@daloyjs/core 0.4.0 → 0.5.0

package/dist/rate-limit-redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-redis.d.ts","sourceRoot":"","sources":["../src/rate-limit-redis.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxE;AAED,uDAAuD;AACvD,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,WAAW,GAAG,aAAa,CAAC;CACzD;AA+BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,cAAc,CAoBpF;AAID;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnF;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,CAMjE;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,CACF,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAC/C,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAMrE"}

package/dist/rate-limit-redis.js

@@ -0,0 +1,117 @@
+/**
+ * Redis-backed {@link RateLimitStore} for {@link rateLimit}.
+ *
+ * The default in-process `MemoryStore` is per-instance and therefore unsafe
+ * behind more than one server replica. This store keeps the same token-bucket
+ * semantics (fixed window of `windowMs`) but stores the counter in Redis so
+ * every replica observes the same value.
+ *
+ * We avoid taking a hard dependency on any specific Redis client. Instead the
+ * store accepts a tiny {@link RedisCommands} contract: a single `eval`
+ * method. It also ships small adapters for the two most common clients
+ * ({@link ioredisAdapter}, {@link nodeRedisAdapter}). That keeps installs
+ * lightweight and means new clients can be plugged in with ~5 lines of glue
+ * code, which matches DaloyJS's "no magic, no global patching" rule.
+ *
+ * @example Using ioredis
+ * ```ts
+ * import IORedis from "ioredis";
+ * import { rateLimit } from "@daloyjs/core";
+ * import { redisRateLimitStore, ioredisAdapter } from "@daloyjs/core/rate-limit-redis";
+ *
+ * const redis = new IORedis(process.env.REDIS_URL!);
+ * app.use(rateLimit({
+ *   windowMs: 60_000,
+ *   max: 120,
+ *   store: redisRateLimitStore({ client: ioredisAdapter(redis) }),
+ * }));
+ * ```
+ *
+ * @example Using node-redis v4+
+ * ```ts
+ * import { createClient } from "redis";
+ * import { redisRateLimitStore, nodeRedisAdapter } from "@daloyjs/core/rate-limit-redis";
+ *
+ * const redis = createClient({ url: process.env.REDIS_URL });
+ * await redis.connect();
+ * app.use(rateLimit({
+ *   windowMs: 60_000,
+ *   max: 120,
+ *   store: redisRateLimitStore({ client: nodeRedisAdapter(redis) }),
+ * }));
+ * ```
+ */
+/**
+ * Atomic INCR + PEXPIRE script.
+ *
+ * Returns `{count, ttlMs}` so the caller can compute `resetMs` without a
+ * second round trip. We set the TTL only on the very first INCR so a busy
+ * key keeps its original window and is not perpetually extended.
+ */
+const SCRIPT = `local current = redis.call('INCR', KEYS[1])
+if current == 1 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+  return {current, tonumber(ARGV[1])}
+end
+local ttl = redis.call('PTTL', KEYS[1])
+if ttl < 0 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+  ttl = tonumber(ARGV[1])
+end
+return {current, ttl}`;
+function toNumber(value) {
+    if (typeof value === "number")
+        return value;
+    if (typeof value === "bigint")
+        return Number(value);
+    if (typeof value === "string") {
+        const n = Number(value);
+        return Number.isFinite(n) ? n : 0;
+    }
+    return 0;
+}
+/**
+ * Build a {@link RateLimitStore} that persists counters in Redis.
+ *
+ * The returned store is safe to share between requests and replicas. Errors
+ * from Redis are fail-open by default (see {@link RedisRateLimitStoreOptions.onError});
+ * pass a custom handler to fail-closed (return `"fail-closed"`).
+ */
+export function redisRateLimitStore(opts) {
+    const prefix = opts.prefix ?? "daloy:rl:";
+    const onError = opts.onError;
+    return {
+        async hit(key, windowMs) {
+            const fullKey = prefix + key;
+            try {
+                const result = (await opts.client.eval(SCRIPT, [fullKey], [String(windowMs)]));
+                const count = toNumber(result?.[0]);
+                const ttl = toNumber(result?.[1]);
+                return { count, resetMs: Date.now() + ttl };
+            }
+            catch (err) {
+                const decision = onError ? onError(err) : "fail-open";
+                if (decision === "fail-closed")
+                    throw err;
+                return { count: 1, resetMs: Date.now() + windowMs };
+            }
+        },
+    };
+}
+/** Wrap an [`ioredis`](https://github.com/redis/ioredis) client. */
+export function ioredisAdapter(client) {
+    return {
+        eval(script, keys, args) {
+            return client.eval(script, keys.length, ...keys, ...args);
+        },
+    };
+}
+/** Wrap a [`node-redis`](https://github.com/redis/node-redis) v4+ client. */
+export function nodeRedisAdapter(client) {
+    return {
+        eval(script, keys, args) {
+            return client.eval(script, { keys, arguments: args });
+        },
+    };
+}
+//# sourceMappingURL=rate-limit-redis.js.map

package/dist/rate-limit-redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-redis.js","sourceRoot":"","sources":["../src/rate-limit-redis.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAiCH;;;;;;GAMG;AACH,MAAM,MAAM,GAAG;;;;;;;;;;sBAUO,CAAC;AAEvB,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,QAAgB;YACrC,MAAM,OAAO,GAAG,MAAM,GAAG,GAAG,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAEvD,CAAC;gBACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBACtD,IAAI,QAAQ,KAAK,aAAa;oBAAE,MAAM,GAAG,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YACtD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAYD,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI;YACrB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC;AAaD,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI;YACrB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -17,6 +17,9 @@
   "author": "DaloyJS",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "daloy": "bin/daloy.mjs"
+  },
   "engines": {
     "node": ">=20.10.0",
     "pnpm": ">=9.0.0"
@@ -69,10 +72,23 @@
     "./tracing": {
       "types": "./dist/tracing.d.ts",
       "import": "./dist/tracing.js"
+    },
+    "./multipart": {
+      "types": "./dist/multipart.d.ts",
+      "import": "./dist/multipart.js"
+    },
+    "./rate-limit-redis": {
+      "types": "./dist/rate-limit-redis.d.ts",
+      "import": "./dist/rate-limit-redis.js"
+    },
+    "./cli": {
+      "types": "./dist/cli.d.ts",
+      "import": "./dist/cli.js"
     }
   },
   "files": [
     "dist",
+    "bin",
     "README.md"
   ],
   "keywords": [
@@ -110,6 +126,7 @@
     "gen:openapi": "node --import tsx scripts/dump-openapi.ts",
     "gen:client": "openapi-ts",
     "gen": "pnpm gen:openapi && pnpm gen:client",
+    "verify:lockfile": "node --import tsx scripts/verify-lockfile-sources.ts",
     "audit": "pnpm audit --prod"
   }
 }