gorsee 0.2.3 → 0.2.5

package/dist-pkg/server/page-render.js

@@ -0,0 +1,67 @@
+import { resetServerHead, getServerHead } from "../runtime/head.js";
+import { renderToString, ssrJsx } from "../runtime/server.js";
+function resolvePageDataHook(mod) {
+  if (typeof mod.load === "function")
+    return mod.load;
+  if (typeof mod.loader === "function")
+    return mod.loader;
+  return;
+}
+export async function resolvePageRoute(mod, match, ctx) {
+  const component = mod.default;
+  if (typeof component !== "function")
+    return null;
+  const layoutImportPromises = (match.route.layoutPaths ?? []).map((layoutPath) => import(layoutPath)), pageLoaderPromise = resolvePageDataHook(mod)?.(ctx), [layoutMods, loaderData] = await Promise.all([
+    Promise.all(layoutImportPromises),
+    pageLoaderPromise
+  ]), layoutLoaderPromises = layoutMods.map((layoutMod) => resolvePageDataHook(layoutMod)?.(ctx)), layoutLoaderResults = await Promise.all(layoutLoaderPromises), cssFiles = [];
+  if (typeof mod.css === "string")
+    cssFiles.push(mod.css);
+  if (Array.isArray(mod.css))
+    cssFiles.push(...mod.css);
+  let pageComponent = component;
+  for (let i = layoutMods.length - 1;i >= 0; i--) {
+    const Layout = layoutMods[i].default;
+    if (typeof Layout === "function") {
+      const inner = pageComponent, layoutData = layoutLoaderResults[i];
+      pageComponent = (props) => Layout({ ...props, data: layoutData, children: () => inner(props) });
+    }
+  }
+  return {
+    component,
+    pageComponent,
+    loaderData,
+    cssFiles,
+    renderMode: mod.render ?? "async"
+  };
+}
+export function createClientScriptPath(entryFile) {
+  return entryFile ? `/_gorsee/${entryFile}` : void 0;
+}
+export function renderPageDocument(pageComponent, ctx, params, loaderData) {
+  resetServerHead();
+  const vnode = ssrJsx(pageComponent, { params, ctx, data: loaderData }), html = renderToString(vnode), headElements = getServerHead();
+  return {
+    html,
+    headElements,
+    title: extractTitle(headElements)
+  };
+}
+export function buildPartialResponsePayload(rendered, loaderData, params, cssFiles, clientScript) {
+  return {
+    html: rendered.html,
+    data: loaderData,
+    params: Object.keys(params).length > 0 ? params : void 0,
+    title: rendered.title,
+    css: cssFiles.length > 0 ? cssFiles : void 0,
+    script: clientScript
+  };
+}
+export function extractTitle(headElements) {
+  for (const element of headElements) {
+    const titleMatch = element.match(/<title>(.+?)<\/title>/);
+    if (titleMatch)
+      return titleMatch[1];
+  }
+  return;
+}

package/dist-pkg/server/partial-navigation.d.ts

@@ -0,0 +1,4 @@
+export declare const PARTIAL_NAV_HEADER = "X-Gorsee-Navigate";
+export declare const PARTIAL_NAV_VALUE = "partial";
+export declare function isPartialNavigationRequest(request: Request): boolean;
+export declare function partialNavigationHeaders(extraHeaders?: Record<string, string>): Record<string, string>;

package/dist-pkg/server/partial-navigation.js

@@ -0,0 +1,16 @@
+export const PARTIAL_NAV_HEADER = "X-Gorsee-Navigate", PARTIAL_NAV_VALUE = "partial";
+export function isPartialNavigationRequest(request) {
+  if (request.method !== "GET")
+    return !1;
+  if (request.headers.get(PARTIAL_NAV_HEADER) !== PARTIAL_NAV_VALUE)
+    return !1;
+  return (request.headers.get("Accept") ?? "").includes("application/json");
+}
+export function partialNavigationHeaders(extraHeaders = {}) {
+  return {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store",
+    Vary: "Accept, X-Gorsee-Navigate",
+    ...extraHeaders
+  };
+}

package/dist-pkg/server/pipe.d.ts

@@ -0,0 +1,9 @@
+import type { MiddlewareFn } from "./middleware.js";
+/** Compose multiple middleware into a single middleware function */
+export declare function pipe(...middlewares: MiddlewareFn[]): MiddlewareFn;
+/** Create a conditional middleware — runs inner only if predicate passes */
+export declare function when(predicate: (ctx: import("./middleware.js").Context) => boolean, middleware: MiddlewareFn): MiddlewareFn;
+/** Create a middleware that runs only for specific HTTP methods */
+export declare function forMethods(methods: string[], middleware: MiddlewareFn): MiddlewareFn;
+/** Create a middleware that runs only for specific path prefixes */
+export declare function forPaths(prefixes: string[], middleware: MiddlewareFn): MiddlewareFn;

package/dist-pkg/server/pipe.js

@@ -0,0 +1,32 @@
+export function pipe(...middlewares) {
+  if (middlewares.length === 0)
+    return async (_ctx, next) => next();
+  if (middlewares.length === 1)
+    return middlewares[0];
+  return async (ctx, next) => {
+    let index = 0;
+    const run = async () => {
+      if (index < middlewares.length) {
+        const mw = middlewares[index];
+        index++;
+        return mw(ctx, run);
+      }
+      return next();
+    };
+    return run();
+  };
+}
+export function when(predicate, middleware) {
+  return async (ctx, next) => {
+    if (predicate(ctx))
+      return middleware(ctx, next);
+    return next();
+  };
+}
+export function forMethods(methods, middleware) {
+  const methodSet = new Set(methods.map((m) => m.toUpperCase()));
+  return when((ctx) => methodSet.has(ctx.request.method), middleware);
+}
+export function forPaths(prefixes, middleware) {
+  return when((ctx) => prefixes.some((p) => ctx.url.pathname.startsWith(p)), middleware);
+}

package/dist-pkg/server/redis-cache-store.d.ts

@@ -0,0 +1,10 @@
+import type { CacheStore } from "./cache.js";
+import { type RedisLikeClient } from "./redis-client.js";
+interface RedisCacheStoreOptions {
+    prefix?: string;
+    maxEntryAgeMs?: number;
+}
+export declare function createRedisCacheStore(client: RedisLikeClient, options?: RedisCacheStoreOptions): CacheStore & {
+    deleteExpired(): Promise<number>;
+};
+export {};

package/dist-pkg/server/redis-cache-store.js

@@ -0,0 +1,73 @@
+import {
+  buildRedisKey,
+  deleteExpiredRedisKeys,
+  stripRedisPrefix
+} from "./redis-client.js";
+import { safeJSONParse } from "../ai/json.js";
+function isExpired(entry, maxEntryAgeMs) {
+  return Date.now() - entry.createdAt > maxEntryAgeMs;
+}
+export function createRedisCacheStore(client, options = {}) {
+  const prefix = options.prefix ?? "gorsee:cache", maxEntryAgeMs = options.maxEntryAgeMs ?? 86400000;
+  return {
+    async get(key) {
+      const raw = await client.get(buildRedisKey(prefix, key));
+      if (!raw)
+        return;
+      const payload = safeJSONParse(raw);
+      if (!payload?.entry) {
+        await client.del(buildRedisKey(prefix, key));
+        return;
+      }
+      if (isExpired(payload.entry, maxEntryAgeMs)) {
+        await client.del(buildRedisKey(prefix, key));
+        return;
+      }
+      return payload.entry;
+    },
+    async set(key, entry) {
+      const redisKey = buildRedisKey(prefix, key);
+      await client.set(redisKey, JSON.stringify({ entry }));
+      if (client.expire)
+        await client.expire(redisKey, Math.max(1, Math.ceil(maxEntryAgeMs / 1000)));
+    },
+    async delete(key) {
+      await client.del(buildRedisKey(prefix, key));
+    },
+    async clear() {
+      const keys = await client.keys(`${prefix}:*`);
+      if (keys.length === 0)
+        return;
+      for (const key of keys)
+        await client.del(key);
+    },
+    async keys() {
+      const keys = await client.keys(`${prefix}:*`), visibleKeys = [];
+      for (const key of keys) {
+        const raw = await client.get(key);
+        if (!raw)
+          continue;
+        const payload = safeJSONParse(raw);
+        if (!payload?.entry) {
+          await client.del(key);
+          continue;
+        }
+        if (isExpired(payload.entry, maxEntryAgeMs)) {
+          await client.del(key);
+          continue;
+        }
+        visibleKeys.push(stripRedisPrefix(prefix, key));
+      }
+      return visibleKeys;
+    },
+    async deleteExpired() {
+      return deleteExpiredRedisKeys(client, `${prefix}:*`, Date.now(), (raw) => {
+        try {
+          return JSON.parse(raw).entry.createdAt;
+        } catch {
+          return;
+        }
+      }, maxEntryAgeMs);
+    }
+  };
+}

package/dist-pkg/server/redis-client.d.ts

@@ -0,0 +1,37 @@
+type Awaitable<T> = T | Promise<T>;
+export interface RedisLikeClient {
+    get(key: string): Awaitable<string | null>;
+    set(key: string, value: string): Awaitable<unknown>;
+    del(key: string): Awaitable<number>;
+    keys(pattern: string): Awaitable<string[]>;
+    incr?(key: string): Awaitable<number>;
+    expire?(key: string, seconds: number): Awaitable<number>;
+    pttl?(key: string): Awaitable<number>;
+    ttl?(key: string): Awaitable<number>;
+}
+export declare function buildRedisKey(prefix: string, key: string): string;
+export declare function stripRedisPrefix(prefix: string, key: string): string;
+export interface NodeRedisClientLike {
+    get(key: string): Awaitable<string | null>;
+    set(key: string, value: string): Awaitable<unknown>;
+    del(key: string): Awaitable<number>;
+    keys(pattern: string): Awaitable<string[]>;
+    incr?(key: string): Awaitable<number>;
+    expire?(key: string, seconds: number): Awaitable<number>;
+    pttl?(key: string): Awaitable<number>;
+    ttl?(key: string): Awaitable<number>;
+}
+export interface IORedisClientLike {
+    get(key: string): Awaitable<string | null>;
+    set(key: string, value: string): Awaitable<unknown>;
+    del(key: string): Awaitable<number>;
+    keys(pattern: string): Awaitable<string[]>;
+    incr?(key: string): Awaitable<number>;
+    expire?(key: string, seconds: number): Awaitable<number>;
+    pttl?(key: string): Awaitable<number>;
+    ttl?(key: string): Awaitable<number>;
+}
+export declare function createNodeRedisLikeClient(client: NodeRedisClientLike): RedisLikeClient;
+export declare function createIORedisLikeClient(client: IORedisClientLike): RedisLikeClient;
+export declare function deleteExpiredRedisKeys(client: RedisLikeClient, pattern: string, now: number, parseCreatedAt: (value: string) => number | undefined, maxEntryAgeMs: number): Promise<number>;
+export {};

package/dist-pkg/server/redis-client.js

@@ -0,0 +1,37 @@
+export function buildRedisKey(prefix, key) {
+  return `${prefix}:${key}`;
+}
+export function stripRedisPrefix(prefix, key) {
+  const expected = `${prefix}:`;
+  return key.startsWith(expected) ? key.slice(expected.length) : key;
+}
+export function createNodeRedisLikeClient(client) {
+  return {
+    get: (key) => client.get(key),
+    set: (key, value) => client.set(key, value),
+    del: (key) => client.del(key),
+    keys: (pattern) => client.keys(pattern),
+    incr: client.incr ? (key) => client.incr(key) : void 0,
+    expire: client.expire ? (key, seconds) => client.expire(key, seconds) : void 0,
+    pttl: client.pttl ? (key) => client.pttl(key) : void 0,
+    ttl: client.ttl ? (key) => client.ttl(key) : void 0
+  };
+}
+export function createIORedisLikeClient(client) {
+  return createNodeRedisLikeClient(client);
+}
+export async function deleteExpiredRedisKeys(client, pattern, now, parseCreatedAt, maxEntryAgeMs) {
+  let deleted = 0;
+  for (const key of await client.keys(pattern)) {
+    const raw = await client.get(key);
+    if (raw === null)
+      continue;
+    const createdAt = parseCreatedAt(raw);
+    if (createdAt === void 0)
+      continue;
+    if (createdAt > now - maxEntryAgeMs)
+      continue;
+    deleted += await client.del(key);
+  }
+  return deleted;
+}

package/dist-pkg/server/request-policy.d.ts

@@ -0,0 +1,55 @@
+type RouteModule = Record<string, unknown>;
+export type RequestExecutionKind = "page" | "partial" | "action" | "route-handler" | "rpc" | "static";
+export type RouteRequestExecutionKind = Exclude<RequestExecutionKind, "rpc" | "static">;
+export type RequestVisibility = "public" | "internal";
+export type RequestAccess = "public" | "internal";
+export type RequestMutation = "read" | "write";
+export type RequestResponseShape = "document" | "data" | "raw";
+export interface RequestMetadata {
+    request: Request;
+    url: URL;
+    pathname: string;
+    method: string;
+    host: string;
+    protocol: string;
+    trustedOrigin?: string;
+    effectiveOrigin: string;
+    effectiveHost: string;
+    effectiveProto: string;
+    origin?: string;
+    forwarded?: string;
+    forwardedHost?: string;
+    forwardedProto?: string;
+    forwardedFor?: string;
+    proxyTrusted: boolean;
+    kind: RequestExecutionKind;
+    visibility: RequestVisibility;
+    access: RequestAccess;
+    mutation: RequestMutation;
+    isStateChanging: boolean;
+}
+export interface RequestExecutionPolicy {
+    kind: RequestExecutionKind;
+    visibility: RequestVisibility;
+    access: RequestAccess;
+    mutation: RequestMutation;
+    responseShape: RequestResponseShape;
+    requiresTrustedOrigin: boolean;
+    allowedContentTypes?: string[];
+}
+export interface RequestPolicyOptions {
+    trustedOrigin?: string;
+    kind: RequestExecutionKind;
+    visibility?: RequestVisibility;
+    trustForwardedHeaders?: boolean;
+    trustedForwardedHops?: number;
+}
+export interface RequestPolicyValidationOptions {
+    allowedContentTypes?: string[];
+}
+export declare function resolveRequestMetadata(request: Request, options: RequestPolicyOptions): RequestMetadata;
+export declare function classifyRouteRequest(mod: RouteModule, request: Request): RouteRequestExecutionKind;
+export declare function validateRequestPolicy(metadata: RequestMetadata, options?: RequestPolicyValidationOptions & Partial<Pick<RequestExecutionPolicy, "requiresTrustedOrigin">>): Response | null;
+export declare function resolveRequestExecutionPolicy(kind: RequestExecutionKind): RequestExecutionPolicy;
+export declare function attachRequestMetadata(locals: Record<string, unknown>, metadata: RequestMetadata, policy?: RequestExecutionPolicy): void;
+export {};

package/dist-pkg/server/request-policy.js

@@ -0,0 +1,216 @@
+import { isAllowedRequestOrigin } from "./middleware.js";
+import { isPartialNavigationRequest } from "./partial-navigation.js";
+import { RPC_ACCEPTED_CONTENT_TYPES } from "./rpc.js";
+export function resolveRequestMetadata(request, options) {
+  const url = new URL(request.url), endpointContract = resolveRequestExecutionPolicy(options.kind), urlProtocol = url.protocol.replace(/:$/, ""), trustedForwardedHops = options.trustForwardedHeaders === !0 ? Math.max(1, options.trustedForwardedHops ?? 1) : 0, forwarded = parseForwardedHeader(request.headers.get("forwarded"), trustedForwardedHops), forwardedHost = normalizeForwardedHost(getTrustedForwardedValue(request.headers.get("x-forwarded-host"), trustedForwardedHops) ?? forwarded.host) ?? forwarded.host ?? void 0, forwardedProto = normalizeForwardedProto(getTrustedForwardedValue(request.headers.get("x-forwarded-proto"), trustedForwardedHops) ?? forwarded.proto) ?? forwarded.proto ?? void 0, forwardedFor = normalizeForwardedFor(getTrustedForwardedValue(request.headers.get("x-forwarded-for"), trustedForwardedHops) ?? forwarded.for) ?? forwarded.for ?? void 0, proxyTrusted = options.trustForwardedHeaders === !0, effectiveHost = proxyTrusted ? forwardedHost ?? (request.headers.get("host") ?? url.host) : request.headers.get("host") ?? url.host, effectiveProto = proxyTrusted ? forwardedProto ?? urlProtocol : urlProtocol;
+  return {
+    request,
+    url,
+    pathname: url.pathname,
+    method: request.method,
+    host: request.headers.get("host") ?? url.host,
+    protocol: urlProtocol,
+    trustedOrigin: options.trustedOrigin,
+    effectiveOrigin: options.trustedOrigin ?? `${effectiveProto}://${effectiveHost}`,
+    effectiveHost,
+    effectiveProto,
+    origin: request.headers.get("origin") ?? void 0,
+    forwarded: request.headers.get("forwarded") ?? void 0,
+    forwardedHost,
+    forwardedProto,
+    forwardedFor,
+    proxyTrusted,
+    kind: options.kind,
+    visibility: options.visibility ?? defaultVisibilityForKind(options.kind),
+    access: endpointContract.access,
+    mutation: endpointContract.mutation,
+    isStateChanging: isStateChangingMethod(request.method)
+  };
+}
+export function classifyRouteRequest(mod, request) {
+  if (typeof mod.GET === "function" && request.method === "GET" || typeof mod.POST === "function" && request.method === "POST")
+    return "route-handler";
+  if (request.method === "POST" && typeof mod.action === "function")
+    return "action";
+  if (isPartialNavigationRequest(request))
+    return "partial";
+  return "page";
+}
+export function validateRequestPolicy(metadata, options = {}) {
+  if (metadata.isStateChanging && options.requiresTrustedOrigin !== !1 && metadata.trustedOrigin && !isAllowedRequestOrigin(metadata.request, metadata.trustedOrigin))
+    return new Response("Forbidden", { status: 403 });
+  if (options.allowedContentTypes && hasRequestBody(metadata.request)) {
+    const contentType = metadata.request.headers.get("content-type") ?? "";
+    if (!contentType)
+      return new Response("Unsupported Media Type", { status: 415 });
+    if (!options.allowedContentTypes.some((allowedType) => contentType.includes(allowedType)))
+      return new Response("Unsupported Media Type", { status: 415 });
+  }
+  return null;
+}
+export function resolveRequestExecutionPolicy(kind) {
+  switch (kind) {
+    case "rpc":
+      return {
+        kind,
+        visibility: "internal",
+        access: "internal",
+        mutation: "write",
+        responseShape: "data",
+        requiresTrustedOrigin: !0,
+        allowedContentTypes: [...RPC_ACCEPTED_CONTENT_TYPES]
+      };
+    case "action":
+      return {
+        kind,
+        visibility: "public",
+        access: "public",
+        mutation: "write",
+        responseShape: "data",
+        requiresTrustedOrigin: !0,
+        allowedContentTypes: [
+          "application/x-www-form-urlencoded",
+          "multipart/form-data",
+          "application/json"
+        ]
+      };
+    case "partial":
+      return {
+        kind,
+        visibility: "internal",
+        access: "internal",
+        mutation: "read",
+        responseShape: "data",
+        requiresTrustedOrigin: !1
+      };
+    case "route-handler":
+      return {
+        kind,
+        visibility: "public",
+        access: "public",
+        mutation: "write",
+        responseShape: "raw",
+        requiresTrustedOrigin: !0
+      };
+    case "page":
+    case "static":
+      return {
+        kind,
+        visibility: "public",
+        access: "public",
+        mutation: "read",
+        responseShape: kind === "static" ? "raw" : "document",
+        requiresTrustedOrigin: !1
+      };
+  }
+}
+export function attachRequestMetadata(locals, metadata, policy = resolveRequestExecutionPolicy(metadata.kind)) {
+  locals.requestKind = metadata.kind;
+  locals.requestVisibility = policy.visibility;
+  locals.requestPolicy = policy;
+  locals.requestAccess = policy.access;
+  locals.requestMutation = policy.mutation;
+  locals.requestResponseShape = policy.responseShape;
+  locals.requestHost = metadata.host;
+  locals.requestProtocol = metadata.protocol;
+  locals.requestOrigin = metadata.origin;
+  locals.requestEffectiveOrigin = metadata.effectiveOrigin;
+  locals.requestEffectiveHost = metadata.effectiveHost;
+  locals.requestEffectiveProto = metadata.effectiveProto;
+  locals.requestProxyTrusted = metadata.proxyTrusted;
+  locals.requestForwarded = metadata.forwarded;
+  locals.forwardedHost = metadata.forwardedHost;
+  locals.forwardedProto = metadata.forwardedProto;
+  locals.forwardedFor = metadata.forwardedFor;
+}
+function defaultVisibilityForKind(kind) {
+  return kind === "partial" || kind === "rpc" ? "internal" : "public";
+}
+function isStateChangingMethod(method) {
+  return !["GET", "HEAD", "OPTIONS"].includes(method.toUpperCase());
+}
+function hasRequestBody(request) {
+  return Number(request.headers.get("content-length") ?? "0") > 0 || request.body !== null;
+}
+function parseForwardedHeader(header, trustedHops = 1) {
+  if (!header)
+    return {};
+  const entries = splitHeaderList(header, ",");
+  if (entries.length === 0)
+    return {};
+  const trustedEntry = entries[Math.max(0, entries.length - trustedHops)] ?? entries[entries.length - 1];
+  if (!trustedEntry)
+    return {};
+  const result = {};
+  for (const segment of splitHeaderList(trustedEntry, ";")) {
+    const [rawKey, rawValue] = segment.split("=", 2);
+    if (!rawKey || !rawValue)
+      continue;
+    const key = rawKey.trim().toLowerCase(), value = normalizeForwardedValue(rawValue);
+    if (!value)
+      continue;
+    if (key === "for")
+      result.for = normalizeForwardedFor(value);
+    if (key === "host")
+      result.host = normalizeForwardedHost(value);
+    if (key === "proto")
+      result.proto = normalizeForwardedProto(value);
+  }
+  return result;
+}
+function getTrustedForwardedValue(header, trustedHops) {
+  if (!header)
+    return;
+  const values = splitHeaderList(header, ",");
+  if (values.length === 0)
+    return;
+  return normalizeForwardedValue(values[Math.max(0, values.length - trustedHops)] ?? values[values.length - 1]);
+}
+function splitHeaderList(input, separator) {
+  const parts = [];
+  let current = "", quoted = !1;
+  for (const char of input) {
+    if (char === '"')
+      quoted = !quoted;
+    if (char === separator && !quoted) {
+      const trimmed = current.trim();
+      if (trimmed)
+        parts.push(trimmed);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  const trimmed = current.trim();
+  if (trimmed)
+    parts.push(trimmed);
+  return parts;
+}
+function normalizeForwardedValue(value) {
+  if (typeof value !== "string")
+    return;
+  const normalized = value.trim().replace(/^"|"$/g, "").trim();
+  return normalized ? normalized : void 0;
+}
+function normalizeForwardedHost(value) {
+  const normalized = normalizeForwardedValue(value);
+  if (!normalized)
+    return;
+  if (/[/?#\s]/.test(normalized))
+    return;
+  return normalized.toLowerCase();
+}
+function normalizeForwardedProto(value) {
+  const normalized = normalizeForwardedValue(value)?.replace(/:$/, "").toLowerCase();
+  if (!normalized)
+    return;
+  return ["http", "https", "ws", "wss"].includes(normalized) ? normalized : void 0;
+}
+function normalizeForwardedFor(value) {
+  const normalized = normalizeForwardedValue(value);
+  if (!normalized)
+    return;
+  if (/[/?#\s]/.test(normalized))
+    return;
+  return normalized;
+}

package/dist-pkg/server/request-preflight.d.ts

@@ -0,0 +1,23 @@
+import { type RPCRegistry } from "./rpc.js";
+import type { MiddlewareFn } from "./middleware.js";
+import { type RequestSecurityPolicy } from "./request-security-policy.js";
+interface RateLimitResult {
+    allowed: boolean;
+    resetAt: number;
+}
+interface RateLimiterLike {
+    check(key: string): RateLimitResult | Promise<RateLimitResult>;
+}
+export declare function createRateLimitResponse(rateLimiter: RateLimiterLike, key: string): Promise<Response | null>;
+export declare function applyResponseHeaders(response: Response, headers: Record<string, string>): Response;
+export interface RPCRequestOptions {
+    registry?: Pick<RPCRegistry, "getHandler">;
+    middlewares?: MiddlewareFn[];
+    trustedOrigin?: string;
+    trustForwardedHeaders?: boolean;
+    trustedForwardedHops?: number;
+    securityPolicy?: RequestSecurityPolicy;
+}
+export declare function handleRPCWithHeaders(request: Request, headers: Record<string, string>, options?: RPCRequestOptions): Promise<Response | null>;
+export declare function handleRPCRequestWithPolicy(request: Request, options?: RPCRequestOptions): Promise<Response | null>;
+export {};

package/dist-pkg/server/request-preflight.js

@@ -0,0 +1,45 @@
+import { handleRPCRequest, handleRPCRequestWithRegistry } from "./rpc.js";
+import { executeServerExecution } from "./server-execution.js";
+import {
+  createRequestSecurityPolicy
+} from "./request-security-policy.js";
+export async function createRateLimitResponse(rateLimiter, key) {
+  const result = await rateLimiter.check(key);
+  if (result.allowed)
+    return null;
+  return new Response("Too Many Requests", {
+    status: 429,
+    headers: {
+      "Retry-After": String(Math.ceil((result.resetAt - Date.now()) / 1000))
+    }
+  });
+}
+export function applyResponseHeaders(response, headers) {
+  for (const key in headers)
+    response.headers.set(key, headers[key]);
+  return response;
+}
+export async function handleRPCWithHeaders(request, headers, options = {}) {
+  const response = await handleRPCRequestWithPolicy(request, options);
+  if (!response)
+    return null;
+  return applyResponseHeaders(response, headers);
+}
+export async function handleRPCRequestWithPolicy(request, options = {}) {
+  const { registry, middlewares = [] } = options, pathname = new URL(request.url).pathname;
+  if (!/^\/api\/_rpc\/[a-zA-Z0-9]+$/.test(pathname))
+    return null;
+  const securityPolicy = options.securityPolicy ?? createRequestSecurityPolicy({
+    trustedOrigin: options.trustedOrigin,
+    trustForwardedHeaders: options.trustForwardedHeaders,
+    trustedForwardedHops: options.trustedForwardedHops
+  });
+  return await executeServerExecution({
+    request,
+    kind: "rpc",
+    securityPolicy,
+    middlewares,
+    route: pathname,
+    handler: async () => registry ? await handleRPCRequestWithRegistry(request, registry) : await handleRPCRequest(request)
+  });
+}

package/dist-pkg/server/request-security-policy.d.ts

@@ -0,0 +1,17 @@
+import type { RequestExecutionPolicy, RequestMetadata } from "./request-policy.js";
+export interface RequestSecurityPolicy {
+    trustedOrigin?: string;
+    trustForwardedHeaders: boolean;
+    trustedForwardedHops: number;
+    trustedHosts: string[];
+    enforceTrustedHosts: boolean;
+}
+export interface RequestSecurityPolicyOptions {
+    trustedOrigin?: string;
+    trustForwardedHeaders?: boolean;
+    trustedForwardedHops?: number;
+    trustedHosts?: string[];
+    enforceTrustedHosts?: boolean;
+}
+export declare function createRequestSecurityPolicy(options?: RequestSecurityPolicyOptions): RequestSecurityPolicy;
+export declare function validateRequestSecurityPolicy(metadata: RequestMetadata, executionPolicy: RequestExecutionPolicy, securityPolicy: RequestSecurityPolicy): Response | null;