silgi 0.0.14 → 0.1.0-beta.10

package/dist/plugins/ratelimit.mjs

@@ -0,0 +1,92 @@
+import { SilgiError } from "../core/error.mjs";
+//#region src/plugins/ratelimit.ts
+/**
+* Rate limiting plugin — v2 guard middleware.
+*
+* Sliding window in-memory rate limiter.
+* Pluggable: swap MemoryRateLimiter for Redis/Upstash/etc.
+*/
+var MemoryRateLimiter = class {
+	#limit;
+	#windowMs;
+	#store = /* @__PURE__ */ new Map();
+	#evictTimer;
+	constructor(options) {
+		this.#limit = options.limit;
+		this.#windowMs = options.windowMs;
+		this.#evictTimer = setInterval(() => this.evict(), this.#windowMs * 2);
+		if (typeof this.#evictTimer === "object" && "unref" in this.#evictTimer) this.#evictTimer.unref();
+	}
+	async limit(key) {
+		const now = Date.now();
+		const windowStart = now - this.#windowMs;
+		let timestamps = this.#store.get(key);
+		if (!timestamps) {
+			timestamps = [];
+			this.#store.set(key, timestamps);
+		}
+		while (timestamps.length > 0 && timestamps[0] < windowStart) timestamps.shift();
+		const remaining = Math.max(0, this.#limit - timestamps.length);
+		const reset = timestamps.length > 0 ? timestamps[0] + this.#windowMs : now + this.#windowMs;
+		if (timestamps.length >= this.#limit) return {
+			success: false,
+			limit: this.#limit,
+			remaining: 0,
+			reset
+		};
+		timestamps.push(now);
+		return {
+			success: true,
+			limit: this.#limit,
+			remaining: remaining - 1,
+			reset
+		};
+	}
+	/** Remove entries with no active timestamps to prevent unbounded Map growth */
+	evict() {
+		const now = Date.now();
+		for (const [key, timestamps] of this.#store) {
+			while (timestamps.length > 0 && timestamps[0] < now - this.#windowMs) timestamps.shift();
+			if (timestamps.length === 0) this.#store.delete(key);
+		}
+	}
+};
+/**
+* Create a rate limiting guard.
+*
+* @example
+* ```ts
+* import { rateLimitGuard, MemoryRateLimiter } from "silgi/ratelimit"
+*
+* const rateLimit = rateLimitGuard({
+*   limiter: new MemoryRateLimiter({ limit: 100, windowMs: 60_000 }),
+*   keyFn: (ctx) => (ctx as any).ip ?? "anonymous",
+* })
+*
+* const proc = k
+*   .$use(rateLimit)
+*   .$resolve(() => ({ ok: true }))
+* ```
+*/
+function rateLimitGuard(options) {
+	return {
+		kind: "guard",
+		fn: async (ctx) => {
+			const key = await options.keyFn(ctx);
+			const result = await options.limiter.limit(key);
+			if (!result.success) throw new SilgiError("TOO_MANY_REQUESTS", {
+				status: 429,
+				message: options.message ?? "Rate limit exceeded",
+				data: {
+					limit: result.limit,
+					remaining: result.remaining,
+					reset: result.reset,
+					retryAfter: Math.ceil((result.reset - Date.now()) / 1e3)
+				}
+			});
+			return { rateLimit: result };
+		}
+	};
+}
+//#endregion
+export { MemoryRateLimiter, rateLimitGuard };

package/dist/plugins/signing.d.mts

@@ -0,0 +1,41 @@
+//#region src/plugins/signing.d.ts
+/**
+ * Signing & Encryption utilities — HMAC-SHA256 and AES-GCM.
+ *
+ * Uses the Web Crypto API (works in Node.js, Bun, Deno, Cloudflare Workers).
+ *
+ * @example
+ * ```ts
+ * import { sign, unsign, encrypt, decrypt } from "silgi/plugins"
+ *
+ * // Sign a value (tamper-proof)
+ * const signed = await sign("user:123", "my-secret")
+ * const value = await unsign(signed, "my-secret") // "user:123" or null
+ *
+ * // Encrypt a value (confidential)
+ * const encrypted = await encrypt("sensitive-data", "my-secret")
+ * const decrypted = await decrypt(encrypted, "my-secret") // "sensitive-data"
+ * ```
+ */
+/**
+ * Sign a string value with HMAC-SHA256.
+ * Returns `value.signature` — use `unsign()` to verify.
+ */
+declare function sign(value: string, secret: string): Promise<string>;
+/**
+ * Verify and extract a signed value.
+ * Returns the original value if valid, or `null` if tampered.
+ */
+declare function unsign(signed: string, secret: string): Promise<string | null>;
+/**
+ * Encrypt a string with AES-256-GCM (PBKDF2 key derivation).
+ * Returns a base64url-encoded string containing salt + iv + ciphertext.
+ */
+declare function encrypt(plaintext: string, secret: string): Promise<string>;
+/**
+ * Decrypt a string encrypted with `encrypt()`.
+ * Returns the original plaintext, or throws if the secret is wrong.
+ */
+declare function decrypt(encrypted: string, secret: string): Promise<string>;
+//#endregion
+export { decrypt, encrypt, sign, unsign };

package/dist/plugins/signing.mjs

@@ -0,0 +1,118 @@
+//#region src/plugins/signing.ts
+/**
+* Signing & Encryption utilities — HMAC-SHA256 and AES-GCM.
+*
+* Uses the Web Crypto API (works in Node.js, Bun, Deno, Cloudflare Workers).
+*
+* @example
+* ```ts
+* import { sign, unsign, encrypt, decrypt } from "silgi/plugins"
+*
+* // Sign a value (tamper-proof)
+* const signed = await sign("user:123", "my-secret")
+* const value = await unsign(signed, "my-secret") // "user:123" or null
+*
+* // Encrypt a value (confidential)
+* const encrypted = await encrypt("sensitive-data", "my-secret")
+* const decrypted = await decrypt(encrypted, "my-secret") // "sensitive-data"
+* ```
+*/
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+async function getSigningKey(secret) {
+	return crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign", "verify"]);
+}
+function toHex(buffer) {
+	return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function fromHex(hex) {
+	if (hex.length % 2 !== 0 || hex.length === 0) return null;
+	if (!/^[0-9a-f]+$/i.test(hex)) return null;
+	const bytes = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < hex.length; i += 2) bytes[i / 2] = Number.parseInt(hex.slice(i, i + 2), 16);
+	return bytes;
+}
+/**
+* Sign a string value with HMAC-SHA256.
+* Returns `value.signature` — use `unsign()` to verify.
+*/
+async function sign(value, secret) {
+	const key = await getSigningKey(secret);
+	return `${value}.${toHex(await crypto.subtle.sign("HMAC", key, encoder.encode(value)))}`;
+}
+/**
+* Verify and extract a signed value.
+* Returns the original value if valid, or `null` if tampered.
+*/
+async function unsign(signed, secret) {
+	const dotIdx = signed.lastIndexOf(".");
+	if (dotIdx === -1) return null;
+	const value = signed.slice(0, dotIdx);
+	const expected = fromHex(signed.slice(dotIdx + 1));
+	if (!expected) return null;
+	const key = await getSigningKey(secret);
+	return await crypto.subtle.verify("HMAC", key, expected.buffer, encoder.encode(value)) ? value : null;
+}
+async function getEncryptionKey(secret, salt) {
+	const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(secret), "PBKDF2", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "PBKDF2",
+		salt: salt.buffer,
+		iterations: 1e5,
+		hash: "SHA-256"
+	}, keyMaterial, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+/**
+* Encrypt a string with AES-256-GCM (PBKDF2 key derivation).
+* Returns a base64url-encoded string containing salt + iv + ciphertext.
+*/
+async function encrypt(plaintext, secret) {
+	const salt = crypto.getRandomValues(new Uint8Array(16));
+	const iv = crypto.getRandomValues(new Uint8Array(12));
+	const key = await getEncryptionKey(secret, salt);
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, key, encoder.encode(plaintext));
+	const combined = new Uint8Array(salt.length + iv.length + ciphertext.byteLength);
+	combined.set(salt, 0);
+	combined.set(iv, salt.length);
+	combined.set(new Uint8Array(ciphertext), salt.length + iv.length);
+	return base64urlEncode(combined);
+}
+/**
+* Decrypt a string encrypted with `encrypt()`.
+* Returns the original plaintext, or throws if the secret is wrong.
+*/
+async function decrypt(encrypted, secret) {
+	const combined = base64urlDecode(encrypted);
+	const salt = combined.slice(0, 16);
+	const iv = combined.slice(16, 28);
+	const ciphertext = combined.slice(28);
+	const key = await getEncryptionKey(secret, salt);
+	const plaintext = await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv
+	}, key, ciphertext);
+	return decoder.decode(plaintext);
+}
+function base64urlEncode(data) {
+	let binary = "";
+	const chunkSize = 8192;
+	for (let i = 0; i < data.length; i += chunkSize) binary += String.fromCharCode(...data.subarray(i, i + chunkSize));
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(str) {
+	const base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+	const binary = atob(padded);
+	return Uint8Array.from(binary, (c) => c.charCodeAt(0));
+}
+//#endregion
+export { decrypt, encrypt, sign, unsign };

package/dist/plugins/strict-get.d.mts

@@ -0,0 +1,10 @@
+import { GuardDef } from "../types.mjs";
+
+//#region src/plugins/strict-get.d.ts
+/**
+ * Guard that rejects non-GET requests. Use on query procedures
+ * to enforce RESTful method semantics and prevent CSRF.
+ */
+declare const strictGetGuard: GuardDef<Record<string, unknown>>;
+//#endregion
+export { strictGetGuard };

package/dist/plugins/strict-get.mjs

@@ -0,0 +1,33 @@
+import { SilgiError } from "../core/error.mjs";
+//#region src/plugins/strict-get.ts
+/**
+* Strict GET method guard — enforce GET for query procedures.
+*
+* Rejects non-GET requests to query procedures with 405 Method Not Allowed.
+* Mutations must use POST. This prevents CSRF on read endpoints.
+*
+* @example
+* ```ts
+* import { strictGetGuard } from "silgi/plugins"
+*
+* const listUsers = k
+*   .$use(strictGetGuard)
+*   .$resolve(({ ctx }) => ctx.db.users.findMany())
+* ```
+*/
+/**
+* Guard that rejects non-GET requests. Use on query procedures
+* to enforce RESTful method semantics and prevent CSRF.
+*/
+const strictGetGuard = {
+	kind: "guard",
+	fn: (ctx) => {
+		const method = ctx.method;
+		if (method && method !== "GET" && method !== "HEAD") throw new SilgiError("METHOD_NOT_ALLOWED", {
+			status: 405,
+			message: `Expected GET, received ${method}`
+		});
+	}
+};
+//#endregion
+export { strictGetGuard };

package/dist/scalar.d.mts

@@ -0,0 +1,49 @@
+import { RouterDef } from "./types.mjs";
+//#region src/scalar.d.ts
+interface ScalarOptions {
+  title?: string;
+  version?: string;
+  description?: string;
+  servers?: {
+    url: string;
+    description?: string;
+  }[];
+  /** Security scheme (e.g. Bearer token) */
+  security?: {
+    type: 'http' | 'apiKey';
+    scheme?: string;
+    bearerFormat?: string;
+    in?: 'header' | 'query';
+    name?: string;
+    description?: string;
+  };
+  /** Contact info */
+  contact?: {
+    name?: string;
+    url?: string;
+    email?: string;
+  };
+  /** License */
+  license?: {
+    name: string;
+    url?: string;
+  };
+  /** External docs */
+  externalDocs?: {
+    url: string;
+    description?: string;
+  };
+  /**
+   * Scalar UI script source.
+   *
+   * - `'cdn'` (default) — loads from cdn.jsdelivr.net
+   * - `'unpkg'` — loads from unpkg.com
+   * - `'local'` — serves from node_modules (offline, requires `@scalar/api-reference` installed)
+   * - Custom URL string — self-hosted or local path (e.g. `'/assets/scalar.js'`)
+   */
+  cdn?: 'cdn' | 'unpkg' | 'local' | (string & {});
+}
+declare function generateOpenAPI(router: RouterDef, options?: ScalarOptions): Record<string, unknown>;
+declare function scalarHTML(specUrl: string, options?: ScalarOptions): string;
+//#endregion
+export { ScalarOptions, generateOpenAPI, scalarHTML };

package/dist/scalar.mjs

@@ -0,0 +1,311 @@
+//#region src/scalar.ts
+/**
+* Generate OpenAPI 3.1.0 document from a v2 RouterDef.
+*/
+/**
+* Convert `:param` and `:param(regex)` to OpenAPI `{param}` syntax.
+* Returns the converted path and an array of extracted param names.
+*/
+function toOpenAPIPath(raw) {
+	const pathParams = [];
+	const httpPath = raw.replace(/:(\w+)\([^)]*\)/g, (_m, name) => {
+		pathParams.push(name);
+		return `{${name}}`;
+	}).replace(/:(\w+)\?/g, (_m, name) => {
+		pathParams.push(name);
+		return `{${name}}`;
+	}).replace(/:(\w+)/g, (_m, name) => {
+		pathParams.push(name);
+		return `{${name}}`;
+	}).replace(/\/\*\*$/g, "/{path}").replace(/\/\*\*/g, "/{path}");
+	if (httpPath.includes("{path}") && !pathParams.includes("path")) pathParams.push("path");
+	return {
+		httpPath,
+		pathParams
+	};
+}
+function generateOpenAPI(router, options = {}) {
+	const paths = {};
+	const tags = /* @__PURE__ */ new Map();
+	collectProcedures(router, [], (path, proc) => {
+		const route = proc.route;
+		const { httpPath, pathParams } = toOpenAPIPath(route?.path ?? "/" + path.join("/"));
+		const rawMethod = route?.method?.toLowerCase() ?? "post";
+		const methods = rawMethod === "*" ? [
+			"get",
+			"put",
+			"post",
+			"delete",
+			"options",
+			"head",
+			"patch",
+			"trace"
+		] : [rawMethod];
+		const baseOperationId = route?.operationId ?? path.join("_");
+		const opTags = route?.tags ?? (path.length > 1 ? [path[0]] : void 0);
+		if (opTags) {
+			for (const t of opTags) if (!tags.has(t)) tags.set(t, {});
+		}
+		let description = route?.description;
+		if (route?.ws) {
+			const wsNote = "Also available over WebSocket (`ws://`). Send `{ id, path: \"" + path.join("/") + "\", input }` as JSON.";
+			description = description ? `${description}\n\n${wsNote}` : wsNote;
+		}
+		const operation = {
+			operationId: baseOperationId,
+			tags: opTags,
+			summary: route?.summary,
+			description,
+			deprecated: route?.deprecated || void 0,
+			responses: {}
+		};
+		if (!operation.summary) delete operation.summary;
+		if (!operation.description) delete operation.description;
+		if (!operation.deprecated) delete operation.deprecated;
+		if (!operation.tags) delete operation.tags;
+		if (route?.security === false) operation.security = [];
+		else if (route?.security) operation.security = route.security.map((s) => ({ [s]: [] }));
+		else if (options.security) operation.security = [{ auth: [] }];
+		const inputSchema = proc.input ? schemaToJsonSchema(proc.input) : null;
+		const successStatus = route?.successStatus ?? 200;
+		const successDesc = route?.successDescription ?? "Successful response";
+		const guards = (proc.use ?? []).filter((m) => m.kind === "guard" && m.errors);
+		let allErrors = proc.errors ? { ...proc.errors } : null;
+		for (const guard of guards) {
+			const ge = guard.errors;
+			if (ge) allErrors = allErrors ? {
+				...allErrors,
+				...ge
+			} : { ...ge };
+		}
+		paths[httpPath] ??= {};
+		for (const method of methods) {
+			const op = {
+				...operation,
+				responses: {}
+			};
+			if (methods.length > 1) op.operationId = `${baseOperationId}_${method}`;
+			const params = [];
+			for (const p of pathParams) params.push({
+				name: p,
+				in: "path",
+				required: true,
+				schema: { type: "string" }
+			});
+			if (inputSchema) if (method === "get") params.push(...objectSchemaToParams(inputSchema));
+			else op.requestBody = {
+				required: true,
+				content: { "application/json": { schema: inputSchema } }
+			};
+			if (params.length > 0) op.parameters = params;
+			if (proc.type === "subscription") {
+				const outputSchema = proc.output ? schemaToJsonSchema(proc.output) : { type: "string" };
+				op.responses[String(successStatus)] = {
+					description: "SSE event stream",
+					content: { "text/event-stream": { schema: {
+						type: "string",
+						description: `Each line: data: ${JSON.stringify(outputSchema)}`
+					} } }
+				};
+			} else if (proc.output) op.responses[String(successStatus)] = {
+				description: successDesc,
+				content: { "application/json": { schema: schemaToJsonSchema(proc.output) } }
+			};
+			else op.responses[String(successStatus)] = { description: successDesc };
+			if (proc.input) op.responses["400"] = {
+				description: "BAD_REQUEST — input validation failed",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						code: {
+							const: "BAD_REQUEST",
+							type: "string"
+						},
+						status: {
+							const: 400,
+							type: "integer"
+						},
+						message: { type: "string" },
+						data: {
+							type: "object",
+							properties: { issues: { type: "array" } }
+						}
+					},
+					required: [
+						"code",
+						"status",
+						"message"
+					]
+				} } }
+			};
+			if (allErrors) {
+				const byStatus = /* @__PURE__ */ new Map();
+				for (const [code, def] of Object.entries(allErrors)) {
+					const status = typeof def === "number" ? def : def.status;
+					if (!byStatus.has(status)) byStatus.set(status, []);
+					const entry = { code };
+					if (typeof def === "object") {
+						if (def.message) entry.message = def.message;
+						if (def.data) entry.schema = schemaToJsonSchema(def.data);
+					}
+					byStatus.get(status).push(entry);
+				}
+				for (const [status, errors] of byStatus) {
+					const errorSchemas = errors.map((e) => {
+						const s = {
+							type: "object",
+							properties: {
+								code: {
+									const: e.code,
+									type: "string"
+								},
+								status: {
+									const: status,
+									type: "integer"
+								},
+								message: {
+									type: "string",
+									...e.message ? { default: e.message } : {}
+								}
+							},
+							required: [
+								"code",
+								"status",
+								"message"
+							]
+						};
+						if (e.schema) {
+							s.properties.data = e.schema;
+							s.required.push("data");
+						}
+						return s;
+					});
+					op.responses[String(status)] = {
+						description: errors.map((e) => e.code).join(" | "),
+						content: { "application/json": { schema: errorSchemas.length === 1 ? errorSchemas[0] : { oneOf: errorSchemas } } }
+					};
+				}
+			}
+			let finalOp = op;
+			if (route?.spec) if (typeof route.spec === "function") finalOp = route.spec(finalOp);
+			else finalOp = {
+				...finalOp,
+				...route.spec
+			};
+			paths[httpPath][method] = finalOp;
+		}
+	});
+	const doc = {
+		openapi: "3.1.0",
+		info: {
+			title: options.title ?? "Silgi API",
+			version: options.version ?? "1.0.0",
+			...options.description ? { description: options.description } : {},
+			...options.contact ? { contact: options.contact } : {},
+			...options.license ? { license: options.license } : {}
+		},
+		paths
+	};
+	if (options.servers?.length) doc.servers = options.servers;
+	if (options.externalDocs) doc.externalDocs = options.externalDocs;
+	if (tags.size > 0) doc.tags = [...tags.entries()].map(([name, meta]) => ({
+		name,
+		...meta.description ? { description: meta.description } : {}
+	}));
+	if (options.security) {
+		const scheme = { type: options.security.type };
+		if (options.security.type === "http") {
+			scheme.scheme = options.security.scheme ?? "bearer";
+			if (options.security.bearerFormat) scheme.bearerFormat = options.security.bearerFormat;
+		} else if (options.security.type === "apiKey") {
+			scheme.in = options.security.in ?? "header";
+			scheme.name = options.security.name ?? "x-api-key";
+		}
+		if (options.security.description) scheme.description = options.security.description;
+		doc.components = { securitySchemes: { auth: scheme } };
+	}
+	return doc;
+}
+const SCALAR_CDN_SOURCES = {
+	cdn: "https://cdn.jsdelivr.net/npm/@scalar/api-reference",
+	unpkg: "https://unpkg.com/@scalar/api-reference",
+	local: "/__silgi/scalar.js"
+};
+function scalarHTML(specUrl, options = {}) {
+	const title = escapeHtml(options.title ?? "Silgi API");
+	const safeUrl = escapeHtml(specUrl);
+	const cdnOption = options.cdn ?? "cdn";
+	return `<!DOCTYPE html>
+<html>
+<head>
+  <title>${title} — Scalar</title>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+</head>
+<body>
+  <script id="api-reference" data-url="${safeUrl}"><\/script>
+  <script src="${escapeHtml(SCALAR_CDN_SOURCES[cdnOption] ?? cdnOption)}"><\/script>
+</body>
+</html>`;
+}
+function escapeHtml(s) {
+	return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function isProcedureDef(value) {
+	return typeof value === "object" && value !== null && "type" in value && "resolve" in value && typeof value.resolve === "function";
+}
+function collectProcedures(node, path, cb) {
+	if (isProcedureDef(node)) {
+		cb(path, node);
+		return;
+	}
+	if (typeof node === "object" && node !== null) for (const [key, child] of Object.entries(node)) collectProcedures(child, [...path, key], cb);
+}
+/**
+* Convert a Standard Schema to JSON Schema via `~standard.jsonSchema.input()`.
+*
+* Works with Zod v4, Valibot, ArkType — any validator implementing Standard Schema v1.
+*/
+function schemaToJsonSchema(schema) {
+	const std = schema["~standard"];
+	if (!std?.jsonSchema?.input) return {};
+	try {
+		const result = std.jsonSchema.input({ target: "draft-2020-12" });
+		if (result && typeof result === "object") {
+			const { $schema: _, ...rest } = result;
+			return rest;
+		}
+	} catch {}
+	return {};
+}
+function objectSchemaToParams(schema) {
+	if (schema.type !== "object" || !schema.properties) return [];
+	const required = new Set(schema.required ?? []);
+	return Object.entries(schema.properties).map(([name, propSchema]) => ({
+		name,
+		in: "query",
+		required: required.has(name),
+		schema: propSchema,
+		...propSchema.description ? { description: propSchema.description } : {}
+	}));
+}
+/**
+* Wrap a fetch handler to serve Scalar API Reference at /reference and /openapi.json.
+* Scalar routes are intercepted before the handler — zero overhead for normal requests.
+*/
+function wrapWithScalar(handler, routerDef, options = {}) {
+	const specJson = JSON.stringify(generateOpenAPI(routerDef, options));
+	const specHtml = scalarHTML("/openapi.json", options);
+	return (request) => {
+		const url = request.url;
+		const pathStart = url.indexOf("/", url.indexOf("//") + 2);
+		const qMark = url.indexOf("?", pathStart);
+		const fullPath = qMark === -1 ? url.slice(pathStart) : url.slice(pathStart, qMark);
+		const pathname = fullPath.length > 1 ? fullPath.slice(1) : "";
+		if (pathname === "openapi.json") return new Response(specJson, { headers: { "content-type": "application/json" } });
+		if (pathname === "reference") return new Response(specHtml, { headers: { "content-type": "text/html" } });
+		return handler(request);
+	};
+}
+//#endregion
+export { generateOpenAPI, scalarHTML, wrapWithScalar };