@daloyjs/core 1.0.0-beta.6 → 1.0.0-rc.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/dist/adapters/bun.d.ts +13 -1
- package/dist/adapters/bun.js +8 -1
- package/dist/adapters/cloudflare.d.ts +7 -1
- package/dist/adapters/cloudflare.js +6 -1
- package/dist/adapters/deno.d.ts +11 -1
- package/dist/adapters/deno.js +8 -1
- package/dist/adapters/fastly.d.ts +12 -2
- package/dist/adapters/fastly.js +12 -2
- package/dist/adapters/lambda.d.ts +37 -1
- package/dist/adapters/lambda.js +6 -1
- package/dist/adapters/node.d.ts +12 -1
- package/dist/adapters/node.js +223 -12
- package/dist/adapters/vercel.d.ts +13 -1
- package/dist/adapters/vercel.js +12 -1
- package/dist/app.d.ts +78 -17
- package/dist/app.js +444 -86
- package/dist/banner.d.ts +6 -0
- package/dist/banner.js +6 -0
- package/dist/cli.d.ts +35 -0
- package/dist/cli.js +23 -1
- package/dist/combine.d.ts +8 -0
- package/dist/combine.js +8 -0
- package/dist/compression.d.ts +3 -0
- package/dist/compression.js +3 -0
- package/dist/config.d.ts +4 -0
- package/dist/config.js +4 -0
- package/dist/conn-info.d.ts +35 -2
- package/dist/conn-info.js +35 -2
- package/dist/contract.d.ts +2 -0
- package/dist/contract.js +2 -0
- package/dist/cookie.d.ts +12 -0
- package/dist/cookie.js +12 -0
- package/dist/dependency.d.ts +4 -0
- package/dist/dependency.js +3 -0
- package/dist/discriminator.d.ts +13 -0
- package/dist/discriminator.js +23 -1
- package/dist/docs.d.ts +78 -0
- package/dist/docs.js +21 -0
- package/dist/errors.d.ts +16 -0
- package/dist/errors.js +14 -0
- package/dist/etag.d.ts +2 -0
- package/dist/etag.js +2 -0
- package/dist/fetch-guard.d.ts +7 -0
- package/dist/fetch-guard.js +7 -0
- package/dist/fetch-resilience.d.ts +4 -0
- package/dist/fetch-resilience.js +4 -0
- package/dist/http-signatures.d.ts +32 -0
- package/dist/http-signatures.js +30 -0
- package/dist/index.d.ts +1 -1
- package/dist/ip-restriction.d.ts +40 -3
- package/dist/ip-restriction.js +35 -3
- package/dist/jwk.d.ts +12 -1
- package/dist/jwk.js +6 -0
- package/dist/jwt.d.ts +14 -0
- package/dist/jwt.js +10 -0
- package/dist/load-shedding.d.ts +3 -0
- package/dist/load-shedding.js +3 -0
- package/dist/logger.d.ts +13 -0
- package/dist/logger.js +3 -0
- package/dist/mcp.d.ts +152 -10
- package/dist/mcp.js +223 -19
- package/dist/middleware.d.ts +68 -0
- package/dist/middleware.js +17 -0
- package/dist/mtls.d.ts +19 -2
- package/dist/mtls.js +12 -2
- package/dist/multipart.d.ts +42 -5
- package/dist/multipart.js +41 -5
- package/dist/openapi.d.ts +15 -9
- package/dist/openapi.js +6 -9
- package/dist/rate-limit-redis.d.ts +21 -2
- package/dist/rate-limit-redis.js +17 -2
- package/dist/safe-redirect.d.ts +6 -0
- package/dist/safe-redirect.js +6 -0
- package/dist/sbom.cdx.json +9 -9
- package/dist/sbom.spdx.json +5 -5
- package/dist/scheduler.d.ts +4 -0
- package/dist/schema.d.ts +25 -0
- package/dist/security-schemes.d.ts +50 -0
- package/dist/security-schemes.js +6 -0
- package/dist/security.d.ts +33 -0
- package/dist/security.js +28 -10
- package/dist/session.d.ts +34 -5
- package/dist/session.js +31 -5
- package/dist/streaming.d.ts +19 -0
- package/dist/streaming.js +16 -0
- package/dist/subdomains.d.ts +4 -0
- package/dist/subdomains.js +4 -0
- package/dist/time-claims.d.ts +22 -2
- package/dist/time-claims.js +6 -0
- package/dist/tracing.d.ts +12 -0
- package/dist/tracing.js +6 -0
- package/dist/types.d.ts +70 -1
- package/dist/waf.js +21 -1
- package/dist/webhook-delivery.d.ts +6 -0
- package/dist/webhook-delivery.js +5 -0
- package/dist/websocket.d.ts +137 -4
- package/dist/websocket.js +105 -4
- package/package.json +1 -1
package/dist/multipart.d.ts
CHANGED
|
@@ -114,6 +114,7 @@ export type UploadedFile = Blob & {
|
|
|
114
114
|
* emit `format: binary`/`byte` accordingly.
|
|
115
115
|
*/
|
|
116
116
|
export interface FileFieldSchema<Output = UploadedFile> extends StandardSchemaV1<unknown, Output> {
|
|
117
|
+
/** Resolved {@link FileFieldOptions} (with `format` defaulted) stamped on the schema for OpenAPI generation. */
|
|
117
118
|
readonly [FILE_FIELD_MARKER]: Required<Pick<FileFieldOptions, "format">> & FileFieldOptions;
|
|
118
119
|
}
|
|
119
120
|
/**
|
|
@@ -122,13 +123,26 @@ export interface FileFieldSchema<Output = UploadedFile> extends StandardSchemaV1
|
|
|
122
123
|
* Use inside a `multipartObject({...})` body schema, or directly inside any
|
|
123
124
|
* Standard-Schema-compatible object schema (Zod, Valibot, ...). DaloyJS
|
|
124
125
|
* keeps the underlying `File` reference so handlers can stream the body.
|
|
126
|
+
*
|
|
127
|
+
* @param options - Field constraints with `optional: true`; `null`/`undefined` values pass through.
|
|
128
|
+
* @returns A {@link FileFieldSchema} whose output may be `null`/`undefined`.
|
|
125
129
|
*/
|
|
126
130
|
export declare function fileField(options: FileFieldOptions & {
|
|
127
131
|
optional: true;
|
|
128
132
|
}): FileFieldSchema<UploadedFile | null | undefined>;
|
|
129
|
-
/**
|
|
133
|
+
/**
|
|
134
|
+
* Validator for a required single uploaded `File`/`Blob` field.
|
|
135
|
+
*
|
|
136
|
+
* @param options - Field constraints (`maxBytes`, `accept`, `filename`, `magicBytes`, ...).
|
|
137
|
+
* @returns A {@link FileFieldSchema} that rejects missing or non-file values.
|
|
138
|
+
*/
|
|
130
139
|
export declare function fileField(options?: FileFieldOptions): FileFieldSchema<UploadedFile>;
|
|
131
|
-
/**
|
|
140
|
+
/**
|
|
141
|
+
* Type-only check used by the OpenAPI generator.
|
|
142
|
+
*
|
|
143
|
+
* @param s - Candidate value to test for the `FILE_FIELD_MARKER` key.
|
|
144
|
+
* @returns `true` when `s` is a {@link fileField}-produced schema.
|
|
145
|
+
*/
|
|
132
146
|
export declare function isFileFieldSchema(s: unknown): s is FileFieldSchema;
|
|
133
147
|
/** Options for {@link multipartObject}. */
|
|
134
148
|
export interface MultipartObjectOptions {
|
|
@@ -154,15 +168,38 @@ interface MultipartSchema<S extends MultipartShape> extends StandardSchemaV1<Rec
|
|
|
154
168
|
* body. Each entry in `shape` validates one form field by name. File fields
|
|
155
169
|
* should use {@link fileField}; non-file fields can use any Standard-Schema
|
|
156
170
|
* validator (`z.string()`, `v.number()`, ...).
|
|
171
|
+
*
|
|
172
|
+
* @param shape - Record mapping form-field names to per-field validators.
|
|
173
|
+
* @param options - `strict: true` rejects undeclared extra fields. Defaults
|
|
174
|
+
* to `{ strict: false }` (extras pass through unvalidated).
|
|
175
|
+
* @returns A marker-carrying schema the OpenAPI generator renders as
|
|
176
|
+
* `multipart/form-data`; validation issues are prefixed with the field name.
|
|
157
177
|
*/
|
|
158
178
|
export declare function multipartObject<S extends MultipartShape>(shape: S, options?: MultipartObjectOptions): MultipartSchema<S>;
|
|
159
|
-
/**
|
|
179
|
+
/**
|
|
180
|
+
* Type-only check used by the OpenAPI generator and request-body parser.
|
|
181
|
+
*
|
|
182
|
+
* @param s - Candidate value to test for the `MULTIPART_SCHEMA_MARKER` key.
|
|
183
|
+
* @returns `true` when `s` is a {@link multipartObject}-produced schema.
|
|
184
|
+
*/
|
|
160
185
|
export declare function isMultipartObjectSchema(s: unknown): s is MultipartSchema<MultipartShape>;
|
|
161
|
-
/**
|
|
186
|
+
/**
|
|
187
|
+
* Internal: pull the multipart shape so the OpenAPI generator can walk it.
|
|
188
|
+
*
|
|
189
|
+
* @param s - Candidate schema value.
|
|
190
|
+
* @returns The `{ shape, strict }` config stored under the multipart marker,
|
|
191
|
+
* or `undefined` when `s` is not a {@link multipartObject} schema.
|
|
192
|
+
*/
|
|
162
193
|
export declare function getMultipartShape(s: unknown): {
|
|
163
194
|
shape: MultipartShape;
|
|
164
195
|
strict: boolean;
|
|
165
196
|
} | undefined;
|
|
166
|
-
/**
|
|
197
|
+
/**
|
|
198
|
+
* Internal: read the file-field options used for OpenAPI documentation.
|
|
199
|
+
*
|
|
200
|
+
* @param s - Candidate schema value.
|
|
201
|
+
* @returns The resolved {@link FileFieldOptions} stored under the file-field
|
|
202
|
+
* marker, or `undefined` when `s` is not a {@link fileField} schema.
|
|
203
|
+
*/
|
|
167
204
|
export declare function getFileFieldOptions(s: unknown): (Required<Pick<FileFieldOptions, "format">> & FileFieldOptions) | undefined;
|
|
168
205
|
export {};
|
package/dist/multipart.js
CHANGED
|
@@ -233,7 +233,15 @@ async function verifyMagicBytes(file, signatures) {
|
|
|
233
233
|
}
|
|
234
234
|
return undefined;
|
|
235
235
|
}
|
|
236
|
-
/**
|
|
236
|
+
/**
|
|
237
|
+
* Shared implementation for the `fileField` overloads above.
|
|
238
|
+
*
|
|
239
|
+
* @param options - Field constraints; `format` defaults to `"binary"`, and
|
|
240
|
+
* the scriptable-image guard defaults to on whenever `magicBytes` is set.
|
|
241
|
+
* @returns The marker-carrying {@link FileFieldSchema} validator.
|
|
242
|
+
* @throws Error at construction when `magicBytes` config is malformed (bad
|
|
243
|
+
* offset, empty/out-of-range bytes, or `true` without a sniffable `accept`).
|
|
244
|
+
*/
|
|
237
245
|
export function fileField(options = {}) {
|
|
238
246
|
const opts = {
|
|
239
247
|
...options,
|
|
@@ -312,7 +320,12 @@ export function fileField(options = {}) {
|
|
|
312
320
|
};
|
|
313
321
|
return schema;
|
|
314
322
|
}
|
|
315
|
-
/**
|
|
323
|
+
/**
|
|
324
|
+
* Type-only check used by the OpenAPI generator.
|
|
325
|
+
*
|
|
326
|
+
* @param s - Candidate value to test for the `FILE_FIELD_MARKER` key.
|
|
327
|
+
* @returns `true` when `s` is a {@link fileField}-produced schema.
|
|
328
|
+
*/
|
|
316
329
|
export function isFileFieldSchema(s) {
|
|
317
330
|
return !!s && typeof s === "object" && FILE_FIELD_MARKER in s;
|
|
318
331
|
}
|
|
@@ -321,6 +334,12 @@ export function isFileFieldSchema(s) {
|
|
|
321
334
|
* body. Each entry in `shape` validates one form field by name. File fields
|
|
322
335
|
* should use {@link fileField}; non-file fields can use any Standard-Schema
|
|
323
336
|
* validator (`z.string()`, `v.number()`, ...).
|
|
337
|
+
*
|
|
338
|
+
* @param shape - Record mapping form-field names to per-field validators.
|
|
339
|
+
* @param options - `strict: true` rejects undeclared extra fields. Defaults
|
|
340
|
+
* to `{ strict: false }` (extras pass through unvalidated).
|
|
341
|
+
* @returns A marker-carrying schema the OpenAPI generator renders as
|
|
342
|
+
* `multipart/form-data`; validation issues are prefixed with the field name.
|
|
324
343
|
*/
|
|
325
344
|
export function multipartObject(shape, options = {}) {
|
|
326
345
|
const strict = options.strict ?? false;
|
|
@@ -368,17 +387,34 @@ export function multipartObject(shape, options = {}) {
|
|
|
368
387
|
};
|
|
369
388
|
return schema;
|
|
370
389
|
}
|
|
371
|
-
/**
|
|
390
|
+
/**
|
|
391
|
+
* Type-only check used by the OpenAPI generator and request-body parser.
|
|
392
|
+
*
|
|
393
|
+
* @param s - Candidate value to test for the `MULTIPART_SCHEMA_MARKER` key.
|
|
394
|
+
* @returns `true` when `s` is a {@link multipartObject}-produced schema.
|
|
395
|
+
*/
|
|
372
396
|
export function isMultipartObjectSchema(s) {
|
|
373
397
|
return !!s && typeof s === "object" && MULTIPART_SCHEMA_MARKER in s;
|
|
374
398
|
}
|
|
375
|
-
/**
|
|
399
|
+
/**
|
|
400
|
+
* Internal: pull the multipart shape so the OpenAPI generator can walk it.
|
|
401
|
+
*
|
|
402
|
+
* @param s - Candidate schema value.
|
|
403
|
+
* @returns The `{ shape, strict }` config stored under the multipart marker,
|
|
404
|
+
* or `undefined` when `s` is not a {@link multipartObject} schema.
|
|
405
|
+
*/
|
|
376
406
|
export function getMultipartShape(s) {
|
|
377
407
|
if (!isMultipartObjectSchema(s))
|
|
378
408
|
return undefined;
|
|
379
409
|
return s[MULTIPART_SCHEMA_MARKER];
|
|
380
410
|
}
|
|
381
|
-
/**
|
|
411
|
+
/**
|
|
412
|
+
* Internal: read the file-field options used for OpenAPI documentation.
|
|
413
|
+
*
|
|
414
|
+
* @param s - Candidate schema value.
|
|
415
|
+
* @returns The resolved {@link FileFieldOptions} stored under the file-field
|
|
416
|
+
* marker, or `undefined` when `s` is not a {@link fileField} schema.
|
|
417
|
+
*/
|
|
382
418
|
export function getFileFieldOptions(s) {
|
|
383
419
|
if (!isFileFieldSchema(s))
|
|
384
420
|
return undefined;
|
package/dist/openapi.d.ts
CHANGED
|
@@ -38,14 +38,23 @@ export interface SecuritySchemeMap {
|
|
|
38
38
|
* (no execution path on the producer side).
|
|
39
39
|
*/
|
|
40
40
|
export interface WebhookDefinition {
|
|
41
|
+
/** HTTP method the producer uses when delivering the webhook. */
|
|
41
42
|
method: HttpMethod;
|
|
43
|
+
/** Stable operation id for codegen. Omitted from the document when unset. */
|
|
42
44
|
operationId?: string;
|
|
45
|
+
/** Short one-line summary shown in docs UIs. */
|
|
43
46
|
summary?: string;
|
|
47
|
+
/** Longer CommonMark description of the webhook operation. */
|
|
44
48
|
description?: string;
|
|
49
|
+
/** Tags used to group the operation in docs UIs. */
|
|
45
50
|
tags?: string[];
|
|
51
|
+
/** Mark the webhook operation as deprecated in the document. */
|
|
46
52
|
deprecated?: boolean;
|
|
53
|
+
/** Request schemas (body, headers, ...) the producer sends. Same shape as route `request`. */
|
|
47
54
|
request?: RequestSchemas;
|
|
55
|
+
/** Map of status code to response schema the consumer is expected to return. */
|
|
48
56
|
responses: ResponsesMap;
|
|
57
|
+
/** Security requirement(s) documented on the webhook operation (e.g. a signature scheme). */
|
|
49
58
|
auth?: AuthSpec;
|
|
50
59
|
/**
|
|
51
60
|
* Optional OpenAPI 3.1 callbacks attached to this webhook operation.
|
|
@@ -112,16 +121,13 @@ export interface OpenAPIOptions {
|
|
|
112
121
|
*/
|
|
113
122
|
export declare function generateOpenAPI(app: App, options: OpenAPIOptions): Record<string, unknown>;
|
|
114
123
|
/**
|
|
115
|
-
* Serialize an OpenAPI document (
|
|
116
|
-
*
|
|
117
|
-
*
|
|
118
|
-
*
|
|
124
|
+
* Serialize an OpenAPI document (from {@link generateOpenAPI}) — or any
|
|
125
|
+
* JSON-safe object — to YAML 1.2 using a minimal built-in emitter. Pure
|
|
126
|
+
* transform with no runtime dependency; output is the form consumed by
|
|
127
|
+
* `/swagger.yaml`-style endpoints and build-time artifacts.
|
|
119
128
|
*
|
|
129
|
+
* @param doc - JSON-safe object to serialize (typically the generated document).
|
|
130
|
+
* @returns The YAML text, without a leading newline.
|
|
120
131
|
* @since 0.13.1
|
|
121
132
|
*/
|
|
122
|
-
/**
|
|
123
|
-
* Serialize an OpenAPI document (from {@link generateOpenAPI}) to YAML using a
|
|
124
|
-
* minimal built-in emitter. No external dependencies; suitable for build-time
|
|
125
|
-
* artifacts. Reads/writes nothing; pure transform.
|
|
126
|
-
*/
|
|
127
133
|
export declare function openapiToYAML(doc: Record<string, unknown>): string;
|
package/dist/openapi.js
CHANGED
|
@@ -485,18 +485,15 @@ function yamlEmit(value, indent) {
|
|
|
485
485
|
return ` ${yamlScalar(value)}\n`;
|
|
486
486
|
}
|
|
487
487
|
/**
|
|
488
|
-
* Serialize an OpenAPI document (
|
|
489
|
-
*
|
|
490
|
-
*
|
|
491
|
-
*
|
|
488
|
+
* Serialize an OpenAPI document (from {@link generateOpenAPI}) — or any
|
|
489
|
+
* JSON-safe object — to YAML 1.2 using a minimal built-in emitter. Pure
|
|
490
|
+
* transform with no runtime dependency; output is the form consumed by
|
|
491
|
+
* `/swagger.yaml`-style endpoints and build-time artifacts.
|
|
492
492
|
*
|
|
493
|
+
* @param doc - JSON-safe object to serialize (typically the generated document).
|
|
494
|
+
* @returns The YAML text, without a leading newline.
|
|
493
495
|
* @since 0.13.1
|
|
494
496
|
*/
|
|
495
|
-
/**
|
|
496
|
-
* Serialize an OpenAPI document (from {@link generateOpenAPI}) to YAML using a
|
|
497
|
-
* minimal built-in emitter. No external dependencies; suitable for build-time
|
|
498
|
-
* artifacts. Reads/writes nothing; pure transform.
|
|
499
|
-
*/
|
|
500
497
|
export function openapiToYAML(doc) {
|
|
501
498
|
const result = yamlEmit(doc, "");
|
|
502
499
|
return result.startsWith("\n") ? result.slice(1) : result;
|
|
@@ -50,10 +50,12 @@ import type { RateLimitStore } from "./middleware.js";
|
|
|
50
50
|
* required by the bundled script.
|
|
51
51
|
*/
|
|
52
52
|
export interface RedisCommands {
|
|
53
|
+
/** Run a Lua script atomically with the given `KEYS` / `ARGV` and return the raw Redis reply. */
|
|
53
54
|
eval(script: string, keys: string[], args: string[]): Promise<unknown>;
|
|
54
55
|
}
|
|
55
56
|
/** Options accepted by {@link redisRateLimitStore}. */
|
|
56
57
|
export interface RedisRateLimitStoreOptions {
|
|
58
|
+
/** Redis transport (see {@link ioredisAdapter} / {@link nodeRedisAdapter} for common clients). */
|
|
57
59
|
client: RedisCommands;
|
|
58
60
|
/**
|
|
59
61
|
* Optional namespace prefix for every Redis key. Defaults to `"daloy:rl:"`.
|
|
@@ -83,6 +85,11 @@ export interface RedisRateLimitStoreOptions {
|
|
|
83
85
|
* abuse-sensitive limiters in front of auth, password-reset, or other
|
|
84
86
|
* credential endpoints, pass `onError: () => "fail-closed"` so a Redis
|
|
85
87
|
* outage rejects rather than silently disables the limit.
|
|
88
|
+
*
|
|
89
|
+
* @param opts - Redis client, key prefix, and error policy; see
|
|
90
|
+
* {@link RedisRateLimitStoreOptions}.
|
|
91
|
+
* @returns A {@link RateLimitStore} whose `hit()` atomically increments the
|
|
92
|
+
* windowed counter in Redis and reports `{ count, resetMs }`.
|
|
86
93
|
*/
|
|
87
94
|
export declare function redisRateLimitStore(opts: RedisRateLimitStoreOptions): RateLimitStore;
|
|
88
95
|
/**
|
|
@@ -90,19 +97,31 @@ export declare function redisRateLimitStore(opts: RedisRateLimitStoreOptions): R
|
|
|
90
97
|
* takes `(script, numKeys, ...keysAndArgs)` is used.
|
|
91
98
|
*/
|
|
92
99
|
export interface IoredisLike {
|
|
100
|
+
/** ioredis-style `EVAL`: script, number of keys, then keys and args flattened. */
|
|
93
101
|
eval(script: string, numKeys: number, ...keysAndArgs: string[]): Promise<unknown>;
|
|
94
102
|
}
|
|
95
|
-
/**
|
|
103
|
+
/**
|
|
104
|
+
* Wrap an [`ioredis`](https://github.com/redis/ioredis) client.
|
|
105
|
+
*
|
|
106
|
+
* @param client - Connected ioredis instance (only its `eval` is used).
|
|
107
|
+
* @returns A {@link RedisCommands} transport for {@link redisRateLimitStore}.
|
|
108
|
+
*/
|
|
96
109
|
export declare function ioredisAdapter(client: IoredisLike): RedisCommands;
|
|
97
110
|
/**
|
|
98
111
|
* Shape of a `node-redis` v4+ client we care about. The v4 `eval` takes an
|
|
99
112
|
* options object instead of variadic arguments.
|
|
100
113
|
*/
|
|
101
114
|
export interface NodeRedisLike {
|
|
115
|
+
/** node-redis v4+ `EVAL`: script plus a `{ keys, arguments }` options object. */
|
|
102
116
|
eval(script: string, options: {
|
|
103
117
|
keys: string[];
|
|
104
118
|
arguments: string[];
|
|
105
119
|
}): Promise<unknown>;
|
|
106
120
|
}
|
|
107
|
-
/**
|
|
121
|
+
/**
|
|
122
|
+
* Wrap a [`node-redis`](https://github.com/redis/node-redis) v4+ client.
|
|
123
|
+
*
|
|
124
|
+
* @param client - Connected node-redis v4+ instance (only its `eval` is used).
|
|
125
|
+
* @returns A {@link RedisCommands} transport for {@link redisRateLimitStore}.
|
|
126
|
+
*/
|
|
108
127
|
export declare function nodeRedisAdapter(client: NodeRedisLike): RedisCommands;
|
package/dist/rate-limit-redis.js
CHANGED
|
@@ -84,6 +84,11 @@ function toNumber(value) {
|
|
|
84
84
|
* abuse-sensitive limiters in front of auth, password-reset, or other
|
|
85
85
|
* credential endpoints, pass `onError: () => "fail-closed"` so a Redis
|
|
86
86
|
* outage rejects rather than silently disables the limit.
|
|
87
|
+
*
|
|
88
|
+
* @param opts - Redis client, key prefix, and error policy; see
|
|
89
|
+
* {@link RedisRateLimitStoreOptions}.
|
|
90
|
+
* @returns A {@link RateLimitStore} whose `hit()` atomically increments the
|
|
91
|
+
* windowed counter in Redis and reports `{ count, resetMs }`.
|
|
87
92
|
*/
|
|
88
93
|
export function redisRateLimitStore(opts) {
|
|
89
94
|
const prefix = opts.prefix ?? "daloy:rl:";
|
|
@@ -106,7 +111,12 @@ export function redisRateLimitStore(opts) {
|
|
|
106
111
|
},
|
|
107
112
|
};
|
|
108
113
|
}
|
|
109
|
-
/**
|
|
114
|
+
/**
|
|
115
|
+
* Wrap an [`ioredis`](https://github.com/redis/ioredis) client.
|
|
116
|
+
*
|
|
117
|
+
* @param client - Connected ioredis instance (only its `eval` is used).
|
|
118
|
+
* @returns A {@link RedisCommands} transport for {@link redisRateLimitStore}.
|
|
119
|
+
*/
|
|
110
120
|
export function ioredisAdapter(client) {
|
|
111
121
|
return {
|
|
112
122
|
eval(script, keys, args) {
|
|
@@ -114,7 +124,12 @@ export function ioredisAdapter(client) {
|
|
|
114
124
|
},
|
|
115
125
|
};
|
|
116
126
|
}
|
|
117
|
-
/**
|
|
127
|
+
/**
|
|
128
|
+
* Wrap a [`node-redis`](https://github.com/redis/node-redis) v4+ client.
|
|
129
|
+
*
|
|
130
|
+
* @param client - Connected node-redis v4+ instance (only its `eval` is used).
|
|
131
|
+
* @returns A {@link RedisCommands} transport for {@link redisRateLimitStore}.
|
|
132
|
+
*/
|
|
118
133
|
export function nodeRedisAdapter(client) {
|
|
119
134
|
return {
|
|
120
135
|
eval(script, keys, args) {
|
package/dist/safe-redirect.d.ts
CHANGED
|
@@ -47,7 +47,9 @@
|
|
|
47
47
|
export type SafeRedirectBlockReason = "empty-target" | "invalid-control-characters" | "protocol-relative" | "backslash-path" | "path-not-allowed" | "origin-not-allowed" | "scheme-not-allowed" | "parse-failed";
|
|
48
48
|
/** Thrown when {@link safeRedirect} refuses a candidate URL and no `fallback` is configured. */
|
|
49
49
|
export declare class OpenRedirectBlockedError extends Error {
|
|
50
|
+
/** Machine-readable {@link SafeRedirectBlockReason} explaining the refusal. */
|
|
50
51
|
readonly reason: SafeRedirectBlockReason;
|
|
52
|
+
/** The candidate URL that was refused, verbatim. */
|
|
51
53
|
readonly target: string;
|
|
52
54
|
constructor(reason: SafeRedirectBlockReason, target: string);
|
|
53
55
|
}
|
|
@@ -88,6 +90,10 @@ export interface SafeRedirectOptions {
|
|
|
88
90
|
*
|
|
89
91
|
* @param target - User-supplied URL candidate (path or absolute URL).
|
|
90
92
|
* @param options - Allowlist + response configuration.
|
|
93
|
+
* @returns A redirect `Response` (default `303`) with `Location` set to the
|
|
94
|
+
* validated target (or the `fallback`) and `Cache-Control: no-store`.
|
|
95
|
+
* @throws {TypeError} for a non-redirect `status` or malformed
|
|
96
|
+
* `allowedPaths` / `allowedOrigins` / `fallback` entries.
|
|
91
97
|
*
|
|
92
98
|
* @since 0.35.0
|
|
93
99
|
*/
|
package/dist/safe-redirect.js
CHANGED
|
@@ -45,7 +45,9 @@
|
|
|
45
45
|
*/
|
|
46
46
|
/** Thrown when {@link safeRedirect} refuses a candidate URL and no `fallback` is configured. */
|
|
47
47
|
export class OpenRedirectBlockedError extends Error {
|
|
48
|
+
/** Machine-readable {@link SafeRedirectBlockReason} explaining the refusal. */
|
|
48
49
|
reason;
|
|
50
|
+
/** The candidate URL that was refused, verbatim. */
|
|
49
51
|
target;
|
|
50
52
|
constructor(reason, target) {
|
|
51
53
|
super(`safeRedirect: refused redirect (${reason})`);
|
|
@@ -148,6 +150,10 @@ function hasEncodedProtocolRelativePrefix(value) {
|
|
|
148
150
|
*
|
|
149
151
|
* @param target - User-supplied URL candidate (path or absolute URL).
|
|
150
152
|
* @param options - Allowlist + response configuration.
|
|
153
|
+
* @returns A redirect `Response` (default `303`) with `Location` set to the
|
|
154
|
+
* validated target (or the `fallback`) and `Cache-Control: no-store`.
|
|
155
|
+
* @throws {TypeError} for a non-redirect `status` or malformed
|
|
156
|
+
* `allowedPaths` / `allowedOrigins` / `fallback` entries.
|
|
151
157
|
*
|
|
152
158
|
* @since 0.35.0
|
|
153
159
|
*/
|
package/dist/sbom.cdx.json
CHANGED
|
@@ -1,15 +1,15 @@
|
|
|
1
1
|
{
|
|
2
2
|
"bomFormat": "CycloneDX",
|
|
3
3
|
"specVersion": "1.5",
|
|
4
|
-
"serialNumber": "urn:uuid:
|
|
4
|
+
"serialNumber": "urn:uuid:e297e402-67fc-54e1-a292-02441ebb5d71",
|
|
5
5
|
"version": 1,
|
|
6
6
|
"metadata": {
|
|
7
|
-
"timestamp": "2026-07-
|
|
7
|
+
"timestamp": "2026-07-03T11:51:00.910Z",
|
|
8
8
|
"tools": [
|
|
9
9
|
{
|
|
10
10
|
"vendor": "DaloyJS",
|
|
11
11
|
"name": "daloy-generate-sbom",
|
|
12
|
-
"version": "1.0.0-
|
|
12
|
+
"version": "1.0.0-rc.0"
|
|
13
13
|
}
|
|
14
14
|
],
|
|
15
15
|
"authors": [
|
|
@@ -19,11 +19,11 @@
|
|
|
19
19
|
],
|
|
20
20
|
"component": {
|
|
21
21
|
"type": "library",
|
|
22
|
-
"bom-ref": "pkg:npm/@daloyjs/core@1.0.0-
|
|
22
|
+
"bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
|
|
23
23
|
"name": "@daloyjs/core",
|
|
24
|
-
"version": "1.0.0-
|
|
24
|
+
"version": "1.0.0-rc.0",
|
|
25
25
|
"description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
|
|
26
|
-
"purl": "pkg:npm/@daloyjs/core@1.0.0-
|
|
26
|
+
"purl": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
|
|
27
27
|
"licenses": [
|
|
28
28
|
{
|
|
29
29
|
"license": {
|
|
@@ -46,9 +46,9 @@
|
|
|
46
46
|
}
|
|
47
47
|
],
|
|
48
48
|
"swid": {
|
|
49
|
-
"tagId": "swidtag--daloyjs-core-1.0.0-
|
|
49
|
+
"tagId": "swidtag--daloyjs-core-1.0.0-rc.0",
|
|
50
50
|
"name": "@daloyjs/core",
|
|
51
|
-
"version": "1.0.0-
|
|
51
|
+
"version": "1.0.0-rc.0",
|
|
52
52
|
"tagVersion": 0,
|
|
53
53
|
"patch": false
|
|
54
54
|
}
|
|
@@ -57,7 +57,7 @@
|
|
|
57
57
|
"components": [],
|
|
58
58
|
"dependencies": [
|
|
59
59
|
{
|
|
60
|
-
"ref": "pkg:npm/@daloyjs/core@1.0.0-
|
|
60
|
+
"ref": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
|
|
61
61
|
"dependsOn": []
|
|
62
62
|
}
|
|
63
63
|
]
|
package/dist/sbom.spdx.json
CHANGED
|
@@ -2,10 +2,10 @@
|
|
|
2
2
|
"spdxVersion": "SPDX-2.3",
|
|
3
3
|
"dataLicense": "CC0-1.0",
|
|
4
4
|
"SPDXID": "SPDXRef-DOCUMENT",
|
|
5
|
-
"name": "@daloyjs/core-1.0.0-
|
|
6
|
-
"documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-
|
|
5
|
+
"name": "@daloyjs/core-1.0.0-rc.0",
|
|
6
|
+
"documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.0-e297e402-67fc-54e1-a292-02441ebb5d71",
|
|
7
7
|
"creationInfo": {
|
|
8
|
-
"created": "2026-07-
|
|
8
|
+
"created": "2026-07-03T11:51:00.910Z",
|
|
9
9
|
"creators": [
|
|
10
10
|
"Tool: daloy-generate-sbom",
|
|
11
11
|
"Organization: DaloyJS"
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
{
|
|
17
17
|
"SPDXID": "SPDXRef-Package--daloyjs-core",
|
|
18
18
|
"name": "@daloyjs/core",
|
|
19
|
-
"versionInfo": "1.0.0-
|
|
19
|
+
"versionInfo": "1.0.0-rc.0",
|
|
20
20
|
"downloadLocation": "https://github.com/daloyjs/daloy",
|
|
21
21
|
"filesAnalyzed": false,
|
|
22
22
|
"licenseConcluded": "MIT",
|
|
@@ -27,7 +27,7 @@
|
|
|
27
27
|
{
|
|
28
28
|
"referenceCategory": "PACKAGE-MANAGER",
|
|
29
29
|
"referenceType": "purl",
|
|
30
|
-
"referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-
|
|
30
|
+
"referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.0"
|
|
31
31
|
}
|
|
32
32
|
]
|
|
33
33
|
}
|
package/dist/scheduler.d.ts
CHANGED
|
@@ -57,9 +57,13 @@ export declare class CronParseError extends Error {
|
|
|
57
57
|
* @since 0.37.0
|
|
58
58
|
*/
|
|
59
59
|
export interface SchedulerLogger {
|
|
60
|
+
/** Log at debug level (task definitions as they are registered). */
|
|
60
61
|
debug(obj: object | string, msg?: string): void;
|
|
62
|
+
/** Log at info level (scheduler started / stopped lifecycle events). */
|
|
61
63
|
info(obj: object | string, msg?: string): void;
|
|
64
|
+
/** Log at warn level (overrun-skipped runs, stop grace-period timeouts). */
|
|
62
65
|
warn(obj: object | string, msg?: string): void;
|
|
66
|
+
/** Log at error level (a task handler threw or rejected). */
|
|
63
67
|
error(obj: object | string, msg?: string): void;
|
|
64
68
|
}
|
|
65
69
|
/**
|
package/dist/schema.d.ts
CHANGED
|
@@ -7,35 +7,60 @@
|
|
|
7
7
|
* `~standard`. No vendor lock-in.
|
|
8
8
|
*/
|
|
9
9
|
export interface StandardSchemaV1<Input = unknown, Output = Input> {
|
|
10
|
+
/** The Standard Schema contract object every compatible validator exposes. */
|
|
10
11
|
readonly "~standard": StandardSchemaV1.Props<Input, Output>;
|
|
11
12
|
}
|
|
12
13
|
export declare namespace StandardSchemaV1 {
|
|
14
|
+
/**
|
|
15
|
+
* The `~standard` contract exposed by a Standard Schema validator: spec
|
|
16
|
+
* version, vendor tag, and the vendor-neutral `validate` entry point.
|
|
17
|
+
*/
|
|
13
18
|
interface Props<Input = unknown, Output = Input> {
|
|
19
|
+
/** Spec version implemented by the validator. Always `1`. */
|
|
14
20
|
readonly version: 1;
|
|
21
|
+
/** Name of the validator library (e.g. `"zod"`, `"valibot"`). */
|
|
15
22
|
readonly vendor: string;
|
|
23
|
+
/** Validates a value; may be sync or async. Returns `{ value }` on success or `{ issues }` on failure. */
|
|
16
24
|
readonly validate: (value: unknown) => Result<Output> | Promise<Result<Output>>;
|
|
25
|
+
/** Type-only carrier for {@link InferInput}/{@link InferOutput}; never populated at runtime. */
|
|
17
26
|
readonly types?: Types<Input, Output>;
|
|
18
27
|
}
|
|
28
|
+
/** Outcome of {@link Props.validate}: a {@link SuccessResult} or a {@link FailureResult}. */
|
|
19
29
|
type Result<Output> = SuccessResult<Output> | FailureResult;
|
|
30
|
+
/** Successful validation: the parsed/coerced output value and no issues. */
|
|
20
31
|
interface SuccessResult<Output> {
|
|
32
|
+
/** The validated (and possibly transformed) output value. */
|
|
21
33
|
readonly value: Output;
|
|
34
|
+
/** Always `undefined` on success; lets `result.issues` discriminate the union. */
|
|
22
35
|
readonly issues?: undefined;
|
|
23
36
|
}
|
|
37
|
+
/** Failed validation: one or more {@link Issue}s and no output value. */
|
|
24
38
|
interface FailureResult {
|
|
39
|
+
/** The validation problems found; always non-empty on failure. */
|
|
25
40
|
readonly issues: ReadonlyArray<Issue>;
|
|
26
41
|
}
|
|
42
|
+
/** One validation problem reported by a validator. */
|
|
27
43
|
interface Issue {
|
|
44
|
+
/** Human-readable description of the problem. */
|
|
28
45
|
readonly message: string;
|
|
46
|
+
/** Location of the problem as a key path from the root; omitted for root-level issues. */
|
|
29
47
|
readonly path?: ReadonlyArray<PropertyKey | PathSegment>;
|
|
30
48
|
}
|
|
49
|
+
/** Object-wrapped path entry used by validators that attach extra metadata to path keys. */
|
|
31
50
|
interface PathSegment {
|
|
51
|
+
/** The property key this segment addresses. */
|
|
32
52
|
readonly key: PropertyKey;
|
|
33
53
|
}
|
|
54
|
+
/** Type-level input/output carrier referenced by {@link Props.types}; runtime value is never read. */
|
|
34
55
|
interface Types<Input, Output> {
|
|
56
|
+
/** The type accepted by the validator before parsing/coercion. */
|
|
35
57
|
readonly input: Input;
|
|
58
|
+
/** The type produced by the validator after parsing/coercion. */
|
|
36
59
|
readonly output: Output;
|
|
37
60
|
}
|
|
61
|
+
/** Infers the input (pre-validation) type of a Standard Schema validator. */
|
|
38
62
|
type InferInput<S extends StandardSchemaV1> = NonNullable<S["~standard"]["types"]>["input"];
|
|
63
|
+
/** Infers the output (post-validation) type of a Standard Schema validator. */
|
|
39
64
|
type InferOutput<S extends StandardSchemaV1> = NonNullable<S["~standard"]["types"]>["output"];
|
|
40
65
|
}
|
|
41
66
|
/**
|