@20syldev/api 5.6.0 → 5.7.0

package/.prettierignore

@@ -0,0 +1,5 @@
+.github/
+dist/
+node_modules/
+package-lock.json
+package.json

package/README.md

@@ -1,50 +1,192 @@
-<div align="center">
-  <a href="https://api.sylvain.sh"><img src="https://api.sylvain.sh/favicon.ico" alt="Logo" width="25%" height="auto"/></a>
+# @20syldev/api
 
-# API Personnelle
+## About
 
-[![Version](https://custom-icon-badges.demolab.com/badge/Version%20:-v5.6.0-6479ee?logo=api.sylvain.sh&labelColor=23272A)](https://github.com/20syldev/api/releases/latest)
+`@20syldev/api` bundles 42 self-contained utilities: encryption, matrix math, SVG charts, CSV, JWT, TOTP, barcodes, fake data generation, text processing, validation and more. Install it and import — no configuration, no setup step, types included.
 
-</div>
+It works two ways:
 
----
+- **As a library** — import any module directly into your code.
+- **As a server** — a single import boots an Express app that exposes every module over HTTP.
 
-## À propos de l'API
+The HTTP surface is versioned from `v1` to `v5`, and every version stays mounted side by side, so a new release never changes the behaviour of the one you already target. The full endpoint reference lives on [docs.sylvain.sh](https://docs.sylvain.sh).
 
-Voici mon API personnelle, disponible sur le domaine [api.sylvain.sh](https://api.sylvain.sh).
-L'API est développée avec **TypeScript** et **Node.js**, et hébergée **24h/7j**. Elle est **simple d'utilisation** et a une **documentation** disponible sur [docs.sylvain.sh](https://docs.sylvain.sh) !
+## Requirements
 
-> _Une limite de **2000** requêtes **par heure** est fixée. Elle change pour certains endpoints nécessitant plus de ressources. Si vous souhaitez une **augmentation** de cette limite, n'hésitez pas à visiter la [documentation](https://docs.sylvain.sh/pricing)._
+**Node.js >= 22.12.0.** The package ships as ESM, but that does not lock out CommonJS: Node has been able to `require()` an ESM module since 22.12, which is why that is the floor. The library entry works from both module systems.
 
-## Prérequis
+```js
+import { evaluate } from '@20syldev/api'; // ESM
+const { evaluate } = require('@20syldev/api'); // CommonJS
+```
+
+The server entry loads its plugins asynchronously, so it must be imported rather than required:
 
-- **Node.js** >= 22.0.0
+```js
+await import('@20syldev/api/server'); // from CommonJS
+```
 
-## Installer le paquet de l'API sur votre machine
+## Installation
 
 ```console
-$ sudo apt install nodejs npm
 $ npm install @20syldev/api
-$ npm init
 ```
 
-> _Attention, vous devez configurer le type sur "**module**" dans votre fichier `package.json`._
+## Quick start
+
+The root import always resolves to the latest version. Use a subpath (`/v1` to `/v5`) to pin a specific one.
+
+```js
+// Latest version, equivalent to '@20syldev/api/v5'
+import { color, evaluate, username } from '@20syldev/api';
+
+// Or a specific version
+import { color as colorV4 } from '@20syldev/api/v4';
+
+// Evaluate a math expression
+const expr = evaluate('sin(pi / 2) + sqrt(4)', 5);
+console.log(expr.result); // 3
+console.log(expr.expression); // 'sin(pi / 2) + sqrt(4)'
+
+// Generate a random color, converted to every common notation
+const c = color();
+console.log(c.hex, c.rgb, c.hsl, c.hsv, c.hwb, c.cmyk);
+
+// Generate a random username
+const user = username();
+console.log(user.username);
+```
+
+## What's inside
+
+| Domain             | Exports                                                                               |
+| ------------------ | ------------------------------------------------------------------------------------- |
+| **Crypto**         | `asymmetric` `symmetric` `hash` `jwt` `otp` `token` `password` `captcha`              |
+| **Math & data**    | **`matrix`** **`algorithms`** `evaluate` `statistics` `convert` `csv`                 |
+| **Text**           | **`text`** **`encode`** **`validate`** `caseConvert` `levenshtein` `regex` `parseUrl` |
+| **Graphics**       | **`chart`** `barcode` `qrcode` `avatar` `placeholder` `color` `palette`               |
+| **Fake data**      | `personal` `address` `credit` `username` `dice` `domain` `agent`                      |
+| **Network & time** | `ip` `geo` `time` `cron` `hyperplanning`                                              |
+| **Stateful**       | `chat` `tic_tac_toe`                                                                  |
+
+The six names in **bold** are namespaces — they group related functions, called as `namespace.method()`:
 
-## Utiliser l'API
+| Namespace        | Functions                                                                                                                |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| **`algorithms`** | `factorial` `fibonacci` `gcd` `isprime` `primefactors` `primelist` `roman` `anagram` `palindrome` `reverse` `bubblesort` |
+| **`chart`**      | `bar` `line` `pie` `donut`                                                                                               |
+| **`encode`**     | `base64encode` `base64decode` `urlencode` `urldecode` `binary` `unbinary` `morse` `unmorse` `caesar` `rot13`             |
+| **`matrix`**     | `add` `subtract` `multiply` `scalar` `transpose` `determinant` `inverse` `identity`                                      |
+| **`text`**       | `lorem` `slug` `stats` `number`                                                                                          |
+| **`validate`**   | `email` `iban` `luhn`                                                                                                    |
 
-### Option 1 : Démarrer un serveur local
+Everything else is a plain function, called directly.
 
-Pour démarrer un serveur local avec tous les endpoints :
+Two names differ from their HTTP endpoint, because `case` and `url` collide with reserved or global identifiers:
+
+| Endpoint | Import        |
+| -------- | ------------- |
+| `/case`  | `caseConvert` |
+| `/url`   | `parseUrl`    |
+
+> _`personal` generates **fake** profiles (names, emails, jobs, addresses) for seeding and testing — it holds no real data._
+
+## Examples
+
+```js
+import {
+    asymmetric,
+    caseConvert,
+    chart,
+    csv,
+    evaluate,
+    jwt,
+    matrix,
+    otp,
+    parseUrl,
+    symmetric,
+    validate,
+} from '@20syldev/api/v5';
+
+// RSA key generation, encryption and decryption
+const { publicKey, privateKey } = asymmetric('keygen', {});
+const { result: encrypted } = asymmetric('encrypt', { text: 'secret message', publicKey });
+const { result: decrypted } = asymmetric('decrypt', { text: encrypted, privateKey });
+console.log(decrypted); // 'secret message'
+
+// AES-256-GCM symmetric encryption, key derived with scrypt
+const { result: blob } = symmetric('encrypt', 'secret message', 'a-strong-key');
+const { result: plain } = symmetric('decrypt', blob, 'a-strong-key');
+console.log(plain); // 'secret message'
+
+// TOTP secret, code generation and verification
+const { secret, uri } = otp('secret', { label: 'alice', issuer: 'MyApp' });
+const { code } = otp('generate', { secret });
+const { valid } = otp('verify', { secret, code });
+console.log(valid); // true
+
+// Decode a JWT without verifying its signature (inspection only)
+const { header, payload } = jwt('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.qfhpVR4l');
+console.log(header.alg, payload.sub); // 'HS256' '1234567890'
+
+// Evaluate a math expression, with a precision
+const { result } = evaluate('log2(8) * (3 + pi)', 4);
+console.log(result); // 18.4248
+
+// Matrix product
+const { result: product } = matrix.multiply(
+    [
+        [1, 2],
+        [3, 4],
+    ],
+    [
+        [5, 6],
+        [7, 8],
+    ],
+);
+console.log(product); // [[19, 22], [43, 50]]
+
+// Render an SVG chart in memory
+const { body: svg } = chart.bar(
+    { labels: ['Jan', 'Feb', 'Mar'], datasets: [{ label: 'Sales', values: [120, 85, 200] }] },
+    { width: 600, height: 300 },
+);
+// body holds a ready-to-serve SVG string
+
+// Parse CSV into rows, or format rows back into CSV
+const { rows } = csv('parse', { csv: 'name,age\nAlice,30\nBob,25' });
+console.log(rows); // [{ name: 'Alice', age: '30' }, { name: 'Bob', age: '25' }]
+
+// Convert between case styles
+console.log(caseConvert('hello world', 'pascal').result); // 'HelloWorld'
+
+// Split a URL into its components
+const parsed = parseUrl('https://example.com/a/b?tag=x&tag=y#top');
+console.log(parsed.host, parsed.port, parsed.params, parsed.fragment);
+
+// Validate an email, an IBAN or a card number
+console.log(validate.email('alice@example.com').valid); // true
+```
+
+## Running the server
+
+From the installed package, one import mounts every version:
+
+```js
+import '@20syldev/api/server';
+```
+
+From a clone of the repository:
 
 ```console
 $ npm run build && npm start
 ```
 
 ```console
-> @20syldev/api@5.6.0 build
+> @20syldev/api@5.7.0 build
 > tsc
 
-> @20syldev/api@5.6.0 start
+> @20syldev/api@5.7.0 start
 > node dist/app.js
 
 API is running on
@@ -52,83 +194,65 @@ API is running on
     - http://localhost:3000
 ```
 
-Pour le développement avec rechargement automatique :
+For development with automatic reloading:
 
 ```console
 $ npm run dev
 ```
 
-### Option 2 : Utiliser les modules directement dans votre code
+Endpoints follow the `/:version/:endpoint` pattern — `GET /v5/color`, `GET /v5/evaluate?expr=2%2B2`, `POST /v5/matrix`. `GET /` lists the available versions, and `GET /:version` lists that version's endpoints with their parameters.
 
-Vous pouvez également importer les modules spécifiques dont vous avez besoin :
+### Configuration
 
-```js
-// Importer des modules spécifiques depuis la v5
-import { evaluate, color, username } from '@20syldev/api/v5';
+Every setting is optional and read from the environment; a `.env` file at the project root is loaded automatically. The server runs with none of them set.
 
-// Évaluer une expression mathématique
-const expr = evaluate('sin(pi / 2) + sqrt(4)', 5);
-console.log(expr.result);     // 3
-console.log(expr.expression); // "sin(pi / 2) + sqrt(4)"
+| Variable           | Default | Purpose                                                                                                                                                |
+| ------------------ | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `PORT`             | `3000`  | Port the server listens on                                                                                                                             |
+| `DOCS_URL`         | —       | Documentation base URL reported by `/`, `/:version` and `/:version/infos`                                                                              |
+| `REPO_URL`         | —       | Source repository reported by `/:version/infos`                                                                                                        |
+| `INSTANCE_CREATED` | —       | Launch date reported by `/:version/infos`                                                                                                              |
+| `LOGS_TOKEN`       | —       | Value required in the `X-Logs-Token` header to read `/logs`; open while unset                                                                          |
+| `TRUSTED_PROXIES`  | one hop | CIDR blocks separated by spaces or commas, or the `loopback` / `linklocal` / `uniquelocal` shorthands, for deployments behind a CDN or platform router |
+| `GLOBAL_LIMIT`     | `50000` | Requests per hour accepted across the whole instance                                                                                                   |
+| `DEFAULT_LIMIT`    | `2000`  | Per-client requests per hour                                                                                                                           |
+| `DEFAULT_BURST`    | `50`    | Per-client requests per 10-second window                                                                                                               |
 
-// Générer une couleur aléatoire
-const couleur = color();
-console.log(`Couleur HEX: ${couleur.hex}`);
-console.log(`Couleur RGB: ${couleur.rgb}`);
+The three metadata variables are omitted from responses when unset, so an instance never advertises somebody else's documentation or repository.
 
-// Générer un nom d'utilisateur aléatoire
-const utilisateur = username();
-console.log(`Nom d'utilisateur: ${utilisateur.username}`);
-```
+Higher quotas can be granted per client: `ADVANCED_`, `PRO_` and `BUSINESS_` variants of `_LIMIT` and `_BURST` define the tiers, and the matching `*_TOKEN_LIST` variables hold the space-separated bearer tokens that map to them. A client's tier and quota are reported by `GET /auth`.
 
-## Scripts disponibles
+> _Rate-limit counters live in process memory, so each instance of a multi-instance deployment counts separately._
 
-| Commande         | Description                                                        |
-| ---------------- | ------------------------------------------------------------------ |
-| `npm run dev`    | Serveur de développement avec rechargement automatique (tsx watch) |
-| `npm run build`  | Compilation TypeScript vers `dist/`                                |
-| `npm start`      | Démarrer le serveur de production (`node dist/app.js`)             |
-| `npm test`       | Lancer les tests unitaires et d'intégration                        |
-| `npm run lint`   | Vérification ESLint                                                |
-| `npm run format` | Formatage avec Prettier                                            |
-| `npm run check`  | Vérification TypeScript + ESLint                                   |
+## Versioning
 
-## Exemples d'utilisation
+| Version | Adds                                                                                                                                                                          |
+| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `v1`    | algorithms, captcha, color, convert, domain, personal, qrcode, username, token                                                                                                |
+| `v2`    | chat, hash, tic-tac-toe                                                                                                                                                       |
+| `v3`    | levenshtein, time, hyperplanning                                                                                                                                              |
+| `v4`    | 24 endpoints — address, avatar, barcode, credit, cron, dice, encode, geo, ip, palette, password, placeholder, regex, statistics, text, validate… plus PATCH and DELETE routes |
+| `v5`    | case, evaluate, url, asymmetric, chart, csv, jwt, matrix, otp, symmetric                                                                                                      |
 
-```js
-import { asymmetric, chart, evaluate, matrix, otp, symmetric } from '@20syldev/api/v5';
+`v4` and `v5` are fully typed. The package root always tracks the latest version.
 
-// Chiffrement RSA asymétrique
-const { publicKey, privateKey } = asymmetric('keygen', {});
-const { result: encrypted } = asymmetric('encrypt', { text: 'message secret', publicKey });
-const { result: decrypted } = asymmetric('decrypt', { text: encrypted, privateKey });
-console.log(decrypted); // 'message secret'
+> _`v1`, `v2` and `v3` share the same untyped JavaScript implementation and differ only by the endpoints they expose. They are **deprecated** and will be removed in `6.0.0` — new code should target `v5`._
 
-// Évaluer une expression mathématique
-const { result } = evaluate('log2(8) * (3 + pi)', 4);
-console.log(result); // 18.4248
+## Scripts
 
-// Opération matricielle — produit de deux matrices
-const { result: product } = matrix.multiply([[1, 2], [3, 4]], [[5, 6], [7, 8]]);
-console.log(product); // [[19, 22], [43, 50]]
+| Command          | Description                                             |
+| ---------------- | ------------------------------------------------------- |
+| `npm run dev`    | Development server with automatic reloading (tsx watch) |
+| `npm run build`  | Compile TypeScript to `dist/`                           |
+| `npm start`      | Start the production server (`node dist/app.js`)        |
+| `npm test`       | Run unit and integration tests                          |
+| `npm run format` | Format with Prettier and auto-fix with ESLint           |
+| `npm run check`  | TypeScript and ESLint verification                      |
 
-// Générer un graphique SVG en mémoire
-const { body: svg } = chart.bar(
-    { labels: ['Jan', 'Fév', 'Mar'], datasets: [{ label: 'Ventes', values: [120, 85, 200] }] },
-    { width: 600, height: 300 },
-);
-// body contient une chaîne SVG prête à l'emploi
+## Hosted instance
 
-// Chiffrement symétrique AES-256-GCM
-const { result: blob } = symmetric('encrypt', 'message secret', 'motdepasse');
-const { result: plain } = symmetric('decrypt', blob, 'motdepasse');
-console.log(plain); // 'message secret'
+A public instance runs at [api.sylvain.sh](https://api.sylvain.sh), with the complete endpoint reference, request examples and usage guides on [docs.sylvain.sh](https://docs.sylvain.sh).
 
-// Générer un secret TOTP et vérifier un code
-const { secret } = otp('secret', {});
-const { code } = otp('generate', { secret });
-const { valid } = otp('verify', { secret, code });
-console.log(valid); // true
-```
+## License
 
-_Visitez la [documentation](https://docs.sylvain.sh) dédiée pour la liste complète des endpoints, des exemples de requêtes et des guides d'utilisation de l'[API](https://api.sylvain.sh)._
+BSD 3-Clause. See [LICENSE](LICENSE).

package/dist/app.d.ts

@@ -0,0 +1,2 @@
+declare const app: import("express-serve-static-core").Express;
+export default app;

package/dist/config/env.d.ts

@@ -0,0 +1,21 @@
+export declare function envList(key: string): string[] | null;
+export declare const env: {
+    PORT: number;
+    TRUSTED_PROXIES: string[] | null;
+    DOCS_URL: string;
+    REPO_URL: string;
+    INSTANCE_CREATED: string;
+    LOGS_TOKEN: string;
+    DEFAULT_LIMIT: number;
+    ADVANCED_LIMIT: number;
+    PRO_LIMIT: number;
+    BUSINESS_LIMIT: number;
+    GLOBAL_LIMIT: number;
+    DEFAULT_BURST: number;
+    ADVANCED_BURST: number;
+    PRO_BURST: number;
+    BUSINESS_BURST: number;
+    BUSINESS_TOKEN_LIST: string[];
+    PRO_TOKEN_LIST: string[];
+    ADVANCED_TOKEN_LIST: string[];
+};

package/dist/config/env.js

@@ -1,9 +1,12 @@
 import dotenv from 'dotenv';
 import { DEFAULT_PORT } from '../constants.js';
 dotenv.config();
-function envList(key) {
+export function envList(key) {
     const v = process.env[key];
-    return v && v !== 'undefined' ? v.split(' ') : null;
+    if (!v || v === 'undefined')
+        return null;
+    const items = v.split(/[\s,]+/).filter(Boolean);
+    return items.length ? items : null;
 }
 function envNumber(key, fallback) {
     const v = parseInt(process.env[key] ?? '', 10);
@@ -11,6 +14,11 @@ function envNumber(key, fallback) {
 }
 export const env = {
     PORT: envNumber('PORT', DEFAULT_PORT),
+    TRUSTED_PROXIES: envList('TRUSTED_PROXIES'),
+    DOCS_URL: (process.env.DOCS_URL ?? '').replace(/\/+$/, ''),
+    REPO_URL: process.env.REPO_URL ?? '',
+    INSTANCE_CREATED: process.env.INSTANCE_CREATED ?? '',
+    LOGS_TOKEN: process.env.LOGS_TOKEN ?? '',
     DEFAULT_LIMIT: envNumber('DEFAULT_LIMIT', 2000),
     ADVANCED_LIMIT: envNumber('ADVANCED_LIMIT', 3500),
     PRO_LIMIT: envNumber('PRO_LIMIT', 6000),

package/dist/config/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,OAAO,CAAC,GAAW;IACxB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,QAAgB;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACf,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC;IAErC,aAAa,EAAE,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/C,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC;IACvC,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC;IAClD,YAAY,EAAE,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC;IAE9C,aAAa,EAAE,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;IAC7C,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC;IAC/C,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC;IACtC,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC;IAEhD,mBAAmB,EAAE,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE;IACzD,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE;IAC/C,mBAAmB,EAAE,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE;CAC5D,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,MAAM,UAAU,OAAO,CAAC,GAAW;IAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,QAAgB;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACf,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC;IACrC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC;IAE3C,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE;IACpC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;IACpD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;IAExC,aAAa,EAAE,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/C,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC;IACvC,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC;IAClD,YAAY,EAAE,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC;IAE9C,aAAa,EAAE,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;IAC7C,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC;IAC/C,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC;IACtC,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC;IAEhD,mBAAmB,EAAE,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE;IACzD,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE;IAC/C,mBAAmB,EAAE,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE;CAC5D,CAAC"}

package/dist/config/plans.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Rate limit plans configuration.
+ *
+ * hourly  — max requests per hour (matches pricing page)
+ * burst   — max requests per 10-second window
+ * tokens  — list of bearer tokens for this tier
+ *
+ * To adjust limits, edit the values below or override via .env:
+ *   DEFAULT_LIMIT, ADVANCED_LIMIT, PRO_LIMIT, BUSINESS_LIMIT
+ *   DEFAULT_BURST, ADVANCED_BURST, PRO_BURST, BUSINESS_BURST
+ */
+export interface Plan {
+    hourly: number;
+    burst: number;
+    tokens: string[];
+}
+export declare const plans: Record<string, Plan>;
+export declare const globalLimit: number;
+/**
+ * Returns the plan matching a bearer token, or 'default'.
+ * Returns null if the token is provided but invalid.
+ */
+export declare function getPlan(token: string): {
+    name: string;
+    plan: Plan;
+} | null;

package/dist/config/versions.d.ts

@@ -0,0 +1,18 @@
+import * as apiv3 from '../modules/v3.js';
+import * as apiv4 from '../modules/v4.js';
+import * as apiv5 from '../modules/v5.js';
+export interface Endpoint {
+    name: string;
+    path?: string;
+    children?: Record<string, string>;
+}
+export interface VersionConfig {
+    endpoints: {
+        get: Endpoint[];
+        post: Endpoint[];
+        patch?: Endpoint[];
+        delete?: Endpoint[];
+    };
+    modules: typeof apiv3 | typeof apiv4 | typeof apiv5;
+}
+export declare const versions: Record<string, VersionConfig>;

package/dist/constants.d.ts

@@ -0,0 +1,39 @@
+export declare const APP_VERSION: string;
+export declare const DEFAULT_PORT = 3000;
+export declare const START_TIME: number;
+export declare const GAME_CLEANUP_TTL = 600000;
+export declare const MAX_LOG_ENTRIES = 1000;
+export declare const RATE_LIMIT_WINDOW = 10000;
+export declare const RATE_LIMIT_MAX = 50;
+export declare const SESSION_TTL = 3600000;
+export declare const STATUS_MESSAGES: Record<number, string>;
+export declare const EARTH_RADIUS_KM = 6371;
+export declare const MAX_ADDRESS_COUNT = 10;
+export declare const MAX_CHART_DATASETS = 5;
+export declare const MAX_CHART_LABELS = 20;
+export declare const MAX_CSV_LENGTH = 50000;
+export declare const MAX_CSV_ROWS = 1000;
+export declare const MAX_CREDIT_COUNT = 10;
+export declare const MAX_COUNTDOWN_YEARS = 100;
+export declare const MAX_CRON_ITERATIONS: number;
+export declare const MAX_CRON_RESULTS = 20;
+export declare const MAX_EXPR_DEPTH = 100;
+export declare const MAX_EXPR_LENGTH = 500;
+export declare const MAX_FACTORIAL = 170;
+export declare const MAX_GCD_VALUE = 100000;
+export declare const MAX_JWT_LENGTH = 8192;
+export declare const MAX_LEVENSHTEIN_LENGTH = 1000;
+export declare const MIN_PASSWORD_LENGTH = 8;
+export declare const MAX_PASSWORD_LENGTH = 128;
+export declare const MAX_PASSWORD_COUNT = 20;
+export declare const MAX_MATRIX_SIZE = 20;
+export declare const MAX_PATTERN_LENGTH = 200;
+export declare const MAX_PRIME_LIST = 10000;
+export declare const MAX_QRCODE_LOGO_BYTES: number;
+export declare const MAX_REGEX_MATCHES = 100;
+export declare const MAX_RSA_MODULUS = 4096;
+export declare const MAX_STRING_LENGTH = 1000;
+export declare const MIN_TOKEN_LENGTH = 12;
+export declare const MAX_TOKEN_LENGTH = 4096;
+export declare const MAX_URL_LENGTH = 2048;
+export declare const ROMAN_VALUES: [number, string][];

package/dist/constants.js

@@ -2,7 +2,6 @@ import pkg from '../package.json' with { type: 'json' };
 // App
 export const APP_VERSION = pkg.version;
 export const DEFAULT_PORT = 3000;
-export const DOCS_URL = 'https://docs.sylvain.sh';
 export const START_TIME = Date.now();
 // Server
 export const GAME_CLEANUP_TTL = 600_000;

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAExD,MAAM;AACN,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAClD,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAErC,SAAS;AACT,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAErC,MAAM,CAAC,MAAM,eAAe,GAA2B;IACnD,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,uBAAuB;CAC/B,CAAC;AAEF,UAAU;AACV,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAuB;IAC5C,CAAC,IAAI,EAAE,GAAG,CAAC;IACX,CAAC,GAAG,EAAE,IAAI,CAAC;IACX,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,GAAG,EAAE,IAAI,CAAC;IACX,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,EAAE,EAAE,IAAI,CAAC;IACV,CAAC,EAAE,EAAE,GAAG,CAAC;IACT,CAAC,EAAE,EAAE,IAAI,CAAC;IACV,CAAC,EAAE,EAAE,GAAG,CAAC;IACT,CAAC,CAAC,EAAE,IAAI,CAAC;IACT,CAAC,CAAC,EAAE,GAAG,CAAC;IACR,CAAC,CAAC,EAAE,IAAI,CAAC;IACT,CAAC,CAAC,EAAE,GAAG,CAAC;CACX,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAExD,MAAM;AACN,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAErC,SAAS;AACT,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAErC,MAAM,CAAC,MAAM,eAAe,GAA2B;IACnD,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,uBAAuB;CAC/B,CAAC;AAEF,UAAU;AACV,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAuB;IAC5C,CAAC,IAAI,EAAE,GAAG,CAAC;IACX,CAAC,GAAG,EAAE,IAAI,CAAC;IACX,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,GAAG,EAAE,IAAI,CAAC;IACX,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,EAAE,EAAE,IAAI,CAAC;IACV,CAAC,EAAE,EAAE,GAAG,CAAC;IACT,CAAC,EAAE,EAAE,IAAI,CAAC;IACV,CAAC,EAAE,EAAE,GAAG,CAAC;IACT,CAAC,CAAC,EAAE,IAAI,CAAC;IACT,CAAC,CAAC,EAAE,GAAG,CAAC;IACR,CAAC,CAAC,EAAE,IAAI,CAAC;IACT,CAAC,CAAC,EAAE,GAAG,CAAC;CACX,CAAC"}

package/dist/middleware/cors.d.ts

@@ -0,0 +1,2 @@
+import { type Express } from 'express';
+export declare function setupCors(app: Express): void;

package/dist/middleware/cors.js

@@ -2,10 +2,11 @@ import cors from 'cors';
 import express from 'express';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
+import { env } from '../config/env.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 export function setupCors(app) {
-    app.set('trust proxy', 1);
+    app.set('trust proxy', env.TRUSTED_PROXIES ?? 1);
     app.use(cors({ methods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'] }));
     app.use(express.urlencoded({ extended: true, limit: '10kb' }));
     app.use(express.json({ limit: '10kb' }));

package/dist/middleware/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,MAAM,UAAU,SAAS,CAAC,GAAY;IAClC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC1B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC3F,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,MAAM,UAAU,SAAS,CAAC,GAAY;IAClC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;IAEjD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC3F,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC"}

package/dist/middleware/error.d.ts

@@ -0,0 +1,4 @@
+import type { NextFunction, Request, Response } from 'express';
+export declare function errorHandler(err: Error & {
+    status?: number;
+}, _req: Request, res: Response, _next: NextFunction): void;

package/dist/middleware/json.d.ts

@@ -0,0 +1,2 @@
+import type { NextFunction, Request, Response } from 'express';
+export declare function jsonResponseMiddleware(_req: Request, res: Response, next: NextFunction): void;

package/dist/middleware/logger.d.ts

@@ -0,0 +1,26 @@
+import type { NextFunction, Request, Response } from 'express';
+export declare const logger: import("@20syldev/logger.ts").Logger;
+/**
+ * Replaces a secret carried in the path with a placeholder.
+ *
+ * @param path - Request path, without its query string
+ * @returns The path, with a trailing credential segment masked
+ */
+export declare function redactPath(path: string): string;
+/**
+ * Strips query string values from a URL, keeping the path and parameter names.
+ *
+ * GET endpoints carry user input in the query string — text passed to /encode,
+ * card numbers and IBANs passed to /validate, URLs passed to /qrcode — and the
+ * log buffer is readable over /logs. Names alone keep the trace useful for
+ * debugging without retaining anybody's payload.
+ *
+ * Names are kept percent-encoded on purpose. Decoding them would let a caller
+ * write raw newlines and ANSI escapes into the operator's terminal and into the
+ * /logs buffer, and would expose the theme's {placeholder} syntax.
+ *
+ * @param originalUrl - Request URL, with or without a query string
+ * @returns The path, followed by the parameter names when the URL had any
+ */
+export declare function redactQuery(originalUrl: string): string;
+export declare function loggerMiddleware(req: Request, res: Response, next: NextFunction): void;

package/dist/middleware/logger.js

@@ -5,6 +5,39 @@ export const logger = createLogger({
     console: true,
     theme: 'colored',
 });
+const SECRET_PATH = /^(\/v\d+\/(?:chat|tic-tac-toe))\/[^/]+/;
+/**
+ * Replaces a secret carried in the path with a placeholder.
+ *
+ * @param path - Request path, without its query string
+ * @returns The path, with a trailing credential segment masked
+ */
+export function redactPath(path) {
+    return path.replace(SECRET_PATH, '$1/[redacted]');
+}
+/**
+ * Strips query string values from a URL, keeping the path and parameter names.
+ *
+ * GET endpoints carry user input in the query string — text passed to /encode,
+ * card numbers and IBANs passed to /validate, URLs passed to /qrcode — and the
+ * log buffer is readable over /logs. Names alone keep the trace useful for
+ * debugging without retaining anybody's payload.
+ *
+ * Names are kept percent-encoded on purpose. Decoding them would let a caller
+ * write raw newlines and ANSI escapes into the operator's terminal and into the
+ * /logs buffer, and would expose the theme's {placeholder} syntax.
+ *
+ * @param originalUrl - Request URL, with or without a query string
+ * @returns The path, followed by the parameter names when the URL had any
+ */
+export function redactQuery(originalUrl) {
+    const [path = '', ...rest] = originalUrl.split('?');
+    const query = rest.join('?');
+    if (!query)
+        return redactPath(path);
+    const names = [...new Set(query.split('&').map((pair) => pair.split('=')[0] ?? ''))].filter(Boolean);
+    return names.length ? `${redactPath(path)}?${names.join('&')}` : redactPath(path);
+}
 export function loggerMiddleware(req, res, next) {
     if (req.method === 'HEAD') {
         next();
@@ -19,7 +52,7 @@ export function loggerMiddleware(req, res, next) {
     res.on('finish', () => {
         const status = res.statusCode === 304 ? 200 : res.statusCode;
         const duration = `${Date.now() - startTime}ms`;
-        logger.log({ method: req.method, url: req.originalUrl, status, duration, platform });
+        logger.log({ method: req.method, url: redactQuery(req.originalUrl), status, duration, platform });
     });
     next();
 }