{"_id":"@absolutejs/http","name":"@absolutejs/http","dist-tags":{"latest":"0.0.1"},"versions":{"0.0.1":{"name":"@absolutejs/http","version":"0.0.1","description":"Origin-locked, authentication-aware HTTP transport for AbsoluteJS applications","type":"module","license":"BSL-1.1","author":"Alex Kahn","repository":{"type":"git","url":"git+https://github.com/absolutejs/http.git"},"homepage":"https://github.com/absolutejs/http","bugs":{"url":"https://github.com/absolutejs/http/issues"},"main":"./dist/index.js","module":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"},"./conformance":{"types":"./dist/conformance.d.ts","import":"./dist/conformance.js"},"./runtime":{"types":"./dist/runtime.d.ts","import":"./dist/runtime.js"},"./ssr":{"types":"./dist/ssr.d.ts","import":"./dist/ssr.js"},"./testing":{"types":"./dist/testing.d.ts","import":"./dist/testing.js"},"./web":{"types":"./dist/web.d.ts","import":"./dist/web.js"}},"publishConfig":{"access":"public"},"scripts":{"build":"rm -rf dist && bun build src/index.ts --root src --outdir dist --target=browser --sourcemap && bun build src/conformance.ts --root src --outdir dist --target=browser --sourcemap && bun build src/runtime.ts --root src --outdir dist --target=browser --sourcemap && bun build src/ssr.ts --root src --outdir dist --target=browser --sourcemap && bun build src/testing.ts --root src --outdir dist --target=browser --sourcemap && bun build src/web.ts --root src --outdir dist --target=browser --sourcemap && tsc --emitDeclarationOnly -p tsconfig.build.json","check":"bun run typecheck && bun test && bun run build && bun run verify:dist","format":"prettier --write .","test":"bun test","typecheck":"tsc --noEmit","verify:dist":"bun run scripts/verifyDist.ts"},"devDependencies":{"@types/bun":"1.3.14","prettier":"3.5.3","typescript":"5.9.3"},"_id":"@absolutejs/http@0.0.1","_integrity":"sha512-RDdLerIjSDlFcNAsAJR7C7cXnSpVGBtls1+ieaPyW98SmLEgayeCHwn73oFvy7pY0KG2WwiyApgwMWGuvugBug==","_nodeVersion":"24.3.0","_npmVersion":"10.8.3","shasum":"ee2c5afb626146a84a3f954a57197f651fda937a","dist":{"integrity":"sha512-RDdLerIjSDlFcNAsAJR7C7cXnSpVGBtls1+ieaPyW98SmLEgayeCHwn73oFvy7pY0KG2WwiyApgwMWGuvugBug==","shasum":"ee2c5afb626146a84a3f954a57197f651fda937a","tarball":"https://registry.npmjs.org/@absolutejs/http/-/http-0.0.1.tgz","fileCount":35,"unpackedSize":111781,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIE1NRSgW0baOyjuBA/7/DCQlEWadwYiQH0ih5oKxv9NsAiBRL6QgmedMUXGv8fQu0rHjXVJq4JWhUQ5P1XRG2MmVRg=="}]},"_npmUser":{"name":"alexkahndev","email":"alexkahn2019@gmail.com"},"directories":{},"maintainers":[{"name":"alexkahndev","email":"alexkahn2019@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/http_0.0.1_1787884288759_0.025909052097760732"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-28T02:31:28.456Z","0.0.1":"2026-08-28T02:31:28.889Z","modified":"2026-08-28T02:31:29.182Z"},"maintainers":[{"name":"alexkahndev","email":"alexkahn2019@gmail.com"}],"description":"Origin-locked, authentication-aware HTTP transport for AbsoluteJS applications","homepage":"https://github.com/absolutejs/http","repository":{"type":"git","url":"git+https://github.com/absolutejs/http.git"},"author":"Alex Kahn","bugs":{"url":"https://github.com/absolutejs/http/issues"},"license":"BSL-1.1","readme":"# @absolutejs/http\n\nProvider-neutral, origin-locked HTTP for AbsoluteJS applications.\n\n```ts\nimport { http } from '@absolutejs/http';\n\nconst orders = await http.get<Order[]>('/api/orders');\nawait http.post('/api/orders', { sku: 'absolute-shirt', quantity: 1 });\n```\n\nApplication code stays the same across browser, PWA, and Capacitor builds. The\nbrowser transport uses same-origin HTTP-only cookies. AbsoluteJS installs the\nCapacitor transport with the native Auth client's renewable bearer credential;\ntokens never enter page code.\n\n## Security contract\n\n- Relative URLs resolve against one configured application origin.\n- Absolute URLs must match that exact origin.\n- HTTPS is required outside loopback development.\n- Application-provided `Authorization`, `Cookie`, and `Proxy-Authorization`\n  headers are rejected. The runtime provider owns credentials.\n- Redirect following is disabled for trusted requests, preventing a server\n  redirect from becoming a credential or request-body forwarding channel.\n- HTTP errors expose status and URL but do not automatically copy a private\n  response body into an exception or diagnostic.\n\nUse `http.request()` when you need a raw `Response`, `http.text()` for text, and\n`http.json()` or the method helpers for JSON. `@absolutejs/sync` remains the\ndurable local-first API; ordinary HTTP is connected-first.\n\nType parameters describe the decoded result at the call site. For end-to-end\nroute inference, pass `http.fetch` into the Elysia Eden client used by your\napplication so Eden retains the server route types while AbsoluteJS owns the\nruntime transport.\n\n## Explicit transports\n\nSSR code must install or construct a request-scoped transport rather than\nguessing a public origin:\n\n```ts\nimport { createAbsoluteHttpClient } from '@absolutejs/http';\nimport { createSsrHttpTransport } from '@absolutejs/http/ssr';\n\nconst http = createAbsoluteHttpClient({\n\ttransport: createSsrHttpTransport({\n\t\torigin: 'https://app.example.com'\n\t})\n});\n```\n\nTests can use `createTestHttpTransport()` from `@absolutejs/http/testing`.\n","readmeFilename":"README.md","_rev":"1-3fa734d5d9a5112e8b1ea296c7a4dcaa"}