@daloyjs/core 1.0.0-beta.6 → 1.0.0-rc.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (99) hide show
  1. package/README.md +2 -2
  2. package/dist/adapters/bun.d.ts +13 -1
  3. package/dist/adapters/bun.js +8 -1
  4. package/dist/adapters/cloudflare.d.ts +7 -1
  5. package/dist/adapters/cloudflare.js +6 -1
  6. package/dist/adapters/deno.d.ts +11 -1
  7. package/dist/adapters/deno.js +8 -1
  8. package/dist/adapters/fastly.d.ts +12 -2
  9. package/dist/adapters/fastly.js +12 -2
  10. package/dist/adapters/lambda.d.ts +37 -1
  11. package/dist/adapters/lambda.js +6 -1
  12. package/dist/adapters/node.d.ts +12 -1
  13. package/dist/adapters/node.js +223 -12
  14. package/dist/adapters/vercel.d.ts +13 -1
  15. package/dist/adapters/vercel.js +12 -1
  16. package/dist/app.d.ts +78 -17
  17. package/dist/app.js +444 -86
  18. package/dist/banner.d.ts +6 -0
  19. package/dist/banner.js +6 -0
  20. package/dist/cli.d.ts +35 -0
  21. package/dist/cli.js +23 -1
  22. package/dist/combine.d.ts +8 -0
  23. package/dist/combine.js +8 -0
  24. package/dist/compression.d.ts +3 -0
  25. package/dist/compression.js +3 -0
  26. package/dist/config.d.ts +4 -0
  27. package/dist/config.js +4 -0
  28. package/dist/conn-info.d.ts +35 -2
  29. package/dist/conn-info.js +35 -2
  30. package/dist/contract.d.ts +2 -0
  31. package/dist/contract.js +2 -0
  32. package/dist/cookie.d.ts +12 -0
  33. package/dist/cookie.js +12 -0
  34. package/dist/dependency.d.ts +4 -0
  35. package/dist/dependency.js +3 -0
  36. package/dist/discriminator.d.ts +13 -0
  37. package/dist/discriminator.js +23 -1
  38. package/dist/docs.d.ts +78 -0
  39. package/dist/docs.js +21 -0
  40. package/dist/errors.d.ts +16 -0
  41. package/dist/errors.js +14 -0
  42. package/dist/etag.d.ts +2 -0
  43. package/dist/etag.js +2 -0
  44. package/dist/fetch-guard.d.ts +7 -0
  45. package/dist/fetch-guard.js +7 -0
  46. package/dist/fetch-resilience.d.ts +4 -0
  47. package/dist/fetch-resilience.js +4 -0
  48. package/dist/http-signatures.d.ts +32 -0
  49. package/dist/http-signatures.js +30 -0
  50. package/dist/index.d.ts +1 -1
  51. package/dist/ip-restriction.d.ts +40 -3
  52. package/dist/ip-restriction.js +35 -3
  53. package/dist/jwk.d.ts +12 -1
  54. package/dist/jwk.js +6 -0
  55. package/dist/jwt.d.ts +14 -0
  56. package/dist/jwt.js +10 -0
  57. package/dist/load-shedding.d.ts +3 -0
  58. package/dist/load-shedding.js +3 -0
  59. package/dist/logger.d.ts +13 -0
  60. package/dist/logger.js +3 -0
  61. package/dist/mcp.d.ts +152 -10
  62. package/dist/mcp.js +223 -19
  63. package/dist/middleware.d.ts +68 -0
  64. package/dist/middleware.js +17 -0
  65. package/dist/mtls.d.ts +19 -2
  66. package/dist/mtls.js +12 -2
  67. package/dist/multipart.d.ts +42 -5
  68. package/dist/multipart.js +41 -5
  69. package/dist/openapi.d.ts +15 -9
  70. package/dist/openapi.js +6 -9
  71. package/dist/rate-limit-redis.d.ts +21 -2
  72. package/dist/rate-limit-redis.js +17 -2
  73. package/dist/safe-redirect.d.ts +6 -0
  74. package/dist/safe-redirect.js +6 -0
  75. package/dist/sbom.cdx.json +9 -9
  76. package/dist/sbom.spdx.json +5 -5
  77. package/dist/scheduler.d.ts +4 -0
  78. package/dist/schema.d.ts +25 -0
  79. package/dist/security-schemes.d.ts +50 -0
  80. package/dist/security-schemes.js +6 -0
  81. package/dist/security.d.ts +33 -0
  82. package/dist/security.js +28 -10
  83. package/dist/session.d.ts +34 -5
  84. package/dist/session.js +31 -5
  85. package/dist/streaming.d.ts +19 -0
  86. package/dist/streaming.js +16 -0
  87. package/dist/subdomains.d.ts +4 -0
  88. package/dist/subdomains.js +4 -0
  89. package/dist/time-claims.d.ts +22 -2
  90. package/dist/time-claims.js +6 -0
  91. package/dist/tracing.d.ts +12 -0
  92. package/dist/tracing.js +6 -0
  93. package/dist/types.d.ts +70 -1
  94. package/dist/waf.js +21 -1
  95. package/dist/webhook-delivery.d.ts +6 -0
  96. package/dist/webhook-delivery.js +5 -0
  97. package/dist/websocket.d.ts +137 -4
  98. package/dist/websocket.js +105 -4
  99. package/package.json +1 -1
@@ -114,6 +114,7 @@ export type UploadedFile = Blob & {
114
114
  * emit `format: binary`/`byte` accordingly.
115
115
  */
116
116
  export interface FileFieldSchema<Output = UploadedFile> extends StandardSchemaV1<unknown, Output> {
117
+ /** Resolved {@link FileFieldOptions} (with `format` defaulted) stamped on the schema for OpenAPI generation. */
117
118
  readonly [FILE_FIELD_MARKER]: Required<Pick<FileFieldOptions, "format">> & FileFieldOptions;
118
119
  }
119
120
  /**
@@ -122,13 +123,26 @@ export interface FileFieldSchema<Output = UploadedFile> extends StandardSchemaV1
122
123
  * Use inside a `multipartObject({...})` body schema, or directly inside any
123
124
  * Standard-Schema-compatible object schema (Zod, Valibot, ...). DaloyJS
124
125
  * keeps the underlying `File` reference so handlers can stream the body.
126
+ *
127
+ * @param options - Field constraints with `optional: true`; `null`/`undefined` values pass through.
128
+ * @returns A {@link FileFieldSchema} whose output may be `null`/`undefined`.
125
129
  */
126
130
  export declare function fileField(options: FileFieldOptions & {
127
131
  optional: true;
128
132
  }): FileFieldSchema<UploadedFile | null | undefined>;
129
- /** Validator for a required single uploaded `File`/`Blob` field. */
133
+ /**
134
+ * Validator for a required single uploaded `File`/`Blob` field.
135
+ *
136
+ * @param options - Field constraints (`maxBytes`, `accept`, `filename`, `magicBytes`, ...).
137
+ * @returns A {@link FileFieldSchema} that rejects missing or non-file values.
138
+ */
130
139
  export declare function fileField(options?: FileFieldOptions): FileFieldSchema<UploadedFile>;
131
- /** Type-only check used by the OpenAPI generator. */
140
+ /**
141
+ * Type-only check used by the OpenAPI generator.
142
+ *
143
+ * @param s - Candidate value to test for the `FILE_FIELD_MARKER` key.
144
+ * @returns `true` when `s` is a {@link fileField}-produced schema.
145
+ */
132
146
  export declare function isFileFieldSchema(s: unknown): s is FileFieldSchema;
133
147
  /** Options for {@link multipartObject}. */
134
148
  export interface MultipartObjectOptions {
@@ -154,15 +168,38 @@ interface MultipartSchema<S extends MultipartShape> extends StandardSchemaV1<Rec
154
168
  * body. Each entry in `shape` validates one form field by name. File fields
155
169
  * should use {@link fileField}; non-file fields can use any Standard-Schema
156
170
  * validator (`z.string()`, `v.number()`, ...).
171
+ *
172
+ * @param shape - Record mapping form-field names to per-field validators.
173
+ * @param options - `strict: true` rejects undeclared extra fields. Defaults
174
+ * to `{ strict: false }` (extras pass through unvalidated).
175
+ * @returns A marker-carrying schema the OpenAPI generator renders as
176
+ * `multipart/form-data`; validation issues are prefixed with the field name.
157
177
  */
158
178
  export declare function multipartObject<S extends MultipartShape>(shape: S, options?: MultipartObjectOptions): MultipartSchema<S>;
159
- /** Type-only check used by the OpenAPI generator and request-body parser. */
179
+ /**
180
+ * Type-only check used by the OpenAPI generator and request-body parser.
181
+ *
182
+ * @param s - Candidate value to test for the `MULTIPART_SCHEMA_MARKER` key.
183
+ * @returns `true` when `s` is a {@link multipartObject}-produced schema.
184
+ */
160
185
  export declare function isMultipartObjectSchema(s: unknown): s is MultipartSchema<MultipartShape>;
161
- /** Internal: pull the multipart shape so the OpenAPI generator can walk it. */
186
+ /**
187
+ * Internal: pull the multipart shape so the OpenAPI generator can walk it.
188
+ *
189
+ * @param s - Candidate schema value.
190
+ * @returns The `{ shape, strict }` config stored under the multipart marker,
191
+ * or `undefined` when `s` is not a {@link multipartObject} schema.
192
+ */
162
193
  export declare function getMultipartShape(s: unknown): {
163
194
  shape: MultipartShape;
164
195
  strict: boolean;
165
196
  } | undefined;
166
- /** Internal: read the file-field options used for OpenAPI documentation. */
197
+ /**
198
+ * Internal: read the file-field options used for OpenAPI documentation.
199
+ *
200
+ * @param s - Candidate schema value.
201
+ * @returns The resolved {@link FileFieldOptions} stored under the file-field
202
+ * marker, or `undefined` when `s` is not a {@link fileField} schema.
203
+ */
167
204
  export declare function getFileFieldOptions(s: unknown): (Required<Pick<FileFieldOptions, "format">> & FileFieldOptions) | undefined;
168
205
  export {};
package/dist/multipart.js CHANGED
@@ -233,7 +233,15 @@ async function verifyMagicBytes(file, signatures) {
233
233
  }
234
234
  return undefined;
235
235
  }
236
- /** Shared implementation for the `fileField` overloads above. */
236
+ /**
237
+ * Shared implementation for the `fileField` overloads above.
238
+ *
239
+ * @param options - Field constraints; `format` defaults to `"binary"`, and
240
+ * the scriptable-image guard defaults to on whenever `magicBytes` is set.
241
+ * @returns The marker-carrying {@link FileFieldSchema} validator.
242
+ * @throws Error at construction when `magicBytes` config is malformed (bad
243
+ * offset, empty/out-of-range bytes, or `true` without a sniffable `accept`).
244
+ */
237
245
  export function fileField(options = {}) {
238
246
  const opts = {
239
247
  ...options,
@@ -312,7 +320,12 @@ export function fileField(options = {}) {
312
320
  };
313
321
  return schema;
314
322
  }
315
- /** Type-only check used by the OpenAPI generator. */
323
+ /**
324
+ * Type-only check used by the OpenAPI generator.
325
+ *
326
+ * @param s - Candidate value to test for the `FILE_FIELD_MARKER` key.
327
+ * @returns `true` when `s` is a {@link fileField}-produced schema.
328
+ */
316
329
  export function isFileFieldSchema(s) {
317
330
  return !!s && typeof s === "object" && FILE_FIELD_MARKER in s;
318
331
  }
@@ -321,6 +334,12 @@ export function isFileFieldSchema(s) {
321
334
  * body. Each entry in `shape` validates one form field by name. File fields
322
335
  * should use {@link fileField}; non-file fields can use any Standard-Schema
323
336
  * validator (`z.string()`, `v.number()`, ...).
337
+ *
338
+ * @param shape - Record mapping form-field names to per-field validators.
339
+ * @param options - `strict: true` rejects undeclared extra fields. Defaults
340
+ * to `{ strict: false }` (extras pass through unvalidated).
341
+ * @returns A marker-carrying schema the OpenAPI generator renders as
342
+ * `multipart/form-data`; validation issues are prefixed with the field name.
324
343
  */
325
344
  export function multipartObject(shape, options = {}) {
326
345
  const strict = options.strict ?? false;
@@ -368,17 +387,34 @@ export function multipartObject(shape, options = {}) {
368
387
  };
369
388
  return schema;
370
389
  }
371
- /** Type-only check used by the OpenAPI generator and request-body parser. */
390
+ /**
391
+ * Type-only check used by the OpenAPI generator and request-body parser.
392
+ *
393
+ * @param s - Candidate value to test for the `MULTIPART_SCHEMA_MARKER` key.
394
+ * @returns `true` when `s` is a {@link multipartObject}-produced schema.
395
+ */
372
396
  export function isMultipartObjectSchema(s) {
373
397
  return !!s && typeof s === "object" && MULTIPART_SCHEMA_MARKER in s;
374
398
  }
375
- /** Internal: pull the multipart shape so the OpenAPI generator can walk it. */
399
+ /**
400
+ * Internal: pull the multipart shape so the OpenAPI generator can walk it.
401
+ *
402
+ * @param s - Candidate schema value.
403
+ * @returns The `{ shape, strict }` config stored under the multipart marker,
404
+ * or `undefined` when `s` is not a {@link multipartObject} schema.
405
+ */
376
406
  export function getMultipartShape(s) {
377
407
  if (!isMultipartObjectSchema(s))
378
408
  return undefined;
379
409
  return s[MULTIPART_SCHEMA_MARKER];
380
410
  }
381
- /** Internal: read the file-field options used for OpenAPI documentation. */
411
+ /**
412
+ * Internal: read the file-field options used for OpenAPI documentation.
413
+ *
414
+ * @param s - Candidate schema value.
415
+ * @returns The resolved {@link FileFieldOptions} stored under the file-field
416
+ * marker, or `undefined` when `s` is not a {@link fileField} schema.
417
+ */
382
418
  export function getFileFieldOptions(s) {
383
419
  if (!isFileFieldSchema(s))
384
420
  return undefined;
package/dist/openapi.d.ts CHANGED
@@ -38,14 +38,23 @@ export interface SecuritySchemeMap {
38
38
  * (no execution path on the producer side).
39
39
  */
40
40
  export interface WebhookDefinition {
41
+ /** HTTP method the producer uses when delivering the webhook. */
41
42
  method: HttpMethod;
43
+ /** Stable operation id for codegen. Omitted from the document when unset. */
42
44
  operationId?: string;
45
+ /** Short one-line summary shown in docs UIs. */
43
46
  summary?: string;
47
+ /** Longer CommonMark description of the webhook operation. */
44
48
  description?: string;
49
+ /** Tags used to group the operation in docs UIs. */
45
50
  tags?: string[];
51
+ /** Mark the webhook operation as deprecated in the document. */
46
52
  deprecated?: boolean;
53
+ /** Request schemas (body, headers, ...) the producer sends. Same shape as route `request`. */
47
54
  request?: RequestSchemas;
55
+ /** Map of status code to response schema the consumer is expected to return. */
48
56
  responses: ResponsesMap;
57
+ /** Security requirement(s) documented on the webhook operation (e.g. a signature scheme). */
49
58
  auth?: AuthSpec;
50
59
  /**
51
60
  * Optional OpenAPI 3.1 callbacks attached to this webhook operation.
@@ -112,16 +121,13 @@ export interface OpenAPIOptions {
112
121
  */
113
122
  export declare function generateOpenAPI(app: App, options: OpenAPIOptions): Record<string, unknown>;
114
123
  /**
115
- * Serialize an OpenAPI document (or any JSON-safe object) as YAML 1.2.
116
- *
117
- * Pure function with no runtime dependency. Output is the canonical form
118
- * consumed by Swagger UI's `/swagger.yaml` style endpoints.
124
+ * Serialize an OpenAPI document (from {@link generateOpenAPI}) or any
125
+ * JSON-safe object — to YAML 1.2 using a minimal built-in emitter. Pure
126
+ * transform with no runtime dependency; output is the form consumed by
127
+ * `/swagger.yaml`-style endpoints and build-time artifacts.
119
128
  *
129
+ * @param doc - JSON-safe object to serialize (typically the generated document).
130
+ * @returns The YAML text, without a leading newline.
120
131
  * @since 0.13.1
121
132
  */
122
- /**
123
- * Serialize an OpenAPI document (from {@link generateOpenAPI}) to YAML using a
124
- * minimal built-in emitter. No external dependencies; suitable for build-time
125
- * artifacts. Reads/writes nothing; pure transform.
126
- */
127
133
  export declare function openapiToYAML(doc: Record<string, unknown>): string;
package/dist/openapi.js CHANGED
@@ -485,18 +485,15 @@ function yamlEmit(value, indent) {
485
485
  return ` ${yamlScalar(value)}\n`;
486
486
  }
487
487
  /**
488
- * Serialize an OpenAPI document (or any JSON-safe object) as YAML 1.2.
489
- *
490
- * Pure function with no runtime dependency. Output is the canonical form
491
- * consumed by Swagger UI's `/swagger.yaml` style endpoints.
488
+ * Serialize an OpenAPI document (from {@link generateOpenAPI}) or any
489
+ * JSON-safe object — to YAML 1.2 using a minimal built-in emitter. Pure
490
+ * transform with no runtime dependency; output is the form consumed by
491
+ * `/swagger.yaml`-style endpoints and build-time artifacts.
492
492
  *
493
+ * @param doc - JSON-safe object to serialize (typically the generated document).
494
+ * @returns The YAML text, without a leading newline.
493
495
  * @since 0.13.1
494
496
  */
495
- /**
496
- * Serialize an OpenAPI document (from {@link generateOpenAPI}) to YAML using a
497
- * minimal built-in emitter. No external dependencies; suitable for build-time
498
- * artifacts. Reads/writes nothing; pure transform.
499
- */
500
497
  export function openapiToYAML(doc) {
501
498
  const result = yamlEmit(doc, "");
502
499
  return result.startsWith("\n") ? result.slice(1) : result;
@@ -50,10 +50,12 @@ import type { RateLimitStore } from "./middleware.js";
50
50
  * required by the bundled script.
51
51
  */
52
52
  export interface RedisCommands {
53
+ /** Run a Lua script atomically with the given `KEYS` / `ARGV` and return the raw Redis reply. */
53
54
  eval(script: string, keys: string[], args: string[]): Promise<unknown>;
54
55
  }
55
56
  /** Options accepted by {@link redisRateLimitStore}. */
56
57
  export interface RedisRateLimitStoreOptions {
58
+ /** Redis transport (see {@link ioredisAdapter} / {@link nodeRedisAdapter} for common clients). */
57
59
  client: RedisCommands;
58
60
  /**
59
61
  * Optional namespace prefix for every Redis key. Defaults to `"daloy:rl:"`.
@@ -83,6 +85,11 @@ export interface RedisRateLimitStoreOptions {
83
85
  * abuse-sensitive limiters in front of auth, password-reset, or other
84
86
  * credential endpoints, pass `onError: () => "fail-closed"` so a Redis
85
87
  * outage rejects rather than silently disables the limit.
88
+ *
89
+ * @param opts - Redis client, key prefix, and error policy; see
90
+ * {@link RedisRateLimitStoreOptions}.
91
+ * @returns A {@link RateLimitStore} whose `hit()` atomically increments the
92
+ * windowed counter in Redis and reports `{ count, resetMs }`.
86
93
  */
87
94
  export declare function redisRateLimitStore(opts: RedisRateLimitStoreOptions): RateLimitStore;
88
95
  /**
@@ -90,19 +97,31 @@ export declare function redisRateLimitStore(opts: RedisRateLimitStoreOptions): R
90
97
  * takes `(script, numKeys, ...keysAndArgs)` is used.
91
98
  */
92
99
  export interface IoredisLike {
100
+ /** ioredis-style `EVAL`: script, number of keys, then keys and args flattened. */
93
101
  eval(script: string, numKeys: number, ...keysAndArgs: string[]): Promise<unknown>;
94
102
  }
95
- /** Wrap an [`ioredis`](https://github.com/redis/ioredis) client. */
103
+ /**
104
+ * Wrap an [`ioredis`](https://github.com/redis/ioredis) client.
105
+ *
106
+ * @param client - Connected ioredis instance (only its `eval` is used).
107
+ * @returns A {@link RedisCommands} transport for {@link redisRateLimitStore}.
108
+ */
96
109
  export declare function ioredisAdapter(client: IoredisLike): RedisCommands;
97
110
  /**
98
111
  * Shape of a `node-redis` v4+ client we care about. The v4 `eval` takes an
99
112
  * options object instead of variadic arguments.
100
113
  */
101
114
  export interface NodeRedisLike {
115
+ /** node-redis v4+ `EVAL`: script plus a `{ keys, arguments }` options object. */
102
116
  eval(script: string, options: {
103
117
  keys: string[];
104
118
  arguments: string[];
105
119
  }): Promise<unknown>;
106
120
  }
107
- /** Wrap a [`node-redis`](https://github.com/redis/node-redis) v4+ client. */
121
+ /**
122
+ * Wrap a [`node-redis`](https://github.com/redis/node-redis) v4+ client.
123
+ *
124
+ * @param client - Connected node-redis v4+ instance (only its `eval` is used).
125
+ * @returns A {@link RedisCommands} transport for {@link redisRateLimitStore}.
126
+ */
108
127
  export declare function nodeRedisAdapter(client: NodeRedisLike): RedisCommands;
@@ -84,6 +84,11 @@ function toNumber(value) {
84
84
  * abuse-sensitive limiters in front of auth, password-reset, or other
85
85
  * credential endpoints, pass `onError: () => "fail-closed"` so a Redis
86
86
  * outage rejects rather than silently disables the limit.
87
+ *
88
+ * @param opts - Redis client, key prefix, and error policy; see
89
+ * {@link RedisRateLimitStoreOptions}.
90
+ * @returns A {@link RateLimitStore} whose `hit()` atomically increments the
91
+ * windowed counter in Redis and reports `{ count, resetMs }`.
87
92
  */
88
93
  export function redisRateLimitStore(opts) {
89
94
  const prefix = opts.prefix ?? "daloy:rl:";
@@ -106,7 +111,12 @@ export function redisRateLimitStore(opts) {
106
111
  },
107
112
  };
108
113
  }
109
- /** Wrap an [`ioredis`](https://github.com/redis/ioredis) client. */
114
+ /**
115
+ * Wrap an [`ioredis`](https://github.com/redis/ioredis) client.
116
+ *
117
+ * @param client - Connected ioredis instance (only its `eval` is used).
118
+ * @returns A {@link RedisCommands} transport for {@link redisRateLimitStore}.
119
+ */
110
120
  export function ioredisAdapter(client) {
111
121
  return {
112
122
  eval(script, keys, args) {
@@ -114,7 +124,12 @@ export function ioredisAdapter(client) {
114
124
  },
115
125
  };
116
126
  }
117
- /** Wrap a [`node-redis`](https://github.com/redis/node-redis) v4+ client. */
127
+ /**
128
+ * Wrap a [`node-redis`](https://github.com/redis/node-redis) v4+ client.
129
+ *
130
+ * @param client - Connected node-redis v4+ instance (only its `eval` is used).
131
+ * @returns A {@link RedisCommands} transport for {@link redisRateLimitStore}.
132
+ */
118
133
  export function nodeRedisAdapter(client) {
119
134
  return {
120
135
  eval(script, keys, args) {
@@ -47,7 +47,9 @@
47
47
  export type SafeRedirectBlockReason = "empty-target" | "invalid-control-characters" | "protocol-relative" | "backslash-path" | "path-not-allowed" | "origin-not-allowed" | "scheme-not-allowed" | "parse-failed";
48
48
  /** Thrown when {@link safeRedirect} refuses a candidate URL and no `fallback` is configured. */
49
49
  export declare class OpenRedirectBlockedError extends Error {
50
+ /** Machine-readable {@link SafeRedirectBlockReason} explaining the refusal. */
50
51
  readonly reason: SafeRedirectBlockReason;
52
+ /** The candidate URL that was refused, verbatim. */
51
53
  readonly target: string;
52
54
  constructor(reason: SafeRedirectBlockReason, target: string);
53
55
  }
@@ -88,6 +90,10 @@ export interface SafeRedirectOptions {
88
90
  *
89
91
  * @param target - User-supplied URL candidate (path or absolute URL).
90
92
  * @param options - Allowlist + response configuration.
93
+ * @returns A redirect `Response` (default `303`) with `Location` set to the
94
+ * validated target (or the `fallback`) and `Cache-Control: no-store`.
95
+ * @throws {TypeError} for a non-redirect `status` or malformed
96
+ * `allowedPaths` / `allowedOrigins` / `fallback` entries.
91
97
  *
92
98
  * @since 0.35.0
93
99
  */
@@ -45,7 +45,9 @@
45
45
  */
46
46
  /** Thrown when {@link safeRedirect} refuses a candidate URL and no `fallback` is configured. */
47
47
  export class OpenRedirectBlockedError extends Error {
48
+ /** Machine-readable {@link SafeRedirectBlockReason} explaining the refusal. */
48
49
  reason;
50
+ /** The candidate URL that was refused, verbatim. */
49
51
  target;
50
52
  constructor(reason, target) {
51
53
  super(`safeRedirect: refused redirect (${reason})`);
@@ -148,6 +150,10 @@ function hasEncodedProtocolRelativePrefix(value) {
148
150
  *
149
151
  * @param target - User-supplied URL candidate (path or absolute URL).
150
152
  * @param options - Allowlist + response configuration.
153
+ * @returns A redirect `Response` (default `303`) with `Location` set to the
154
+ * validated target (or the `fallback`) and `Cache-Control: no-store`.
155
+ * @throws {TypeError} for a non-redirect `status` or malformed
156
+ * `allowedPaths` / `allowedOrigins` / `fallback` entries.
151
157
  *
152
158
  * @since 0.35.0
153
159
  */
@@ -1,15 +1,15 @@
1
1
  {
2
2
  "bomFormat": "CycloneDX",
3
3
  "specVersion": "1.5",
4
- "serialNumber": "urn:uuid:a88e3a69-b278-5771-a67e-40fb774e004e",
4
+ "serialNumber": "urn:uuid:e297e402-67fc-54e1-a292-02441ebb5d71",
5
5
  "version": 1,
6
6
  "metadata": {
7
- "timestamp": "2026-07-01T22:47:12.881Z",
7
+ "timestamp": "2026-07-03T11:51:00.910Z",
8
8
  "tools": [
9
9
  {
10
10
  "vendor": "DaloyJS",
11
11
  "name": "daloy-generate-sbom",
12
- "version": "1.0.0-beta.6"
12
+ "version": "1.0.0-rc.0"
13
13
  }
14
14
  ],
15
15
  "authors": [
@@ -19,11 +19,11 @@
19
19
  ],
20
20
  "component": {
21
21
  "type": "library",
22
- "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-beta.6",
22
+ "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
23
23
  "name": "@daloyjs/core",
24
- "version": "1.0.0-beta.6",
24
+ "version": "1.0.0-rc.0",
25
25
  "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
26
- "purl": "pkg:npm/@daloyjs/core@1.0.0-beta.6",
26
+ "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
27
27
  "licenses": [
28
28
  {
29
29
  "license": {
@@ -46,9 +46,9 @@
46
46
  }
47
47
  ],
48
48
  "swid": {
49
- "tagId": "swidtag--daloyjs-core-1.0.0-beta.6",
49
+ "tagId": "swidtag--daloyjs-core-1.0.0-rc.0",
50
50
  "name": "@daloyjs/core",
51
- "version": "1.0.0-beta.6",
51
+ "version": "1.0.0-rc.0",
52
52
  "tagVersion": 0,
53
53
  "patch": false
54
54
  }
@@ -57,7 +57,7 @@
57
57
  "components": [],
58
58
  "dependencies": [
59
59
  {
60
- "ref": "pkg:npm/@daloyjs/core@1.0.0-beta.6",
60
+ "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
61
61
  "dependsOn": []
62
62
  }
63
63
  ]
@@ -2,10 +2,10 @@
2
2
  "spdxVersion": "SPDX-2.3",
3
3
  "dataLicense": "CC0-1.0",
4
4
  "SPDXID": "SPDXRef-DOCUMENT",
5
- "name": "@daloyjs/core-1.0.0-beta.6",
6
- "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-beta.6-a88e3a69-b278-5771-a67e-40fb774e004e",
5
+ "name": "@daloyjs/core-1.0.0-rc.0",
6
+ "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.0-e297e402-67fc-54e1-a292-02441ebb5d71",
7
7
  "creationInfo": {
8
- "created": "2026-07-01T22:47:12.881Z",
8
+ "created": "2026-07-03T11:51:00.910Z",
9
9
  "creators": [
10
10
  "Tool: daloy-generate-sbom",
11
11
  "Organization: DaloyJS"
@@ -16,7 +16,7 @@
16
16
  {
17
17
  "SPDXID": "SPDXRef-Package--daloyjs-core",
18
18
  "name": "@daloyjs/core",
19
- "versionInfo": "1.0.0-beta.6",
19
+ "versionInfo": "1.0.0-rc.0",
20
20
  "downloadLocation": "https://github.com/daloyjs/daloy",
21
21
  "filesAnalyzed": false,
22
22
  "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
27
27
  {
28
28
  "referenceCategory": "PACKAGE-MANAGER",
29
29
  "referenceType": "purl",
30
- "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-beta.6"
30
+ "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.0"
31
31
  }
32
32
  ]
33
33
  }
@@ -57,9 +57,13 @@ export declare class CronParseError extends Error {
57
57
  * @since 0.37.0
58
58
  */
59
59
  export interface SchedulerLogger {
60
+ /** Log at debug level (task definitions as they are registered). */
60
61
  debug(obj: object | string, msg?: string): void;
62
+ /** Log at info level (scheduler started / stopped lifecycle events). */
61
63
  info(obj: object | string, msg?: string): void;
64
+ /** Log at warn level (overrun-skipped runs, stop grace-period timeouts). */
62
65
  warn(obj: object | string, msg?: string): void;
66
+ /** Log at error level (a task handler threw or rejected). */
63
67
  error(obj: object | string, msg?: string): void;
64
68
  }
65
69
  /**
package/dist/schema.d.ts CHANGED
@@ -7,35 +7,60 @@
7
7
  * `~standard`. No vendor lock-in.
8
8
  */
9
9
  export interface StandardSchemaV1<Input = unknown, Output = Input> {
10
+ /** The Standard Schema contract object every compatible validator exposes. */
10
11
  readonly "~standard": StandardSchemaV1.Props<Input, Output>;
11
12
  }
12
13
  export declare namespace StandardSchemaV1 {
14
+ /**
15
+ * The `~standard` contract exposed by a Standard Schema validator: spec
16
+ * version, vendor tag, and the vendor-neutral `validate` entry point.
17
+ */
13
18
  interface Props<Input = unknown, Output = Input> {
19
+ /** Spec version implemented by the validator. Always `1`. */
14
20
  readonly version: 1;
21
+ /** Name of the validator library (e.g. `"zod"`, `"valibot"`). */
15
22
  readonly vendor: string;
23
+ /** Validates a value; may be sync or async. Returns `{ value }` on success or `{ issues }` on failure. */
16
24
  readonly validate: (value: unknown) => Result<Output> | Promise<Result<Output>>;
25
+ /** Type-only carrier for {@link InferInput}/{@link InferOutput}; never populated at runtime. */
17
26
  readonly types?: Types<Input, Output>;
18
27
  }
28
+ /** Outcome of {@link Props.validate}: a {@link SuccessResult} or a {@link FailureResult}. */
19
29
  type Result<Output> = SuccessResult<Output> | FailureResult;
30
+ /** Successful validation: the parsed/coerced output value and no issues. */
20
31
  interface SuccessResult<Output> {
32
+ /** The validated (and possibly transformed) output value. */
21
33
  readonly value: Output;
34
+ /** Always `undefined` on success; lets `result.issues` discriminate the union. */
22
35
  readonly issues?: undefined;
23
36
  }
37
+ /** Failed validation: one or more {@link Issue}s and no output value. */
24
38
  interface FailureResult {
39
+ /** The validation problems found; always non-empty on failure. */
25
40
  readonly issues: ReadonlyArray<Issue>;
26
41
  }
42
+ /** One validation problem reported by a validator. */
27
43
  interface Issue {
44
+ /** Human-readable description of the problem. */
28
45
  readonly message: string;
46
+ /** Location of the problem as a key path from the root; omitted for root-level issues. */
29
47
  readonly path?: ReadonlyArray<PropertyKey | PathSegment>;
30
48
  }
49
+ /** Object-wrapped path entry used by validators that attach extra metadata to path keys. */
31
50
  interface PathSegment {
51
+ /** The property key this segment addresses. */
32
52
  readonly key: PropertyKey;
33
53
  }
54
+ /** Type-level input/output carrier referenced by {@link Props.types}; runtime value is never read. */
34
55
  interface Types<Input, Output> {
56
+ /** The type accepted by the validator before parsing/coercion. */
35
57
  readonly input: Input;
58
+ /** The type produced by the validator after parsing/coercion. */
36
59
  readonly output: Output;
37
60
  }
61
+ /** Infers the input (pre-validation) type of a Standard Schema validator. */
38
62
  type InferInput<S extends StandardSchemaV1> = NonNullable<S["~standard"]["types"]>["input"];
63
+ /** Infers the output (post-validation) type of a Standard Schema validator. */
39
64
  type InferOutput<S extends StandardSchemaV1> = NonNullable<S["~standard"]["types"]>["output"];
40
65
  }
41
66
  /**