@decohere/http 0.0.1-dev.125 → 0.0.1-dev.127

package/README.md

@@ -58,7 +58,7 @@ Builder.create()
 
 **`exclude`.** Patterns for paths the mount never answers, neither a file nor the fallback (the request gets the JSON `404`), for anything the defaults get wrong. They are globs ([picomatch](https://github.com/micromatch/picomatch), `dot` on) matched against the full request path after decoding it and collapsing repeated slashes, not relative to the prefix: `*` is any characters within one segment, `**` crosses segments, `?` is one character. `"/docs/**"` covers `/docs`, `/docs/` and everything below.
 
-Why this shape, and what is left (running the UI's own build is [#381](https://github.com/typesmiths/decohere/issues/381)): [ADR 0007](../../docs/adr/0007-serving-a-built-ui-from-http.md).
+Why this shape, and what is left (running the UI's own build): [ADR 0007](../../docs/adr/0007-serving-a-built-ui-from-http.md).
 
 ## Global prefix
 
@@ -113,7 +113,7 @@ What to know about the plugin's behaviour:
 - **A `304`** for a file can carry the `Content-Encoding` header of the `200` it stands for. It has no body.
 - **Helmet, CORS and the rate limit** are unaffected, and an error reply (a `401`, a `400` with a large body) is compressed like any other.
 - **BREACH.** Compressing a response served over HTTPS that contains both a secret and input an attacker controls can leak the secret to someone who can watch response sizes. It mostly concerns HTML that reflects input next to a CSRF token. A JSON API that authenticates with a bearer token in a header is low risk, because the token is not in the body. If you render such pages, mask per-response secrets, do not reflect input beside them, or turn compression off for them.
-- **Pre-compressed files.** Serving `.br`/`.gz` files built ahead of time is a possible later step ([#642](https://github.com/typesmiths/decohere/issues/642)); today static files are compressed on the fly.
+- **Pre-compressed files.** Serving `.br`/`.gz` files built ahead of time is a possible later step; today static files are compressed on the fly.
 - **Testing.** Node's `fetch` negotiates and decodes compression itself. To see what is on the wire, use `node:http` and read the body undecoded.
 
 Why this shape: [ADR 0008](../../docs/adr/0008-response-compression-in-http.md).

package/commonjs/src/auth/token-service.js

@@ -18,7 +18,7 @@ class TokenService {
     principalMapper;
     /** Lazily resolved JWKS set when using OIDC discovery. */ discoveryJwks;
     discoveryIssuer;
-    /** Remote key set for `jwksUrl` mode, created once so jose can cache the keys (#499). */ configuredJwks;
+    /** Remote key set for `jwksUrl` mode, created once so jose can cache the keys. */ configuredJwks;
     constructor(config, principalMapper){
         if ((0, _authtypes.isDevStaticConfig)(config)) {
             (0, _authtypes.assertDevStaticAllowed)();

package/commonjs/src/openapi/request-validator.js

@@ -41,7 +41,7 @@ const ajv = new _ajv.Ajv({
 });
 /**
  * Compiled once per route and reused. Compiling per request was slow, and AJV keeps every
- * schema it compiles, so memory grew with traffic (#498).
+ * schema it compiles, so memory grew with traffic.
  */ const validatorsByRoute = new WeakMap();
 function getValidators(route) {
     let validators = validatorsByRoute.get(route);

package/commonjs/src/routing/pipes/pipes.js

@@ -132,7 +132,7 @@ class JsonPipe extends Pipe {
     }
 }
 class NumberPipe extends Pipe {
-    /** Finite numbers only. Blank or non-numeric input is a 400, not `undefined` (#503). */ transform(value, _context) {
+    /** Finite numbers only. Blank or non-numeric input is a 400, not `undefined`. */ transform(value, _context) {
         const text = typeof value === "number" ? null : String(value).trim();
         const number = text == null ? value : text === "" ? Number.NaN : Number(text);
         if (!Number.isFinite(number)) {

package/commonjs/src/routing/services/route-registry.js

@@ -60,7 +60,7 @@ class RouteRegistry {
         const key = `${method}|${path}`;
         const existing = this.routeMap.get(key);
         if (existing != null) {
-            // Last one used to win silently, leaving the other handler unreachable (#503).
+            // Last one used to win silently, leaving the other handler unreachable.
             throw new _anviltypes.RouteConfigurationError(`Duplicate route ${method.toUpperCase()} ${path}: ${existing.controller.name}.${existing.handler} and ${controller.name}.${handler}`);
         }
         const routeArgs = this.getRouteArguments(controller, func);

package/commonjs/src/routing/services/router.js

@@ -49,7 +49,7 @@ class Router {
     }
     /**
 	 * Without an authorization service nothing checks tokens, so a route marked @Authorize
-	 * would be served to anyone. Refuse to start instead of failing open (#500).
+	 * would be served to anyone. Refuse to start instead of failing open.
 	 */ assertAuthConfiguredForProtectedRoutes() {
         if (this.authService != null) {
             return;
@@ -67,13 +67,13 @@ class Router {
             throw new _anviltypes.RoutingError(`Route was not configured for key ${routeKey}`);
         }
         const { controller, handler, routeArgs } = routeConfig;
-        // Unnamed: the request id comes from the client, so it is not unique (#497).
+        // Unnamed: the request id comes from the client, so it is not unique.
         // Disposed before we respond, so async cleanup (e.g. rolling back a DB transaction)
         // finishes first. An SSE route is the exception: its scope lives as long as the stream.
         const scope = this.lifetimeScope.beginScope();
         let scopeHandedOff = false;
         // Runs inside the middleware chain so rejections (401/403/400) reach middleware such as
-        // the access log. Auth comes first so anonymous callers learn nothing about the body (#501).
+        // the access log. Auth comes first so anonymous callers learn nothing about the body.
         const handle = async ()=>{
             const principal = await this.authorize(routeConfig, httpRequest);
             if (this.httpOptions?.openapi?.validateRequests !== false && this.httpOptions?.openapi) {

package/es6/src/auth/token-service.js

@@ -8,7 +8,7 @@ export class TokenService {
     principalMapper;
     /** Lazily resolved JWKS set when using OIDC discovery. */ discoveryJwks;
     discoveryIssuer;
-    /** Remote key set for `jwksUrl` mode, created once so jose can cache the keys (#499). */ configuredJwks;
+    /** Remote key set for `jwksUrl` mode, created once so jose can cache the keys. */ configuredJwks;
     constructor(config, principalMapper){
         if (isDevStaticConfig(config)) {
             assertDevStaticAllowed();

package/es6/src/openapi/request-validator.js

@@ -27,7 +27,7 @@ const ajv = new Ajv({
 });
 /**
  * Compiled once per route and reused. Compiling per request was slow, and AJV keeps every
- * schema it compiles, so memory grew with traffic (#498).
+ * schema it compiles, so memory grew with traffic.
  */ const validatorsByRoute = new WeakMap();
 function getValidators(route) {
     let validators = validatorsByRoute.get(route);

package/es6/src/routing/pipes/pipes.js

@@ -105,7 +105,7 @@ export class JsonPipe extends Pipe {
     }
 }
 export class NumberPipe extends Pipe {
-    /** Finite numbers only. Blank or non-numeric input is a 400, not `undefined` (#503). */ transform(value, _context) {
+    /** Finite numbers only. Blank or non-numeric input is a 400, not `undefined`. */ transform(value, _context) {
         const text = typeof value === "number" ? null : String(value).trim();
         const number = text == null ? value : text === "" ? Number.NaN : Number(text);
         if (!Number.isFinite(number)) {

package/es6/src/routing/services/route-registry.js

@@ -50,7 +50,7 @@ export class RouteRegistry {
         const key = `${method}|${path}`;
         const existing = this.routeMap.get(key);
         if (existing != null) {
-            // Last one used to win silently, leaving the other handler unreachable (#503).
+            // Last one used to win silently, leaving the other handler unreachable.
             throw new RouteConfigurationError(`Duplicate route ${method.toUpperCase()} ${path}: ${existing.controller.name}.${existing.handler} and ${controller.name}.${handler}`);
         }
         const routeArgs = this.getRouteArguments(controller, func);

package/es6/src/routing/services/router.js

@@ -39,7 +39,7 @@ export class Router {
     }
     /**
 	 * Without an authorization service nothing checks tokens, so a route marked @Authorize
-	 * would be served to anyone. Refuse to start instead of failing open (#500).
+	 * would be served to anyone. Refuse to start instead of failing open.
 	 */ assertAuthConfiguredForProtectedRoutes() {
         if (this.authService != null) {
             return;
@@ -57,13 +57,13 @@ export class Router {
             throw new RoutingError(`Route was not configured for key ${routeKey}`);
         }
         const { controller, handler, routeArgs } = routeConfig;
-        // Unnamed: the request id comes from the client, so it is not unique (#497).
+        // Unnamed: the request id comes from the client, so it is not unique.
         // Disposed before we respond, so async cleanup (e.g. rolling back a DB transaction)
         // finishes first. An SSE route is the exception: its scope lives as long as the stream.
         const scope = this.lifetimeScope.beginScope();
         let scopeHandedOff = false;
         // Runs inside the middleware chain so rejections (401/403/400) reach middleware such as
-        // the access log. Auth comes first so anonymous callers learn nothing about the body (#501).
+        // the access log. Auth comes first so anonymous callers learn nothing about the body.
         const handle = async ()=>{
             const principal = await this.authorize(routeConfig, httpRequest);
             if (this.httpOptions?.openapi?.validateRequests !== false && this.httpOptions?.openapi) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/http",
-  "version": "0.0.1-dev.125",
+  "version": "0.0.1-dev.127",
   "description": "Web API and microservice platform built on Fastify with decorator-based routing",
   "keywords": [
     "typescript",
@@ -56,9 +56,9 @@
   },
   "dependencies": {
     "@casl/ability": "^6.8.1",
-    "@decohere/core": "0.0.1-dev.125",
-    "@decohere/crucible": "0.0.1-dev.125",
-    "@decohere/scribe": "0.0.1-dev.125",
+    "@decohere/core": "0.0.1-dev.127",
+    "@decohere/crucible": "0.0.1-dev.127",
+    "@decohere/scribe": "0.0.1-dev.127",
     "@fastify/compress": "^9.2.1",
     "@fastify/cors": "^11.3.0",
     "@fastify/helmet": "^13.1.0",

package/types/src/auth/token-service.d.ts

@@ -7,7 +7,7 @@ export declare class TokenService {
     /** Lazily resolved JWKS set when using OIDC discovery. */
     private discoveryJwks?;
     private discoveryIssuer?;
-    /** Remote key set for `jwksUrl` mode, created once so jose can cache the keys (#499). */
+    /** Remote key set for `jwksUrl` mode, created once so jose can cache the keys. */
     private configuredJwks?;
     constructor(config: TokenServiceConfig, principalMapper?: PrincipalMapper);
     verifyRequest(request: HttpRequest): Promise<Principal>;

package/types/src/routing/pipes/pipes.d.ts

@@ -16,6 +16,6 @@ export declare class JsonPipe extends Pipe<object> {
     private reviver;
 }
 export declare class NumberPipe extends Pipe<number> {
-    /** Finite numbers only. Blank or non-numeric input is a 400, not `undefined` (#503). */
+    /** Finite numbers only. Blank or non-numeric input is a 400, not `undefined`. */
     transform(value: unknown, _context?: unknown): number;
 }

package/types/src/routing/services/router.d.ts

@@ -13,7 +13,7 @@ export declare class Router {
     constructor(routeRegistry: RouteRegistry, lifetimeScope: LifetimeScope, authService?: IAuthorizationService, httpOptions?: HttpOptions);
     /**
      * Without an authorization service nothing checks tokens, so a route marked @Authorize
-     * would be served to anyone. Refuse to start instead of failing open (#500).
+     * would be served to anyone. Refuse to start instead of failing open.
      */
     private assertAuthConfiguredForProtectedRoutes;
     route(routeKey: string, httpRequest: HttpRequest): Promise<any>;