Wire-side input gate: reject smuggled server-only keys, then validate
+ * against {@link clientSchema}.
+ */
+declare const wireInput: <S>(schema: S, value: unknown, path?: string) => unknown;
+/** Parse a JSON request body and run it through {@link wireInput}. */
+declare const fromJsonBody: <S>(request: Request, schema: S, path?: string) => Promise<unknown>;
+//#endregion
+export { clientSchema, fromJsonBody, rejectServerOnly, serverOnly, wireInput };
+//# sourceMappingURL=attrs.d.cts.map

package/dist/plugins/http/attrs.d.mts

@@ -0,0 +1,26 @@
+//#region src/plugins/http/attrs.d.ts
+/** Mark a field as unusable over the wire - HTTP / capability edges
+ * reject it if present; in-process callers may still pass it. */
+declare const serverOnly: <S>(schema: S) => S;
+/**
+ * Drop fields (and nested object keys) marked {@link serverOnly}. Used
+ * for OpenAPI / client contracts; {@link InferArgs} on the original
+ * schema stays the full shape.
+ */
+declare const clientSchema: <S>(schema: S) => S;
+/**
+ * Throw if any {@link serverOnly} field is present on `value` (own key).
+ * Object validation otherwise strips unknown keys, so this is what stops
+ * wire callers from smuggling server-only values.
+ */
+declare const rejectServerOnly: (schema: unknown, value: unknown, path?: string) => void;
+/**
+ * Wire-side input gate: reject smuggled server-only keys, then validate
+ * against {@link clientSchema}.
+ */
+declare const wireInput: <S>(schema: S, value: unknown, path?: string) => unknown;
+/** Parse a JSON request body and run it through {@link wireInput}. */
+declare const fromJsonBody: <S>(request: Request, schema: S, path?: string) => Promise<unknown>;
+//#endregion
+export { clientSchema, fromJsonBody, rejectServerOnly, serverOnly, wireInput };
+//# sourceMappingURL=attrs.d.mts.map

package/dist/plugins/http/attrs.mjs

@@ -0,0 +1,87 @@
+import { ValidationError } from "../../error.mjs";
+import { asType, attrsOf, isVar, typeOf, validate, withAttrs } from "../../schema.mjs";
+//#region src/plugins/http/attrs.ts
+/** Mark a field as unusable over the wire - HTTP / capability edges
+* reject it if present; in-process callers may still pass it. */
+const serverOnly = (schema) => withAttrs(schema, "http", { serverOnly: true });
+const isServerOnly = (schema) => attrsOf(schema, "http")?.serverOnly === true;
+/**
+* Drop fields (and nested object keys) marked {@link serverOnly}. Used
+* for OpenAPI / client contracts; {@link InferArgs} on the original
+* schema stays the full shape.
+*/
+const clientSchema = (schema) => {
+	if (isVar(schema)) {
+		const v = schema;
+		return {
+			...schema,
+			schema: v.schema === void 0 ? void 0 : clientSchema(v.schema)
+		};
+	}
+	const def = asType(schema);
+	if (def.name === "object" && def.shape !== void 0) {
+		const shape = {};
+		for (const [key, child] of Object.entries(def.shape)) {
+			if (isServerOnly(child)) continue;
+			shape[key] = clientSchema(child);
+		}
+		return {
+			...def,
+			shape
+		};
+	}
+	if (def.name === "array" && def.shape !== void 0) return {
+		...def,
+		shape: clientSchema(def.shape)
+	};
+	if (def.name === "union" && Array.isArray(def.shape)) return {
+		...def,
+		shape: def.shape.map((option) => clientSchema(option))
+	};
+	return schema;
+};
+/**
+* Throw if any {@link serverOnly} field is present on `value` (own key).
+* Object validation otherwise strips unknown keys, so this is what stops
+* wire callers from smuggling server-only values.
+*/
+const rejectServerOnly = (schema, value, path = "input") => {
+	if (value === null || value === void 0) return;
+	const def = asType(isVar(schema) ? schema.schema ?? {} : schema);
+	if (def.name === "object" && def.shape !== void 0) {
+		if (typeOf(value) !== "object") return;
+		const record = value;
+		for (const [key, child] of Object.entries(def.shape)) {
+			if (isServerOnly(child) && Object.hasOwn(record, key)) throw new ValidationError(`${path}.${key}`, "server-only field is not allowed over the wire");
+			if (Object.hasOwn(record, key)) rejectServerOnly(child, record[key], `${path}.${key}`);
+		}
+		return;
+	}
+	if (def.name === "array" && def.shape !== void 0 && Array.isArray(value)) {
+		for (let i = 0; i < value.length; i++) rejectServerOnly(def.shape, value[i], `${path}[${i}]`);
+		return;
+	}
+	if (def.name === "union" && Array.isArray(def.shape)) for (const option of def.shape) rejectServerOnly(option, value, path);
+};
+/**
+* Wire-side input gate: reject smuggled server-only keys, then validate
+* against {@link clientSchema}.
+*/
+const wireInput = (schema, value, path = "input") => {
+	rejectServerOnly(schema, value, path);
+	return validate(asType(clientSchema(schema)), value, path);
+};
+/** Parse a JSON request body and run it through {@link wireInput}. */
+const fromJsonBody = async (request, schema, path = "body") => {
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		throw new ValidationError(path, "expected a JSON body");
+	}
+	return wireInput(schema, body, path);
+};
+//#endregion
+export { clientSchema, fromJsonBody, rejectServerOnly, serverOnly, wireInput };
+
+//# sourceMappingURL=attrs.mjs.map

package/dist/plugins/http/attrs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"attrs.mjs","names":[],"sources":["../../../src/plugins/http/attrs.ts"],"sourcesContent":["import { ValidationError } from \"../../error\";\nimport {\n\tasType,\n\tattrsOf,\n\tisVar,\n\ttypeOf,\n\tvalidate,\n\twithAttrs,\n} from \"../../schema\";\n\n/** Mark a field as unusable over the wire - HTTP / capability edges\n * reject it if present; in-process callers may still pass it. */\nexport const serverOnly = <S>(schema: S): S =>\n\twithAttrs(schema, \"http\", { serverOnly: true });\n\nconst isServerOnly = (schema: unknown) =>\n\tattrsOf(schema, \"http\")?.serverOnly === true;\n\n/**\n * Drop fields (and nested object keys) marked {@link serverOnly}. Used\n * for OpenAPI / client contracts; {@link InferArgs} on the original\n * schema stays the full shape.\n */\nexport const clientSchema = <S>(schema: S): S => {\n\tif (isVar(schema)) {\n\t\tconst v = schema as { schema?: unknown };\n\t\treturn {\n\t\t\t...(schema as object),\n\t\t\tschema: v.schema === undefined ? undefined : clientSchema(v.schema as S),\n\t\t} as S;\n\t}\n\tconst def = asType(schema);\n\tif (def.name === \"object\" && def.shape !== undefined) {\n\t\tconst shape: Record<string, unknown> = {};\n\t\tfor (const [key, child] of Object.entries(\n\t\t\tdef.shape as Record<string, unknown>,\n\t\t)) {\n\t\t\tif (isServerOnly(child)) continue;\n\t\t\tshape[key] = clientSchema(child);\n\t\t}\n\t\treturn { ...def, shape } as S;\n\t}\n\tif (def.name === \"array\" && def.shape !== undefined) {\n\t\treturn { ...def, shape: clientSchema(def.shape) } as S;\n\t}\n\tif (def.name === \"union\" && Array.isArray(def.shape)) {\n\t\treturn {\n\t\t\t...def,\n\t\t\tshape: (def.shape as unknown[]).map((option) => clientSchema(option)),\n\t\t} as S;\n\t}\n\treturn schema;\n};\n\n/**\n * Throw if any {@link serverOnly} field is present on `value` (own key).\n * Object validation otherwise strips unknown keys, so this is what stops\n * wire callers from smuggling server-only values.\n */\nexport const rejectServerOnly = (\n\tschema: unknown,\n\tvalue: unknown,\n\tpath = \"input\",\n): void => {\n\tif (value === null || value === undefined) return;\n\tconst root = isVar(schema)\n\t\t? ((schema as { schema?: unknown }).schema ?? {})\n\t\t: schema;\n\tconst def = asType(root);\n\tif (def.name === \"object\" && def.shape !== undefined) {\n\t\tif (typeOf(value) !== \"object\") return;\n\t\tconst record = value as Record<string, unknown>;\n\t\tfor (const [key, child] of Object.entries(\n\t\t\tdef.shape as Record<string, unknown>,\n\t\t)) {\n\t\t\tif (isServerOnly(child) && Object.hasOwn(record, key)) {\n\t\t\t\tthrow new ValidationError(\n\t\t\t\t\t`${path}.${key}`,\n\t\t\t\t\t\"server-only field is not allowed over the wire\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (Object.hasOwn(record, key)) {\n\t\t\t\trejectServerOnly(child, record[key], `${path}.${key}`);\n\t\t\t}\n\t\t}\n\t\treturn;\n\t}\n\tif (def.name === \"array\" && def.shape !== undefined && Array.isArray(value)) {\n\t\tfor (let i = 0; i < value.length; i++) {\n\t\t\trejectServerOnly(def.shape, value[i], `${path}[${i}]`);\n\t\t}\n\t\treturn;\n\t}\n\tif (def.name === \"union\" && Array.isArray(def.shape)) {\n\t\tfor (const option of def.shape as unknown[]) {\n\t\t\trejectServerOnly(option, value, path);\n\t\t}\n\t}\n};\n\n/**\n * Wire-side input gate: reject smuggled server-only keys, then validate\n * against {@link clientSchema}.\n */\nexport const wireInput = <S>(\n\tschema: S,\n\tvalue: unknown,\n\tpath = \"input\",\n): unknown => {\n\trejectServerOnly(schema, value, path);\n\treturn validate(asType(clientSchema(schema)), value, path);\n};\n\n/** Parse a JSON request body and run it through {@link wireInput}. */\nexport const fromJsonBody = async <S>(\n\trequest: Request,\n\tschema: S,\n\tpath = \"body\",\n): Promise<unknown> => {\n\tlet body: unknown;\n\ttry {\n\t\tbody = await request.json();\n\t} catch {\n\t\tthrow new ValidationError(path, \"expected a JSON body\");\n\t}\n\treturn wireInput(schema, body, path);\n};\n"],"mappings":";;;;;AAYA,MAAa,cAAiB,WAC7B,UAAU,QAAQ,QAAQ,EAAE,YAAY,KAAK,CAAC;AAE/C,MAAM,gBAAgB,WACrB,QAAQ,QAAQ,MAAM,CAAC,EAAE,eAAe;;;;;;AAOzC,MAAa,gBAAmB,WAAiB;CAChD,IAAI,MAAM,MAAM,GAAG;EAClB,MAAM,IAAI;EACV,OAAO;GACN,GAAI;GACJ,QAAQ,EAAE,WAAW,KAAA,IAAY,KAAA,IAAY,aAAa,EAAE,MAAW;EACxE;CACD;CACA,MAAM,MAAM,OAAO,MAAM;CACzB,IAAI,IAAI,SAAS,YAAY,IAAI,UAAU,KAAA,GAAW;EACrD,MAAM,QAAiC,CAAC;EACxC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QACjC,IAAI,KACL,GAAG;GACF,IAAI,aAAa,KAAK,GAAG;GACzB,MAAM,OAAO,aAAa,KAAK;EAChC;EACA,OAAO;GAAE,GAAG;GAAK;EAAM;CACxB;CACA,IAAI,IAAI,SAAS,WAAW,IAAI,UAAU,KAAA,GACzC,OAAO;EAAE,GAAG;EAAK,OAAO,aAAa,IAAI,KAAK;CAAE;CAEjD,IAAI,IAAI,SAAS,WAAW,MAAM,QAAQ,IAAI,KAAK,GAClD,OAAO;EACN,GAAG;EACH,OAAQ,IAAI,MAAoB,KAAK,WAAW,aAAa,MAAM,CAAC;CACrE;CAED,OAAO;AACR;;;;;;AAOA,MAAa,oBACZ,QACA,OACA,OAAO,YACG;CACV,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW;CAI3C,MAAM,MAAM,OAHC,MAAM,MAAM,IACpB,OAAgC,UAAU,CAAC,IAC7C,MACoB;CACvB,IAAI,IAAI,SAAS,YAAY,IAAI,UAAU,KAAA,GAAW;EACrD,IAAI,OAAO,KAAK,MAAM,UAAU;EAChC,MAAM,SAAS;EACf,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QACjC,IAAI,KACL,GAAG;GACF,IAAI,aAAa,KAAK,KAAK,OAAO,OAAO,QAAQ,GAAG,GACnD,MAAM,IAAI,gBACT,GAAG,KAAK,GAAG,OACX,gDACD;GAED,IAAI,OAAO,OAAO,QAAQ,GAAG,GAC5B,iBAAiB,OAAO,OAAO,MAAM,GAAG,KAAK,GAAG,KAAK;EAEvD;EACA;CACD;CACA,IAAI,IAAI,SAAS,WAAW,IAAI,UAAU,KAAA,KAAa,MAAM,QAAQ,KAAK,GAAG;EAC5E,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KACjC,iBAAiB,IAAI,OAAO,MAAM,IAAI,GAAG,KAAK,GAAG,EAAE,EAAE;EAEtD;CACD;CACA,IAAI,IAAI,SAAS,WAAW,MAAM,QAAQ,IAAI,KAAK,GAClD,KAAK,MAAM,UAAU,IAAI,OACxB,iBAAiB,QAAQ,OAAO,IAAI;AAGvC;;;;;AAMA,MAAa,aACZ,QACA,OACA,OAAO,YACM;CACb,iBAAiB,QAAQ,OAAO,IAAI;CACpC,OAAO,SAAS,OAAO,aAAa,MAAM,CAAC,GAAG,OAAO,IAAI;AAC1D;;AAGA,MAAa,eAAe,OAC3B,SACA,QACA,OAAO,WACe;CACtB,IAAI;CACJ,IAAI;EACH,OAAO,MAAM,QAAQ,KAAK;CAC3B,QAAQ;EACP,MAAM,IAAI,gBAAgB,MAAM,sBAAsB;CACvD;CACA,OAAO,UAAU,QAAQ,MAAM,IAAI;AACpC"}

package/dist/plugins/http/cookie.cjs

@@ -0,0 +1,117 @@
+const require_index = require("../../index.cjs");
+const require_response = require("./response.cjs");
+const require_request = require("./request.cjs");
+//#region src/plugins/http/cookie.ts
+/** Cookie attributes as a SCHEMA - the source of truth. The TS type
+* falls out of it, and everything crossing a fn door validates against
+* it (enum-checked sameSite, `instanceof`-checked expires). */
+const cookieShape = {
+	maxAge: require_index.v.number({ optional: true }),
+	expires: require_index.v.date({ optional: true }),
+	path: require_index.v.string({ optional: true }),
+	domain: require_index.v.string({ optional: true }),
+	secure: require_index.v.boolean({ optional: true }),
+	httpOnly: require_index.v.boolean({ optional: true }),
+	sameSite: require_index.v.string({
+		enum: [
+			"strict",
+			"lax",
+			"none"
+		],
+		optional: true
+	})
+};
+/**
+* Scope-level cookie DEFAULTS, as a var: whatever sets it - app setup, a
+* module, an interceptor - every `setCookie` below merges its per-call
+* options ON TOP. Config that travels down the call tree is exactly what
+* a var is, so "change the global cookie config" is just a `.set()` at
+* any point in the scope.
+*/
+const cookieOptions = require_index.v.var("cookieOptions", {
+	default: {},
+	schema: require_index.v.object(cookieShape)
+});
+/** The per-call options field: the same shape, optional to send. */
+const cookieOptionsField = require_index.v.object(cookieShape, { optional: true });
+const serialize = (name, value, options = {}) => {
+	const parts = [`${name}=${encodeURIComponent(value)}`];
+	if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+	if (options.expires) parts.push(`Expires=${options.expires.toUTCString()}`);
+	if (options.path) parts.push(`Path=${options.path}`);
+	if (options.domain) parts.push(`Domain=${options.domain}`);
+	if (options.secure) parts.push("Secure");
+	if (options.httpOnly) parts.push("HttpOnly");
+	if (options.sameSite) parts.push(`SameSite=${options.sameSite.charAt(0).toUpperCase()}${options.sameSite.slice(1)}`);
+	return parts.join("; ");
+};
+const ck = require_index.v.fn("cookie.", { use: [{
+	req: require_request.req,
+	res: require_response.res,
+	cookieOptions
+}] });
+/** Read one cookie from the REQUEST jar. Positional: `getCookie("theme")`.
+* Readonly - reading a cookie can never write the scope. */
+const getCookie = ck.fn("get", {
+	input: [require_index.v.string()],
+	readonly: true
+}, (c) => {
+	const [name] = c.input;
+	return c.req?.cookies[name] ?? null;
+});
+/** Queue a Set-Cookie on the scope's response headers: the scope's
+* `cookieOptions` defaults, with per-call options merged on top. The
+* written cookie also lands in the request jar, so a later `getCookie`
+* in the same scope reads what was set. */
+const setCookie = ck.fn("set", { input: {
+	name: require_index.v.string(),
+	value: require_index.v.string(),
+	options: cookieOptionsField
+} }, (c) => {
+	const { name, value, options } = c.input;
+	let response = c.res;
+	if (!response) {
+		response = { headers: new Headers() };
+		c.res = response;
+	}
+	response.headers.append("set-cookie", serialize(name, value, {
+		...c.cookieOptions,
+		...options
+	}));
+	const current = c.req;
+	if (current) c.req = {
+		...current,
+		cookies: {
+			...current.cookies,
+			[name]: value
+		}
+	};
+	return { set: true };
+});
+/** Expire a cookie: a Set-Cookie with Max-Age=0 - the attributes (path,
+* domain) must match the ones it was set with. */
+const deleteCookie = ck.fn("delete", {
+	input: {
+		name: require_index.v.string(),
+		options: cookieOptionsField
+	},
+	use: [{ setCookie }]
+}, (c) => {
+	const { name, options } = c.input;
+	return c.setCookie({
+		name,
+		value: "",
+		options: {
+			...options,
+			maxAge: 0
+		}
+	});
+});
+//#endregion
+exports.cookieOptions = cookieOptions;
+exports.cookieShape = cookieShape;
+exports.deleteCookie = deleteCookie;
+exports.getCookie = getCookie;
+exports.setCookie = setCookie;
+
+//# sourceMappingURL=cookie.cjs.map

package/dist/plugins/http/cookie.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.cjs","names":["v"],"sources":["../../../src/plugins/http/cookie.ts"],"sourcesContent":["import { v } from \"../../index\";\nimport type { InferArgs } from \"../../schema\";\nimport { req } from \"./request\";\nimport { res } from \"./response\";\n\n/** Cookie attributes as a SCHEMA - the source of truth. The TS type\n * falls out of it, and everything crossing a fn door validates against\n * it (enum-checked sameSite, `instanceof`-checked expires). */\nexport const cookieShape = {\n\tmaxAge: v.number({ optional: true }),\n\texpires: v.date({ optional: true }),\n\tpath: v.string({ optional: true }),\n\tdomain: v.string({ optional: true }),\n\tsecure: v.boolean({ optional: true }),\n\thttpOnly: v.boolean({ optional: true }),\n\tsameSite: v.string({ enum: [\"strict\", \"lax\", \"none\"], optional: true }),\n};\n\nexport type CookieOptions = InferArgs<typeof cookieShape>;\n\n/**\n * Scope-level cookie DEFAULTS, as a var: whatever sets it - app setup, a\n * module, an interceptor - every `setCookie` below merges its per-call\n * options ON TOP. Config that travels down the call tree is exactly what\n * a var is, so \"change the global cookie config\" is just a `.set()` at\n * any point in the scope.\n */\nexport const cookieOptions = v.var(\"cookieOptions\", {\n\tdefault: {},\n\tschema: v.object(cookieShape),\n});\n\n/** The per-call options field: the same shape, optional to send. */\nconst cookieOptionsField = v.object(cookieShape, { optional: true });\n\nconst serialize = (\n\tname: string,\n\tvalue: string,\n\toptions: CookieOptions = {},\n) => {\n\tconst parts = [`${name}=${encodeURIComponent(value)}`];\n\tif (options.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`);\n\tif (options.expires) parts.push(`Expires=${options.expires.toUTCString()}`);\n\tif (options.path) parts.push(`Path=${options.path}`);\n\tif (options.domain) parts.push(`Domain=${options.domain}`);\n\tif (options.secure) parts.push(\"Secure\");\n\tif (options.httpOnly) parts.push(\"HttpOnly\");\n\tif (options.sameSite) {\n\t\tparts.push(\n\t\t\t`SameSite=${options.sameSite.charAt(0).toUpperCase()}${options.sameSite.slice(1)}`,\n\t\t);\n\t}\n\treturn parts.join(\"; \");\n};\n\nconst ck = v.fn(\"cookie.\", {\n\tuse: [{ req, res, cookieOptions }],\n});\n\n/** Read one cookie from the REQUEST jar. Positional: `getCookie(\"theme\")`.\n * Readonly - reading a cookie can never write the scope. */\nexport const getCookie = ck.fn(\n\t\"get\",\n\t{ input: [v.string()], readonly: true },\n\t(c): string | null => {\n\t\tconst [name] = c.input;\n\t\treturn c.req?.cookies[name] ?? null;\n\t},\n);\n\n/** Queue a Set-Cookie on the scope's response headers: the scope's\n * `cookieOptions` defaults, with per-call options merged on top. The\n * written cookie also lands in the request jar, so a later `getCookie`\n * in the same scope reads what was set. */\nexport const setCookie = ck.fn(\n\t\"set\",\n\t{\n\t\tinput: {\n\t\t\tname: v.string(),\n\t\t\tvalue: v.string(),\n\t\t\toptions: cookieOptionsField,\n\t\t},\n\t},\n\t(c) => {\n\t\tconst { name, value, options } = c.input;\n\t\tlet response = c.res;\n\t\tif (!response) {\n\t\t\tresponse = { headers: new Headers() };\n\t\t\tc.res = response;\n\t\t}\n\t\tresponse.headers.append(\n\t\t\t\"set-cookie\",\n\t\t\tserialize(name, value, { ...c.cookieOptions, ...options }),\n\t\t);\n\t\tconst current = c.req;\n\t\tif (current) {\n\t\t\tc.req = {\n\t\t\t\t...current,\n\t\t\t\tcookies: { ...current.cookies, [name]: value },\n\t\t\t};\n\t\t}\n\t\treturn { set: true };\n\t},\n);\n\n/** Expire a cookie: a Set-Cookie with Max-Age=0 - the attributes (path,\n * domain) must match the ones it was set with. */\nexport const deleteCookie = ck.fn(\n\t\"delete\",\n\t{\n\t\tinput: {\n\t\t\tname: v.string(),\n\t\t\toptions: cookieOptionsField,\n\t\t},\n\t\tuse: [{ setCookie }],\n\t},\n\t(c) => {\n\t\tconst { name, options } = c.input;\n\t\treturn c.setCookie({\n\t\t\tname,\n\t\t\tvalue: \"\",\n\t\t\toptions: { ...options, maxAge: 0 },\n\t\t});\n\t},\n);\n"],"mappings":";;;;;;;AAQA,MAAa,cAAc;CAC1B,QAAQA,cAAAA,EAAE,OAAO,EAAE,UAAU,KAAK,CAAC;CACnC,SAASA,cAAAA,EAAE,KAAK,EAAE,UAAU,KAAK,CAAC;CAClC,MAAMA,cAAAA,EAAE,OAAO,EAAE,UAAU,KAAK,CAAC;CACjC,QAAQA,cAAAA,EAAE,OAAO,EAAE,UAAU,KAAK,CAAC;CACnC,QAAQA,cAAAA,EAAE,QAAQ,EAAE,UAAU,KAAK,CAAC;CACpC,UAAUA,cAAAA,EAAE,QAAQ,EAAE,UAAU,KAAK,CAAC;CACtC,UAAUA,cAAAA,EAAE,OAAO;EAAE,MAAM;GAAC;GAAU;GAAO;EAAM;EAAG,UAAU;CAAK,CAAC;AACvE;;;;;;;;AAWA,MAAa,gBAAgBA,cAAAA,EAAE,IAAI,iBAAiB;CACnD,SAAS,CAAC;CACV,QAAQA,cAAAA,EAAE,OAAO,WAAW;AAC7B,CAAC;;AAGD,MAAM,qBAAqBA,cAAAA,EAAE,OAAO,aAAa,EAAE,UAAU,KAAK,CAAC;AAEnE,MAAM,aACL,MACA,OACA,UAAyB,CAAC,MACtB;CACJ,MAAM,QAAQ,CAAC,GAAG,KAAK,GAAG,mBAAmB,KAAK,GAAG;CACrD,IAAI,QAAQ,WAAW,KAAA,GAAW,MAAM,KAAK,WAAW,QAAQ,QAAQ;CACxE,IAAI,QAAQ,SAAS,MAAM,KAAK,WAAW,QAAQ,QAAQ,YAAY,GAAG;CAC1E,IAAI,QAAQ,MAAM,MAAM,KAAK,QAAQ,QAAQ,MAAM;CACnD,IAAI,QAAQ,QAAQ,MAAM,KAAK,UAAU,QAAQ,QAAQ;CACzD,IAAI,QAAQ,QAAQ,MAAM,KAAK,QAAQ;CACvC,IAAI,QAAQ,UAAU,MAAM,KAAK,UAAU;CAC3C,IAAI,QAAQ,UACX,MAAM,KACL,YAAY,QAAQ,SAAS,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,QAAQ,SAAS,MAAM,CAAC,GAChF;CAED,OAAO,MAAM,KAAK,IAAI;AACvB;AAEA,MAAM,KAAKA,cAAAA,EAAE,GAAG,WAAW,EAC1B,KAAK,CAAC;CAAE,KAAA,gBAAA;CAAK,KAAA,iBAAA;CAAK;AAAc,CAAC,EAClC,CAAC;;;AAID,MAAa,YAAY,GAAG,GAC3B,OACA;CAAE,OAAO,CAACA,cAAAA,EAAE,OAAO,CAAC;CAAG,UAAU;AAAK,IACrC,MAAqB;CACrB,MAAM,CAAC,QAAQ,EAAE;CACjB,OAAO,EAAE,KAAK,QAAQ,SAAS;AAChC,CACD;;;;;AAMA,MAAa,YAAY,GAAG,GAC3B,OACA,EACC,OAAO;CACN,MAAMA,cAAAA,EAAE,OAAO;CACf,OAAOA,cAAAA,EAAE,OAAO;CAChB,SAAS;AACV,EACD,IACC,MAAM;CACN,MAAM,EAAE,MAAM,OAAO,YAAY,EAAE;CACnC,IAAI,WAAW,EAAE;CACjB,IAAI,CAAC,UAAU;EACd,WAAW,EAAE,SAAS,IAAI,QAAQ,EAAE;EACpC,EAAE,MAAM;CACT;CACA,SAAS,QAAQ,OAChB,cACA,UAAU,MAAM,OAAO;EAAE,GAAG,EAAE;EAAe,GAAG;CAAQ,CAAC,CAC1D;CACA,MAAM,UAAU,EAAE;CAClB,IAAI,SACH,EAAE,MAAM;EACP,GAAG;EACH,SAAS;GAAE,GAAG,QAAQ;IAAU,OAAO;EAAM;CAC9C;CAED,OAAO,EAAE,KAAK,KAAK;AACpB,CACD;;;AAIA,MAAa,eAAe,GAAG,GAC9B,UACA;CACC,OAAO;EACN,MAAMA,cAAAA,EAAE,OAAO;EACf,SAAS;CACV;CACA,KAAK,CAAC,EAAE,UAAU,CAAC;AACpB,IACC,MAAM;CACN,MAAM,EAAE,MAAM,YAAY,EAAE;CAC5B,OAAO,EAAE,UAAU;EAClB;EACA,OAAO;EACP,SAAS;GAAE,GAAG;GAAS,QAAQ;EAAE;CAClC,CAAC;AACF,CACD"}