@dunx/create-app 2.3.1 → 2.5.0

package/templates/features/health/indicators.ts

@@ -0,0 +1,98 @@
+import {
+  DatabaseIndicator,
+  DiskIndicator,
+  DiskOptions,
+  HealthIndicator,
+  MemoryIndicator,
+  MemoryOptions,
+  RedisIndicator,
+  type ProbeResult,
+} from '@dunx/http';
+import type { DbConnection } from '@dunx/infra/db';
+import type { RedisConnection } from '@dunx/infra/redis';
+import { Ledger } from '../database/ledger.service.js';
+
+/**
+ * The custom-indicator path: an app-specific query rather than a round trip.
+ *
+ * `DatabaseIndicator` answers "does the connection answer". This answers "is the
+ * data there", which is the part only the app knows how to ask.
+ */
+export class LedgerIndicator extends HealthIndicator {
+  readonly name = 'ledger';
+
+  constructor(private readonly ledger: Ledger) {
+    super();
+  }
+
+  check(): ProbeResult {
+    const rows = this.ledger.rows();
+    return rows > 0
+      ? {
+          state: 'up',
+          detail: `${rows} rows, balance ${this.ledger.balance()}`,
+        }
+      : { state: 'down', detail: 'no rows - the seeds did not run' };
+  }
+}
+
+/**
+ * `RedisIndicator` with the criticality flipped, because this app treats a missing
+ * cache as degraded rather than fatal - the same promise `CacheModule` makes with
+ * lazy connections and `maxRetries: 0`.
+ *
+ * Shedding traffic here would be wrong: the routes that need Redis report
+ * themselves degraded and every other route still works.
+ */
+export class CacheIndicator extends RedisIndicator {
+  override readonly critical = false;
+}
+
+export interface AppIndicatorsInit {
+  readonly db: DbConnection;
+  readonly redis: RedisConnection;
+  readonly ledger: Ledger;
+  /** Where uploads land, so a full disk here is a real failure. */
+  readonly uploadRoot: string;
+}
+
+/**
+ * The one declaration of what this service probes.
+ *
+ * It is a provider rather than two lists inlined into two factories because two
+ * things read it: `HealthModule` answers `/api/health/ready`, and
+ * `DashboardModule` lights the same checks on the ops page. A `HealthIndicator`
+ * satisfies `DashboardProbe` as written, so neither side needs an adapter.
+ */
+export class AppIndicators {
+  readonly readiness: readonly HealthIndicator[];
+  readonly liveness: readonly HealthIndicator[];
+  /**
+   * The readiness list minus what the dashboard already sources itself:
+   * `DashboardOptions.redis` drives the Redis panel *and* a `redis` probe, so
+   * handing it `CacheIndicator` as well would light the same name twice.
+   */
+  readonly dashboardProbes: readonly HealthIndicator[];
+
+  constructor(init: AppIndicatorsInit) {
+    this.readiness = [
+      new DatabaseIndicator(init.db),
+      new LedgerIndicator(init.ledger),
+      new CacheIndicator(init.redis),
+      // Non-critical, because no other pod's disk is any emptier.
+      new DiskIndicator(
+        new DiskOptions({ path: init.uploadRoot, maxUsedFraction: 0.95 }),
+      ),
+    ];
+    // A ceiling belongs on liveness, where the orchestrator restarts the process
+    // rather than routing around it.
+    this.liveness = [
+      new MemoryIndicator(
+        new MemoryOptions({ maxRssBytes: 1024 * 1024 * 1024 }),
+      ),
+    ];
+    this.dashboardProbes = this.readiness.filter(
+      (indicator) => !(indicator instanceof CacheIndicator),
+    );
+  }
+}

package/templates/features/http/compression.demo.ts

@@ -0,0 +1,88 @@
+import { Logger } from '@dunx/core';
+
+/** Large enough that every branch below is the interesting one. */
+const DOCUMENT = 'api/openapi.json';
+/** Two fields. Under the 1024-byte threshold, so it is sent as it is. */
+const SMALL = 'api/notes/whoami';
+
+interface Measured {
+  readonly encoding: string;
+  readonly wire: number;
+  readonly decoded: number;
+  readonly vary: string;
+}
+
+/**
+ * `fetch` decodes the body itself but leaves `content-encoding` and the encoded
+ * `content-length` on the response, so one request measures both sides.
+ */
+const measure = async (
+  url: string,
+  path: string,
+  accept: string,
+): Promise<Measured> => {
+  const response = await fetch(new URL(path, url), {
+    headers: { 'accept-encoding': accept },
+  });
+  const decoded = await response.text();
+  const wire = response.headers.get('content-length');
+  return {
+    encoding: response.headers.get('content-encoding') ?? 'identity',
+    wire: wire === null ? decoded.length : Number(wire),
+    decoded: decoded.length,
+    vary: response.headers.get('vary') ?? '-',
+  };
+};
+
+const ratio = (m: Measured): string =>
+  `${((m.wire / m.decoded) * 100).toFixed(1)}%`;
+
+export class CompressionDemo {
+  constructor(private readonly logger: Logger) {}
+
+  async demonstrate(url: string): Promise<void> {
+    const { logger } = this;
+
+    // This folder is vendored by `@dunx/create-app`, and a scaffold that took
+    // `http` without `openapi` has no document to encode. Same convention as a
+    // part whose backing service is absent: say so and carry on.
+    const available = await fetch(new URL(DOCUMENT, url));
+    await available.body?.cancel();
+    if (!available.ok) {
+      logger.info(`skipping: no ${DOCUMENT} in this app to encode`);
+      return;
+    }
+
+    // `identity` names a coding the app does not offer, so negotiation picks
+    // nothing and the body goes out unencoded.
+    for (const accept of ['identity', 'gzip', 'zstd', 'gzip, zstd']) {
+      const m = await measure(url, DOCUMENT, accept);
+      logger.info(
+        `accept-encoding: ${accept.padEnd(11)} -> ${m.encoding.padEnd(8)} ` +
+          `${String(m.wire).padStart(6)} of ${m.decoded} bytes (${ratio(m)})`,
+      );
+    }
+
+    // Both offered at the same q, so the server's own order decides. The app
+    // offers `['zstd', 'gzip']`: on a body this size the two compress to within
+    // 0.2% of each other and zstd is the faster encoder.
+    const preferred = await measure(url, DOCUMENT, 'gzip, zstd');
+    logger.info(
+      `a tie in the client's q-values is broken by the server order -> ${preferred.encoding}`,
+    );
+
+    // An explicit q-value outranks that order.
+    const forced = await measure(url, DOCUMENT, 'zstd;q=0.1, gzip;q=0.9');
+    logger.info(`zstd;q=0.1, gzip;q=0.9 -> ${forced.encoding}`);
+
+    const small = await measure(url, SMALL, 'gzip, zstd');
+    logger.info(
+      `under the 1024-byte threshold: ${SMALL} -> ${small.encoding} ` +
+        `(${small.decoded} bytes, encoding it would add bytes)`,
+    );
+    logger.info(
+      `vary: ${small.vary} - set even when nothing was encoded, so a shared ` +
+        `cache does not serve one client's encoding to another`,
+    );
+  }
+}

package/templates/features/http/http.demo.ts

@@ -1,7 +1,7 @@
 import { Logger } from '@dunx/core';
 import type { HttpApp } from '@dunx/http';
 import { AppConfigService } from '../config.js';
-import { RequestLog } from './request-log.js';
+import { RequestTrail } from './request-trail.js';
 
 const CORS_HEADERS = [
   'access-control-allow-origin',
@@ -49,7 +49,7 @@ const whoami = async (url: string, forwarded: boolean): Promise<string> => {
 
 export class HttpDemo {
   constructor(
-    private readonly log: RequestLog,
+    private readonly trail: RequestTrail,
     private readonly config: AppConfigService,
     private readonly logger: Logger,
   ) {}
@@ -70,10 +70,12 @@ export class HttpDemo {
 
     const created = await postNote(url, 'ship it');
     logger.info(
-      `use(RequestLoggerMiddleware): POST /api/notes -> ${created.status}, ` +
+      `use(RequestTrailMiddleware): POST /api/notes -> ${created.status}, ` +
         `x-handled-by: ${created.headers.get('x-handled-by')}`,
     );
-    logger.info(`RequestLog -> ${JSON.stringify(this.log.entries.slice(-2))}`);
+    logger.info(
+      `RequestTrail -> ${JSON.stringify(this.trail.entries.slice(-2))}`,
+    );
 
     const rejected = await postNote(url, 7);
     logger.info(

package/templates/features/http/http.module.ts

@@ -1,11 +1,39 @@
 import { Module } from '@dunx/core';
+import { CompressionModule } from '@dunx/http';
+import { CompressionDemo } from './compression.demo.js';
+import { TraceController } from './trace.controller.js';
+import { TraceDemo } from './trace.demo.js';
 import { HttpDemo } from './http.demo.js';
-import { RequestLog, RequestLoggerMiddleware } from './request-log.js';
+import { RequestTrail, RequestTrailMiddleware } from './request-trail.js';
 
 // `use()` resolves middleware from the container, and every class self-binds - so
 // declaring them here is for the reader, not for the resolver.
 @Module({
-  providers: [RequestLog, RequestLoggerMiddleware, HttpDemo],
-  exports: [RequestLog, RequestLoggerMiddleware, HttpDemo],
+  imports: [
+    // Binds `Compression`; the **app** registers it, in `bootstrap.ts`, for the
+    // same reason `StaticFiles` is registered there. Nothing is installed by
+    // importing this, so an app that never calls `app.use(Compression)` has no
+    // branch in the request path to skip.
+    //
+    // Defaults left alone apart from the threshold, which is here to be seen: a
+    // body under it is sent as it is, because gzip's header and trailer alone are
+    // 18 bytes and a short JSON response comes out larger.
+    CompressionModule.forRoot({ threshold: 1024 }),
+  ],
+  controllers: [TraceController],
+  providers: [
+    RequestTrail,
+    RequestTrailMiddleware,
+    HttpDemo,
+    CompressionDemo,
+    TraceDemo,
+  ],
+  exports: [
+    RequestTrail,
+    RequestTrailMiddleware,
+    HttpDemo,
+    CompressionDemo,
+    TraceDemo,
+  ],
 })
 export class HttpModule {}

package/templates/features/http/{request-log.ts → request-trail.ts}

@@ -2,7 +2,7 @@ import type { BunRequest } from 'bun';
 import type { Middleware, Next, RouteContext } from '@dunx/http';
 
 /** The observable side effect: whatever the middleware saw is readable after. */
-export class RequestLog {
+export class RequestTrail {
   readonly entries: string[] = [];
 }
 
@@ -11,15 +11,14 @@ export class RequestLog {
  * what lets it inject. Chains are folded into one closure per route at boot, and
  * `ctx` is the route it was folded into: names, method, path, and its metadata.
  *
- * **This does not log.** `@dunx/http` already installs
- * `RequestLoggingMiddleware` by default - one structured entry per request,
- * with `requestId` propagated through `RequestContext` - so an app writing its
- * own would be logging everything twice. What is left here is the part a
- * framework cannot supply: an app-specific side effect, kept because the tour
- * asserts on it and because it is the smallest possible example of the seam.
+ * **This does not log**, which is what the name says now and did not before.
+ * `@dunx/http` installs `RequestLoggingMiddleware` itself - one structured entry
+ * per request, tuned through `requestLogging` in bootstrap.ts - so an app writing
+ * its own would write everything twice. What is left here is the part a framework
+ * cannot supply: an app-specific side effect on a response the middleware can see.
  */
-export class RequestLoggerMiddleware implements Middleware {
-  constructor(private readonly log: RequestLog) {}
+export class RequestTrailMiddleware implements Middleware {
+  constructor(private readonly trail: RequestTrail) {}
 
   async handle(
     req: BunRequest,
@@ -27,11 +26,11 @@ export class RequestLoggerMiddleware implements Middleware {
     next: Next,
   ): Promise<Response> {
     const response = await next();
-    this.log.entries.push(
+    this.trail.entries.push(
       `${req.method} ${new URL(req.url).pathname} -> ${response.status} ` +
         `(${ctx.controller}.${ctx.handler})`,
     );
-    response.headers.set('x-handled-by', 'request-logger');
+    response.headers.set('x-handled-by', 'request-trail');
     return response;
   }
 }

package/templates/features/http/trace.controller.ts

@@ -0,0 +1,30 @@
+import { RequestContext } from '@dunx/core';
+import { Controller, Get, type Input, type RouteSchemas } from '@dunx/http';
+
+/**
+ * What the request's W3C trace looks like from inside a handler.
+ *
+ * `RequestContext` is bound by `@dunx/core` whatever else the app imports, and
+ * `requestLogging: { trace: true }` is what puts the trace fields into it. Every
+ * log line this request writes carries the same three values.
+ */
+@Controller('trace')
+export class TraceController {
+  constructor(private readonly context: RequestContext) {}
+
+  @Get('/')
+  current(input: Input<RouteSchemas>): {
+    traceId: string | undefined;
+    spanId: string | undefined;
+    parentSpanId: string | undefined;
+    inbound: string | null;
+  } {
+    const { traceId, spanId, parentSpanId } = this.context.getContext();
+    return {
+      traceId: traceId as string | undefined,
+      spanId: spanId as string | undefined,
+      parentSpanId: parentSpanId as string | undefined,
+      inbound: input.req.headers.get('traceparent'),
+    };
+  }
+}

package/templates/features/http/trace.demo.ts

@@ -0,0 +1,58 @@
+import { Logger } from '@dunx/core';
+
+interface Seen {
+  readonly traceId: string | undefined;
+  readonly spanId: string | undefined;
+  readonly parentSpanId: string | undefined;
+}
+
+const UPSTREAM_TRACE = '4bf92f3577b34da6a3ce929d0e0e4736';
+const UPSTREAM_SPAN = '00f067aa0ba902b7';
+
+const ask = async (url: string, traceparent?: string): Promise<Seen> => {
+  const response = await fetch(new URL('api/trace', url), {
+    headers: traceparent === undefined ? {} : { traceparent },
+  });
+  return (await response.json()) as Seen;
+};
+
+export class TraceDemo {
+  constructor(private readonly logger: Logger) {}
+
+  async demonstrate(url: string): Promise<void> {
+    const { logger } = this;
+
+    const fresh = await ask(url);
+    logger.info(
+      `no traceparent in: trace ${fresh.traceId} span ${fresh.spanId} ` +
+        `(no parent - this service started the trace)`,
+    );
+
+    const continued = await ask(
+      url,
+      `00-${UPSTREAM_TRACE}-${UPSTREAM_SPAN}-01`,
+    );
+    logger.info(
+      `traceparent in:    trace ${continued.traceId} span ${continued.spanId} ` +
+        `parent ${continued.parentSpanId}`,
+    );
+    logger.info(
+      `the caller's trace id survived: ${continued.traceId === UPSTREAM_TRACE}, ` +
+        `and its span became this one's parent: ${continued.parentSpanId === UPSTREAM_SPAN}`,
+    );
+
+    // Discarded rather than repaired. An unparseable header means the caller's
+    // trace is unknown, so this request starts one of its own.
+    const broken = await ask(url, '00-not-a-trace-id-01');
+    logger.info(
+      `malformed traceparent in: trace ${broken.traceId} ` +
+        `(a fresh one, not the caller's)`,
+    );
+
+    // Two requests are two traces, and two spans within one.
+    const second = await ask(url);
+    logger.info(
+      `each request gets its own span: ${fresh.spanId !== second.spanId}`,
+    );
+  }
+}

package/templates/features/jobs/jobs.controller.ts

@@ -17,8 +17,13 @@ const Enqueue = z
     width: z.coerce.number().int().min(1).max(1024).default(128),
     format: z.enum(EncodableFormat).default(EncodableFormat.WEBP),
   })
-  .meta({ id: 'EnqueueRender', title: 'A thumbnail to render off the request' })
-  .strict();
+  // `.strict()` **after** `.meta()` discards the metadata - `meta()` then returns
+  // null and the schema is inlined despite declaring an id. Order matters.
+  .strict()
+  .meta({
+    id: 'EnqueueRender',
+    description: 'A thumbnail to render off the request',
+  });
 
 const enqueue = { body: Enqueue } as const;
 const oneJob = { params: z.object({ id: z.string().min(1) }) } as const;

package/templates/features/jobs/thumbnail.jobs.ts

@@ -37,6 +37,7 @@ export class ThumbnailJobs {
   // in this process's stream.
   @JobHandler({ queue: THUMBNAIL_QUEUE, name: 'render', background: true })
   async render(job: Job<RenderRequest>): Promise<RenderResult> {
+    const started = Bun.nanoseconds();
     const encoded = await this.thumbnails.render({
       width: job.data.width,
       fit: ImageFit.INSIDE,
@@ -48,8 +49,13 @@ export class ThumbnailJobs {
       height: encoded.height,
       bytes: encoded.bytes.byteLength,
     };
+    const elapsedMs = (Bun.nanoseconds() - started) / 1e6;
     // Written in the child, and visible here: that is the point of the sandbox.
-    this.logger.info(`rendered job ${job.id ?? '?'}`, result);
+    this.logger.info(
+      `rendered job ${job.id ?? '?'} in ${elapsedMs.toFixed(2)} ms`,
+      result,
+    );
+
     return result;
   }
 }

package/templates/features/notes/notes.controller.ts

@@ -13,7 +13,7 @@ import { NotesService } from './notes.service.js';
 
 const CreateNote = z
   .object({ text: z.string().min(1) })
-  .meta({ id: 'CreateNote', title: 'Add a note' });
+  .meta({ id: 'CreateNote', description: 'Add a note' });
 
 // An explicit status, unlike the users controller which takes the POST default.
 const createNote = {

package/templates/features/pictures/images.controller.ts

@@ -11,13 +11,16 @@ const Resize = z
     format: z.enum(EncodableFormat).default(EncodableFormat.PNG),
     quality: z.coerce.number().int().min(1).max(100).optional(),
   })
-  .meta({ id: 'Resize', title: 'How to render the generated source image' });
+  .meta({
+    id: 'Resize',
+    description: 'How to render the generated source image',
+  });
 
 const render = { query: Resize } as const;
 const describe = {
   body: z
     .object({ base64: z.string().min(1) })
-    .meta({ id: 'InlineImage', title: 'Any image, base64-encoded' }),
+    .meta({ id: 'InlineImage', description: 'Any image, base64-encoded' }),
 } as const;
 
 /**

package/templates/features/schedule/maintenance.service.ts

@@ -0,0 +1,71 @@
+import { Logger } from '@dunx/core';
+import { Cron, Interval, OnceOnBoot } from '@dunx/infra/schedule';
+
+/**
+ * The three decorators, on one class.
+ *
+ * The runner finds them by walking the prototype chains of the classes the modules
+ * already declare, so none of these needs a second registration - the same
+ * discovery routes, gateways and `@JobHandler` use.
+ *
+ * Nothing here is single-node-unsafe on purpose: two replicas would both run every
+ * one of these, because nothing in `@dunx/infra/schedule` coordinates. Work that
+ * must happen once across a fleet is a job, which is `@JobHandler` and bullmq.
+ */
+/**
+ * Counters are written as `x = x + 1` rather than `x += 1`, and that is not style.
+ * Bun 1.4.0 refuses to parse a class that has both a decorated member and a
+ * read-modify-write on a private field - `+=`, `++` and `??=` alike - with a
+ * `SyntaxError` naming neither. See docs/bun-apis.md.
+ */
+export class Maintenance {
+  #sweeps = 0;
+  #compactions = 0;
+  #warmed = false;
+
+  constructor(private readonly logger: Logger) {}
+
+  /**
+   * `0`, so it fires on the next macrotask after the container is ready - and
+   * "ready" is `onInit`, which is the latest hook there is and runs **before**
+   * `Bun.serve` binds. Measured: this has already run by the time `listen()`
+   * resolves, so the first request never sees a cold cache.
+   */
+  @OnceOnBoot(0, { name: 'maintenance.warm' })
+  warmCaches(): void {
+    this.#warmed = true;
+    this.logger.info('@OnceOnBoot(0): caches warmed, before listen() resolved');
+  }
+
+  /**
+   * Every ten minutes, so it does not fire during a tour or a suite. `trigger`
+   * runs it now, which is what makes a schedule testable without waiting.
+   */
+  @Interval(600_000, { name: 'maintenance.sweep' })
+  sweepSessions(): number {
+    this.#sweeps = this.#sweeps + 1;
+    return this.#sweeps;
+  }
+
+  /**
+   * Minute resolution: `Bun.cron` rejects a sixth field with "seconds are not
+   * supported", so anything sub-minute is `@Interval`.
+   *
+   * `overlap` is `skip` by default, which is what `Bun.cron` does for free - it
+   * computes the next fire only once the returned promise settles.
+   */
+  @Cron('0 3 * * *', { name: 'maintenance.compact' })
+  async compactLedger(): Promise<number> {
+    await Bun.sleep(1);
+    this.#compactions = this.#compactions + 1;
+    return this.#compactions;
+  }
+
+  get counts(): { sweeps: number; compactions: number; warmed: boolean } {
+    return {
+      sweeps: this.#sweeps,
+      compactions: this.#compactions,
+      warmed: this.#warmed,
+    };
+  }
+}

package/templates/features/schedule/schedule.demo.ts

@@ -0,0 +1,56 @@
+import { Logger } from '@dunx/core';
+import { ScheduleRegistry } from '@dunx/infra/schedule';
+import { Maintenance } from './maintenance.service.js';
+
+/**
+ * What is armed, and what a schedule does when it is not waiting for a clock.
+ *
+ * `trigger` is the reason `ScheduleRegistry` is injectable: a cron at 03:00 is
+ * otherwise untestable without waiting, and an operator forcing a nightly job has
+ * nowhere else to go.
+ */
+export class ScheduleDemo {
+  constructor(
+    private readonly logger: Logger,
+    private readonly registry: ScheduleRegistry,
+    private readonly maintenance: Maintenance,
+  ) {}
+
+  async demonstrate(): Promise<void> {
+    for (const entry of this.registry.list()) {
+      const next =
+        entry.nextRunAt === undefined
+          ? 'a timer, so no next fire to compute'
+          : `next ${entry.nextRunAt.toISOString()}`;
+      this.logger.info(
+        `${entry.kind.padEnd(8)} ${entry.name} at ${String(entry.at)} - ${next}`,
+      );
+    }
+
+    // The @OnceOnBoot already ran, before listen() bound the port.
+    this.logger.info(
+      `@OnceOnBoot fired at boot -> warmed=${this.maintenance.counts.warmed}`,
+    );
+
+    // Off its own cadence, honouring overlap. The cron is a 03:00 daily.
+    await this.registry.trigger('maintenance.compact');
+    await this.registry.trigger('maintenance.sweep');
+    const counts = this.maintenance.counts;
+    this.logger.info(
+      `trigger() x2 -> ${counts.compactions} compaction, ${counts.sweeps} sweep, ` +
+        'neither waited for a clock',
+    );
+
+    const entry = this.registry.get('maintenance.compact');
+    this.logger.info(
+      `runs recorded on the entry -> ${entry?.runs ?? 0}, lastError ` +
+        `${entry?.lastError?.message ?? 'none'}`,
+    );
+
+    // Removing one disarms it. A feature flag has nowhere else to live.
+    this.logger.info(
+      `remove("maintenance.sweep") -> ${this.registry.remove('maintenance.sweep')}, ` +
+        `${this.registry.list().length} left armed`,
+    );
+  }
+}

package/templates/features/schedule/schedule.module.ts

@@ -0,0 +1,31 @@
+import { Module } from '@dunx/core';
+import { ScheduleModule } from '@dunx/infra/schedule';
+import { AppConfigService } from '../config.js';
+import { Maintenance } from './maintenance.service.js';
+import { ScheduleDemo } from './schedule.demo.js';
+
+/**
+ * `Bun.cron` behind `@Cron`, `@Interval` and `@OnceOnBoot`, armed at boot.
+ *
+ * `keepAlive: false`, unlike the default. `Bun.cron` holds the event loop open so a
+ * process with an armed schedule and nothing else to do waits for the next fire;
+ * this app has a server holding it open already, and `bun run tour` has to exit.
+ *
+ * `tz` comes from the config because that is the one thing a zero-argument
+ * `forRoot` cannot reach. A named zone is refused at boot on a Bun that ignores
+ * `Bun.cron`'s `tz` option, rather than running at the UTC hour and saying nothing.
+ */
+@Module({
+  imports: [
+    ScheduleModule.forRootAsync({
+      useFactory: (config: AppConfigService) => ({
+        tz: config.get('schedule').tz,
+        keepAlive: false,
+      }),
+      inject: [AppConfigService] as const,
+    }),
+  ],
+  providers: [Maintenance, ScheduleDemo],
+  exports: [Maintenance, ScheduleDemo],
+})
+export class MaintenanceModule {}

package/templates/features/storage/files.controller.ts

@@ -16,13 +16,14 @@ import { z } from 'zod';
  * by `Storage` itself rather than by a pattern here, which is the behaviour worth
  * seeing: try `?key=../../etc/passwd`.
  */
-const FileKey = z
-  .object({ key: z.string().min(1).max(200) })
-  .meta({ id: 'FileKey', title: 'An object key inside the storage root' });
+const FileKey = z.object({ key: z.string().min(1).max(200) }).meta({
+  id: 'FileKey',
+  description: 'An object key inside the storage root',
+});
 
 const WriteFile = z
   .object({ content: z.string().max(64 * 1024) })
-  .meta({ id: 'WriteFile', title: 'Text to store under the key' });
+  .meta({ id: 'WriteFile', description: 'Text to store under the key' });
 
 const listFiles = {
   query: z.object({