@devxcrew/framework 0.1.8 → 0.1.9

package/README.md

@@ -106,6 +106,29 @@ Receive and header timeouts are configurable positive millisecond values. They d
 `createRequestContext` supplies a server-generated request ID and an abort signal.
 Identity, tenant scope, transactions, and domain rules remain with their owner providers.
 
+## Owner providers
+
+Use `parseWithSchema` or `createValidationProvider().parse` to validate untrusted server input with a Zod schema.
+Validation failures throw `HttpError` with status 422 and safe field messages. Keep schemas and domain rules in the application module.
+
+Use `createLogger` for JSON logs. Set the minimum level and pass a sink for a logging adapter.
+Child loggers keep request context. The logger masks values under secret-like field names, bearer tokens, URL credentials, and common secret query parameters.
+
+Use `createHealthProvider` with named, synchronous dependency checks.
+`isReady()` returns false when any check fails. `snapshot()` reports check names and results. Expose that detail only through an authorized operations route.
+
+`createApplicationServer` applies `X-Content-Type-Options`, `X-Frame-Options`, and `Referrer-Policy` by default.
+Set `security.allowedOrigins` to enable exact-origin CORS. A configured allowlist rejects requests with other Origin values.
+Set `security.headers` for application-specific headers. Configure HSTS only when the public connection uses HTTPS.
+Set `security.trustedProxyAddresses` to exact proxy IP addresses before trusting `X-Forwarded-For`.
+Set `security.rateLimit` to enable an in-memory fixed-window limit by client address. It applies to all requests in one process.
+Use a shared rate-limit service when multiple app processes must share a limit.
+
+Import the browser-safe client from `@devxcrew/framework/client`.
+`createApiClient` accepts a base URL, optional common headers, and an optional Fetch implementation.
+Its `request` method passes cancellation through, returns JSON responses, and throws `ApiClientError` for non-success responses.
+The client reads only the Framework safe error envelope. It does not add authentication or retry mutations.
+
 Provider factories must only compose values. Acquire connections and other resources inside start hooks so failed startup can release them.
 Stop during startup is rejected. Concurrent stop calls share one cleanup operation.
 Oversized streamed JSON is drained without destroying the response socket, allowing a safe 413 response.

package/dist/http/server.d.ts

@@ -1,12 +1,14 @@
 import { type RequestListener } from "node:http";
 import type { ApplicationConfig } from "../runtime/config.js";
 import { createRequestContext } from "../modules/http/http.provider.js";
+import { type HttpSecurityOptions } from "../modules/http/http-security.provider.js";
 export interface ApplicationServerOptions {
     config: ApplicationConfig;
     frontendDirectory: string;
     developmentHandler?: RequestListener;
     apiHandler?: (request: import("node:http").IncomingMessage, response: import("node:http").ServerResponse, context: ReturnType<typeof createRequestContext>) => void | Promise<void>;
     readiness?: () => boolean;
+    security?: HttpSecurityOptions;
     requestTimeoutMs?: number;
     headersTimeoutMs?: number;
     handlerTimeoutMs?: number;

package/dist/http/server.js

@@ -1,7 +1,8 @@
 import { createServer } from "node:http";
 import { readFile, realpath } from "node:fs/promises";
 import { extname, resolve, sep } from "node:path";
-import { createRequestContext, writeJsonError, HttpError } from "../modules/http/http.provider.js";
+import { createRequestContext, writeJsonError, HttpError, } from "../modules/http/http.provider.js";
+import { createHttpSecurityProvider, } from "../modules/http/http-security.provider.js";
 const contentTypes = {
     ".html": "text/html; charset=utf-8",
     ".js": "text/javascript; charset=utf-8",
@@ -14,7 +15,10 @@ const contentTypes = {
 };
 export function createApplicationServer(options) {
     const handlerTimeoutMs = positiveTimeout(options.handlerTimeoutMs ?? 30_000);
+    const security = createHttpSecurityProvider(options.security);
     const server = createServer((request, response) => {
+        if (security.handle(request, response))
+            return;
         if (options.readiness && request.url === "/health/ready") {
             if (request.method !== "GET" && request.method !== "HEAD") {
                 response.writeHead(405, { Allow: "GET, HEAD" });
@@ -28,7 +32,10 @@ export function createApplicationServer(options) {
             catch {
                 ready = false;
             }
-            response.writeHead(ready ? 200 : 503, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+            response.writeHead(ready ? 200 : 503, {
+                "Content-Type": "application/json",
+                "Cache-Control": "no-store",
+            });
             response.end(request.method === "HEAD" ? undefined : JSON.stringify({ ready }));
             return;
         }
@@ -43,9 +50,12 @@ export function createApplicationServer(options) {
             response.once("finish", () => clearTimeout(deadline));
             response.once("close", () => clearTimeout(deadline));
             response.setHeader("X-Request-ID", context.requestId);
-            response.once("close", () => { if (!response.writableFinished)
-                request.emit("aborted"); });
-            void Promise.resolve().then(() => options.apiHandler(request, response, context))
+            response.once("close", () => {
+                if (!response.writableFinished)
+                    request.emit("aborted");
+            });
+            void Promise.resolve()
+                .then(() => options.apiHandler(request, response, context))
                 .catch((error) => {
                 if (!response.writableEnded && !response.destroyed)
                     writeJsonError(response, error, context.requestId);
@@ -95,8 +105,12 @@ async function serveFrontend(root, requestUrl, method, response) {
     }
     const target = extname(pathname) ? file : resolve(root, "index.html");
     try {
-        const [actualRoot, actualTarget] = await Promise.all([realpath(root), realpath(target)]);
-        if (actualTarget !== actualRoot && !actualTarget.startsWith(`${actualRoot}${sep}`)) {
+        const [actualRoot, actualTarget] = await Promise.all([
+            realpath(root),
+            realpath(target),
+        ]);
+        if (actualTarget !== actualRoot &&
+            !actualTarget.startsWith(`${actualRoot}${sep}`)) {
             response.writeHead(403);
             response.end("Forbidden");
             return;

package/dist/index.d.ts

@@ -1,4 +1,8 @@
 export { readApplicationConfig, type ApplicationConfig, } from "./runtime/config.js";
 export { createApplicationServer, type ApplicationServerOptions, } from "./http/server.js";
-export { composeModules, type ModuleProvider } from "./modules/runtime/runtime.provider.js";
-export { HttpError, createRequestContext, writeJsonError, parseListQuery, readJsonBody } from "./modules/http/http.provider.js";
+export { composeModules, type ModuleProvider, } from "./modules/runtime/runtime.provider.js";
+export { HttpError, createRequestContext, writeJsonError, parseListQuery, readJsonBody, } from "./modules/http/http.provider.js";
+export { createValidationProvider, parseWithSchema, type ValidationProvider, } from "./modules/validation/validation.provider.js";
+export { createLogger, type Logger, type LoggerOptions, type LogFields, type LogLevel, type LogRecord, } from "./modules/logger/logger.provider.js";
+export { createHttpSecurityProvider, type HttpSecurityOptions, type HttpSecurityProvider, type RateLimitOptions, } from "./modules/http/http-security.provider.js";
+export { createHealthProvider, type HealthCheck, type HealthProvider, type HealthSnapshot, } from "./modules/health/health.provider.js";

package/dist/index.js

@@ -1,4 +1,8 @@
 export { readApplicationConfig, } from "./runtime/config.js";
 export { createApplicationServer, } from "./http/server.js";
-export { composeModules } from "./modules/runtime/runtime.provider.js";
-export { HttpError, createRequestContext, writeJsonError, parseListQuery, readJsonBody } from "./modules/http/http.provider.js";
+export { composeModules, } from "./modules/runtime/runtime.provider.js";
+export { HttpError, createRequestContext, writeJsonError, parseListQuery, readJsonBody, } from "./modules/http/http.provider.js";
+export { createValidationProvider, parseWithSchema, } from "./modules/validation/validation.provider.js";
+export { createLogger, } from "./modules/logger/logger.provider.js";
+export { createHttpSecurityProvider, } from "./modules/http/http-security.provider.js";
+export { createHealthProvider, } from "./modules/health/health.provider.js";

package/dist/modules/api-client/api-client.provider.d.ts

@@ -0,0 +1,16 @@
+export interface ApiClientOptions {
+    baseUrl: string | URL;
+    headers?: HeadersInit;
+    fetch?: typeof fetch;
+}
+export interface ApiClient {
+    request<T>(path: string | URL, init?: RequestInit): Promise<T>;
+}
+export declare class ApiClientError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly requestId?: string | undefined;
+    readonly fields?: Record<string, string[]> | undefined;
+    constructor(message: string, status: number, code: string, requestId?: string | undefined, fields?: Record<string, string[]> | undefined);
+}
+export declare function createApiClient(options: ApiClientOptions): ApiClient;

package/dist/modules/api-client/api-client.provider.js

@@ -0,0 +1,76 @@
+export class ApiClientError extends Error {
+    status;
+    code;
+    requestId;
+    fields;
+    constructor(message, status, code, requestId, fields) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.requestId = requestId;
+        this.fields = fields;
+        this.name = "ApiClientError";
+    }
+}
+export function createApiClient(options) {
+    const baseUrl = options.baseUrl instanceof URL ? options.baseUrl : new URL(options.baseUrl);
+    const fetcher = options.fetch ?? globalThis.fetch;
+    if (typeof fetcher !== "function")
+        throw new Error("A Fetch implementation is required.");
+    return {
+        async request(path, init = {}) {
+            const url = path instanceof URL ? path : new URL(path, baseUrl);
+            const headers = new Headers(options.headers);
+            new Headers(init.headers).forEach((value, key) => headers.set(key, value));
+            const response = await fetcher(url, { ...init, headers });
+            if (response.status === 204 || init.method?.toUpperCase() === "HEAD")
+                return undefined;
+            const payload = await readPayload(response);
+            if (!response.ok)
+                throw toApiError(response, payload);
+            return payload;
+        },
+    };
+}
+async function readPayload(response) {
+    if (!/application\/(?:[a-z0-9.+-]+\+)?json/i.test(response.headers.get("content-type") ?? ""))
+        return undefined;
+    try {
+        return await response.json();
+    }
+    catch {
+        return undefined;
+    }
+}
+function toApiError(response, payload) {
+    const envelope = asRecord(payload);
+    const error = asRecord(envelope?.error);
+    const code = stringValue(error?.code) ?? "request_failed";
+    const message = stringValue(error?.message) ?? "The request could not be completed.";
+    return new ApiClientError(message, response.status, code, stringValue(error?.requestId) ??
+        stringValue(envelope?.requestId) ??
+        response.headers.get("x-request-id") ??
+        undefined, readFields(error?.fields));
+}
+function asRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function stringValue(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function readFields(value) {
+    const source = asRecord(value);
+    if (!source)
+        return undefined;
+    const fields = Object.create(null);
+    for (const [name, messages] of Object.entries(source)) {
+        if (Array.isArray(messages) &&
+            messages.every((message) => typeof message === "string"))
+            fields[name] = messages;
+    }
+    return Object.keys(fields).length
+        ? Object.fromEntries(Object.entries(fields))
+        : undefined;
+}

package/dist/modules/health/health.provider.d.ts

@@ -0,0 +1,7 @@
+export type HealthCheck = () => boolean;
+export type HealthSnapshot = Readonly<Record<string, boolean>>;
+export interface HealthProvider {
+    isReady(): boolean;
+    snapshot(): HealthSnapshot;
+}
+export declare function createHealthProvider(checks: Readonly<Record<string, HealthCheck>>): HealthProvider;

package/dist/modules/health/health.provider.js

@@ -0,0 +1,22 @@
+export function createHealthProvider(checks) {
+    const entries = Object.entries(checks);
+    if (entries.some(([name, check]) => !name.trim() || typeof check !== "function")) {
+        throw new Error("Health checks require a name and function.");
+    }
+    return {
+        isReady() {
+            return entries.every(([, check]) => runCheck(check));
+        },
+        snapshot() {
+            return Object.fromEntries(entries.map(([name, check]) => [name, runCheck(check)]));
+        },
+    };
+}
+function runCheck(check) {
+    try {
+        return check();
+    }
+    catch {
+        return false;
+    }
+}

package/dist/modules/http/http-security.provider.d.ts

@@ -0,0 +1,22 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+export interface RateLimitOptions {
+    limit: number;
+    windowMs: number;
+    maxEntries?: number;
+}
+export interface HttpSecurityOptions {
+    allowedOrigins?: readonly string[];
+    allowedMethods?: readonly string[];
+    allowedHeaders?: readonly string[];
+    exposedHeaders?: readonly string[];
+    allowCredentials?: boolean;
+    preflightMaxAgeSeconds?: number;
+    headers?: Readonly<Record<string, string>>;
+    trustedProxyAddresses?: readonly string[];
+    rateLimit?: RateLimitOptions;
+}
+export interface HttpSecurityProvider {
+    handle(request: IncomingMessage, response: ServerResponse): boolean;
+    clientAddress(request: IncomingMessage): string;
+}
+export declare function createHttpSecurityProvider(options?: HttpSecurityOptions): HttpSecurityProvider;

package/dist/modules/http/http-security.provider.js

@@ -0,0 +1,190 @@
+import { isIP } from "node:net";
+import { validateHeaderName, validateHeaderValue, } from "node:http";
+const defaultMethods = [
+    "GET",
+    "HEAD",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+    "OPTIONS",
+];
+const defaultHeaders = ["Content-Type", "Authorization", "X-Request-ID"];
+export function createHttpSecurityProvider(options = {}) {
+    const origins = new Set((options.allowedOrigins ?? []).map(validateOrigin));
+    const methods = validateTokens(options.allowedMethods ?? defaultMethods, "method", true);
+    const headers = validateTokens(options.allowedHeaders ?? defaultHeaders, "header");
+    const exposedHeaders = validateTokens(options.exposedHeaders ?? [], "header");
+    const trustedProxies = new Set((options.trustedProxyAddresses ?? []).map(validateAddress));
+    const maxAge = options.preflightMaxAgeSeconds ?? 600;
+    if (!Number.isSafeInteger(maxAge) || maxAge < 0 || maxAge > 86_400)
+        throw new Error("Invalid CORS max age.");
+    if (options.allowCredentials && origins.size === 0)
+        throw new Error("Credentialed CORS requires allowed origins.");
+    const customHeaders = Object.entries(options.headers ?? {});
+    for (const [name, value] of customHeaders) {
+        validateHeaderName(name);
+        validateHeaderValue(name, value);
+    }
+    const limiter = options.rateLimit
+        ? createLimiter(options.rateLimit)
+        : undefined;
+    const clientAddress = (request) => resolveClientAddress(request, trustedProxies);
+    return {
+        handle(request, response) {
+            response.setHeader("X-Content-Type-Options", "nosniff");
+            response.setHeader("X-Frame-Options", "DENY");
+            response.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
+            for (const [name, value] of customHeaders)
+                response.setHeader(name, value);
+            if (limiter) {
+                const retryAfter = limiter(clientAddress(request));
+                if (retryAfter > 0) {
+                    response.writeHead(429, {
+                        "Content-Type": "application/json; charset=utf-8",
+                        "Cache-Control": "no-store",
+                        "Retry-After": String(retryAfter),
+                    });
+                    response.end(JSON.stringify({
+                        error: {
+                            code: "rate_limit_exceeded",
+                            message: "Too many requests.",
+                        },
+                    }));
+                    return true;
+                }
+            }
+            const origin = request.headers.origin;
+            if (!origins.size || !origin)
+                return false;
+            response.setHeader("Vary", appendVary(response.getHeader("Vary"), "Origin"));
+            if (!origins.has(origin)) {
+                response.writeHead(403, { "Cache-Control": "no-store" });
+                response.end();
+                return true;
+            }
+            response.setHeader("Access-Control-Allow-Origin", origin);
+            if (options.allowCredentials)
+                response.setHeader("Access-Control-Allow-Credentials", "true");
+            if (exposedHeaders.length)
+                response.setHeader("Access-Control-Expose-Headers", exposedHeaders.join(", "));
+            const requestedMethod = request.headers["access-control-request-method"];
+            if (request.method === "OPTIONS" && requestedMethod) {
+                response.setHeader("Vary", appendVary(appendVary(response.getHeader("Vary"), "Access-Control-Request-Method"), "Access-Control-Request-Headers"));
+                const requestedHeaders = (request.headers["access-control-request-headers"] ?? "")
+                    .split(",")
+                    .map((value) => value.trim())
+                    .filter(Boolean);
+                if (!methods.includes(requestedMethod) ||
+                    requestedHeaders.some((name) => !headers.some((allowed) => allowed.toLowerCase() === name.toLowerCase()))) {
+                    response.writeHead(403, { "Cache-Control": "no-store" });
+                    response.end();
+                    return true;
+                }
+                response.setHeader("Access-Control-Allow-Methods", methods.join(", "));
+                if (requestedHeaders.length)
+                    response.setHeader("Access-Control-Allow-Headers", requestedHeaders.join(", "));
+                response.setHeader("Access-Control-Max-Age", String(maxAge));
+                response.writeHead(204);
+                response.end();
+                return true;
+            }
+            if (!methods.includes(request.method ?? "GET")) {
+                response.writeHead(405, { Allow: methods.join(", ") });
+                response.end();
+                return true;
+            }
+            return false;
+        },
+        clientAddress,
+    };
+}
+function resolveClientAddress(request, trustedProxies) {
+    const peer = normalizeAddress(request.socket.remoteAddress ?? "");
+    if (!peer || !trustedProxies.has(peer))
+        return peer || "unknown";
+    const forwarded = request.headers["x-forwarded-for"];
+    if (typeof forwarded !== "string")
+        return peer;
+    const chain = forwarded
+        .split(",")
+        .map((value) => normalizeAddress(value.trim()));
+    if (!chain.length || chain.some((value) => !value))
+        return peer;
+    for (const candidate of chain.reverse()) {
+        if (!trustedProxies.has(candidate))
+            return candidate;
+    }
+    return peer;
+}
+function createLimiter(options) {
+    const maxEntries = options.maxEntries ?? 10_000;
+    if (!Number.isSafeInteger(options.limit) ||
+        options.limit < 1 ||
+        !Number.isSafeInteger(options.windowMs) ||
+        options.windowMs < 1 ||
+        !Number.isSafeInteger(maxEntries) ||
+        maxEntries < 1 ||
+        maxEntries > 100_000) {
+        throw new Error("Invalid rate limit.");
+    }
+    const clients = new Map();
+    return (address) => {
+        const now = Date.now();
+        for (const [key, record] of clients)
+            if (record.resetAt <= now)
+                clients.delete(key);
+        let record = clients.get(address);
+        if (!record) {
+            if (clients.size >= maxEntries)
+                return Math.ceil(options.windowMs / 1000);
+            record = { count: 0, resetAt: now + options.windowMs };
+            clients.set(address, record);
+        }
+        if (record.count >= options.limit)
+            return Math.max(1, Math.ceil((record.resetAt - now) / 1000));
+        record.count++;
+        return 0;
+    };
+}
+function validateOrigin(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error("Invalid allowed origin.");
+    }
+    if (!(["http:", "https:"].includes(parsed.protocol) && parsed.origin === value))
+        throw new Error("Allowed origins must be exact HTTP origins.");
+    return value;
+}
+function validateTokens(values, kind, uppercase = false) {
+    for (const value of values) {
+        if (!value ||
+            (uppercase
+                ? !/^[A-Z]+$/.test(value)
+                : !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(value)))
+            throw new Error(`Invalid CORS ${kind}.`);
+    }
+    return [...new Set(values)];
+}
+function validateAddress(value) {
+    const address = normalizeAddress(value);
+    if (!address)
+        throw new Error("Trusted proxies must use IP addresses.");
+    return address;
+}
+function normalizeAddress(value) {
+    const address = value.toLowerCase().replace(/^::ffff:/, "");
+    return isIP(address) ? address : "";
+}
+function appendVary(existing, value) {
+    const values = (Array.isArray(existing) ? existing.join(",") : String(existing ?? ""))
+        .split(",")
+        .map((item) => item.trim())
+        .filter(Boolean);
+    if (!values.some((item) => item.toLowerCase() === value.toLowerCase()))
+        values.push(value);
+    return values.join(", ");
+}

package/dist/modules/logger/logger.provider.d.ts

@@ -0,0 +1,22 @@
+export type LogLevel = "debug" | "info" | "warn" | "error";
+export type LogFields = Readonly<Record<string, unknown>>;
+export interface LogRecord {
+    timestamp: string;
+    level: LogLevel;
+    message: string;
+    requestId?: string;
+    [key: string]: unknown;
+}
+export interface Logger {
+    child(fields: LogFields): Logger;
+    debug(message: string, fields?: LogFields): void;
+    info(message: string, fields?: LogFields): void;
+    warn(message: string, fields?: LogFields): void;
+    error(message: string, fields?: LogFields): void;
+}
+export interface LoggerOptions {
+    level?: LogLevel;
+    sink?: (record: LogRecord) => void;
+    context?: LogFields;
+}
+export declare function createLogger(options?: LoggerOptions): Logger;

package/dist/modules/logger/logger.provider.js

@@ -0,0 +1,88 @@
+const priorities = {
+    debug: 10,
+    info: 20,
+    warn: 30,
+    error: 40,
+};
+const secretField = /(?:secret|password|passwd|token|authorization|cookie|credential|api[-_]?key|private[-_]?key)/i;
+const secretQuery = /([?&](?:access[-_]?token|refresh[-_]?token|client[-_]?secret|token|secret|password|api[-_]?key)=)[^&#\s]*/gi;
+const bearer = /\bBearer\s+[^\s,;]+/gi;
+const urlCredentials = /(\b[a-z][a-z\d+.-]*:\/\/)[^/@\s]+@/gi;
+export function createLogger(options = {}) {
+    const level = options.level ?? "info";
+    if (!(level in priorities))
+        throw new Error("Invalid log level.");
+    const sink = options.sink ?? writeConsoleRecord;
+    return makeLogger(level, sink, options.context ?? {});
+}
+function makeLogger(level, sink, context) {
+    const write = (entryLevel, message, fields = {}) => {
+        if (priorities[entryLevel] < priorities[level])
+            return;
+        const record = redact({
+            ...context,
+            ...fields,
+            timestamp: new Date().toISOString(),
+            level: entryLevel,
+            message,
+        });
+        try {
+            sink(record);
+        }
+        catch {
+            /* Logging failures must not break application work. */
+        }
+    };
+    return {
+        child(fields) {
+            return makeLogger(level, sink, { ...context, ...fields });
+        },
+        debug(message, fields) {
+            write("debug", message, fields);
+        },
+        info(message, fields) {
+            write("info", message, fields);
+        },
+        warn(message, fields) {
+            write("warn", message, fields);
+        },
+        error(message, fields) {
+            write("error", message, fields);
+        },
+    };
+}
+function writeConsoleRecord(record) {
+    const output = JSON.stringify(record);
+    if (record.level === "error")
+        console.error(output);
+    else if (record.level === "warn")
+        console.warn(output);
+    else if (record.level === "debug")
+        console.debug(output);
+    else
+        console.info(output);
+}
+function redact(value, parentKey = "", seen = new WeakSet()) {
+    if (secretField.test(parentKey))
+        return "[REDACTED]";
+    if (typeof value === "string") {
+        return value
+            .replace(bearer, "Bearer [REDACTED]")
+            .replace(urlCredentials, "$1[REDACTED]@")
+            .replace(secretQuery, "$1[REDACTED]");
+    }
+    if (value instanceof Error)
+        return { name: value.name, message: redact(value.message) };
+    if (value instanceof URL)
+        return redact(value.toString());
+    if (typeof value === "bigint")
+        return value.toString();
+    if (!value || typeof value !== "object")
+        return value;
+    if (seen.has(value))
+        return "[Circular]";
+    seen.add(value);
+    if (Array.isArray(value))
+        return value.map((item) => redact(item, "", seen));
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redact(item, key, seen)]));
+}

package/dist/modules/validation/validation.provider.d.ts

@@ -0,0 +1,6 @@
+import { z } from "zod";
+export interface ValidationProvider {
+    parse<T extends z.ZodType>(schema: T, input: unknown): z.output<T>;
+}
+export declare function createValidationProvider(): ValidationProvider;
+export declare function parseWithSchema<T extends z.ZodType>(schema: T, input: unknown): z.output<T>;

package/dist/modules/validation/validation.provider.js

@@ -0,0 +1,18 @@
+import { HttpError } from "../http/http.provider.js";
+export function createValidationProvider() {
+    return { parse: parseWithSchema };
+}
+export function parseWithSchema(schema, input) {
+    const result = schema.safeParse(input);
+    if (!result.success) {
+        const fields = Object.create(null);
+        for (const issue of result.error.issues) {
+            const path = issue.path.length
+                ? issue.path.map(String).join(".")
+                : "_form";
+            (fields[path] ??= []).push(issue.message);
+        }
+        throw new HttpError(422, "validation_failed", "The submitted data is invalid.", Object.fromEntries(Object.entries(fields)));
+    }
+    return result.data;
+}

package/package.json

@@ -1,11 +1,15 @@
 {
   "name": "@devxcrew/framework",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "type": "module",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/modules/api-client/api-client.provider.d.ts",
+      "default": "./dist/modules/api-client/api-client.provider.js"
     }
   },
   "files": [
@@ -20,10 +24,13 @@
     "url": "git+https://github.com/devxcrew/framework.git"
   },
   "devDependencies": {
-    "@devxcrew/tools": "0.1.7",
+    "@devxcrew/tools": "0.1.8",
     "@types/node": "^26.0.0",
     "typescript": "6.0.3"
   },
+  "dependencies": {
+    "zod": "4.6.5"
+  },
   "scripts": {
     "github:now": "devxcrew-tools github:now",
     "version:update": "devxcrew-tools version:bump",
@@ -44,7 +51,7 @@
     "build": "tsc -p tsconfig.json",
     "prepack": "npm run build",
     "release:check": "npm run check && npm run build && npm pack --dry-run --ignore-scripts",
-    "test": "npm run build && node --test tests/*.test.mjs"
+    "test": "npm run build && node --test"
   },
   "publishConfig": {
     "access": "public",