@browserlessapi/inferlo 0.4.0 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +15 -3
- package/dist/adonisjs.d.ts +33 -0
- package/dist/adonisjs.js +30 -0
- package/dist/adonisjs.js.map +1 -0
- package/dist/ai/index.d.ts +15 -8
- package/dist/ai/index.js +39 -13
- package/dist/ai/index.js.map +1 -1
- package/dist/ai/providers.js +5 -4
- package/dist/ai/providers.js.map +1 -1
- package/dist/ai/public.d.ts +20 -0
- package/dist/ai/public.js +17 -0
- package/dist/ai/public.js.map +1 -0
- package/dist/ai/tool.d.ts +47 -0
- package/dist/ai/tool.js +85 -0
- package/dist/ai/tool.js.map +1 -0
- package/dist/ai-client.d.ts +3 -0
- package/dist/ai-client.js +8 -0
- package/dist/ai-client.js.map +1 -0
- package/dist/app.d.ts +87 -2
- package/dist/app.js +471 -127
- package/dist/app.js.map +1 -1
- package/dist/cli/main.js +21 -2
- package/dist/cli/main.js.map +1 -1
- package/dist/config.d.ts +16 -0
- package/dist/config.js +101 -0
- package/dist/config.js.map +1 -0
- package/dist/db/table.d.ts +31 -0
- package/dist/db/table.js +140 -1
- package/dist/db/table.js.map +1 -1
- package/dist/deprecation.d.ts +23 -0
- package/dist/deprecation.js +70 -0
- package/dist/deprecation.js.map +1 -0
- package/dist/describe.d.ts +27 -5
- package/dist/describe.js +14 -2
- package/dist/describe.js.map +1 -1
- package/dist/elysia.d.ts +49 -0
- package/dist/elysia.js +10 -0
- package/dist/elysia.js.map +1 -0
- package/dist/env.d.ts +2 -0
- package/dist/env.js +5 -4
- package/dist/env.js.map +1 -1
- package/dist/express.d.ts +38 -0
- package/dist/express.js +18 -0
- package/dist/express.js.map +1 -0
- package/dist/fastify.d.ts +44 -0
- package/dist/fastify.js +47 -0
- package/dist/fastify.js.map +1 -0
- package/dist/hono.d.ts +26 -0
- package/dist/hono.js +10 -0
- package/dist/hono.js.map +1 -0
- package/dist/index.d.ts +13 -4
- package/dist/index.js +4 -2
- package/dist/index.js.map +1 -1
- package/dist/jobs.d.ts +4 -0
- package/dist/jobs.js +18 -1
- package/dist/jobs.js.map +1 -1
- package/dist/logging.d.ts +23 -0
- package/dist/logging.js +87 -0
- package/dist/logging.js.map +1 -0
- package/dist/mcp.d.ts +0 -6
- package/dist/mcp.js +11 -1
- package/dist/mcp.js.map +1 -1
- package/dist/metrics.d.ts +48 -0
- package/dist/metrics.js +184 -0
- package/dist/metrics.js.map +1 -0
- package/dist/nestjs.d.ts +43 -0
- package/dist/nestjs.js +47 -0
- package/dist/nestjs.js.map +1 -0
- package/dist/openapi.d.ts +0 -1
- package/dist/openapi.js +4 -0
- package/dist/openapi.js.map +1 -1
- package/dist/redact.d.ts +19 -0
- package/dist/redact.js +150 -0
- package/dist/redact.js.map +1 -0
- package/dist/route.d.ts +18 -0
- package/dist/route.js.map +1 -1
- package/dist/secure-headers.d.ts +8 -0
- package/dist/secure-headers.js +61 -0
- package/dist/secure-headers.js.map +1 -0
- package/dist/serve.d.ts +53 -1
- package/dist/serve.js +157 -61
- package/dist/serve.js.map +1 -1
- package/dist/trpc.d.ts +57 -0
- package/dist/trpc.js +142 -0
- package/dist/trpc.js.map +1 -0
- package/dist/tsed.d.ts +32 -0
- package/dist/tsed.js +13 -0
- package/dist/tsed.js.map +1 -0
- package/llms.txt +10 -4
- package/package.json +57 -3
- package/templates/app/AGENTS.md +8 -4
- package/templates/app/_env.example +2 -0
- package/templates/app/src/app.ts +15 -8
- package/templates/app/src/config.ts +17 -0
- package/templates/app/src/server.ts +9 -9
- package/templates/app/src/routes/health.ts +0 -3
package/dist/tsed.d.ts
ADDED
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Inferlo inside Ts.ED (8 and later), without a runtime dependency on Ts.ED:
|
|
3
|
+
*
|
|
4
|
+
* import { InferloAI, inferloAI } from "@browserlessapi/inferlo/tsed";
|
|
5
|
+
*
|
|
6
|
+
* @Configuration({ imports: [inferloAI(ai)] }) // or { token: InferloAI, useFactory: () => createAI(...) }
|
|
7
|
+
* export class Server {}
|
|
8
|
+
*
|
|
9
|
+
* @Injectable()
|
|
10
|
+
* export class TicketsService {
|
|
11
|
+
* constructor(private readonly ai: InferloAI) {} // or: ai = inject(InferloAI)
|
|
12
|
+
* }
|
|
13
|
+
*
|
|
14
|
+
* A whole Inferlo app mounts with app.use("/api", toNodeHandler(inferloApp)) in $beforeRoutesInit on the
|
|
15
|
+
* Express platform. This entry point never loads the router, database or jobs code.
|
|
16
|
+
*/
|
|
17
|
+
import type { AI } from "./ai/index.ts";
|
|
18
|
+
/**
|
|
19
|
+
* Injection token and type of the AI client in Ts.ED: constructor(private readonly ai: InferloAI) {},
|
|
20
|
+
* @Inject(InferloAI) ai: InferloAI, or inject(InferloAI). It has every method of AI.
|
|
21
|
+
*/
|
|
22
|
+
export declare abstract class InferloAI {
|
|
23
|
+
}
|
|
24
|
+
export interface InferloAI extends AI {
|
|
25
|
+
}
|
|
26
|
+
/** A Ts.ED provider that registers an AI client as InferloAI, for @Configuration({ imports }) and PlatformTest.create({ imports }). */
|
|
27
|
+
export interface InferloAIProvider {
|
|
28
|
+
token: typeof InferloAI;
|
|
29
|
+
use: AI;
|
|
30
|
+
}
|
|
31
|
+
/** Registers an AI client (createAI(...) or an Inferlo app's app.ai) for injection: @Configuration({ imports: [inferloAI(ai)] }). */
|
|
32
|
+
export declare function inferloAI(ai: AI): InferloAIProvider;
|
package/dist/tsed.js
ADDED
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
import { assertAIClient } from "./ai-client.js";
|
|
2
|
+
/**
|
|
3
|
+
* Injection token and type of the AI client in Ts.ED: constructor(private readonly ai: InferloAI) {},
|
|
4
|
+
* @Inject(InferloAI) ai: InferloAI, or inject(InferloAI). It has every method of AI.
|
|
5
|
+
*/
|
|
6
|
+
export class InferloAI {
|
|
7
|
+
}
|
|
8
|
+
/** Registers an AI client (createAI(...) or an Inferlo app's app.ai) for injection: @Configuration({ imports: [inferloAI(ai)] }). */
|
|
9
|
+
export function inferloAI(ai) {
|
|
10
|
+
assertAIClient(ai, 'Pass createAI({ providers, models }) from "@browserlessapi/inferlo/ai", or an Inferlo app\'s app.ai: @Configuration({ imports: [inferloAI(ai)] }).');
|
|
11
|
+
return { token: InferloAI, use: ai };
|
|
12
|
+
}
|
|
13
|
+
//# sourceMappingURL=tsed.js.map
|
package/dist/tsed.js.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tsed.js","sourceRoot":"","sources":["../src/tsed.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;GAGG;AACH,MAAM,OAAgB,SAAS;CAAG;AASlC,qIAAqI;AACrI,MAAM,UAAU,SAAS,CAAC,EAAM;IAC9B,cAAc,CAAC,EAAE,EAAE,oJAAoJ,CAAC,CAAC;IACzK,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC"}
|
package/llms.txt
CHANGED
|
@@ -1,22 +1,28 @@
|
|
|
1
1
|
# Inferlo
|
|
2
2
|
|
|
3
|
-
> Inferlo is
|
|
3
|
+
> Inferlo is an enterprise-ready, batteries-included TypeScript backend framework (routes, schemas, database with PostgreSQL and migrations, auth, rate limiting, background jobs, cron, OpenAPI) with AI models built in (Anthropic, OpenAI, Gemini, Ollama and OpenAI-compatible providers with fallback, structured output, streaming, tool calling, embeddings and usage tracking) and an MCP server, with zero runtime dependencies. Runs on Node.js 22.18+, Bun, Deno and edge runtimes. Package: @browserlessapi/inferlo.
|
|
4
4
|
|
|
5
5
|
Key rules: routes are private unless `auth: "public"`; validate input with `t.*` schemas; use `db.<table>` methods (never string-built SQL); every model has id, createdAt, updatedAt automatically; relative imports end in `.ts`; run `inferlo describe --json` to see an app and `inferlo check --json` after changes.
|
|
6
6
|
|
|
7
7
|
## Docs
|
|
8
8
|
|
|
9
9
|
- [Getting started](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/getting-started.md): install, project layout, minimal app
|
|
10
|
+
- [Configuration](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/config.md): config({ schema, secrets, environments }), typed settings validated at startup, secrets redacted
|
|
10
11
|
- [Schemas](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/schema.md): t.* types, modifiers, validation, JSON Schema
|
|
11
12
|
- [Models and database](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/database.md): model(), queries, adapters, db push, transactions
|
|
12
|
-
- [Routes](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/routes.md): options, handler context, return values, errors, middleware
|
|
13
|
+
- [Routes](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/routes.md): options, handler context, return values, errors, middleware, deprecated routes (Deprecation and Sunset headers)
|
|
13
14
|
- [Auth](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/auth.md): auth.resolve, roles, bearer API keys, passwords
|
|
14
15
|
- [AI](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/ai.md): providers, aliases and fallback, structured output, streaming, embeddings, usage and budgets
|
|
15
16
|
- [MCP, OpenAPI and describe](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/mcp.md)
|
|
16
17
|
- [CLI](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/cli.md)
|
|
17
18
|
- [Testing](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/testing.md)
|
|
18
|
-
- [
|
|
19
|
-
- [
|
|
19
|
+
- [Use with other frameworks](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/integrations.md): the AI module in any framework, toNodeHandler and fromNodeRequest to mount an app in Express, Fastify, NestJS or node:http, inferloAI() middleware for Hono (c.var.ai), Express (req.ai), Elysia (ai) and tRPC (ctx.ai), inferloPlugin for Fastify (request.ai, app under a prefix), InferloModule for NestJS, an AdonisJS provider (ctx.ai, config/ai.ts), InferloAI and inferloAI() for Ts.ED injection, trpcTools() for tRPC procedures as AI tools
|
|
20
|
+
- [Migrate from Express](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/migrate-from-express.md): move an Express app to Inferlo route by route at the same URLs, with a concept mapping table, shared auth and tests
|
|
21
|
+
- [Security](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/security.md): secure defaults and security headers (createApp({ secureHeaders }))
|
|
22
|
+
- [Observability](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/observability.md): request ids (X-Request-Id, ctx.requestId), request logs and JSON logs with createApp({ logging: { format: "json", requests: true } }), your own logger, Prometheus metrics with createApp({ metrics: { token } })
|
|
23
|
+
- [Deployment](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/deploy.md): Node, Bun, Deno, edge, health and readiness endpoints, graceful shutdown with app.close()
|
|
24
|
+
- [Support policy](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/support.md): semantic versioning, which versions get fixes, LTS after 1.0, deprecation rules and supported runtime, database and framework versions
|
|
25
|
+
- [Error codes](https://github.com/BrowserlessAPI/Inferlo/blob/main/docs/errors.md): every ILxxxx code with its fix
|
|
20
26
|
|
|
21
27
|
## Full text
|
|
22
28
|
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@browserlessapi/inferlo",
|
|
3
|
-
"version": "0.
|
|
4
|
-
"description": "The TypeScript backend framework with built
|
|
3
|
+
"version": "0.5.0",
|
|
4
|
+
"description": "The enterprise-ready TypeScript backend framework, with AI models built in: routing, validation, PostgreSQL and migrations, auth, rate limiting, jobs, OpenAPI and MCP, plus Anthropic, OpenAI, Gemini, Ollama and OpenAI-compatible models.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|
|
7
7
|
"author": "BrowserlessAPI",
|
|
@@ -35,6 +35,42 @@
|
|
|
35
35
|
"types": "./dist/index.d.ts",
|
|
36
36
|
"default": "./dist/index.js"
|
|
37
37
|
},
|
|
38
|
+
"./adonisjs": {
|
|
39
|
+
"types": "./dist/adonisjs.d.ts",
|
|
40
|
+
"default": "./dist/adonisjs.js"
|
|
41
|
+
},
|
|
42
|
+
"./ai": {
|
|
43
|
+
"types": "./dist/ai/public.d.ts",
|
|
44
|
+
"default": "./dist/ai/public.js"
|
|
45
|
+
},
|
|
46
|
+
"./elysia": {
|
|
47
|
+
"types": "./dist/elysia.d.ts",
|
|
48
|
+
"default": "./dist/elysia.js"
|
|
49
|
+
},
|
|
50
|
+
"./express": {
|
|
51
|
+
"types": "./dist/express.d.ts",
|
|
52
|
+
"default": "./dist/express.js"
|
|
53
|
+
},
|
|
54
|
+
"./fastify": {
|
|
55
|
+
"types": "./dist/fastify.d.ts",
|
|
56
|
+
"default": "./dist/fastify.js"
|
|
57
|
+
},
|
|
58
|
+
"./hono": {
|
|
59
|
+
"types": "./dist/hono.d.ts",
|
|
60
|
+
"default": "./dist/hono.js"
|
|
61
|
+
},
|
|
62
|
+
"./nestjs": {
|
|
63
|
+
"types": "./dist/nestjs.d.ts",
|
|
64
|
+
"default": "./dist/nestjs.js"
|
|
65
|
+
},
|
|
66
|
+
"./tsed": {
|
|
67
|
+
"types": "./dist/tsed.d.ts",
|
|
68
|
+
"default": "./dist/tsed.js"
|
|
69
|
+
},
|
|
70
|
+
"./trpc": {
|
|
71
|
+
"types": "./dist/trpc.d.ts",
|
|
72
|
+
"default": "./dist/trpc.js"
|
|
73
|
+
},
|
|
38
74
|
"./postgres": {
|
|
39
75
|
"types": "./dist/db/postgres.d.ts",
|
|
40
76
|
"default": "./dist/db/postgres.js"
|
|
@@ -57,7 +93,7 @@
|
|
|
57
93
|
"scripts": {
|
|
58
94
|
"build": "rm -rf dist && tsc -p tsconfig.build.json && chmod +x dist/cli/main.js",
|
|
59
95
|
"prepare": "npm run build",
|
|
60
|
-
"typecheck": "tsc --noEmit && tsc --noEmit -p examples/helpdesk",
|
|
96
|
+
"typecheck": "tsc --noEmit && tsc --noEmit -p examples/helpdesk && tsc --noEmit -p examples/with-hono && tsc --noEmit -p examples/with-express && tsc --noEmit -p examples/with-fastify && tsc --noEmit -p examples/with-elysia && tsc --noEmit -p examples/with-nestjs && tsc --noEmit -p examples/with-trpc && tsc --noEmit -p examples/with-adonisjs && tsc --noEmit -p examples/with-tsed",
|
|
61
97
|
"test": "node --test --test-reporter=spec \"test/**/*.test.ts\" \"examples/*/test/*.test.ts\"",
|
|
62
98
|
"test:bun": "bun test test/",
|
|
63
99
|
"llms": "node scripts/build-llms.ts",
|
|
@@ -73,9 +109,27 @@
|
|
|
73
109
|
}
|
|
74
110
|
},
|
|
75
111
|
"devDependencies": {
|
|
112
|
+
"@adonisjs/core": "^6.21.0",
|
|
113
|
+
"@nestjs/common": "^12.3.3",
|
|
114
|
+
"@nestjs/core": "^12.3.3",
|
|
115
|
+
"@nestjs/platform-express": "^12.3.3",
|
|
116
|
+
"@trpc/server": "^11.24.0",
|
|
117
|
+
"@tsed/core": "^8.45.0",
|
|
118
|
+
"@tsed/di": "^8.45.0",
|
|
119
|
+
"@tsed/platform-express": "^8.45.0",
|
|
120
|
+
"@tsed/platform-http": "^8.45.0",
|
|
121
|
+
"@tsed/platform-params": "^8.45.0",
|
|
122
|
+
"@tsed/schema": "^8.45.0",
|
|
123
|
+
"@types/express": "^5.0.6",
|
|
76
124
|
"@types/node": "^22.18.0",
|
|
77
125
|
"@types/pg": "^8.15.0",
|
|
126
|
+
"elysia": "^1.4.30",
|
|
127
|
+
"express": "^5.3.0",
|
|
128
|
+
"fastify": "^5.12.8",
|
|
129
|
+
"hono": "^4.13.16",
|
|
78
130
|
"pg": "^8.16.0",
|
|
131
|
+
"reflect-metadata": "^0.2.2",
|
|
132
|
+
"rxjs": "^7.8.2",
|
|
79
133
|
"typescript": "^5.9.3"
|
|
80
134
|
},
|
|
81
135
|
"publishConfig": {
|
package/templates/app/AGENTS.md
CHANGED
|
@@ -22,6 +22,7 @@ Do not finish until `inferlo check` passes.
|
|
|
22
22
|
|---|---|
|
|
23
23
|
| `src/models.ts` | Every model (`model("table_name", { ... })`) and the `models` array |
|
|
24
24
|
| `src/routes/<feature>.ts` | Routes for one feature, each one an exported `const` |
|
|
25
|
+
| `src/config.ts` | `settings`: every environment variable, validated at startup with `config({ schema, secrets })` |
|
|
25
26
|
| `src/app.ts` | `createApp({ models, routes, db, auth, ai })`. Import route modules with `import * as x` |
|
|
26
27
|
| `src/server.ts` | Starts the server. Keep it small |
|
|
27
28
|
| `test/<feature>.test.ts` | Tests using `app.request(path, { method, json, as: user })` |
|
|
@@ -32,16 +33,19 @@ Do not finish until `inferlo check` passes.
|
|
|
32
33
|
2. **Routes are private by default.** A route without `auth` needs a signed-in user. Use `auth: "public"` only for routes anyone may call, and `auth: "<role>"` for role checks.
|
|
33
34
|
3. **Validate every input with a schema.** `body`, `query` and `params` options. Reuse model schemas: `Ticket.pick("title", "body")`, `Ticket.omit("ownerId")`, `.partial()` for PATCH.
|
|
34
35
|
4. **Check ownership.** Fetch with `db.x.get(id)` (throws 404) and compare `ownerId` to `user.id`; throw `notFound()` when it does not match, so other users' ids are not revealed.
|
|
35
|
-
5. **Related rows:** a `t.ref` field named `<name>Id` is a relation: `db.notes.findMany({ include: { owner: true } })` adds `note.owner` with one extra query, and `db.users.findMany({ include: { notes: true } })` adds `user.notes` (the rows that point to each user). Never load related rows in a loop.
|
|
36
|
+
5. **Related rows:** a `t.ref` field named `<name>Id` is a relation: `db.notes.findMany({ include: { owner: true } })` adds `note.owner` with one extra query, and `db.users.findMany({ include: { notes: true } })` adds `user.notes` (the rows that point to each user). Never load related rows in a loop. For lists clients page through, use `db.notes.paginate({ where, orderBy: { createdAt: "desc" }, cursor: query.cursor, limit: query.limit })`, which returns `{ items, nextCursor }`.
|
|
36
37
|
6. **Never write raw SQL with string concatenation.** Use the table methods. If you really need SQL, use `db.$sql(text, params)` with `$1` placeholders.
|
|
37
38
|
7. **Model ids, timestamps:** every model already has `id`, `createdAt`, `updatedAt`. Never define them or send them as input.
|
|
38
39
|
8. **New field?** Add it to the model in `src/models.ts`, then run `npx inferlo db push` in development, or `npx inferlo db migrate <name>` to write a migration file for production (applied with `npx inferlo db migrate --apply`). Use `.optional()` or `.default()` for new fields on existing tables. Never edit `migrations/snapshot.json`, and never edit a migration file that has been applied (`--apply` warns with IL4018 and does not run the change): put changes in a new migration. Removing a model or field needs `npx inferlo db migrate <name> --allow-drop` (it deletes that data); never use it for a rename. Changing a field's type or default, making it required or optional, or changing an enum's values needs `--allow-change`; give a newly required field a `.default()` so existing NULL rows get a value, and before removing an enum value add an `UPDATE` in the new migration file (before its `ADD CONSTRAINT`) that moves rows off it (IL4021).
|
|
39
40
|
9. **New resource?** `npx inferlo add resource <plural_name>` generates the model and CRUD routes. Then edit them.
|
|
40
|
-
10. **AI calls** use aliases from `src/app.ts` (`model: "fast"`), never hard-coded provider model ids in routes. Use `output: schema` for structured data and `for: user.id` so usage is tracked per user. To let the model act, pass routes as tools: `ai.generate({ prompt, tools: [createNote, getNote], for: user.id })`. Each tool call runs as the current user with that route's auth and validation. To send images: `ai.generate({ prompt, images: [{ url }] })` or `[{ base64, mediaType: "image/png" }]`. Give routes that call AI models, send email or check passwords a `rateLimit: { max, per, by }` (IL2005 is the 429 it returns).
|
|
41
|
+
10. **AI calls** use aliases from `src/app.ts` (`model: "fast"`), never hard-coded provider model ids in routes. Use `output: schema` for structured data and `for: user.id` so usage is tracked per user. To let the model act, pass routes as tools: `ai.generate({ prompt, tools: [createNote, getNote], for: user.id })`. Each tool call runs as the current user with that route's auth and validation. For work that is not a route (an external API, a calculation), make a function tool: `tool("getWeather", { description, input: t.object({ ... }) }).handle(async ({ input }) => ...)`. To send images: `ai.generate({ prompt, images: [{ url }] })` or `[{ base64, mediaType: "image/png" }]`. Give routes that call AI models, send email or check passwords a `rateLimit: { max, per, by }` (IL2005 is the 429 it returns).
|
|
41
42
|
11. **Errors:** throw `notFound()`, `forbidden()`, `badRequest()` or `httpError(status, message)`. Every Inferlo error has a code (ILxxxx), a fix and a docs link: read the fix before changing code.
|
|
42
43
|
12. **Imports:** relative imports end in `.ts` (`import { Note } from "../models.ts"`).
|
|
43
|
-
13. **
|
|
44
|
-
14. **
|
|
44
|
+
13. **Configuration:** read environment variables only through `settings` from `src/config.ts`. A new variable is a new field in its `t.object({ ... })` schema (`.default(...)` or `.optional()` unless the app cannot start without it), and API keys, passwords and connection URLs go in `secrets` so they are never logged. Never read `process.env` in routes.
|
|
45
|
+
14. **Expose to AI agents:** add `tool: true` to a route to make it an MCP tool at `/mcp`. Same auth applies.
|
|
46
|
+
15. **Slow work after the response** (email, slow AI calls) is a background job: `export const x = job("send-email", { input: t.object({ ... }) }).handle(async ({ input, db, ai }) => { ... })` in `src/jobs.ts`, registered with `createApp({ jobs: [jobs] })`, queued with `await ctx.jobs.enqueue(x, { ... })`. Pass ids in the input, not rows. In tests, run queued jobs with `await app.jobs.runDue()`. Jobs run in the server process (`app.jobs.start()` in `src/server.ts`); with `createApp({ jobQueue: { store: "database" } })` they are kept in Postgres and `npm run worker` (`inferlo worker`) runs them in separate processes. Scheduled work is a cron next to its job: `export const nightly = cron("0 3 * * *", cleanupJob)` (UTC; the job's input must be `t.object({})`).
|
|
47
|
+
16. **Security headers and health:** every response already gets security headers (CSP, HSTS over HTTPS, nosniff, frame and referrer policies) and `GET /health` and `GET /ready` are built in (`health: true` in `src/app.ts`). Change a header with `createApp({ secureHeaders: { "Content-Security-Policy": "..." } })` instead of setting it in every route, never turn them all off without a proxy that adds them, and never add your own `/health` route. On SIGTERM, `src/server.ts` calls `app.close()`, which finishes in-flight requests and jobs first. Prometheus metrics (`GET /metrics`: requests, jobs, AI calls, tokens and cost) are served when `METRICS_TOKEN` is set; never add your own `/metrics` route.
|
|
48
|
+
17. **Replacing a route:** do not delete a route clients use. Add the new one and mark the old one `deprecated: { since: "YYYY-MM-DD", sunset: "YYYY-MM-DD", link: "https://..." }` in its options; it then sends the standard Deprecation and Sunset headers and is marked in OpenAPI and MCP. Remove it after the sunset date.
|
|
45
49
|
|
|
46
50
|
## Testing
|
|
47
51
|
|
package/templates/app/src/app.ts
CHANGED
|
@@ -1,18 +1,25 @@
|
|
|
1
|
-
import { anthropic, bearer, createApp,
|
|
1
|
+
import { anthropic, bearer, createApp, hashToken, memory, openai } from "@browserlessapi/inferlo";
|
|
2
2
|
import { postgres } from "@browserlessapi/inferlo/postgres";
|
|
3
|
+
import { settings } from "./config.ts";
|
|
3
4
|
import { models } from "./models.ts";
|
|
4
|
-
import * as health from "./routes/health.ts";
|
|
5
5
|
import * as notes from "./routes/notes.ts";
|
|
6
6
|
|
|
7
|
-
const databaseUrl = env("DATABASE_URL", { optional: true });
|
|
8
|
-
|
|
9
7
|
export const app = createApp({
|
|
10
8
|
name: "{{name}}",
|
|
11
9
|
version: "0.1.0",
|
|
12
10
|
models,
|
|
13
11
|
// inferlo:routes
|
|
14
|
-
routes: [
|
|
15
|
-
|
|
12
|
+
routes: [notes],
|
|
13
|
+
// GET /health (liveness) and GET /ready (readiness: database and AI configuration).
|
|
14
|
+
health: true,
|
|
15
|
+
// Config secrets never appear in logs (provider keys, tokens and passwords in URLs are hidden too).
|
|
16
|
+
redact: [settings],
|
|
17
|
+
// One log line per request with its id (also in the X-Request-Id header), status and duration.
|
|
18
|
+
// Use format: "json" for one JSON object per line when a log collector reads the output.
|
|
19
|
+
logging: { requests: true },
|
|
20
|
+
// Prometheus metrics at GET /metrics (requests, jobs, AI calls, tokens and cost) when METRICS_TOKEN is set.
|
|
21
|
+
metrics: settings.METRICS_TOKEN ? { token: settings.METRICS_TOKEN } : false,
|
|
22
|
+
db: settings.DATABASE_URL ? postgres({ url: settings.DATABASE_URL }) : memory(),
|
|
16
23
|
|
|
17
24
|
// Requests send "Authorization: Bearer <api key>". Keys are stored as SHA-256 hashes.
|
|
18
25
|
auth: bearer(async (token, { db }) => {
|
|
@@ -24,8 +31,8 @@ export const app = createApp({
|
|
|
24
31
|
|
|
25
32
|
ai: {
|
|
26
33
|
providers: {
|
|
27
|
-
anthropic: anthropic({ apiKey:
|
|
28
|
-
openai: openai({ apiKey:
|
|
34
|
+
anthropic: anthropic({ apiKey: settings.ANTHROPIC_API_KEY }),
|
|
35
|
+
openai: openai({ apiKey: settings.OPENAI_API_KEY }),
|
|
29
36
|
},
|
|
30
37
|
// Aliases keep model ids in one place. A list means: try in order.
|
|
31
38
|
models: {
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
import { config, t } from "@browserlessapi/inferlo";
|
|
2
|
+
|
|
3
|
+
// Every environment variable the app reads, validated once at startup (IL7003 lists what is wrong).
|
|
4
|
+
// Values come from the environment (inferlo dev reads .env), then from `environments`, then defaults.
|
|
5
|
+
// Secrets are redacted when settings are logged or serialised.
|
|
6
|
+
export const settings = config({
|
|
7
|
+
schema: t.object({
|
|
8
|
+
// Leave empty to use the in-memory database (data resets on restart).
|
|
9
|
+
DATABASE_URL: t.string().optional(),
|
|
10
|
+
PORT: t.int().min(1).max(65535).default(3000),
|
|
11
|
+
ANTHROPIC_API_KEY: t.string().default(""),
|
|
12
|
+
OPENAI_API_KEY: t.string().default(""),
|
|
13
|
+
// Set to serve Prometheus metrics at GET /metrics (scrapers send it as a bearer token).
|
|
14
|
+
METRICS_TOKEN: t.string().min(16).optional(),
|
|
15
|
+
}),
|
|
16
|
+
secrets: ["DATABASE_URL", "ANTHROPIC_API_KEY", "OPENAI_API_KEY", "METRICS_TOKEN"],
|
|
17
|
+
});
|
|
@@ -1,5 +1,6 @@
|
|
|
1
|
-
import { createToken,
|
|
1
|
+
import { createToken, hashToken } from "@browserlessapi/inferlo";
|
|
2
2
|
import { app } from "./app.ts";
|
|
3
|
+
import { settings } from "./config.ts";
|
|
3
4
|
|
|
4
5
|
await app.db.$sync();
|
|
5
6
|
|
|
@@ -9,18 +10,17 @@ if (app.db.$adapter.dialect === "memory") {
|
|
|
9
10
|
const token = createToken("dev");
|
|
10
11
|
await app.db.api_keys.insert({ userId: user.id, hash: await hashToken(token) });
|
|
11
12
|
console.log(`Dev API key: ${token}`);
|
|
12
|
-
console.log(`Try: curl -H "Authorization: Bearer ${token}" http://localhost:${
|
|
13
|
+
console.log(`Try: curl -H "Authorization: Bearer ${token}" http://localhost:${settings.PORT}/notes`);
|
|
13
14
|
}
|
|
14
15
|
|
|
15
|
-
const server = await app.listen(
|
|
16
|
+
const server = await app.listen(settings.PORT);
|
|
16
17
|
console.log(`{{name}} running on http://localhost:${server.port}`);
|
|
17
18
|
|
|
18
19
|
// Background jobs run in this process. With jobQueue: { store: "database" } in src/app.ts they can
|
|
19
20
|
// also run in separate processes: npm run worker.
|
|
20
|
-
|
|
21
|
+
app.jobs.start();
|
|
21
22
|
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
});
|
|
23
|
+
// Graceful shutdown: /ready answers 503 at once so the load balancer stops sending traffic, requests are
|
|
24
|
+
// still served for 5 seconds, then in-flight requests and the running job finish and the server and the
|
|
25
|
+
// database close.
|
|
26
|
+
process.on("SIGTERM", () => void app.close({ delayMs: 5000 }));
|